Network traffic anomaly detection method and system based on knowledge graph

Abstract

The invention relates to the technical field of network security, and discloses a network traffic anomaly detection method and system based on a knowledge graph, and the network traffic anomaly detection method comprises the following steps: protocol perception metadata feature extraction: extracting metadata features which do not involve content privacy from encrypted network traffic through a deep packet inspection technology, comprising flow statistical characteristics, time sequence characteristics and connection relation characteristics; multi-level knowledge graph construction: based on the extracted metadata features, according to a network architecture, respectively constructing corresponding knowledge graphs on a device layer, a gateway layer and a cloud layer, and respectively representing device behaviors, network activities and global security information; the method does not depend on flow decryption operation, effective recognition of abnormal behaviors in the encrypted flow is achieved only by analyzing the metadata features of the network flow, and therefore the detection accuracy is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network traffic anomaly detection method and system based on knowledge graph. Background Art

[0002] With the development of 5G technology and the widespread use of IoT devices, network traffic has seen explosive growth, and encrypted transmission has become the mainstream method for ensuring data security. However, existing network anomaly detection technologies have the following shortcomings when dealing with encrypted traffic analysis in IoT environments: Traditional Deep Packet Inspection (DPI) technology relies on parsing traffic content. When dealing with encrypted traffic, it must first decrypt and then analyze it, which is computationally expensive and often infringes on user privacy. Existing anomaly detection methods mostly use a single model, which is difficult to adapt to the diverse device types, limited resources, and multiple protocols in the IoT environment, resulting in limited detection accuracy and applicability. The IoT architecture typically presents a layered structure (device-edge-cloud). However, traditional detection methods lack information sharing and coordination mechanisms between layers. Consequently, information at each layer forms "islands," making it impossible to build a global security view. In high-concurrency environments, especially in resource-constrained edge computing scenarios, traditional compute-intensive detection models are difficult to meet real-time response requirements, affecting system availability.

[0003] Some existing network traffic anomaly detection methods are mainly targeted at enterprise network environments, without considering the particularity of the Internet of Things, and do not solve the problems of encrypted traffic analysis and multi-level collaboration. At the same time, they have high computational complexity and are difficult to apply in resource-constrained environments.

[0004] Therefore, there is an urgent need for a network anomaly detection method that can analyze encrypted traffic without decryption, adapt to the heterogeneous environment of the Internet of Things, support multi-level collaboration and ensure computational efficiency. Summary of the Invention

[0005] The present invention provides a network traffic anomaly detection method and system based on knowledge graph to solve the technical problems of network traffic anomaly detection in related technologies.

[0006] The present invention provides a method for detecting network traffic anomalies based on a knowledge graph, comprising the following steps: Protocol-aware metadata feature extraction: Deep packet inspection technology is used to extract metadata features that do not involve content privacy from encrypted network traffic, including traffic statistics features, time series features, and connection relationship features; Multi-level knowledge graph construction: Based on the extracted metadata features and according to the network architecture, corresponding knowledge graphs are constructed at the device layer, gateway layer, and cloud layer to represent device behavior, network activity, and global security information respectively; Inter-level information collaboration: For the constructed multi-level knowledge graph, a cross-level knowledge transfer protocol is established to achieve information sharing and collaboration among detection systems at different levels, ensuring the consistency and integrity of information at each level; Probabilistic relational reasoning and detection based on knowledge graphs: Utilizes the constructed knowledge graph and collaborative information to perform probabilistic relational inference, calculate edge confidence, and apply a multi-dimensional anomaly scoring model to identify abnormal behavior; Adaptive resource allocation and detection task scheduling: Based on detection results and priorities, combined with the resource status of devices at different levels, computing resources are adaptively allocated and detection tasks are dynamically scheduled to optimize overall system performance.

[0007] As a further optimization solution of the present invention, the protocol-aware metadata feature extraction step specifically includes: Traffic session identification and preprocessing: divide network traffic into sessions according to preset protocol rules; Protocol feature recognition: Identify the protocol type used in network communication by analyzing the basic features in network traffic; Metadata feature extraction: Extract metadata features from data of different protocol types and construct feature vectors, including: Data flow statistical characteristics, time series characteristics, connection relationship characteristics and protocol behavior characteristics.

[0008] Feature dimensionality reduction and normalization: Apply the principal component analysis algorithm to the generated feature vector set to perform dimensionality reduction processing, and normalize the features of each dimension to obtain a standardized feature vector set : ; in, represents the normalized feature vector set; represents the normalization operation function; represents the principal component analysis algorithm; Represents a set of metadata feature vectors; Represents the target dimension after dimensionality reduction.

[0009] As a further optimization solution of the present invention, the multi-level knowledge graph construction step specifically includes: Device-layer lightweight behavior pattern graph construction: Build a lightweight behavior pattern graph based on the network traffic characteristics of a single IoT device; Gateway layer regional network behavior map construction: Based on the communication characteristics of all devices managed by the gateway, a regional network behavior map is constructed; Cloud layer global correlation map construction: Integrate multiple gateway layer maps to build a global correlation map; Graph indexing and storage optimization: Implement indexing and storage optimization for the constructed multi-level knowledge graph.

[0010] As a further optimization solution of the present invention, the inter-level information coordination step specifically includes: Adaptive sampling and aggregation algorithm: Adaptive sampling and aggregation algorithm is implemented to meet the information exchange requirements between different network layers to balance information integrity and transmission efficiency; Bidirectional information flow channel construction: Establish bidirectional information flow channels between multi-level knowledge graphs, so that upper and lower level systems can efficiently exchange key information; Information compression and recovery: Targeting the limited bandwidth in IoT environments, we implement methods for compressing and recovering graph information. Collaborative decision-making and feedback optimization: Based on multi-level information fusion results, collaborative decision-making and feedback optimization methods are implemented.

[0011] As a further optimization solution of the present invention, the inter-level information coordination step specifically includes: the calculation formula of adaptive sampling is: ; in, represents the sampling function; Indicates the knowledge graphs to be sampled; Indicates the sampling rate parameter; Represents a node in the graph; Representation Spectrum The set of all nodes in ; Represents a compute node A function of the importance score of Indicates based on sampling rate Node adaptive threshold function; Represents an edge in the graph; Representation Spectrum The set of all edges in ; Indicates the calculation edge Function of weight; Indicates based on sampling rate Edge adaptive threshold function; Represents the set union operator.

[0012] As a further optimization solution of the present invention, the probabilistic relationship reasoning detection step based on the knowledge graph specifically includes: Device behavior fingerprint generation: Based on the device nodes and their associations in the multi-level knowledge graph, a unique behavior fingerprint is generated for each device; Path probabilistic reasoning algorithm: Based on the relationship paths between entities in the knowledge graph, a path probabilistic reasoning algorithm is implemented to identify abnormal entity association patterns; Multi-dimensional anomaly scoring model: Build a multi-dimensional anomaly scoring model that comprehensively considers multiple anomaly indicators of device behavior; Decision tree ensemble judgment: Based on multi-dimensional anomaly scores, a decision tree ensemble model is applied to make the final anomaly judgment.

[0013] As a further optimization solution of the present invention, the device behavior fingerprint generation function is expressed as: ; in, Representation device Behavioral fingerprint generation function; Represents a device node; represents a hash function; Represents the protocol node associated with the device; Represents the relationship characteristics between devices and protocols; Represents a device node With the protocol node There is a relationship between ; Representing hierarchical knowledge graphs; Behavioral fingerprints are further organized into a fingerprint library to support fast retrieval: ; in, Represents the device behavior fingerprint database; Indicates the device nodes; Representation device behavioral fingerprints; Representation device Category; Represents a collection of device nodes; For newly observed device behaviors, calculate the deviation between the current fingerprint and the historical fingerprint: ; in, Representation device In time Degree of behavioral deviation; Represents a device node; Indicates the current time point; represents the function for calculating the distance between two fingerprints; Representation device In time Current behavioral fingerprint; Representation device historical behavioral fingerprints.

[0014] As a further optimization solution of the present invention, the resource adaptive allocation and detection task scheduling steps specifically include: Hierarchical task priority evaluation: Build a hierarchical task priority evaluation model to assign reasonable execution priorities to different detection tasks; Multi-objective resource allocation algorithm: Based on task priority and current available resource status, a multi-objective resource allocation algorithm is implemented; Load balancing and task migration: Implement load balancing and task migration methods to dynamically adjust task distribution to avoid resource bottlenecks; Resource utilization efficiency monitoring and optimization: Build a resource utilization efficiency monitoring and optimization system to continuously evaluate and improve resource allocation strategies.

[0015] As a further optimization solution of the present invention, the expression of the multi-objective resource allocation algorithm is: ; in, represents the optimal resource allocation plan; Represents the resource allocation plan that maximizes the objective function ; Indicates the sum operation of all tasks; Indicates the total number of tasks; Indicates the Priority rating of each task; Indicates the A detection task; represents the performance evaluation function; Indicates assignment to a task resources; Represent the constraints of the optimization problem; Indicates assignment to a task the amount of resources; Indicates the total amount of resources currently available in the system.

[0016] A knowledge graph-based network traffic anomaly detection system, used in the above-mentioned knowledge graph-based network traffic anomaly detection method, is characterized by comprising: Protocol-aware metadata feature extraction module: used to extract metadata features that do not involve content privacy from encrypted network traffic; Multi-level knowledge graph construction module: used to build corresponding knowledge graphs at the device layer, gateway layer, and cloud layer respectively; Inter-level information collaboration module: used to realize information sharing and collaboration among detection systems at different levels; Probabilistic relational reasoning and detection module based on knowledge graph: used to use knowledge graph to perform probabilistic relational reasoning and identify abnormal behavior; Resource adaptive allocation and detection task scheduling module: used to adaptively allocate computing resources and schedule detection tasks based on the resource status of devices at different levels.

[0017] The beneficial effects of the present invention are: this method does not rely on traffic decryption operations, but only realizes the effective identification of abnormal behavior in encrypted traffic by analyzing the metadata characteristics of network traffic, thereby improving the detection accuracy; and through the hierarchical knowledge graph structure and inter-level collaborative system, it realizes the security information sharing and collaboration of devices at all levels of the Internet of Things, reduces the system computing load, and reduces the network transmission overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is an overall flow chart of a network traffic anomaly detection method based on knowledge graph of the present invention; Figure 2 is a detailed flow chart of the protocol-aware metadata feature extraction steps of the present invention; Figure 3 It is a detailed flow chart of the multi-level knowledge graph construction of the present invention; Figure 4 It is a detailed flow chart of the inter-level information coordination of the present invention; Figure 5 It is a detailed flow chart of the probabilistic relational reasoning detection based on knowledge graph of the present invention; Figure 6 It is a detailed flow chart of the adaptive resource allocation and detection task scheduling of the present invention. DETAILED DESCRIPTION

[0019] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that these embodiments are discussed solely to enable those skilled in the art to better understand and implement the subject matter described herein, and that the functions and arrangements of the elements discussed may be varied without departing from the scope of this specification. Various examples may omit, substitute, or add various processes or components as needed. Furthermore, features described in some examples may be combined in other examples.

[0020] At least one embodiment of the present invention discloses a method for detecting network traffic anomalies based on a knowledge graph, such as Figures 1 to 6 As shown, the following steps are included: Step 1: Protocol-aware metadata feature extraction: Deep packet inspection technology is used to extract metadata features that do not involve content privacy from encrypted network traffic, including traffic statistics features, time series features, and connection relationship features; This step extracts non-privacy metadata features from encrypted network traffic and establishes a feature set that meets privacy protection requirements. It specifically includes the following sub-steps: Step 1.1, traffic data preprocessing; A protocol identification algorithm is applied to preprocess the raw network traffic data, dividing it into sessions based on the five-tuple (source IP, destination IP, source port, destination port, and protocol type) to form a traffic session set. This step does not decrypt encrypted content; it only analyzes the traffic's transmission characteristics.

[0021] Step 1.2: protocol adaptive feature extractor construction; Build a set of protocol-adaptive feature extractors for different types of IoT communication protocols: ; in, 、 、 Respectively indicate the 、 、 Feature extractor for the protocol, Indicates the total number of protocol types supported by the system; Each extractor consists of the following key components: Time feature component: extracts time series features such as time interval distribution and periodic patterns of traffic; Spatial feature component: extracts spatial features such as packet size distribution and data direction ratio; Behavioral feature component: extracts behavioral features such as connection establishment mode and session duration.

[0022] The selection of feature extractors is automatically triggered by the protocol recognition results, which is expressed as: ; in, Indicates that the agreement The chosen feature extractor function, Indicates the recognized protocol type. Indicates the Class protocol collection, Indicates that it applies to A feature extractor for this protocol.

[0023] Step 1.3: Metadata feature vector generation; Apply the protocol adaptive feature extractor to the preprocessed traffic session to generate a set of metadata feature vectors: ; in, represents a set of metadata feature vectors, 、 、 Respectively represent 、 、 The feature vector of a traffic session, Indicates the total number of traffic sessions; Each feature vector The characteristic representation of a traffic session is calculated as follows: ; Specifically, The protocol type is Conversation in, Indicates the The feature vector of a traffic session; Indicates the A feature extractor function; Indicates the Network traffic sessions; Indicates the protocol type; Indicates the A collection of class protocols; The mathematical symbol for "belong to".

[0024] Step 1.4: Feature dimensionality reduction and normalization; Apply the principal component analysis algorithm to the generated feature vector set to perform dimensionality reduction processing, and normalize the features of each dimension to obtain a standardized feature vector set : ; in, represents the normalized feature vector set; represents the normalization operation function; represents the principal component analysis algorithm; Represents a set of metadata feature vectors; Represents the target dimension after dimensionality reduction.

[0025] Through steps 1.1 to 1.4, the present invention can extract rich metadata features from encrypted traffic, providing key input for subsequent anomaly detection without infringing user privacy.

[0026] Step 2: Multi-level knowledge graph construction: Based on the extracted metadata features and the network architecture, corresponding knowledge graphs are constructed at the device layer, gateway layer, and cloud layer to represent device behavior, network activity, and global security information respectively; This step is based on the hierarchical structure of the IoT network and builds a three-level knowledge graph at the device layer, gateway layer, and cloud layer to achieve anomaly detection at different granularities. Specifically, it includes the following steps: Step 2.1: Constructing a lightweight behavioral pattern map at the device layer; Build a lightweight behavior pattern map based on the network traffic characteristics of a single IoT device: ; in, Represents a lightweight behavioral pattern graph at the device layer, A device node set, including a single device node and its communicating peer node; It is a protocol set, which contains the communication protocol nodes used by the device; It is a set of behavioral relationships that describes the communication relationship between devices and protocols, and between devices.

[0027] The graph construction process uses the following mapping functions: ; in, Represents the device layer mapping function, which is used to map the feature vector to the device layer knowledge graph; represents the normalized feature vector set; Mathematical symbols representing mapping relationships; Represents a lightweight behavioral pattern graph at the device layer.

[0028] This function maps the normalized feature vectors to nodes and edges in the graph. The specific implementation is: ; in, Indicates the operation of creating a device node. Indicates the device nodes; Indicates that from A function to extract device information from a feature vector; Indicates the operation of creating a connection relationship between a device node and a protocol node. device nodes and protocol nodes; Indicates that from A function to extract protocol information from feature vectors; Indicates the operation of creating a connection relationship between device nodes. device nodes and device nodes; Indicates that from A function to extract the information of the peer device from the feature vector; Indicates the Normalized feature vectors.

[0029] Step 2.2: Constructing the network behavior graph in the gateway layer area; Build a regional network behavior map based on the communication characteristics of all devices managed by the gateway: ; in, Represents the network behavior graph of the gateway layer area, It is the set of device nodes in the area; A set of protocol nodes used within the region; is the set of behavioral relationships within the region; It is a collection of device classification nodes in the area, indicating the functional category of the equipment.

[0030] The gateway layer graph is constructed by aggregating the device layer graph and adding device category information: ; in, Represents the network behavior graph of the gateway layer area, 、 、 Respectively represent 、 、 Behavioral pattern map of each device, Indicates the total number of devices, represents the graph aggregation function, Represents a device classification function, used to map devices to their functional categories, represents the set union operator, Represents the collection of device nodes within a region.

[0031] Step 2.3: Constructing a global cloud layer correlation map; Integrate multiple gateway layer graphs to build a global correlation graph: ; in, Represents the global correlation map of the cloud layer; It is a collection of device nodes in the entire network; It is the set of protocol nodes in the entire network; is the set of behavioral relationships across the entire network; Classify the node set for all network devices; It is a collection of abnormal type nodes, representing known abnormal behavior patterns.

[0032] The cloud layer graph is constructed using a distributed graph computing framework to merge and streamline the gateway layer graph: ; in, represents the global correlation map of the cloud layer, 、 、 Respectively represent 、 、 The regional network behavior map of each gateway, 、 、 Respectively represent 、 、 The sampling rate parameters of each gateway, Indicates the total number of gateways, represents the graph merging function, Represents a set of predefined exception patterns, represents the sampling function, Represents the set union operator.

[0033] Step 2.4: Graph indexing and storage optimization; To improve the efficiency of graph query and reasoning, we implement indexing and storage optimization on the constructed multi-level knowledge graph: in, Represents the spectrum The index collection created; Indicates the knowledge graph that needs to be indexed; 、 and They represent node index, edge index and pattern index functions respectively, which can be used to quickly locate and retrieve elements in the graph.

[0034] Storage adopts a layered architecture, allocating graph data to different storage layers based on access frequency: in, Indicates that graphs are stored at different levels function, Represents the knowledge graph that needs to be stored, Indicates the storage level, 、 and Represents memory storage, SSD storage and disk storage functions respectively.

[0035] Through steps 2.1 to 2.4, this embodiment constructs a multi-level knowledge graph that adapts to the Internet of Things environment, providing structured knowledge representation for subsequent anomaly detection and relationship reasoning.

[0036] Step 3: Inter-level information collaboration: For the constructed multi-level knowledge graph, establish a cross-level knowledge transfer protocol to achieve information sharing and collaboration among different levels of detection systems, ensuring the consistency and integrity of information at each level; This step establishes a collaborative working system between multi-level knowledge graphs to achieve information sharing and collaboration between detection systems at different levels. Specifically, it includes the following steps: Step 3.1, adaptive sampling and aggregation algorithm; Adaptive sampling and aggregation algorithms are implemented to balance information integrity and transmission efficiency in response to information exchange requirements between different network layers: ; in, represents the sampling function; Indicates the knowledge graphs to be sampled; Indicates the sampling rate parameter; Represents a node in the graph; Representation Spectrum The set of all nodes in ; Represents a compute node A function of the importance score of Indicates based on sampling rate Node adaptive threshold function; Represents an edge in the graph; Representation Spectrum The set of all edges in ; Indicates the calculation edge Function of weight; Indicates based on sampling rate Edge adaptive threshold function; Represents the set union operator.

[0037] and The calculation formula is: ; ; in, Indicates based on sampling rate Node adaptive threshold function, Indicates based on sampling rate Edge adaptive threshold function; Indicates the basic threshold value of node importance; Indicates the base value of the edge threshold; represents the adjustment parameter of the node threshold, represents the adjustment parameter of the edge threshold, Indicates the sampling rate parameter; Represents the multiplication operator; represents the adjustment factor that reduces the threshold as the sampling rate increases; Indicates the scaling factor adjusted according to the sampling rate.

[0038] After sampling, the sampling results are integrated into a higher-level graph representation through an aggregation algorithm: ; in, Represents an aggregate function, 、 、 Respectively represent the first 、 、 A knowledge graph, represents the total number of knowledge graphs, Represents the graph fusion function, which achieves consistent representation of multiple graphs by merging nodes and integrating relationships. represents the sampling function, Indicates the knowledge graphs to be sampled, Indicates that it is applied to The sampling rate parameter of the spectrum, Represents an index The value range is from arrive An integer.

[0039] Step 3.2: Building a two-way information flow channel; Establish a two-way information flow channel between multi-level knowledge graphs, so that upper and lower level systems can efficiently exchange key information: ; in, Represented in the graph and A two-way information flow channel established between them; Represents a lower-level knowledge graph; Represents a higher-level knowledge graph; Represents a low-level graph Towards a high-level graph Uplink channel for transmitting information; Represents a high-level graph Towards a low-level graph Downstream channel for transmitting information.

[0040] The calculation formula is: ; in, Represents a low-level graph Abnormal feature information extracted from Represented in the low-level graph The results of local anomaly detection performed on The calculation formula is: ; in, Represents a high-level graph The global pattern information extracted from Represents a high-level graph Detection strategy information generated in ; Through two-way channels, real-time information sharing between levels is achieved, avoiding the "information island" problem.

[0041] Step 3.3: Information compression and recovery; In view of the limited bandwidth in the IoT environment, the following methods are used to compress and recover graph information: ; in, Representation graph compression function, used to compress the knowledge graph into a smaller representation; Represents the knowledge graph to be compressed; Indicates the compression ratio parameter; Represents the encoding function, which converts the graph into a compressed representation; Representation based on graph The encoding dictionary generated by the feature is used to support the compression process.

[0042] The compressed graph is restored at the target level: ; in, Represents the graph recovery function, which is used to restore the compressed graph to its original form. Represents the graph after being processed by the compression function, which is the compressed graph representation. represents the decoding function, Representation based on graph The encoding dictionary generated by the feature is used to support the compression process.

[0043] Through compression and recovery methods, the amount of data transmitted between layers is significantly reduced, and communication efficiency is improved.

[0044] Step 3.4: Collaborative decision-making and feedback optimization; Based on the multi-level information fusion results, collaborative decision-making and feedback optimization methods are realized: ; in, Represents the final decision function for network events; Represents the network event to be evaluated; Represents the decision combination function, which is used to fuse the detection results of different levels; Represents the local decision function for events on the device-level knowledge graph; Represents the device layer knowledge graph; Represents the regional decision function for events on the gateway layer knowledge graph; Represents the knowledge graph of the gateway layer; Represents the global decision function for events on the cloud knowledge graph; Represents the cloud layer knowledge graph.

[0045] The decision results are used to optimize the detection models at each level through feedback channels: ; in, Represents the feedback function, which is used to feed back the decision results into the knowledge graph; Indicates the final decision result on the network event; Represents the network event to be evaluated; Indicates the Hierarchical knowledge graph; Represents the graph update function, which is used to update the knowledge graph; Represents a function that learns new knowledge from decision results, used to extract knowledge that can be used to update the graph.

[0046] Through steps 3.1 to 3.4, this embodiment establishes an efficient inter-level information collaboration system, realizes deep collaboration between detection systems at different levels, and improves overall detection efficiency and accuracy.

[0047] Step 4: Probabilistic relational reasoning detection based on knowledge graph: Using the constructed knowledge graph and collaborative information, probabilistic relational inference is performed, edge confidence is calculated, and a multi-dimensional anomaly scoring model is applied to identify abnormal behavior. This step uses the reasoning capability of the knowledge graph to infer probabilistic relationships and identify abnormal network behavior without decrypting traffic. It specifically includes the following sub-steps: Step 4.1: Generate device behavior fingerprint; Based on the device nodes and their associations in the multi-level knowledge graph, a unique behavioral fingerprint is generated for each device for rapid anomaly detection: ; in, Representation device Behavioral fingerprint generation function; Represents a device node; represents a hash function; Represents the protocol node associated with the device; Represents the relationship characteristics between devices and protocols; Represents a device node With the protocol node There is a relationship between ; Represents a hierarchical knowledge graph.

[0048] Behavioral fingerprints are further organized into a fingerprint library to support fast retrieval: ; in, Represents the device behavior fingerprint database; Indicates the device nodes; Representation device behavioral fingerprints; Representation device Category; Represents a collection of device nodes.

[0049] For newly observed device behaviors, calculate the deviation between the current fingerprint and the historical fingerprint: ; in, Representation device In time Degree of behavioral deviation; Represents a device node; Indicates the current time point; represents the function for calculating the distance between two fingerprints; Representation device In time Current behavioral fingerprint; Representation device historical behavioral fingerprints.

[0050] Step 4.2, path probability inference algorithm; Based on the relationship paths between entities in the knowledge graph, a path probability reasoning algorithm is implemented to identify abnormal entity association patterns: ; in, Indicates that at a known node In the case of reaching the node The conditional probability of Indicates the target node; Indicates the starting node; Represents a slave node To Node The set of all possible paths; Represents a slave node To Node A specific path; Indicates the path The weight value of Represents a set All paths in Sum the weights of Represents a slave node To Node The total number of paths; The calculation method is: ; in, Indicates the path The weight of Represents the multiplication symbol, which multiplies the confidence of all edges on the path; Indicates the path Each edge on ; Represents an edge confidence level; Represents the length penalty factor, which is used to control the impact of path length on weight; Indicates the path length.

[0051] Evaluate the likelihood of a device being abnormal by calculating the path probability between the device and known abnormal patterns:

[0052] in, Represents a device node Abnormal score; Indicates the device to be evaluated; The operator that represents the maximum value; Indicates an exception type node; Represents the set of all abnormal type nodes; Represents a collection All exception type nodes in ; Indicates that on known devices In the case of an exception type node The conditional probability of .

[0053] The specific implementation of the path probability inference algorithm includes the following key components and technical details: Bidirectional search optimization: To improve the efficiency of path search in large-scale graphs, the algorithm adopts a bidirectional search strategy, searching from both the start and target nodes simultaneously and merging paths when they meet at intermediate nodes. The implementation uses a priority queue to manage the search frontier, prioritizing high-confidence paths: ; ; in, Represents a priority queue for forward search, used to search from the start node to the target node; Represents a priority queue for backward search, used to search from the target node to the starting node; Represents the operation of adding an element to a priority queue; Indicates the graph node currently being processed; Represents the path from the starting node (or target node) to the current node; Represents the cumulative confidence score of the path, which is used to sort in the priority queue to ensure that high-confidence paths are explored first; Specifically, nodes are sorted by the cumulative confidence of the paths to achieve optimal path-first search; To avoid combinatorial explosion, the path pruning mechanism introduces a three-level pruning strategy: Length pruning: discards data with a length exceeding a preset threshold Path; Confidence pruning: discarding data with cumulative confidence below a threshold Path; Redundant path pruning: When two paths are found to pass through the same set of key nodes and the confidence of one of the paths is significantly lower, the high-confidence path is retained.

[0054] Edge confidence calculation: edge confidence Calculated as follows: ; in, Represents an edge confidence level; Represents an edge Frequency of observations; Represents an edge Semantic similarity between connected entities; Represents an edge The temporal correlation of 、 、 They represent the weight coefficients of observation frequency, semantic similarity, and temporal correlation respectively.

[0055] Path probability cache and incremental updates: To improve inference efficiency, the system maintains a path probability cache and handles graph changes through an incremental update mechanism: ; in, Indicates that after the graph is updated, the node To Node The conditional probability of Indicates the slave node before the graph is updated To Node The conditional probability of Indicates the slave node before the graph is updated To Node The total number of paths; Indicates the slave nodes affected by the graph changes To Node The number of paths; Indicates the newly added slave nodes after the graph is updated To Node The path collection of Represents a single path in the newly added path set; Indicates the path The weight value of Indicates the summation of the weights of all newly added paths.

[0056] In actual network security monitoring applications, this path probability inference algorithm exhibits the following characteristics and application cases: Zero-Day Vulnerability Correlation Detection: In a large enterprise network deployment, this algorithm successfully identified implicit correlations between a device and known vulnerability patterns. Although the device wasn't explicitly flagged as vulnerable, by analyzing its communication patterns similar to those of known vulnerable devices, the system calculated a high probability path, detecting potential risks in advance and preventing a data breach.

[0057] Multi-hop attack chain identification: The system can identify complex multi-hop attack paths, defined as chains of attacks formed by attackers through multiple intermediate devices. In one industrial control network, the algorithm identified a six-hop attack path from an external network to a critical control system. This path leveraged a propagation chain consisting of multiple seemingly unrelated devices, making this complex connection difficult to detect using traditional single-point detection methods.

[0058] Abnormal Behavior Propagation Prediction: By analyzing the path probabilities between nodes, the algorithm can predict the potential propagation paths of abnormal behavior. In the early stages of a ransomware attack, the system accurately predicted the next batch of high-risk devices likely to be infected based on the behavioral patterns of the first few infected devices, enabling administrators to take targeted protective measures.

[0059] Dynamic Trust Relationship Assessment: In a dynamically changing network environment, the algorithm continuously updates the trust relationships between entities. For example, in a cloud-edge-end collaborative IoT architecture, the trust relationship between the edge gateway and the cloud platform is dynamically adjusted based on communication patterns and security incidents, ensuring that abnormal nodes are promptly isolated and preventing the spread of risks.

[0060] Step 4.3, multidimensional anomaly scoring model; Build a multi-dimensional anomaly scoring model that comprehensively considers multiple anomaly indicators of device behavior: ; in, Representation device The comprehensive abnormality score; Indicates the device being evaluated; Indicates the total number of abnormal indicators; Indicates the The weight coefficient of each indicator; Representation device No. Types of abnormal indicator function values; Indicates a weighted sum operation for all abnormal indicators; Indicates the Abnormal indicator functions, including but not limited to: Behavioral Deviation: ; in, Representation device Behavioral deviation indicators; Indicates the device to be evaluated; Representation device In time Behavioral deviation function; Indicates the current time point; Relationship abnormality: ; in, Representation device The abnormality index of the relationship; Indicates the device to be evaluated; Representation device Relation anomaly scoring function in knowledge graphs; Communication mode change rate: ; in, Representation device Communication mode change rate indicator; Indicates the device to be evaluated; Representation device Communication mode function; represents a function for calculating the rate of change of the communication pattern; Abnormal resource usage: ; in, Representation device Resource usage abnormality indicator; Indicates the device to be evaluated; Represents a computing device A function of the degree of abnormal resource usage; Specifically, satisfy ; in, Indicates the summation of the weights of all abnormal indicators; Indicates the index of the indicator, from 1 to ; Indicates the total number of abnormal indicators; Indicates the The weight coefficient of each indicator; Indicates that the sum of all weight coefficients is equal to 1, ensuring weight normalization; The weights are determined by the following adaptive method: ; in, Indicates the The effectiveness score of the indicators, Indicates the sum of the effectiveness scores of all abnormal indicators. Indicates the The effectiveness score of each indicator.

[0061] The specific implementation of the multidimensional anomaly scoring model is based on the following components and structures: Feature Extractor: For each anomaly indicator, a dedicated feature extractor is built to extract relevant information from the knowledge graph. For example, the communication pattern change rate feature extractor extracts time series features from the device node's historical communication records. Using a sliding window algorithm, it calculates statistical features within each time window to analyze pattern change trends.

[0062] Anomaly Quantification Method: For each type of anomaly indicator, a specialized quantification method is used to calculate the degree of anomaly. Behavior deviation uses the Mahalanobis distance to calculate the degree of deviation between current and historical behavior. Relationship anomaly is quantified by path probabilities in the graph. Resource usage anomaly is calculated using a Z-score based on the statistical distribution of resource usage.

[0063] Adaptive weight learning: The weight learning module is based on a feedback loop mechanism, records the contribution of each indicator in historical detection, and uses reinforcement learning methods to dynamically adjust the weight. The learning algorithm is based on the following update formula: ; in, Indicates the The first iteration The weight of each indicator; Indicates the The first iteration The weight of each indicator; represents the learning rate; Indicates the The reward for the detection result feedback of the iteration; Represents the mean of historical test result feedback rewards; Indicates the The first iteration The abnormal measurement value of each indicator; Indicates the The average of the historical abnormal measurement values of the indicator.

[0064] Adaptive anomaly threshold: The model uses a dynamic threshold mechanism to automatically adjust the anomaly threshold based on device type, environmental conditions, and historical anomaly distribution. The threshold calculation formula is: ; in, Representation device Dynamic abnormal threshold; Indicates the device to be evaluated; Indicates the basic threshold, which serves as the benchmark value for dynamic threshold calculation; Representation device The adjustment parameter is used to control the impact of volatility on the threshold; Representation device Behavioral volatility measurement, which quantifies the degree of instability of device behavior; Represents a multiplication operation.

[0065] In actual network environment applications, this multi-dimensional anomaly scoring model demonstrates the following advantages and specific application cases: Adaptability to heterogeneous devices: In an industrial internet environment comprised of diverse IoT devices (such as cameras, smart speakers, and sensor networks), the model automatically identifies the normal behavioral characteristics of each device and adjusts the weighting of abnormal indicators accordingly. For example, for data-intensive devices, the communication mode change rate indicator is given a higher weight, while for state-sensitive devices, the behavioral deviation indicator is given a higher weight.

[0066] Achieving a low false alarm rate: In a large-scale smart city project, this model reduced false alarm rates while maintaining a high detection rate through adaptive weight learning. When a new attack emerges, the model increases sensitivity to unknown attack patterns by increasing the weight of relationship anomalies.

[0067] Incremental Learning Capability: The model supports online incremental learning, continuously learning and adjusting anomaly scoring strategies from newly observed network behavior. During a six-month long-term test, the model's detection accuracy showed an upward trend, demonstrating its ability to continuously learn and improve.

[0068] Seasonal behavior adaptation: For network environments with obvious time patterns (such as commercial office networks), the model can identify and adapt to normal seasonal behavior changes, automatically adjusting the anomaly thresholds for each time period, and avoiding false alarms caused by behavioral differences between working hours and non-working hours.

[0069] Step 4.4, decision tree integration judgment; Based on the multi-dimensional anomaly score, the decision tree ensemble model is applied to make the final anomaly judgment: ; in, Indicates the device The final abnormal judgment result; Indicates the device to be evaluated; Representation device Multidimensional abnormality score; 、 、 Respectively represent 、 、 Decision tree for device The judgment result of abnormal score; Represents the total number of decision trees in the decision tree ensemble model; represents the integrated function; The weighted voting method is used, and the calculation formula is: ; in, Represents the output of the integrated function, that is, the final abnormality judgment (1 indicates abnormality, 0 indicates normal); Represents the set of voting results of all decision trees; Indicates the The judgment result of a decision tree (1 means abnormal, 0 means normal); Represents the total number of decision trees in the decision tree ensemble model; Indicates the The weight coefficient of a decision tree reflects the importance of the decision tree in the final judgment; represents the sum of weighted votes of all decision trees; represents the decision threshold.

[0070] The verdicts are further broken down into exception types: ; in, Representation device The abnormal type determination result; Indicates the device to be evaluated; Indicates a certain type of exception; Represents the set of all possible exception types; Indicates the exception type Belongs to the exception type set ; Representation device Conditions judged to be abnormal; Indicates that the device Under the conditions determined to be abnormal, the device belongs to the abnormal type The conditional probability of Indicates the independent variable that causes the function to reach its maximum value.

[0071] The specific implementation of the decision tree ensemble model uses the Gradient Boosting Decision Tree (GBDT) structure, which includes the following key components: Basic Decision Tree Builder: Used to construct a single decision tree using the Classification and Regression Tree (CART) algorithm. Each decision tree is limited to a maximum depth of five layers to balance model complexity and generalization. The decision tree uses multidimensional anomaly score features as input and selects the optimal split point using the information gain ratio criterion.

[0072] Sequential training process: The model is trained iteratively, with each iteration adding a new decision tree to fit the residuals of the previous stage model. The training process uses the following loss function: ; in, Represents the loss function, which is used to measure the difference between the model's predicted value and the true value; represents the true label vector; represents the predicted label vector; Indicates the sample index; Indicates the total number of samples; Indicates the The true label value of each sample; Indicates the The predicted label value of each sample; represents the natural logarithm function; Indicates the summation operation for all samples.

[0073] Feature importance assessment: The integrated model automatically assesses the importance of each feature and dynamically adjusts the weight of each decision tree accordingly , improving sensitivity to key abnormal features.

[0074] In IoT environment applications, the model has the following adaptability features: Lightweight implementation: The model is optimized for resource-constrained edge devices, supports incremental updates and model quantization, and the computational complexity of a single prediction operation is controlled at the O(log n) level.

[0075] Distributed deployment: The decision tree integration model supports distributed deployment on devices at different levels. Simplified models can be deployed on low-level devices, while complete models can be deployed on high-level devices to achieve hierarchical decision-making.

[0076] Explainability: Unlike black-box models, the decision tree ensemble model retains a high degree of explainability. The system can generate explanations of the decision path, illustrating the key features and thresholds for anomaly determination, helping security analysts understand and verify detection results.

[0077] In practical applications, such as smart home network security monitoring systems, this decision tree ensemble model successfully detected IoT device firmware tampering attacks transmitted via encrypted traffic. By analyzing multiple metrics, such as changes in device communication patterns and traffic periodicity deviations, the model identified anomalous behavior patterns before an actual attack occurred. Combining device type information, the model classified these as high-risk firmware operations, triggering security intervention and preventing the attack from spreading further.

[0078] Through steps 4.1 to 4.4, this embodiment implements probabilistic relational reasoning detection based on knowledge graphs, which can accurately identify abnormal behaviors in the network without decrypting traffic and give corresponding abnormal type judgments.

[0079] Step 5: Adaptive resource allocation and detection task scheduling: Based on the detection results and priorities, combined with the resource status of devices at different levels, computing resources are adaptively allocated and detection tasks are dynamically scheduled to optimize overall system performance. This step implements dynamic scheduling and load balancing of detection tasks based on the computing resource conditions at different levels, ensuring the system's real-time responsiveness in a high-concurrency environment. Specifically, it includes the following steps: Step 5.1: Hierarchical task priority assessment; Construct a hierarchical task priority evaluation model to assign reasonable execution priorities to different detection tasks: ; in, Indicates the priority score of the task; represents the detection task to be evaluated; represents the threat level assessment function related to the task; represents the task urgency evaluation function; represents the task resource requirement evaluation function; 、 、 Represent the weight coefficients of threat level, mission urgency factor, and resource demand factor, respectively, satisfying .

[0080] Based on different levels of security concerns, the weight coefficient is dynamically adjusted: ; in, 、 、 Represents the weight coefficients of the threat level assessment factors at the device layer, gateway layer, and cloud layer respectively; 、 、 Represents the weight coefficients of the task urgency assessment factors at the device layer, gateway layer, and cloud layer respectively; 、 、 Represent the weight coefficients of the resource demand assessment factors at the device layer, gateway layer, and cloud layer respectively.

[0081] This reflects the characteristics that the device layer focuses more on direct threats, the cloud layer focuses more on global planning, and the device layer focuses more on resource consumption.

[0082] Step 5.2, multi-objective resource allocation algorithm; Implement a multi-objective resource allocation algorithm based on task priorities and current available resource conditions: ; in, represents the optimal resource allocation plan; Represents the resource allocation plan that maximizes the objective function ; Indicates the sum operation of all tasks; Indicates the total number of tasks; Indicates the Priority rating of each task; Indicates the A detection task; represents the performance evaluation function; Indicates assignment to a task resources; Represent the constraints of the optimization problem; Indicates assignment to a task the amount of resources; Indicates the total amount of resources currently available in the system.

[0083] Given the heterogeneity of IoT environments, resource allocation also needs to consider device capability matching: ; in, represents the compatibility score between the task and the device; Indicates the detection task to be assigned; Represents equipment that can be used to perform a task; Indicates the total number of dimensions for ability fit assessment; Indicates the index of the capability dimension, ranging from 1 to ; Indicates the The weight coefficients of the ability dimensions; Indicates that the task and equipment are in Matching evaluation function based on the capability dimension; Indicates the summation operation of all capability dimensions.

[0084] Step 5.3: Load balancing and task migration; Implement load balancing and task migration methods to dynamically adjust task distribution to avoid resource bottlenecks: ; in, Represents a device collection The degree of load imbalance; Represents a collection of devices; Represents a device in the set S; Representation device load; Representing a collection The maximum value of all equipment loads in; Representing a collection The minimum value of all equipment loads in; Represents the average load of all devices in set S.

[0085] When the imbalance exceeds the threshold, task migration is triggered: ; in, Represents a set of task migrations; Indicates the first tasks; Indicates the A source device (the device currently running the task); Indicates the a target device (the device to which the task will be migrated); Indicates the source device load; Indicates the target device load; Indicates high load threshold; Indicates the low load threshold.

[0086] Task migration selects the optimal task and target device combination: ; in, represents the optimal task migration solution; It means that among all possible combinations of tasks and target devices, we search for the combination that maximizes the following expression. Indicates the tasks to be migrated; Indicates the target device to which the task will be migrated; Indicates the source device where the task is currently located; Represents the benefit of migrating tasks from the source device to the target device; Represents the cost required to migrate a task from the source device to the target device.

[0087] Step 5.4: Monitor and optimize resource utilization efficiency; Build a resource utilization efficiency monitoring and optimization system to continuously evaluate and improve resource allocation strategies: ; in, Indicates the resource utilization efficiency of the task; represents the detection task to be evaluated; Indicates the performance of the task, such as detection accuracy, response speed and other indicators; Indicates the amount of resources consumed by the task, such as CPU usage, memory usage, etc. Periodically collect efficiency indicators for each detection task and identify inefficient tasks: ; in, Represents a collection of inefficient tasks; represents the detection task being evaluated; Indicates the resource utilization efficiency of the task; Indicates the efficiency threshold. When the task efficiency is lower than this value, it is considered an inefficient task. Optimize resource allocation or replace algorithms for inefficient tasks:

[0088] in, represents the best configuration obtained after optimizing the task; Indicates the detection task that needs to be optimized; It means that among all possible configurations, we search for the configuration that maximizes the following expression. Represents possible configuration parameter combinations for a task; Indicates the resource utilization efficiency of a task under a specific configuration; At the same time, historical data analysis is used to predict future resource demand trends: ; in, Indicates a point in the future Forecasted resource requirements; Indicates the current time point; Indicates the time span of the prediction, that is, the length of time predicted from the current time to the future; Indicates a point in time from the past To the current time point Historical resource demand data; Indicates the length of the time window for historical data collection; Represents a prediction function, which is used to predict future demand based on historical data; Indicates from the time point At the time time interval.

[0089] Through steps 5.1 to 5.4, this embodiment realizes the adaptive allocation of detection system resources, and can dynamically adjust the computing resource allocation strategy according to the resource status and task priority of different levels to ensure the real-time response capability of the system in a high-concurrency environment.

[0090] This implementation combines knowledge graphs with encrypted traffic analysis methods to construct an efficient and scalable method for detecting anomaly traffic in IoT networks. The main technical effects include: Efficient encrypted traffic anomaly detection: This capability effectively identifies anomalous behavior in encrypted traffic by analyzing network traffic metadata, independent of traffic decryption. In large-scale testing, this approach improved detection accuracy and reduced detection latency from seconds to milliseconds, enabling near-real-time anomaly detection response.

[0091] Efficient Resource Utilization and Multi-Level Collaboration: Through a hierarchical knowledge graph structure and an inter-level collaborative system, this implementation enables security information sharing and collaboration among IoT devices at all levels. Compared to traditional centralized detection architectures, this reduces system computational load and network transmission overhead, making it particularly suitable for resource-constrained IoT environments. Furthermore, this multi-level collaborative system enables the detection system to make more accurate judgments from a holistic perspective, reducing false alarm rates.

[0092] Adaptability and Scalability: The protocol-adaptive feature extraction method enables this implementation to adapt to a diverse range of IoT devices and communication protocols, eliminating the need for retraining for each new protocol. The system scales linearly with the number of devices, with only logarithmic performance degradation, and can handle a wide range of scenarios, from small local area networks to large-scale IoT environments.

[0093] Privacy Protection and Security Compliance: By analyzing only metadata features, rather than decrypted content, this implementation ensures user data privacy while achieving effective security monitoring and complying with modern cybersecurity regulations. Compared to traditional deep packet inspection methods, this approach achieves similar detection results while completely avoiding the need to parse encrypted content, effectively preventing the risk of sensitive information leakage.

[0094] Adaptive resource allocation: The adaptive resource allocation system dynamically adjusts computing resource allocation based on threat scores and detection task priorities, ensuring sufficient resources for critical anomaly detection tasks. Compared to traditional static allocation schemes, this reduces system performance degradation in the event of resource fluctuations and significantly improves system robustness. Dynamic load balancing ensures stable system operation even during peak hours.

[0095] In summary, this implementation solves the problem of detecting anomalies in encrypted traffic in the IoT environment by innovatively combining knowledge graphs with encrypted traffic analysis methods, achieving efficient, scalable, and privacy-protecting network security monitoring capabilities, and providing strong protection for IoT security in the 5G / 6G era.

[0096] Application examples of this embodiment 1. Application scenarios of smart city IoT security monitoring system: This implementation focuses on a smart city project involving over 50,000 IoT devices, including smart cameras, environmental sensors, traffic control devices, and other types. The system needs to effectively identify abnormal device behavior and prevent various cyberattacks without decrypting traffic, while also meeting privacy regulations.

[0097] This application scenario has the following characteristics: Diverse device types and complex communication protocols (including MQTT, CoAP, HTTPS, etc.); Edge devices have limited computing resources, and most processing needs to be done in a resource-constrained environment; The peak network traffic volume reached 15GB / minute, with 99% of the traffic being encrypted. The average response time for security incidents must be less than 500 milliseconds.

[0098] The distribution and traffic characteristics of smart city IoT devices are shown in the following table: .

[0099] 2. Example of building a multi-level knowledge graph: In actual deployment, the system has built a three-level knowledge graph structure. The scale and characteristics of each level of knowledge graph are as follows: The actual construction results of the multi-level knowledge graph are shown in the following table: .

[0100] 3. Probabilistic relational reasoning detection example: In actual applications, the system has successfully detected multiple covert attacks using a path probability inference algorithm. The following is a case study of a smart camera firmware implanted with a Trojan: The camera device appeared to be operating normally, but the system detected a minor anomaly in its communication pattern. Using a path probabilistic inference algorithm, the system calculated the device's correlation with known anomaly patterns and found a high correlation with the "firmware backdoor implant" pattern.

[0101] The path probability reasoning detection results are shown in the following table: .

[0102] 4. Multi-level collaborative detection example: The multi-layered collaborative system of this embodiment demonstrated significant advantages during a large-scale DDoS attack. The attacker attempted to use IoT devices distributed across different areas to launch low-intensity, long-duration DDoS attacks to evade traditional detection systems.

[0103] The multi-level collaborative detection process and results are shown in the following table: .

[0104] 5. Example of adaptive resource allocation: During the system deployment process, the adaptive resource allocation strategy significantly improved the system's performance stability during peak periods.

[0105] The following table shows the system performance comparison before and after adaptive resource allocation: .

[0106] 6. Core technology effect verification: Through actual deployment and long-term operation in a smart city environment, the two core technical effects of this implementation have been verified: the ability to detect anomalies in encrypted traffic and the ability to efficiently utilize system resources.

[0107] The results of the encrypted traffic anomaly detection capability verification are shown in the following table: .

[0108] The system resource utilization efficiency verification results are shown in the following table: .

[0109] These results demonstrate that this implementation significantly reduces system resource consumption while maintaining high detection accuracy, making it particularly suitable for distributed deployment in IoT environments. Compared to traditional detection methods, detection accuracy increased by 32.7% while reducing resource consumption by approximately 65%, achieving the desired technical benefits.

[0110] The above describes an embodiment of the present invention, but this embodiment is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Ordinary technicians in this field can also make more forms of equivalent embodiments based on the inspiration of this embodiment, all of which are protected by this embodiment.

Claims

1. A network traffic anomaly detection method based on knowledge graph, characterized in that: The following steps are involved: Protocol-aware metadata feature extraction: Deep packet inspection technology is used to extract metadata features that do not involve content privacy from encrypted network traffic, including traffic statistics features, time series features, and connection relationship features; Multi-level knowledge graph construction: Based on the extracted metadata features and according to the network architecture, corresponding knowledge graphs are constructed at the device layer, gateway layer, and cloud layer to represent device behavior, network activity, and global security information respectively; Inter-level information collaboration: For the constructed multi-level knowledge graph, a cross-level knowledge transfer protocol is established to achieve information sharing and collaboration among detection systems at different levels, ensuring the consistency and integrity of information at each level; Probabilistic relational reasoning and detection based on knowledge graphs: Utilizes the constructed knowledge graph and collaborative information to perform probabilistic relational inference, calculate edge confidence, and apply a multi-dimensional anomaly scoring model to identify abnormal behavior; Adaptive resource allocation and detection task scheduling: Based on detection results and priorities, combined with the resource status of devices at different levels, computing resources are adaptively allocated and detection tasks are dynamically scheduled to optimize overall system performance.

2. A network traffic anomaly detection method based on knowledge graph according to claim 1, characterized in that: The protocol-aware metadata feature extraction step specifically includes: Traffic session identification and preprocessing: divide network traffic into sessions according to preset protocol rules; Protocol feature recognition: Identify the protocol type used in network communication by analyzing the basic features in network traffic; Metadata feature extraction: Extract metadata features from data of different protocol types and construct feature vectors, including: Data flow statistical characteristics, time series characteristics, connection relationship characteristics and protocol behavior characteristics; Feature dimensionality reduction and normalization: Apply the principal component analysis algorithm to the generated feature vector set to perform dimensionality reduction processing, and normalize the features of each dimension to obtain a standardized feature vector set : ； in, represents the normalized feature vector set; represents the normalization operation function; represents the principal component analysis algorithm; Represents a set of metadata feature vectors; Represents the target dimension after dimensionality reduction.

3. The method for detecting network traffic anomalies based on knowledge graph according to claim 1, characterized in that: The multi-level knowledge graph construction steps specifically include: Device-layer lightweight behavior pattern graph construction: Build a lightweight behavior pattern graph based on the network traffic characteristics of a single IoT device; Gateway layer regional network behavior map construction: Based on the communication characteristics of all devices managed by the gateway, a regional network behavior map is constructed; Cloud layer global correlation map construction: Integrate multiple gateway layer maps to build a global correlation map; Graph indexing and storage optimization: Implement indexing and storage optimization for the constructed multi-level knowledge graph.

4. The method for detecting network traffic anomalies based on knowledge graph according to claim 1, characterized in that: The inter-level information coordination step specifically includes: Adaptive sampling and aggregation algorithm: Adaptive sampling and aggregation algorithm is implemented to meet the information exchange requirements between different network layers to balance information integrity and transmission efficiency; Bidirectional information flow channel construction: Establish bidirectional information flow channels between multi-level knowledge graphs, so that upper and lower level systems can efficiently exchange key information; Information compression and recovery: Targeting the limited bandwidth in IoT environments, we implement methods for compressing and recovering graph information. Collaborative decision-making and feedback optimization: Based on multi-level information fusion results, collaborative decision-making and feedback optimization methods are implemented.

5. The method for detecting network traffic anomalies based on knowledge graph according to claim 1, characterized in that: The inter-level information coordination step specifically includes: the calculation formula for adaptive sampling is: ； in, represents the sampling function; Indicates the knowledge graphs to be sampled; Indicates the sampling rate parameter; Represents a node in the graph; Representation Spectrum The set of all nodes in ; Represents a compute node A function of the importance score of Indicates based on sampling rate Node adaptive threshold function; Represents an edge in the graph; Representation Spectrum The set of all edges in ; Indicates the calculation edge Function of weight; Indicates based on sampling rate Edge adaptive threshold function; Represents the set union operator.

6. The method for detecting network traffic anomalies based on knowledge graph according to claim 1, characterized in that: The probabilistic relational reasoning detection step based on the knowledge graph specifically includes: Device behavior fingerprint generation: Based on the device nodes and their associations in the multi-level knowledge graph, a unique behavior fingerprint is generated for each device; Path probabilistic reasoning algorithm: Based on the relationship paths between entities in the knowledge graph, a path probabilistic reasoning algorithm is implemented to identify abnormal entity association patterns; Multi-dimensional anomaly scoring model: Build a multi-dimensional anomaly scoring model that comprehensively considers multiple anomaly indicators of device behavior; Decision tree ensemble judgment: Based on multi-dimensional anomaly scores, a decision tree ensemble model is applied to make the final anomaly judgment.

7. The method for detecting network traffic anomalies based on knowledge graph according to claim 6 is characterized in that: The device's behavioral fingerprint generation function is expressed as: ； in, Representation device Behavioral fingerprint generation function; Represents a device node; represents a hash function; Represents the protocol node associated with the device; Represents the relationship characteristics between devices and protocols; Represents a device node With the protocol node There is a relationship between ; Representing hierarchical knowledge graphs; Behavioral fingerprints are further organized into a fingerprint library to support fast retrieval: ； in, Represents the device behavior fingerprint database; Indicates the device nodes; Representation device behavioral fingerprints; Representation device Category; Represents a collection of device nodes; For newly observed device behaviors, calculate the deviation between the current fingerprint and the historical fingerprint: ； in, Representation device In time Degree of behavioral deviation; Represents a device node; Indicates the current time point; represents the function for calculating the distance between two fingerprints; Representation device In time Current behavioral fingerprint; Representation device historical behavioral fingerprints.

8. The method for detecting network traffic anomalies based on knowledge graph according to claim 1, characterized in that: The resource adaptive allocation and detection task scheduling steps specifically include: Hierarchical task priority evaluation: Build a hierarchical task priority evaluation model to assign reasonable execution priorities to different detection tasks; Multi-objective resource allocation algorithm: Based on task priority and current available resource status, a multi-objective resource allocation algorithm is implemented; Load balancing and task migration: Implement load balancing and task migration methods to dynamically adjust task distribution to avoid resource bottlenecks; Resource utilization efficiency monitoring and optimization: Build a resource utilization efficiency monitoring and optimization system to continuously evaluate and improve resource allocation strategies.

9. The method for detecting network traffic anomalies based on knowledge graph according to claim 8, characterized in that: The expression of the multi-objective resource allocation algorithm is: ； in, represents the optimal resource allocation plan; Represents the resource allocation plan that maximizes the objective function ; Indicates the sum operation of all tasks; Indicates the total number of tasks; Indicates the Priority rating of each task; Indicates the A detection task; represents the performance evaluation function; Indicates assignment to a task resources; Represent the constraints of the optimization problem; Indicates assignment to a task the amount of resources; Indicates the total amount of resources currently available in the system.

10. A network traffic anomaly detection system based on knowledge graph, used to execute the network traffic anomaly detection method based on knowledge graph according to any one of claims 1 to 9, characterized in that: include: Protocol-aware metadata feature extraction module: used to extract metadata features that do not involve content privacy from encrypted network traffic; Multi-level knowledge graph construction module: used to build corresponding knowledge graphs at the device layer, gateway layer, and cloud layer respectively; Inter-level information collaboration module: used to realize information sharing and collaboration among detection systems at different levels; Probabilistic relational reasoning and detection module based on knowledge graph: used to use knowledge graph to perform probabilistic relational reasoning and identify abnormal behavior; Resource adaptive allocation and detection task scheduling module: used to adaptively allocate computing resources and schedule detection tasks based on the resource status of devices at different levels.

Images