Network intrusion detection method, system and equipment based on improved VGAE and medium

Abstract

The invention discloses a network intrusion detection method, system and device based on improved VGAE and a medium, and the method comprises the steps: obtaining to-be-detected network original data, carrying out the preprocessing, and constructing a network communication graph; inputting the constructed network communication graph into the trained network intrusion detection model, and outputting a network intrusion detection result; wherein the training of the network intrusion detection model comprises the following steps: acquiring and preprocessing a network original data sample, and constructing a network communication graph; a flow prediction part is added to a VGAE network decoder part, the flow prediction part constructs an edge embedding vector with the edge of a network communication graph as a unit, and then original edge features are fused for flow prediction; and setting training parameters and a loss function, performing model training by using the constructed network communication graph, and outputting a trained network intrusion detection model.

Description

Technical Field

[0001] The present invention relates to the field of network detection, and in particular to a network intrusion detection method, system, equipment and medium based on improved VGAE. Background Art

[0002] A network intrusion detection system (NIDS) is a core component of network security, identifying external intrusions by monitoring network traffic. Existing NIDS detection methods fall into two main categories: flow-based and graph-based. Flow-based methods analyze network traffic attributes, such as protocol type, port number, packet size, and traffic duration, to detect anomalous traffic. However, these methods typically focus only on individual traffic attribute fields, ignoring the complex interactions between traffic flows. This significantly limits their detection performance when faced with complex network attacks, such as botnets.

[0003] VGAE, short for Variational Graph Auto-Encoder, is a generative model based on graph neural networks (GNNs). It has been used in various fields to perform graph embedding operations and has achieved promising results. However, VGAE has not received sufficient attention in the field of network intrusion detection, and its application potential remains to be further explored. Furthermore, compared to traditional GNNs, VGAE has stronger generalization capabilities in capturing latent relationships between nodes. Therefore, applying VGAE to network intrusion detection tasks is expected to more accurately identify complex attack patterns and abnormal behaviors. However, the original VGAE also has the following shortcomings: ① It cannot effectively capture the core network traffic information of the network communication graph; ② It has difficulty effectively utilizing the label information of the traffic data; and ③ It cannot achieve end-to-end learning. Therefore, directly applying the original VGAE to detection tasks may risk performance limitations and fail to fully utilize its advantages. Summary of the Invention

[0004] In order to overcome the risk of performance limitation when using original VGAE to perform network intrusion detection tasks in the existing technology, the present invention provides a network intrusion detection method, system, device and medium based on improved VGAE. The detection method based on AC-VGAE gives full play to the advantage of VGAE in capturing the association relationship between graph nodes. By integrating graph topology information and network traffic characteristics, it realizes the comprehensive capture of network communication behavior and improves the network intrusion detection system's ability to identify abnormal behavior.

[0005] According to one aspect of the present invention, a network intrusion detection method based on an improved VGAE is provided, comprising:

[0006] Obtain the original network data to be detected and preprocess it to build a network communication graph;

[0007] Input the constructed network communication graph into the trained network intrusion detection model and output the network intrusion detection results;

[0008] The training of the network intrusion detection model includes:

[0009] Obtain network raw data samples and preprocess them to construct a network communication graph;

[0010] Build a network intrusion detection model: Add a traffic prediction part to the VGAE network decoder. The traffic prediction part constructs edge embedding vectors based on the edges of the network communication graph, and then fuses the original edge features to perform traffic prediction.

[0011] Set the training parameters and loss function, use the constructed network communication graph to train the model, and output the trained network intrusion detection model.

[0012] As a further implementation plan, the network raw data is the interaction traffic data between ports, including but not limited to IP address, port number, duration, number of bytes received, number of bytes sent, number of data packets received, number of data packets sent and traffic labels; wherein, the traffic labels include normal traffic and abnormal traffic.

[0013] As a further implementation scheme, the pre-processing steps of the network raw data include:

[0014] The IP addresses and port numbers in the network raw data are merged as nodes, and the following operations are performed on other data in the network raw data: numerical data is used as numerical features, non-numerical data is converted into numerical features using feature encoding technology, and then all numerical features except labels are normalized. Among them, the processed traffic label is used as the traffic label feature, and the remaining processed network raw data is used as the network traffic feature.

[0015] As a further implementation scheme, the network communication diagram is constructed as follows:

[0016] Select the source node, and obtain the node that has network traffic interaction with the source node as the target node through the network traffic characteristics. Set the node characteristics as constants, connect the corresponding source node and the target node through edges, use the network traffic characteristics as the edge characteristics, and the traffic label characteristics as the edge label characteristics.

[0017] As a further implementation scheme, the structure of the network intrusion detection model includes two parts: encoder and decoder;

[0018] The encoder uses a two-layer graph convolutional network structure to generate an embedded representation of the graph nodes based on the graph node features and topological structure in the network communication graph, and then resamples the parameters to obtain a low-dimensional embedding vector of the graph nodes;

[0019] The decoder consists of a reconstruction part and a traffic prediction part. The reconstruction part performs an inner product operation on the embedding vectors of any two nodes to reconstruct the adjacency matrix of the original graph, and the traffic prediction part outputs the traffic prediction results in the network communication graph.

[0020] As a further implementation scheme, the traffic prediction part includes:

[0021] The edge embedding generation module takes edges as units and concatenates the low-dimensional embedding vectors of the source and target nodes corresponding to the network communication graph to obtain the edge embedding vector.

[0022] The feature fusion module fuses the edge embedding with the original edge features of the network communication graph to obtain the fused edge representation;

[0023] The traffic classification module predicts edge label features based on the fused edge representation and uses the prediction results as traffic prediction results.

[0024] As a further implementation scheme, the loss function consists of three parts: reconstruction loss, KL loss and classification loss.

[0025] According to another aspect of the present invention, a network intrusion detection system based on an improved VGAE is provided, comprising:

[0026] The network raw data acquisition and processing module obtains the network raw data to be detected and performs preprocessing;

[0027] The network communication graph construction module constructs the network communication graph based on the preprocessing results of the network raw data;

[0028] The network intrusion detection module inputs the network communication graph and outputs the network intrusion detection results.

[0029] According to another aspect of the present invention, the present invention provides an electronic device including a memory and a processor, wherein the memory stores program instructions executed by the processor, and the processor calls the program instructions to execute a network intrusion detection method based on an improved VGAE.

[0030] According to another aspect of the present disclosure, the present disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions enable the computer to execute a network intrusion detection method based on an improved VGAE.

[0031] Compared with the existing technology, the beneficial effects of the present invention are: the detection method based on AC-VGAE fully utilizes the advantages of VGAE in capturing the association relationship between graph nodes, and by integrating graph topology information with network traffic characteristics, it realizes the comprehensive capture of network communication behavior and improves the network intrusion detection system's ability to identify abnormal behavior; it integrates graph embedding and traffic classification in a unified framework, forming an end-to-end detection process, simplifying the system architecture, and effectively reducing computing overhead and training burden. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, a brief introduction will be given below to the drawings used in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 A flowchart of a network intrusion detection method based on an improved VGAE provided by an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of the structure of a VGAE provided in an embodiment of the present invention;

[0035] Figure 3 A schematic diagram of the structure of AC-VGAE provided in an embodiment of the present invention;

[0036] Figure 4 A block diagram of a network intrusion detection method based on AC-VGAE provided by an embodiment of the present invention;

[0037] Figure 5 A schematic diagram of a network communication diagram provided by an embodiment of the present invention;

[0038] Figure 6 A schematic diagram of a network intrusion detection system based on an improved VGAE provided by an embodiment of the present invention;

[0039] Figure 7 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] It should be noted that:

[0041] The terms "including" and "having" and any variations thereof in the description and claims of the present invention and the above-mentioned drawings are intended to cover non-exclusive inclusions, for example, a process, method, system, product or apparatus that includes a series of steps or units is not necessarily limited to the steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products or apparatuses.

[0042] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically separate entities. That is, these functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices. The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily need to be executed in the order described. For example, some operations / steps may be further decomposed, while others may be combined or partially combined, so the actual execution order may vary depending on the actual situation.

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. In addition, the technical features in the various embodiments or single embodiments provided by the present invention are arbitrarily combined with each other to form a new technical solution. This combination is not restricted by the sequence of steps and / or structural composition mode, but must be based on the ability of ordinary technicians in this field to implement it. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that this combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0044] like Figure 1 As shown, Figure 1 The flowchart of the network intrusion detection method based on the improved VGAE (Variational Graph Autoencoder) provided in the embodiment of the present invention is as follows:

[0045] Obtain the original network data to be detected and preprocess it to build a network communication graph;

[0046] Input the constructed network communication graph into the trained network intrusion detection model and output the network intrusion detection results;

[0047] The training of the network intrusion detection model includes:

[0048] Obtain network raw data samples and preprocess them to construct a network communication graph;

[0049] Build a network intrusion detection model: Add a traffic prediction part to the VGAE network decoder. The traffic prediction part constructs edge embedding vectors based on the edges of the network communication graph, and then fuses the original edge features to perform traffic prediction.

[0050] Set the training parameters and loss function, use the constructed network communication graph to train the model, and output the trained network intrusion detection model.

[0051] Furthermore, the network raw data is the interaction traffic data between ports, including but not limited to IP address, port number, duration, number of bytes received, number of bytes sent, number of data packets received, number of data packets sent, and traffic labels; among which, traffic labels include normal traffic and abnormal traffic.

[0052] Furthermore, the preprocessing steps of the network raw data include:

[0053] The IP addresses and port numbers in the network raw data are merged as nodes, and the following operations are performed on other data in the network raw data: numerical data is used as numerical features, non-numerical data is converted into numerical features using feature encoding technology, and then all numerical features except labels are normalized. Among them, the processed traffic label is used as the traffic label feature, and the remaining processed network raw data is used as the network traffic feature.

[0054] Furthermore, the network communication graph is constructed as follows:

[0055] Select the source node, and obtain the node that has network traffic interaction with the source node as the target node through the network traffic characteristics. Set the node characteristics as constants, connect the corresponding source node and the target node through edges, use the network traffic characteristics as the edge characteristics, and the traffic label characteristics as the edge label characteristics.

[0056] Furthermore, the network intrusion detection model uses an improved variational graph autoencoder AC-VGAE (Auxiliary Classifier VGAE). The conventional variational graph autoencoder (VGAE) is a graph neural network variant based on the variational autoencoder (VAE) architecture. It consists of two parts: an encoder and a decoder. Specifically:

[0057] The encoder uses a two-layer graph convolutional network (GCN) structure to fuse node features and graph topology information to generate the mean vector and variance vector of the latent variable (the latent variable is the embedded representation of the node). Then, random sampling is performed from the normal distribution space determined by the mean and variance to obtain a low-dimensional embedded representation of each node. The decoder reconstructs the adjacency matrix of the original graph by performing an inner product operation on the embedded vectors of any two nodes. The structure of VGAE is as follows: Figure 2 As shown, the loss function is as follows:

[0058] (1)

[0059] In formula (1), is the node feature matrix, is the adjacency matrix of the graph, is the embedding representation of the node. Represents the reconstruction loss, which is used to measure the difference between the original adjacency matrix and the reconstructed adjacency matrix to ensure that the generated node embedding can fully preserve the topological information of the graph. Represents KL loss, which is used to constrain the distribution of latent variables to be close to the standard normal distribution, thereby improving the generalization ability and stability of the model.

[0060] AC-VGAE adds a traffic prediction part to the decoding part of the original VGAE decoder, thereby building an end-to-end graph embedding and traffic prediction integrated framework to effectively enhance the NIDS's ability to identify abnormal behaviors in complex network traffic. The structure of AC-VGAE is as follows: Figure 3 shown.

[0061] The traffic prediction part includes the following three modules:

[0062] ① Edge Embedding Generation Module: Since the goal of network intrusion detection is to classify edges in the communication graph, after obtaining the embeddings of each node, it is necessary to generate an edge embedding by concatenating the node embeddings based on the source and target nodes of the edge. This edge embedding will contain the graph's topological information.

[0063] ② Feature fusion module: The edge embedding is fused with the original edge features to generate a fused edge representation that contains both graph topology information and core network traffic information.

[0064] ③ Traffic classification module: traffic category prediction based on fused edge representation.

[0065] The role of the traffic prediction part: First, to address the problem that VGAE cannot capture graph edge information, AC-VGAE uses a feature fusion module to fuse edge embeddings containing graph topology information with original edge features containing core network traffic information, thereby capturing both graph topology information and edge information and improving the detection performance of the model; secondly, to address the problem that VGAE cannot use traffic label information for supervised optimization. AC-VGAE introduces a traffic prediction branch to perform traffic classification, thereby using traffic labels to generate classification loss. This loss is jointly optimized with the original reconstruction loss, thereby constraining the node embedding generated by the encoder to not only contain graph topology information but also have good traffic classification capabilities; finally, to address the problem that VGAE cannot achieve end-to-end learning and has a heavy training burden, AC-VGAE integrates graph embedding and traffic classification into the same framework, achieving end-to-end optimization and effectively reducing system complexity and training overhead.

[0066] The specific workflow of AC-VGAE is as follows:

[0067] (a) Input network communication graph. Given a network communication graph , whose graph adjacency matrix is , the node feature matrix is , the edge feature matrix is .in, is the number of nodes, is the dimension of node features, represents the number of edges in the graph, Represents the characteristic dimension of the edge, and converts the graph adjacency matrix , node feature matrix and edge feature matrix Input to AC-VGAE.

[0068] (b) Encoder encoding. The encoder encodes the graph structure and node features through two layers of GCN. The first layer of GCN is used to extract the local structural information of the node and generate an intermediate representation. The second layer of GCN further captures the global structural information of the graph based on the first layer, generating the node's potential mean vector and variance vector (usually the logarithmic variance vector), as shown in formulas (2)-(3):

[0069] (2)

[0070] (3)

[0071] in, , represents the adjacency matrix Add the identity matrix The matrix obtained by symmetric normalization is for The degree matrix of . is the learnable weight matrix of the first layer of GCN, and is the learnable weight matrix of the second layer. is the output of the first layer of GCN, that is, the intermediate representation of node embedding. 、 are the outputs of the second layer of GCN, representing the potential mean vector and logarithmic variance vector of the node respectively.

[0072] (c) Reparameter sampling. Using the reparameterization technique from and The random sampling node embedding in the determined normal distribution is shown in formula (4):

[0073] (4)

[0074] in, and Representation node The mean and standard deviation vector of , is a noise vector randomly sampled from a standard normal distribution, Represents vector element-wise multiplication.

[0075] (d) Reconstruct the adjacency matrix of the graph. The decoder reconstruction part predicts the connection relationship between nodes by calculating the inner product of the two node embeddings, thereby reconstructing the adjacency matrix of the graph. , as shown in formula (5):

[0076] (5)

[0077] in, Represents the sigmoid function, which is used to compress the inner product result to interval, thereby predicting the probability of the existence of an edge between nodes.

[0078] (e) Edge embedding generation. For each edge in the graph , concatenate the corresponding node embeddings to generate edge embeddings, as shown in formula (6):

[0079] (6)

[0080] in, Represents vector concatenation operation, 、 Represents nodes respectively and nodes Embedded, express Edge embedding representation.

[0081] (f) Edge feature fusion. For any edge in the graph , embed the edge With the original edge feature After concatenation, it is transformed through a linear layer to generate the fused edge representation , as shown in formula (7):

[0082] (7)

[0083] in, and denote the learnable weight matrix and bias vector respectively.

[0084] (g) Traffic prediction. The fused edge is represented as Input into the prediction network to realize traffic prediction (edge classification), as shown in formula (8).

[0085] (8)

[0086] in, express The predicted value of the edge, It is a multi-layer perceptron module.

[0087] Furthermore, the training process of the network intrusion detection model is as follows:

[0088] Set the learning rate and number of training rounds, repeat the training, calculate the loss function after each round of training, and optimize the model parameters through back propagation. The loss function consists of three parts: reconstruction loss, KL loss, and classification loss.

[0089] Specifically, in each round of training, the model generates node embeddings, edge predictions, and a reconstructed adjacency matrix through forward propagation, and then calculates the loss function based on these values. Subsequently, the model parameters are optimized through backpropagation. This process is repeated until training is complete.

[0090] Compared with the original VGAE, AC-VGAE introduces the classification loss generated by the traffic prediction task into the loss function. Therefore, its overall loss function consists of three parts: reconstruction loss , KL loss and classification loss , as shown in formulas (9)-(10):

[0091]

[0092]

[0093] in, and Same as VGAE. This is achieved through the calculation of the cross entropy loss function. and Respectively The true and predicted values of an edge.

[0094] The previously constructed test graph is fed into the trained AC-VGAE model to obtain edge predictions, enabling network traffic anomaly detection. The predictions are then compared with the true edge labels to evaluate the NIDS's detection performance in a real-world network environment.

[0095] A network intrusion detection method based on AC-VGAE, such as Figure 4 shown.

[0096] (1) Construction of network communication diagram.

[0097] The construction of a network communication graph mainly includes two steps: data preprocessing and graph construction.

[0098] In the data preprocessing stage, the IP addresses and ports of the original network data are first merged to identify the nodes in the network communication graph; then the dataset is divided into a training set and a test set. The former is used for model training, and the latter is used to simulate the real network environment to evaluate the detection performance of NIDS; then feature encoding technology is used to convert non-numerical features into numerical form; finally, all features except nodes and labels are normalized to adjust the data to the same numerical range.

[0099] After completing data preprocessing, the DGL tool is used to construct the corresponding training graph and test graph based on the obtained training set and test set. The training graph is used to train the AC-VGAE model, and the test graph is used to evaluate the performance of the model after training. Figure 4 As shown, the specific graph construction method is as follows.

[0100] Nodes in the figure: a combination of IP address and port number, the source IP and source port number constitute the source node, and the destination IP and destination port number constitute the destination node.

[0101] Edges in the graph: communication behavior between source nodes and target nodes, that is, specific network traffic.

[0102] Node characteristics: Traffic data does not directly contain node attributes, so they are set as constants.

[0103] Edge features: Consists of network traffic fields except node fields and label fields, representing the core information of network traffic.

[0104] Edge label: the category of the traffic, Figure 1 The red edge represents abnormal traffic, and the black edge represents normal traffic.

[0105] In this graph construction approach, each edge in the communication graph represents a piece of network traffic, and the edge classification reflects whether that traffic is anomalous. By determining the edge classification, anomalous traffic can be identified, enabling network intrusion detection. Therefore, after constructing the network communication graph, the task of network intrusion detection can be naturally transformed into the task of edge classification within the network communication graph.

[0106] Building on this foundation, the graph-based detection approach in the subsequent AC-VGAE model first leverages graph embedding technology to extract topological information from the communication graph and generate embedded representations containing this information. Then, based on these representations, edges in the graph are classified to identify anomalous traffic. In this way, NIDS can effectively capture the interactive relationships between traffic flows, improving detection performance.

[0107] (2) AC-VGAE model training

[0108] The training graph constructed previously was fed into the AC-VGAE model for training. The model uses a two-layer GCN architecture, with the hidden dimension of the first GCN layer set to 128 and the output dimension of the second GCN layer set to 8. In the decoder, the dimension of the fused edge representation was set to 32. Parameters were updated using an optimizer with a learning rate of 0.01, and training was performed for a total of 300 epochs.

[0109] In each round of training, the model generates node embeddings, edge predictions, and a reconstructed adjacency matrix through forward propagation, and then calculates the loss function based on these values. Subsequently, the model parameters are optimized through backpropagation. This process is repeated until training is complete.

[0110] (3) Edge classification

[0111] The previously constructed test graph is fed into the trained AC-VGAE model to obtain edge predictions, enabling network traffic anomaly detection. The predictions are then compared with the true edge labels to evaluate the NIDS's detection performance in a real-world network environment.

[0112] In addition, in order to verify the effectiveness of the AC-VGAE model proposed in the present invention, the following detection performance comparison experiment between AC-VGAE and the baseline model was conducted.

[0113] (1) Experimental dataset

[0114] The NF-BoT-IoT dataset is a benchmark dataset specifically designed for evaluating network intrusion detection systems. It contains 600,100 network traffic records, including 586,241 abnormal traffic records and 13,859 normal traffic records. The dataset covers five network traffic categories, including normal traffic and four abnormal traffic types: information gathering / reconnaissance (Reconnaissance), distributed denial of service (DDoS), denial of service (DoS), and data theft (Theft).

[0115] (2) Evaluation indicators

[0116] This experiment uses two metrics, Accuracy and F1-Score, to evaluate the performance of the model. Accuracy is used to evaluate the accuracy of the model's predictions on all samples, reflecting the overall performance of the model. F1-Score comprehensively considers Precision and Recall, and can more accurately evaluate the performance of the model in classification tasks. The calculation formulas for these two metrics are shown in formulas (11)-(12):

[0117]

[0118]

[0119] in, 、 、 and They represent the number of samples predicted to be positive and actually are positive, the number of samples predicted to be negative and actually are negative, the number of samples predicted to be positive but actually are negative, and the number of samples predicted to be negative but actually are positive.

[0120] (3) Experimental steps

[0121] The experiment verifies the effectiveness of AC-VGAE in network intrusion detection tasks by comparing its detection performance with that of the baseline model. The experimental steps are as follows.

[0122] ① Baseline model setting. This experiment selected three representative baseline models as comparison objects. E-GraphSAGE: A classic GNN-based detection model that can simultaneously capture the topological information and edge information of the network graph. XGBoost: A traditional machine learning model, a flow-based detection model commonly used in the field of network intrusion detection. VGAE-RF: A method for network intrusion detection using the original VGAE. Specifically, VGAE is used to embed the network communication graph to obtain an embedding vector, and then the embedding vector is used to train a random forest classifier (RF) for detection.

[0123] ② Data processing. Data processing refers to the process of constructing a network communication graph based on the network traffic dataset. The steps are basically the same as the AC-VGAE-NIDS network communication graph construction method, including data preprocessing and graph construction. However, there are some additional details that need to be explained for the NF-BoT-IoT dataset, as follows:

[0124] During data preprocessing, the NF-BoT-IoT dataset was first divided into training and test sets in a 7:3 ratio. Next, the three non-numeric feature columns, "TCP_FLAGS," "L7_PROTO," and "PROTOCOL," were converted to numeric form using target encoding. Finally, standard normalization techniques were used to normalize the training and test sets. The corresponding training and test graphs were then constructed using a graph construction method.

[0125] ③ Model training and evaluation. In this phase, the AC-VGAE model and other baseline models are trained using training data, and then the model performance is evaluated using test data. The training and testing processes for different models vary depending on their characteristics.

[0126] AC-VGAE and E-GraphSAGE share the same training and testing process. Specifically, they use the training graph to train the model, and then use the test graph to evaluate the model's performance.

[0127] XGBoost: As a traditional stream-based machine learning model, it cannot directly process graph-structured data. Therefore, it is trained using a training set after data preprocessing, and its performance is evaluated using a corresponding test set.

[0128] VGAE-RF: During the training phase, the VGAE model is first trained on the training image to obtain embedding vectors. Then, the RF classifier is trained based on these embedding vectors to build the overall framework for detection tasks. During the testing phase, the trained VGAE model is first used to generate embedding vectors for the test image. The generated embedding vectors are then input into the trained RF classifier to evaluate the detection performance of the overall framework.

[0129] ④ Model Performance Comparison. To verify the advantages of the AC-VGAE model, this experiment uses the Accuracy and F1-Score metrics to compare the performance of AC-VGAE and three baseline models.

[0130] (5) Experimental results and analysis

[0131] The binary and multi-classification performance of AC-VGAE compared to three baseline models are shown in Tables 1 and 2. In the binary classification task, AC-VGAE achieved 0.99 accuracy and F1-score, significantly outperforming E-GraphSGAE (Acc: 0.92, F1: 0.94) and VGAE-RF (Acc: 0.98, F1: 0.97), and on par with XGBoost. In the multi-classification task, AC-VGAE achieved an accuracy of 0.83 and an F1-score of 0.85, respectively, similarly outperforming the other three baseline models. To further validate AC-VGAE's performance advantage, we compared it with the three baseline models one by one.

[0132] Table 1. Model binary classification performance

[0133] AC-VGAE E-GraphSAGE XGBoost VGAE-RF Acc 0.99 0.92 0.99 0.98 F1 0.99 0.94 0.99 0.97

[0134] Table 2 Multi-classification performance of the model

[0135] AC-VGAE E-GraphSAGE XGBoost VGAE-RF Acc 0.83 0.78 0.83 0.79 F1 0.85 0.78 0.83 0.69

[0136] Compared with E-GrpahSAGE, both AC-VGAE and E-GraphSAGE can simultaneously capture the topology information and traffic information of the communication graph, but the detection performance of AC-VGAE is significantly better than that of E-GraphSAGE, which shows that the graph topology information and traffic information capture scheme adopted by AC-VGAE is more effective and reasonable.

[0137] Compared to XGBoost, while XGBoost performs well in binary classification tasks, on par with AC-VGAE, its performance in multi-classification tasks (Acc: 0.83, F1: 0.83) is lower than AC-VGAE. This suggests that while flow-based detection methods can effectively distinguish between normal and abnormal traffic, they struggle to capture the complex interactions between traffic flows. Therefore, their detection performance may face bottlenecks in multi-classification scenarios.

[0138] Compared to VGAE-RF, AC-VGAE performs slightly better in binary classification tasks and shows a significant advantage in multi-classification tasks. VGAE-RF, which learns embeddings based solely on the topology of the network communication graph, is able to effectively distinguish between normal and abnormal traffic. However, due to its lack of consideration of traffic flow information, it performs poorly in multi-classification tasks. This demonstrates that AC-VGAE, by adding a traffic prediction component, effectively captures traffic flow information and integrates it with the graph's topology, significantly improving the model's detection performance.

[0139] In summary, AC-VGAE outperforms three typical baseline models in both binary and multi-classification tasks, fully demonstrating its design advantages in fusing graph topology and traffic information, and verifying its effectiveness and advancement in network intrusion detection.

[0140] The implementation of each embodiment of the present invention is based on programmed processing by a system with processor functionality. Therefore, in practical engineering, the technical solutions and functions of each embodiment of the present invention are encapsulated into various modules. Based on this reality, and in addition to the aforementioned embodiments, an embodiment of the present invention provides an improved VGAE-based network intrusion detection system. This system is used to implement the improved VGAE-based network intrusion detection method described in the aforementioned method embodiments.

[0141] See also Figure 5 , the system comprises:

[0142] The network raw data acquisition and processing module obtains the network raw data to be detected and performs preprocessing;

[0143] The network communication graph construction module constructs the network communication graph based on the preprocessing results of the network raw data;

[0144] The network intrusion detection module inputs the network communication graph and outputs the network intrusion detection results.

[0145] Based on the proposed AC-VGAE model, this embodiment of the present invention constructs an AC-VGAE-based network intrusion detection system (AC-VGAE-NIDS). First, a network communication graph is constructed using the original network traffic dataset. Second, this network communication graph is input into AC-VGAE for model training. Finally, the trained AC-VGAE model is used to perform edge classification on other communication graphs to implement network traffic anomaly detection.

[0146] It should be noted that the system embodiments provided by the present invention are not only used to implement the methods in the above-mentioned method embodiments, but also used to implement the methods in other method embodiments provided by the present invention. The only difference lies in the setting of corresponding functional modules, and its principles are basically the same as the principles of the above-mentioned system embodiments provided by the present invention. As long as those skilled in the art refer to the specific technical solutions in other method embodiments on the basis of the above-mentioned system embodiments, obtain corresponding technical means and technical solutions composed of these technical means by combining technical features, and on the premise of ensuring the practicality of the technical solutions, they will improve the equipment in the above-mentioned system embodiments to obtain corresponding system embodiments for implementing the methods in other method embodiments.

[0147] The method of the embodiment of the present invention is implemented by electronic devices, so it is necessary to introduce the relevant electronic devices. Based on this purpose, the embodiment of the present invention provides an electronic device, such as Figure 6 As shown, the electronic device includes: at least one processor, a communications interface, at least one memory, and a communications bus, wherein the at least one processor, the communications interface, and the at least one memory communicate with each other via the communications bus. The at least one processor invokes logic instructions in the at least one memory to execute all or part of the steps of the methods provided in the aforementioned method embodiments.

[0148] In addition, when the logic instructions in the at least one memory are implemented in the form of a software functional unit and sold or used as an independent product, they are stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution is embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (a personal computer, a server, or a network device) to execute all or part of the steps of the method described in each method embodiment of the present invention. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, various media for storing program codes.

[0149] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, located in one place or distributed across multiple network units. Depending on practical needs, some or all of these modules may be selected to achieve the objectives of this embodiment. Persons of ordinary skill in the art will understand and implement these embodiments without inventive effort.

[0150] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0151] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0154] In summary, the effects and advantages created by the present invention are: (1) Enhanced ability to capture interactive relationships between traffic flows. Compared with existing GNN-based detection methods, the AC-VGAE-based detection method proposed in the present invention fully utilizes the advantages of VGAE in capturing the association relationship between graph nodes, thereby enabling NIDS to more accurately identify the interactive patterns between network traffic flows and improve its ability to identify abnormal behaviors. (2) Significantly improved detection accuracy. The AC-VGAE model proposed in the present invention achieves comprehensive capture of network communication behaviors by integrating graph topology information with network traffic characteristics, thereby significantly improving the detection accuracy of NIDS. (3) Lower system complexity and smaller training burden. The AC-VGAE-based network intrusion detection system proposed in the present invention integrates graph embedding and traffic classification in a unified framework, forming an end-to-end detection process. Compared with the two-stage process based on the VGAE method that requires embedding first and then training the classifier, the present invention simplifies the system architecture and effectively reduces the computational overhead and training burden.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. The network intrusion detection method based on improved VGAE is characterized by: include: Obtain the original network data to be detected and preprocess it to build a network communication graph; Input the constructed network communication graph into the trained network intrusion detection model and output the network intrusion detection results; The training of the network intrusion detection model includes: Obtain network raw data samples and preprocess them to construct a network communication graph; Build a network intrusion detection model: Add a traffic prediction part to the VGAE network decoder. The traffic prediction part constructs edge embedding vectors based on the edges of the network communication graph, and then fuses the original edge features to perform traffic prediction. Set the training parameters and loss function, use the constructed network communication graph to train the model, and output the trained network intrusion detection model.

2. The network intrusion detection method based on improved VGAE according to claim 1, characterized in that: The network raw data is the interaction traffic data between ports, including but not limited to IP address, port number, duration, number of bytes received, number of bytes sent, number of data packets received, number of data packets sent, and traffic labels; wherein the traffic labels include normal traffic and abnormal traffic.

3. The network intrusion detection method based on improved VGAE according to claim 2, characterized in that: The preprocessing steps of the network raw data include: The IP addresses and port numbers in the network raw data are merged as nodes, and the following operations are performed on other data in the network raw data: numerical data is used as numerical features, non-numerical data is converted into numerical features using feature encoding technology, and then all numerical features except labels are normalized. Among them, the processed traffic label is used as the traffic label feature, and the remaining processed network raw data is used as the network traffic feature.

4. The network intrusion detection method based on improved VGAE according to claim 3, wherein the network communication graph is constructed by: Select the source node, and obtain the node that has network traffic interaction with the source node as the target node through the network traffic characteristics. Set the node characteristics as constants, connect the corresponding source node and the target node through edges, use the network traffic characteristics as the edge characteristics, and the traffic label characteristics as the edge label characteristics.

5. The network intrusion detection method based on improved VGAE according to claim 1, characterized in that: The structure of the network intrusion detection model includes two parts: encoder and decoder; The encoder uses a two-layer graph convolutional network structure to generate an embedded representation of the graph nodes based on the graph node features and topological structure in the network communication graph, and then resamples the parameters to obtain a low-dimensional embedding vector of the graph nodes; The decoder consists of a reconstruction part and a traffic prediction part. The reconstruction part performs an inner product operation on the embedding vectors of any two nodes to reconstruct the adjacency matrix of the original graph, and the traffic prediction part outputs the traffic prediction results in the network communication graph.

6. The network intrusion detection method based on improved VGAE according to claim 5, characterized in that: The traffic prediction part includes: The edge embedding generation module takes edges as units and concatenates the low-dimensional embedding vectors of the source and target nodes corresponding to the network communication graph to obtain the edge embedding vector. The feature fusion module fuses the edge embedding with the original edge features of the network communication graph to obtain the fused edge representation; The traffic classification module predicts edge label features based on the fused edge representation and uses the prediction results as traffic prediction results.

7. The network intrusion detection method based on improved VGAE according to claim 1, characterized in that: The loss function consists of three parts: reconstruction loss, KL loss and classification loss.

8. A network intrusion detection system based on improved VGAE, used to implement the network intrusion detection method based on improved VGAE according to any one of claims 1 to 7, characterized in that: include: The network raw data acquisition and processing module obtains the network raw data to be detected and performs preprocessing; The network communication graph construction module constructs the network communication graph based on the preprocessing results of the network raw data; The network intrusion detection module inputs the network communication graph and outputs the network intrusion detection results.

9. An electronic device, characterized in that: The invention comprises a memory and a processor, wherein the memory stores program instructions executed by the processor, and the processor calls the program instructions to execute the network intrusion detection method based on the improved VGAE according to any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions enable the computer to execute the improved VGAE-based network intrusion detection method according to any one of claims 1 to 7.

Images