Network traffic data security assessment method and system based on deep learning

Abstract

The invention provides a network traffic data security assessment method and system based on deep learning. The method comprises the following steps: converting original network traffic data into a graph structure data set comprising a topological structure, node attributes and time sequence behaviors; in the process, the time-space fusion input tensor is formed through the association strength between adjacent matrix and Laplacian matrix coding network entities and the fusion of time sequence characteristics extracted by time window slices. Compared with traditional flow analysis which only pays attention to a single protocol or a rate threshold value, the method achieves global relevance expression of network behaviors through graph structure modeling. Through graph structure modeling, multi-dimensional feature fusion and probabilistic risk assessment, the method can adapt to dynamic change of network topology and continuous evolution of an attack mode, so that a final assessment result is more accurate.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a network traffic data security assessment method and system based on deep learning. Background Art

[0002] The current network environment is becoming highly dynamic and complex. The popularity of technologies such as the Internet of Things and cloud native has led to frequent changes in network topology, and attack methods are increasingly characterized by multi-stage collaboration (such as lateral movement of APT attacks), covert penetration (such as data leakage through encrypted channels), and compliance evasion (such as GDPR privacy leakage). Existing evaluation methods mostly rely on static rule bases or single-dimensional traffic analysis (such as abnormal protocol detection), which cannot adapt to the dynamic changes in network topology and the continuous evolution of attack patterns, resulting in inaccurate evaluation results. Summary of the Invention

[0003] The purpose of the embodiments of the present application is to provide a network traffic data security assessment method and system based on deep learning, so as to solve the problem that existing assessment methods mostly rely on static rule bases or single-dimensional traffic analysis, cannot adapt to the dynamic changes of network topology and the continuous evolution of attack patterns, and lead to inaccurate assessment results.

[0004] The present invention provides a method for assessing network traffic data security based on deep learning, including: Obtain the raw traffic data of multiple network entities in the system and convert it into a graph data set containing topology structure, node attributes, and temporal behavior; Based on the data of four dimensions, namely, node vulnerability, traffic anomaly, transmission risk, and compliance, the risk association features in the graph data set are extracted to obtain a high-dimensional vector that integrates spatiotemporal features. The high-dimensional vector represents the risk status of the node and the entire world. Based on the values of high-dimensional vectors and corresponding labels, a node compromise probability model is trained; Generate a risk hotspot distribution map based on the node attack probability model.

[0005] In this technical solution, raw network traffic data is converted into a graph-structured dataset that includes topology (nodes, edges), node attributes (device type, vulnerability status, etc.), and temporal behavior (traffic fluctuations, protocol changes). This process encodes the strength of associations between network entities using adjacency and Laplacian matrices, and fuses temporal features extracted from time window slices (such as DDoS attack pulse characteristics) to form a spatiotemporal fusion input tensor. Compared to traditional traffic analysis that focuses solely on a single protocol or rate threshold, this approach achieves a global representation of network behavior through graph modeling. Through graph modeling, multi-dimensional feature fusion, and probabilistic risk assessment, it can adapt to dynamic changes in network topology and the continuous evolution of attack patterns, resulting in more accurate assessment results.

[0006] In some optional implementations, converting the raw traffic data into a graph data set containing topology, node attributes, and temporal behavior includes: Constructing a traffic association graph: Nodes define network entities, and node feature vectors include traffic frequency and vulnerability exposure status; edges define communication relationships, and edge weights are dynamically calculated based on session frequency and traffic intensity; topology encoding represents the connection strength between nodes; Slice by time window, extract the traffic mutation rate and abnormal connection frequency to form a spatiotemporal fusion input tensor, and obtain a graph data set.

[0007] In the above technical solution, dynamic edge weights (based on session frequency and traffic intensity) adaptively adjust the strength of connections between nodes. For example, high-frequency attack traffic sessions automatically amplify edge weights, triggering the GCN model to focus on critical paths. Topological encoding (adjacency matrix, Laplacian matrix) transforms the network's global connectivity into a mathematical representation, enabling the graph convolutional network (GCN) to efficiently aggregate high-order neighborhood information. For example, nodes with high vulnerability exposure (e.g., CVSS score >9) are automatically associated with other vulnerable nodes in their communication path through spectral filtering using the Laplacian matrix. Node feature vectors integrate traffic frequency (dynamic behavior) and vulnerability exposure (static attributes), breaking the limitations of traditional single-dimensional analysis. For example, traffic frequency can identify the pulsed traffic patterns of DDoS attacks; vulnerability exposure can be combined with the CVE vulnerability database to flag vulnerable devices. Vulnerability exposure is directly linked to security standards (such as NIST CSF and GDPR), enabling automatic compliance reporting. Time window slicing (such as a 5-minute window) extracts traffic mutation rate and abnormal connection frequency, and can identify multi-stage attack behaviors: short-term attacks: such as DDoS pulse traffic (mutation rate >90% within the time window); long-term latent attacks: such as low-frequency covert communication of APT attacks (abnormal connection frequency continues to accumulate).

[0008] In some optional implementations, node vulnerability includes vulnerability severity and the number of permission misconfigurations; traffic anomalies include protocol compliance and packet signature deviation; propagation risk includes node betweenness centrality and attack path reachability; and compliance includes privacy data leakage risk and access control policy matching.

[0009] In the above technical solution, node vulnerability is quantified by vulnerability severity (e.g., CVSS score) to quantify the inherent risk of the device, combined with the number of permission misconfigurations to reflect management oversights. For example, a node with a CVSS score > 9 is labeled "critical," while a node with a permission misconfiguration count exceeding a threshold is considered high configuration risk. The CVSS score provides a standardized vulnerability assessment, while the number of permission misconfigurations reveals human-caused configuration flaws. Together, they cover both technical and management risks.

[0010] Protocol compliance: Detects non-standard HTTP ports, unencrypted Telnet, and other protocol violations to identify potential attack vectors. Packet signature deviation: Analyzes differences between payload patterns and baseline signatures (e.g., abnormal HTTP headers, malicious payload injection) to detect unknown attacks. Protocol compliance blocks known attacks (e.g., SSH brute force attacks), while signature deviation identifies emerging threats (e.g., zero-day vulnerability exploits).

[0011] Betweenness centrality measures a node's centrality within the network (e.g., a high betweenness value for a core switch), reflecting the impact of its failure on the entire network. Attack path reachability simulates the success rate of an attacker's path from the initial penetration point to the core area (e.g., the probability of lateral movement). High-betweenness nodes (e.g., authentication servers) are prioritized for monitoring to block attack spread hubs. Monte Carlo simulations assess attack path reachability and predict the scope of cascading failures.

[0012] Privacy data leakage risk: Detect whether the transmission path of sensitive data is encrypted and whether it complies with regulations such as GDPR. Access control policy matching: Verify whether the permission allocation complies with the principle of least privilege.

[0013] In some optional implementations, extracting risk association features from a graph dataset to obtain a high-dimensional vector integrating spatiotemporal features includes: Use Chebyshev graph convolution layer to perform local neighborhood aggregation, capture high-order correlations between nodes, and obtain spatial features; Superimpose a one-dimensional time convolutional network to analyze traffic periodicity patterns and obtain time series features; Combine temporal features with spatial features; Dynamically assign node importance through self-attention pooling layer.

[0014] In this technical solution, the Chebyshev graph convolution layer uses Chebyshev polynomials to perform a K-th-order approximation of the graph Laplacian matrix. This polynomial expansion enables multi-hop information aggregation within a local neighborhood. For example, when K = 3, each node can capture abnormal behavior within its 3-hop neighborhood (such as adjacent devices and indirectly connected devices).

[0015] The one-dimensional temporal convolutional network (1D-TCN) uses a dilated causal convolution structure, capturing long-term temporal features by exponentially increasing the dilation factor layer by layer (e.g., 1, 2, 4, etc.). For example, it can detect the pulse period of DDoS attacks (e.g., a sudden increase in traffic every 10 minutes) and the timed heartbeat packets of covert C2 communications.

[0016] The spatial features (node neighborhood associations) output by Chebyshev GCN and the temporal features (traffic cycle patterns) output by TCN are concatenated along the feature dimension to form a high-dimensional vector that integrates time and space. Spatial features reveal attack propagation paths, while temporal features locate active attack windows. Combining these two improves the detection rate of complex attack chains, such as multi-stage ransomware attacks.

[0017] The self-attention pooling layer calculates the correlation score between node features and the global context and dynamically assigns weights (e.g., high-risk nodes have a weight > 0.9, low-risk nodes have a weight < 0.1). This automatically focuses on high-risk nodes, avoiding the information loss of traditional mean / max pooling. For example, in the focus on key nodes, database servers exposed to the public network receive higher attention weights due to their high vulnerability (CVSS score of 9.8) and high betweenness centrality. In the noise suppression layer, regular traffic from internal employee terminals is filtered out due to its low risk.

[0018] In some optional implementations, after generating the risk hotspot distribution map, the method further includes: According to the risk hot zone distribution map, determine high-risk nodes, medium-risk nodes and low-risk nodes; Immediately block traffic and issue an alarm for high-risk nodes; limit traffic and initiate vulnerability scanning for medium-risk nodes.

[0019] In some optional implementations, the node compromise probability model uses logistic regression or random forest tree, the input of the node compromise probability model is a high-dimensional vector, and the output of the node compromise probability model is the probability value of the node being infected.

[0020] Logistic regression: This method linearly combines input features (high-dimensional vectors) and applies the Sigmoid function to output the probability of a node being infected (0-1). This method is suitable for scenarios where the relationship between features and risk is approximately linear (e.g., vulnerability score is positively correlated with attack probability).

[0021] Random Forest: This algorithm uses an integrated voting algorithm across multiple decision trees to output a probability value. It is suitable for scenarios where nonlinear feature interactions occur, such as the combined effect of vulnerability scores and traffic mutations.

[0022] The high-dimensional vector input to the node capture probability model is composed of spatiotemporal fusion features extracted by GCN (such as node neighborhood association and traffic periodicity pattern), and the model output is a continuous probability value.

[0023] In some optional implementations, the loss function of the node compromise probability model uses binary cross entropy loss to measure the difference between the predicted infection probability and the true label.

[0024] In some optional implementations, when training a node compromise probability model, simulated attack paths are randomly inserted into the training data to generate synthetic infection samples, thereby enhancing the model's ability to identify complex attack chains.

[0025] In the above technical solution, synthetic attack samples (such as lateral penetration paths and supply chain attack chains) are generated through red team simulation or penetration testing tools (such as Metasploit) and injected into the training data set. This makes up for the lack of low-frequency attack samples (such as APT attacks) in real data and enhances the model's ability to identify multi-stage attacks (such as initial access → lateral movement → data theft).

[0026] The present invention provides a deep learning-based network traffic data security assessment system, including: The conversion module is used to obtain the original traffic data of multiple network entities in the system and convert the original traffic data into a graph data set containing topology structure, node attributes, and temporal behavior; The feature extraction module is used to extract risk-related features from the graph data set based on the four dimensions of node vulnerability, traffic anomaly, transmission risk, and compliance in the book corner collection. This module then generates a high-dimensional vector that integrates spatiotemporal features. This high-dimensional vector represents the risk status of the node and the entire world. The model training module is used to train the node compromise probability model based on the values of high-dimensional vectors and corresponding labels; The evaluation module is used to generate a risk hotspot distribution map based on the node compromise probability model.

[0027] An electronic device provided in an embodiment of the present application includes: a processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and when the machine-readable instructions are executed by the processor, any of the above methods is performed.

[0028] A computer program product provided in an embodiment of the present application includes a computer program / instruction, which implements the steps of any of the above methods when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A flowchart of a method for security assessment of network traffic data based on deep learning provided in an embodiment of the present application; Figure 2 A functional module diagram of a network traffic data security assessment system based on deep learning provided in an embodiment of the present application; Figure 3 A schematic diagram of a possible structure of an electronic device provided in an embodiment of the present application.

[0031] icon: 1-Conversion module, 2-Feature extraction module, 3-Model training module, 4-Evaluation module, 51-Processor, 52-Memory, 53-Communication interface, 54-Communication bus. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0033] Please refer to Figure 1 , Figure 1 A flowchart of a method for security assessment of network traffic data based on deep learning provided in an embodiment of the present application includes: Step 100: Obtain the original traffic data of multiple network entities in the system and convert the original traffic data into a graph data set including topology structure, node attributes, and time series behavior; Step 200: Based on the data of the four dimensions of node vulnerability, traffic anomaly, transmission risk, and compliance in the book corner collection, risk-related features are extracted from the graph data set to obtain a high-dimensional vector that integrates spatiotemporal features. The high-dimensional vector represents the risk status of the node and the entire world. Step 300: training a node attack probability model based on the value of the high-dimensional vector and the corresponding label; Step 400: Generate a risk hotspot distribution map based on the node compromise probability model.

[0034] In an embodiment of the present application, the raw network traffic data is converted into a graph structure data set containing topological structure (nodes, edges), node attributes (device type, vulnerability status, etc.) and temporal behavior (traffic fluctuations, protocol changes). This process encodes the correlation strength between network entities through the adjacency matrix and the Laplace matrix, and fuses the temporal features extracted by time window slices (such as DDoS attack pulse features) to form a spatiotemporal fusion input tensor. Compared with traditional traffic analysis that only focuses on a single protocol or rate threshold, this method achieves a global correlation expression of network behavior through graph structure modeling. Through graph structure modeling, multi-dimensional feature fusion and probabilistic risk assessment, it can adapt to the dynamic changes of network topology and the continuous evolution of attack patterns, making the final evaluation results more accurate.

[0035] In some optional implementations, converting the raw traffic data into a graph data set containing topology, node attributes, and temporal behavior includes: Constructing a traffic association graph: Nodes define network entities, and node feature vectors include traffic frequency and vulnerability exposure status; edges define communication relationships, and edge weights are dynamically calculated based on session frequency and traffic intensity; topology encoding represents the connection strength between nodes; Slice by time window, extract the traffic mutation rate and abnormal connection frequency to form a spatiotemporal fusion input tensor, and obtain a graph data set.

[0036] In this embodiment of the present application, dynamic edge weights (based on session frequency and traffic intensity) can adaptively adjust the strength of connections between nodes. For example, high-frequency attack traffic sessions automatically amplify edge weights, triggering the GCN model to focus on critical paths. Topological encoding (adjacency matrix, Laplacian matrix) transforms the global connectivity of the network into a mathematical representation, enabling the graph convolutional network (GCN) to efficiently aggregate high-order neighborhood information. For example, nodes with high vulnerability exposure (e.g., CVSS score > 9) are automatically associated with other vulnerable nodes in their communication path through spectral filtering using the Laplacian matrix. Node feature vectors integrate traffic frequency (dynamic behavior) and vulnerability exposure (static attribute), breaking through the limitations of traditional single-dimensional analysis. For example, traffic frequency can identify the pulsed traffic patterns of DDoS attacks; vulnerability exposure can be combined with the CVE vulnerability database to identify vulnerable devices. Vulnerability exposure is directly linked to security standards (such as NIST CSF and GDPR), enabling automatic compliance reporting. Time window slicing (such as a 5-minute window) extracts traffic mutation rate and abnormal connection frequency, and can identify multi-stage attack behaviors: short-term attacks: such as DDoS pulse traffic (mutation rate >90% within the time window); long-term latent attacks: such as low-frequency covert communication of APT attacks (abnormal connection frequency continues to accumulate).

[0037] In some optional implementations, node vulnerability includes vulnerability severity and the number of permission misconfigurations; traffic anomalies include protocol compliance and packet signature deviation; propagation risk includes node betweenness centrality and attack path reachability; and compliance includes privacy data leakage risk and access control policy matching.

[0038] In this embodiment of the application, node vulnerability is quantified by vulnerability severity (e.g., CVSS score) to quantify the inherent risk of the device, combined with the number of permission configuration errors to reflect management oversights. For example, a node with a CVSS score > 9 is labeled as "critical vulnerability," while a node with a permission error count exceeding a threshold is considered a high configuration risk. The CVSS score provides a standardized vulnerability assessment, while the number of permission errors reveals human configuration flaws. The combination of the two covers both technical and management risks.

[0039] Protocol compliance: Detects non-standard HTTP ports, unencrypted Telnet, and other protocol violations to identify potential attack vectors. Packet signature deviation: Analyzes differences between payload patterns and baseline signatures (e.g., abnormal HTTP headers, malicious payload injection) to detect unknown attacks. Protocol compliance blocks known attacks (e.g., SSH brute force attacks), while signature deviation identifies emerging threats (e.g., zero-day vulnerability exploits).

[0040] Betweenness centrality measures a node's centrality within the network (e.g., a high betweenness value for a core switch), reflecting the impact of its failure on the entire network. Attack path reachability simulates the success rate of an attacker's path from the initial penetration point to the core area (e.g., the probability of lateral movement). High-betweenness nodes (e.g., authentication servers) are prioritized for monitoring to block attack spread hubs. Monte Carlo simulations assess attack path reachability and predict the scope of cascading failures.

[0041] Privacy data leakage risk: Detect whether the transmission path of sensitive data is encrypted and whether it complies with regulations such as GDPR. Access control policy matching: Verify whether the permission allocation complies with the principle of least privilege.

[0042] In some optional implementations, extracting risk association features from a graph dataset to obtain a high-dimensional vector integrating spatiotemporal features includes: Use Chebyshev graph convolution layer to perform local neighborhood aggregation, capture high-order correlations between nodes, and obtain spatial features; Superimpose a one-dimensional time convolutional network to analyze traffic periodicity patterns and obtain time series features; Combine temporal features with spatial features; Dynamically assign node importance through self-attention pooling layer.

[0043] In this embodiment, the Chebyshev graph convolution layer uses Chebyshev polynomials to perform a K-order approximation of the graph Laplacian matrix, and achieves multi-hop information aggregation of local neighborhoods through polynomial expansion. For example, when K=3, each node can capture abnormal behavior in its neighborhood within 3 hops (such as adjacent devices and indirectly connected devices).

[0044] The one-dimensional temporal convolutional network (1D-TCN) uses a dilated causal convolution structure, capturing long-term temporal features by exponentially increasing the dilation factor layer by layer (e.g., 1, 2, 4, etc.). For example, it can detect the pulse period of DDoS attacks (e.g., a sudden increase in traffic every 10 minutes) and the timed heartbeat packets of covert C2 communications.

[0045] The spatial features (node neighborhood associations) output by Chebyshev GCN and the temporal features (traffic cycle patterns) output by TCN are concatenated along the feature dimension to form a high-dimensional vector that integrates time and space. Spatial features reveal attack propagation paths, while temporal features locate active attack windows. Combining these two improves the detection rate of complex attack chains, such as multi-stage ransomware attacks.

[0046] The self-attention pooling layer calculates the correlation score between node features and the global context and dynamically assigns weights (e.g., high-risk nodes have a weight > 0.9, low-risk nodes have a weight < 0.1). This automatically focuses on high-risk nodes, avoiding the information loss of traditional mean / max pooling. For example, in the focus on key nodes, database servers exposed to the public network receive higher attention weights due to their high vulnerability (CVSS score of 9.8) and high betweenness centrality. In the noise suppression layer, regular traffic from internal employee terminals is filtered out due to its low risk.

[0047] In some optional implementations, after generating the risk hotspot distribution map, the method further includes: According to the risk hot zone distribution map, determine high-risk nodes, medium-risk nodes and low-risk nodes; Immediately block traffic and issue an alarm for high-risk nodes; limit traffic and initiate vulnerability scanning for medium-risk nodes.

[0048] In some optional implementations, the node compromise probability model uses logistic regression or random forest tree, the input of the node compromise probability model is a high-dimensional vector, and the output of the node compromise probability model is the probability value of the node being infected.

[0049] Logistic regression: This method linearly combines input features (high-dimensional vectors) and applies the Sigmoid function to output the probability of a node being infected (0-1). This method is suitable for scenarios where the relationship between features and risk is approximately linear (e.g., vulnerability score is positively correlated with attack probability).

[0050] Random Forest: This algorithm uses an integrated voting algorithm across multiple decision trees to output a probability value. It is suitable for scenarios where nonlinear feature interactions occur, such as the combined effect of vulnerability scores and traffic mutations.

[0051] The high-dimensional vector input to the node capture probability model is composed of spatiotemporal fusion features extracted by GCN (such as node neighborhood association and traffic periodicity pattern), and the model output is a continuous probability value.

[0052] In some optional implementations, the loss function of the node compromise probability model uses binary cross entropy loss to measure the difference between the predicted infection probability and the true label.

[0053] In some optional implementations, when training a node compromise probability model, simulated attack paths are randomly inserted into the training data to generate synthetic infection samples, thereby enhancing the model's ability to identify complex attack chains.

[0054] In an embodiment of the present application, synthetic attack samples (such as lateral penetration paths and supply chain attack chains) are generated through red team simulation or penetration testing tools (such as Metasploit) and injected into the training data set, thereby making up for the lack of low-frequency attack samples (such as APT attacks) in real data and enhancing the model's ability to identify multi-stage attacks (such as initial access → lateral movement → data theft).

[0055] Please refer to Figure 2 , Figure 2 A functional module diagram of a network traffic data security assessment system based on deep learning provided in an embodiment of the present application specifically includes: a conversion module 1, a feature extraction module 2, a model training module 3 and an assessment module 4.

[0056] The conversion module is used to obtain raw traffic data from multiple network entities within the system and convert it into a graph data set containing topological structures, node attributes, and temporal behaviors. The feature extraction module is used to extract risk-related features from the graph data set based on the four dimensions of node vulnerability, traffic anomaly, transmission risk, and compliance in the book corner collection, and obtain a high-dimensional vector that integrates spatiotemporal features. The high-dimensional vector represents the risk status of the node and the world. The model training module is used to train a node compromise probability model based on the values and corresponding labels of the high-dimensional vector. The evaluation module is used to generate a risk hotspot distribution map based on the node compromise probability model.

[0057] Figure 3 A possible structure of the electronic device provided by the embodiment of the present application is shown. Figure 3 The electronic device includes: a processor 51, a memory 52 and a communication interface 53. These components are interconnected and communicate with each other through a communication bus 54 and / or other forms of connection mechanisms (not shown).

[0058] The memory 52 includes one or more (only one is shown in the figure), which may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The processor 51 and other possible components can access the memory 52 and read and / or write data therein.

[0059] The processor 51 includes one or more processors (only one is shown in the figure), which can be an integrated circuit chip with signal processing capabilities. The processor 51 can be a general-purpose processor, including a central processing unit (CPU), a microcontroller unit (MCU), a network processor (NP), or other conventional processors; it can also be a special-purpose processor, including a neural network processing unit (NPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. Furthermore, when there are multiple processors 51, some of them can be general-purpose processors, while others can be special-purpose processors.

[0060] The communication interface 53 includes one or more (only one is shown in the figure) interfaces that can be used to communicate directly or indirectly with other devices to exchange data. The communication interface 53 can include interfaces for wired and / or wireless communication.

[0061] One or more computer program instructions may be stored in the memory 52 , and the processor 51 may read and execute these computer program instructions to implement the method provided in the embodiment of the present application.

[0062] Understandably, Figure 3 The structure shown is only for illustration, and the electronic device may also include Figure 3 More or fewer components than shown, or with Figure 3 Different structures are shown. Figure 3 The components shown in the figure can be implemented using hardware, software, or a combination thereof. The electronic device can be a physical device, such as a PC, laptop, tablet, mobile phone, server, embedded device, etc., or a virtual device, such as a virtual machine or virtualized container. Furthermore, the electronic device is not limited to a single device and can also be a combination of multiple devices or a cluster consisting of a large number of devices.

[0063] A computer program product provided in an embodiment of the present application includes a computer program / instruction, which implements the steps of any of the above methods when executed by a processor.

[0064] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0065] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0066] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0067] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0068] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A network traffic data security assessment method based on deep learning, characterized in that: include: Obtain the raw traffic data of multiple network entities in the system and convert it into a graph data set containing topology structure, node attributes, and temporal behavior; Based on the data of four dimensions, namely node vulnerability, traffic anomaly, transmission risk, and compliance, the risk association features in the graph data set are extracted to obtain a high-dimensional vector that integrates spatiotemporal features. The high-dimensional vector represents the risk status of the node and the entire world. Based on the values of high-dimensional vectors and corresponding labels, a node compromise probability model is trained; Based on the trained node attack probability model, a risk hotspot distribution map is generated.

2. The method according to claim 1, wherein The conversion of raw traffic data into a graph data set containing topological structure, node attributes, and temporal behavior includes: Constructing a traffic association graph: Nodes define network entities, and node feature vectors include traffic frequency and vulnerability exposure status; edges define communication relationships, and edge weights are dynamically calculated based on session frequency and traffic intensity; topology encoding represents the connection strength between nodes; Slice by time window, extract the traffic mutation rate and abnormal connection frequency to form a spatiotemporal fusion input tensor, and obtain a graph data set.

3. The method according to claim 1, wherein The node vulnerability includes the severity level of the vulnerability and the number of permission configuration errors; the traffic anomaly includes protocol compliance and data packet signature deviation; the propagation risk includes node betweenness centrality and attack path reachability; and the compliance includes privacy data leakage risk and access control policy matching.

4. The method according to claim 1, wherein The step of extracting risk association features from the graph data set to obtain a high-dimensional vector integrating spatiotemporal features includes: Use Chebyshev graph convolution layer to perform local neighborhood aggregation, capture high-order correlations between nodes, and obtain spatial features; Superimpose a one-dimensional time convolutional network to analyze traffic periodicity patterns and obtain time series features; Combine temporal features with spatial features; Dynamically assign node importance through self-attention pooling layer.

5. The method according to claim 1, wherein After generating the risk hotspot distribution map, the method further includes: According to the risk hot zone distribution map, determine high-risk nodes, medium-risk nodes and low-risk nodes; Immediately block traffic and issue an alarm for high-risk nodes; limit traffic and initiate vulnerability scanning for medium-risk nodes.

6. The method according to claim 1, wherein The node attack probability model uses logistic regression or random forest tree, the input of the node attack probability model is a high-dimensional vector, and the output of the node attack probability model is the probability value of the node being infected.

7. The method according to claim 6, wherein The loss function of the node compromise probability model uses binary cross entropy loss to measure the difference between the predicted infection probability and the true label.

8. The method according to claim 1, wherein When training the node compromise probability model, simulated attack paths are randomly inserted into the training data to generate synthetic infection samples, enhancing the model's ability to identify complex attack chains.

9. A network traffic data security assessment system based on deep learning, characterized in that: include: The conversion module is used to obtain the original traffic data of multiple network entities in the system and convert the original traffic data into a graph data set containing topology structure, node attributes, and temporal behavior; The feature extraction module is used to extract risk-related features from the graph data set based on the four dimensions of node vulnerability, traffic anomaly, transmission risk, and compliance of the book corner collection, and obtain a high-dimensional vector that integrates spatiotemporal features. The high-dimensional vector represents the risk status of the node and the entire world. The model training module is used to train the node compromise probability model based on the values of high-dimensional vectors and corresponding labels; The evaluation module is used to generate a risk hotspot distribution map based on the node compromise probability model.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images