Malicious traffic real-time blocking method based on dynamic interaction flow graph and space-time attention fusion mechanism

Abstract

The invention discloses a malicious flow real-time blocking method based on a dynamic interaction flow graph and a space-time attention fusion mechanism, which comprises the following steps: acquiring a data packet of port host flow interaction, performing flow matching based on a flow matching rule, and updating an interaction flow set according to a matching result; according to the updating information of the interaction flow set, obtaining a dynamic interaction flow graph structure of each updated interaction flow; original features of the data packet are obtained, enhancement processing and dimension reduction processing are carried out, and a data packet feature vector is obtained; and a detection model based on a dynamic space-time attention fusion mechanism is constructed, whether the traffic is malicious traffic is judged by combining the data packet feature vector and the dynamic interaction flow graph structure, and real-time blocking is realized according to a judgment result. According to the method, the dynamic interaction flow graph is constructed, original data packet features are embedded into graph nodes after being processed, a dynamic space-time attention fusion model is constructed based on a path and node sensing mechanism, a graph structure is detected in real time, and real-time blocking can be achieved when malicious behaviors occur.

Description

Technical Field

[0001] The present invention belongs to the technical field of malicious encrypted traffic detection, and in particular relates to a real-time malicious traffic blocking method based on a dynamic interactive flow graph and a spatiotemporal attention fusion mechanism. Background Art

[0002] In the field of malicious encrypted traffic detection, existing feature extraction technologies are primarily based on two analytical dimensions: packet-level analysis and flow-level analysis. Packet-level detection involves extracting features from each packet. Existing techniques have proposed a packet-level malicious traffic pattern recognition framework, treating packet headers as sentences, with each two bytes considered a word. Word2Vec is used to construct a word vector representation of the packet header, and binary classification detection is performed based on an LSTM learning model. In flow-level detection, a flow is a collection of packets with identical or opposite quintuples. Existing methods for flow-level detection involve extracting the first two packets from each flow, each with a fixed length of 100 bytes, and then using a shallower CNN to construct a detection model. Furthermore, packet-level detection can construct a detection model by extracting statistical features of individual packets (such as packet length distribution and arrival time interval), while flow-level detection can construct a detection model based on temporal features of the flow (such as flow duration and total number of bytes). Current research is also underway to combine packet-level and flow-level features to construct deep learning detection models.

[0003] In recent years, detection methods based on graph neural networks have constructed graph neural network models (such as GNN, GCN, GAT, etc.) by structuring traffic feature graphs. Existing technologies capture the multi-dimensional features of client-server interactions by constructing traffic interaction graphs and building GNN-based classification models.

[0004] However, these methods generally have two technical limitations: first, existing graph construction methods require complete session data to generate effective features, which makes it impossible to implement a dynamic blocking mechanism for attacks; second, the interaction feature extraction of the traffic interaction graph is insufficient, and it is impossible to effectively implement dynamic feature extraction of traffic interaction patterns.

[0005] In response to the above technical limitations, the present invention proposes a new real-time blocking technology solution based on dynamic interaction flow graph and spatiotemporal attention fusion mechanism. Summary of the Invention

[0006] In order to solve the above technical problems, the present invention proposes a real-time blocking method for malicious traffic based on a dynamic interactive flow graph and a spatiotemporal attention fusion mechanism to solve the problems existing in the above-mentioned prior art.

[0007] To achieve the above objectives, the present invention provides a real-time malicious traffic blocking method based on a dynamic interactive flow graph and a spatiotemporal attention fusion mechanism, comprising:

[0008] Acquire data packets of port host traffic interaction in real time, perform flow matching on the data packets based on flow matching rules, and update the interaction flow set according to the matching results;

[0009] According to the updated information of the interaction flow set, a dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set is obtained;

[0010] Obtaining original features of the data packet and performing enhancement processing and dimensionality reduction processing to obtain a data packet feature vector;

[0011] A detection model based on a dynamic spatiotemporal attention fusion mechanism is constructed, and the data packet feature vector is combined with the dynamic interactive flow graph structure to determine whether it is malicious traffic, and real-time blocking is achieved based on the judgment results.

[0012] Optionally, the process of performing flow matching on the data packet based on a flow matching rule and updating the interactive flow set according to the matching result includes:

[0013] Determine whether the update time of each interactive flow in the interactive flow set exceeds the timeout threshold. If so, remove the corresponding interactive flow from the interactive flow set. If not, generate a candidate flow set for the newly arrived data packet. Determine whether there is a matching interactive flow in the interactive flow set. If so, update the interactive flow. If not, create a new interactive flow. The candidate flow set includes the original data packet mapping and the corresponding reverse data packet.

[0014] Optionally, if there is a match between the interactive flow in the interactive flow set and the candidate flow set, it is determined that there is a matching interactive flow, and the data packet direction identifier is given by comparing the source port information and destination port information in the new data packet quintuple with the source port information and destination port information of the first data packet in the matching interactive flow.

[0015] Optionally, the process of obtaining the dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set according to the updated information of the interaction flow set includes:

[0016] If the flow identifier of the interaction flow has not changed, a new node is added to the dynamic interaction flow graph and the internal edges and inter-edges are updated according to the grouping logic and edge definition; if the flow identifier of the interaction flow has changed, it is divided into multiple groups based on the direction attribute of the data packet, and continuous nodes are connected in timestamp order within the group to form internal edges. Inter-edges are established between adjacent groups according to the number of data packets, and finally the dynamic interaction flow graph structure is obtained.

[0017] Optionally, a Hamiltonian path of the dynamic interactive flow graph structure is obtained through a graph acquisition sequence algorithm to obtain a dynamic change sequence representing the graph structure.

[0018] Optionally, the process of obtaining a data packet feature vector includes: extracting the first m bytes of the data packet, constructing a matrix as a feature matrix and generating a corresponding grayscale image, performing three-time average pooling on the grayscale image in sequence to generate a multi-scale feature map, performing feature reorganization on the multi-scale feature map to obtain multi-channel features, fusing the multi-channel features into a single-channel weight map through a convolution operation, multiplying the single-channel weight map with the grayscale image element by element, and then performing dimensionality reduction through a lightweight encoder to obtain a data packet feature vector.

[0019] Optionally, the data packet feature vector and the dynamic interaction flow graph structure are input into a detection model based on a dynamic spatiotemporal attention fusion mechanism, and the data packet feature vector is directly embedded into the corresponding node of the dynamic interaction flow graph structure to obtain a graph node with features.

[0020] Optionally, the detection model adds position encoding and context encoding to the graph nodes with features based on the Hamiltonian path sequence of the dynamic interactive flow graph structure to generate path-aware features; identifies key nodes in the dynamic graph based on preset node in-degree and preset node out-degree and calculates their features to obtain key node features; uses a gating mechanism to fuse path features and key node features to obtain enhanced feature representation.

[0021] Optionally, the detection model obtains the temporal enhancement features and spatial aggregation features of the enhanced feature representation through the temporal attention mechanism and the spatial attention mechanism respectively, fuses the temporal enhancement features and the spatial aggregation features to obtain the spatiotemporal feature representation, and inputs the spatiotemporal feature representation into the classifier to obtain the probability of malicious traffic.

[0022] Compared with the prior art, the present invention has the following advantages and technical effects:

[0023] This method constructs a dynamic interactive flow graph from incoming data packets. It also uses feature enhancement and dimensionality reduction to process raw data packet features and embed them into graph nodes. Based on path and node perception, it builds a dynamic spatiotemporal attention fusion model to detect graph structures in real time, enabling real-time inspection of network traffic. When malicious behavior occurs, it issues real-time alerts and blocks interacting IP addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0025] Figure 1 The following is a usage background and flow chart of an embodiment of the present invention;

[0026] Figure 2 This is a flow chart of flow matching rules according to an embodiment of the present invention;

[0027] Figure 3 Schematic diagram of a data packet sequence according to an embodiment of the present invention;

[0028] Figure 4 This is a dynamic interaction flow diagram of an embodiment of the present invention;

[0029] Figure 5 Schematic diagram of the dynamic graph structure evolution process according to an embodiment of the present invention;

[0030] Figure 6 A schematic diagram of time series changes based on a dynamic graph according to an embodiment of the present invention;

[0031] Figure 7 is an example grayscale image of an embodiment of the present invention;

[0032] Figure 8 This is a flow chart of temporal attention calculation according to an embodiment of the present invention;

[0033] Figure 9 This is a detection flowchart based on a dynamic interaction flow graph and spatiotemporal attention fusion mechanism according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0035] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0036] Example 1

[0037] like Figure 1 As shown, this embodiment provides a real-time blocking method for malicious traffic based on a dynamic interaction flow graph and a spatiotemporal attention fusion mechanism, including:

[0038] S1. Capture the transmitted data packets in the switch port and use the obtained data packets to construct a data packet sequence set, denoted as {p1,p2,…,p m}, where m is the number of data packets in the data packet set.

[0039] S12. Parse the data packet to construct the interaction flow.

[0040] Extract the five-tuple of the data packet, and the data packet can be represented as:

[0041] <Source_IP,Destination_IP,Source_Port,Destination_Port,Protocol>

[0042] Construction of interactive flow set, an interactive flow is defined as a data packet composed of opposite or same five-tuples within a certain period of time. The interactive flow is defined as f, and the five-tuple (source address, source port, destination address, destination port, transport layer protocol) of the first data packet of the interactive flow is used as its flow index.

[0043] For each data packet, p i Indicates the i-th data packet, set the direction d for p i ∈{0,1},d i When it is 0, it is defined as the positive direction, and the direction of the first p (ie p1) is defined as the positive direction of the interaction flow, that is,

[0044] Set a recent active time T for each interaction flow f active , which is determined according to the timestamp Timestamp of the most recently arrived data packet in the interactive flow, T n is the most recently arrived data packet, i.e., p n timestamp.

[0045] T active =T n ;

[0046] At the same time, set the collection update time T update , the current time is T current .

[0047] T update =T current -T active ;

[0048] The construction of the interactive flow set depends on the sequence of data packets that have arrived before. The five-tuple of the data packet is extracted to construct the interactive flow set F.

[0049] F={f1,f2,f3,...,f n};

[0050] where f i represents the i-th interaction flow object, and a flow identifier Sign is set for it. The default identifier is 0, which means a unidirectional interaction flow, and 1 means a bidirectional interaction flow.

[0051] The parameters of data packet p are shown in Table 1:

[0052] Table 1

[0053]

[0054] The parameters of interaction flow object f are shown in Table 2:

[0055] Table 2

[0056]

[0057]

[0058] S2. Parse the arrived data packets and introduce a flow matching rule. The flow chart of the matching rule is as Figure 2 shown. When a data packet arrives and is mapped to p, first check T in each f in the interaction flow set F update . If it exceeds the timeout threshold θ, it is considered that the interaction flow has ended and is removed from the interaction flow set.

[0059]

[0060] Example: When the data packet p arrives, it is represented by <srcip: a, dstip: b, srcport: c, dstport: d, protocol: 6> and the mapping is completed;

[0061] Generate a candidate flow set C(P):

[0062] C(P) = {p, p -};

[0063] where p - represents the reverse data packet and is represented by <srcip: b, dstip: a, srcport: d, dstport: c, protocol: p>.

[0064] 1) Check the interaction flow set F. If there is a matching interaction flow f * satisfying:

[0065] p ∪ p - ∈ f * ;

[0066] Record the direction identifier of d. If d and f * in (f* If the direction is the same as the direction of the first data packet in , set it to positive direction, otherwise it is negative, as follows:

[0067]

[0068] Record f * of (Sign before update), add p to f * Update its T active and T update ;

[0069] Update(f*)if p∪p - ∈f * ;

[0070] Check the updated interaction flow f * Logo If f * If it is already 1 before the update, it will not be updated. If it is 0, the updated f * Whether it is a bidirectional interactive flow. If it is a bidirectional interactive flow, the flow identifier of the interactive flow is updated at the same time. The update logic is as follows:

[0071]

[0072] 2) If there is no matching interaction flow in the interaction flow set, a new interaction flow f is created * , and update the identifier of the interaction flow

[0073] f * ={p};

[0074]

[0075] For example, a data packet arrives, and the five-tuple of the data packet p is represented as:

[0076] (srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP>;

[0077] When a data packet arrives, the update time of all interactive flows in the interactive flow set is checked first, and the interactive flows that have timed out are removed. Based on the arriving data packet p, the candidate flow set is constructed as follows:

[0078]

[0079] Checks whether a matching interaction flow exists in the interaction flow collection.

[0080] (1) If the interactive flow is:

[0081] f = {p1, p2};

[0082] Where p1 is identified as:

[0083] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0084] p2 is identified as:

[0085] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0086] Then p matches the interaction flow, and the interaction flow was originally a two-way interaction flow and remains a two-way interaction flow after matching.

[0087] (2) If the interactive flow is:

[0088] f = {p1, p2};

[0089] Where p1 is identified as:

[0090] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0091] p2 is identified as:

[0092] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0093] Then p matches the interaction flow, and the interaction flow was originally a unidirectional interaction flow and remains a unidirectional interaction flow after matching.

[0094] (3) If the interactive flow is:

[0095] f = {p1, p2};

[0096] Where p1 is identified as:

[0097] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0098] p2 is identified as:

[0099] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0100] Then p matches the interaction flow, and the interaction flow was originally a unidirectional interaction flow, which is changed to a bidirectional interaction flow after matching.

[0101] (4) If there is no interactive flow matching in the interactive flow set, a new interactive flow is created. The interactive flow contains only data packet p, then:

[0102] f={p}.

[0103] S3. Dynamic interaction flow graph construction. Every time a data packet arrives in the interaction flow, after going through the above process, the interaction flow set information is updated.

[0104] S31. Build or update the graph structure for the updated interaction flow f*. If the updated interaction flow identifier From 0 to 1, it is the initial construction graph structure. If the updated interaction flow identifier From 1 to 1, the graph structure is updated.

[0105]

[0106] From the first creation of a new interactive flow, the interactive flow graph structure is synchronously constructed. If the flow identifier Sign of the interactive flow is not changed after a new data packet is added, the interactive flow is still updated. See S32 for details.

[0107] S32.Build interactive flow f * The flow of this interactive flow set is marked as bidirectional, and F * Divide into K groups, where a group is a sequence of data packets in the same direction within a certain period of time, denoted as b. This sequence can be one. Here, it should be distinguished from Burst (Burst is a series of continuous data packets transmitted in the same direction, and only one data packet is allowed in the sequence). The group set is represented as follows:

[0108] B=(b1,b1,...,b k );

[0109] Among them, each group b in the group set satisfies:

[0110] Isotropy:

[0111] Maximum continuity: adjacent b directions are different, that is, Where last(bk ) means b k The last data packet, first(b k+1 ) means b k+1 The first data packet.

[0112] Define graph nodes, each data packet is mapped to a graph node v i , the original feature vector (the original feature vector here will be explained in detail in S4) is mapped to a high-dimensional space through a fully connected layer:

[0113] x i =f θ (B' i )=σ(WB' i T +a);

[0114] where W∈R d×m , a∈R d , σ is the activation function.

[0115] Embed features into graph nodes.

[0116]

[0117] Construct a directed edge graph. The edge set E consists of two parts: group internal edges E intra and the inter-group edge E inter ;

[0118] E=E intra ∪E inter ;

[0119] Construct the internal edges of the group and connect them in the order of timestamps. k , if its length |b k |>1, then connect consecutive nodes:

[0120]

[0121] Construct the edge between groups, for adjacent groups b k and b k+1 If the adjacent groups have only one node, only one node from b is connected. k The last node to b k+1 The first node has a directed edge, otherwise, add a directed edge from b k The last node to b k+1 The directed edge between the last nodes:

[0122]

[0123] In summary, the graph structure can be expressed as:

[0124]

[0125] For example, there is a two-way interaction flow. The forward five-tuple is represented as <srcip: a, dstip: b, srcport: c, dstport: d, protocol: UDP>, and the reverse five-tuple is represented as <srcip: b, dstip: a, srcport: d, dstport: c, protocol: UDP>. Let the forward direction be 1 and the reverse direction be -1. The direction vectors in the sequence are [1, -1, -1, 1, 1, 1, -1]. The blue arrow represents the forward direction, the yellow arrow represents the reverse direction, the blue solid circle represents the forward direction data packet, and the yellow solid circle represents the reverse direction data packet. Figure 3 It is the data packet sequence at a certain moment. Figure 4 It is the dynamic interaction flow graph constructed according to this data packet sequence.

[0126] S33. Dynamic graph sequence;

[0127] A dynamic graph sequence can be constructed based on the time step when each packet arrives:

[0128]

[0129] t j represents the time step when the j-th data packet arrives. represents the dynamic graph structure corresponding to this time step. Based on the traffic detection scheme of this embodiment, the graph is reconstructed every time a data packet arrives in the interaction flow. As Figure 5 shown, starting from every time a data packet arrives, the evolution process of the dynamic graph structure is shown. For each time step when a data packet arrives, a dynamic graph is constructed.

[0130] S34. Graph acquisition sequence algorithm;

[0131] The dynamic interaction flow graph structure constructed based on the graph construction logic of S34 will always maintain a unique Hamiltonian path (passing through all the nodes in the graph and the path length is the number of nodes - 1). There is one and only one root node in this graph structure, and the in-degree and out-degree of the nodes are at most 2.

[0132] Here, the graph sequence algorithm is introduced to obtain the unique Hamiltonian path in each dynamic interaction flow graph. The input is the dynamic interaction flow graph The algorithm steps are as follows:

[0133] (1) Construct a global parameter CurrentLayer to identify the current layer, initially -1; set parameters for each node, three parameters, the node layer identifier Layer, initially 0; key node identifier Key, initially 0 (0 for ordinary nodes, 1 for incoming nodes, 2 for forked nodes); node visit identifier Visited, initially 0 (0 for not yet visited, 1 for visited).

[0134] (2) The point with in-degree 0 is used as the root node. Set the root node level to 0. Set up a queue Q and initially add the root node to the queue.

[0135] (3) The current queue Q is not empty:

[0136] CurrentLayer increments by 1, checks the parameters of the first node, and if its node visit flag Visited is 0, updates the key node flag Key. If the node has only in-degree 2, sets its key node flag Key to 1. If the node has only out-degree 2, sets its key node flag Key to 2. If its node visit flag Visited is 0, updates it to 1. The first node is dequeued, its child node is enqueued, and the node layer flag Layer of the child node is set to CurrentLayer.

[0137] (4) The current queue Q is empty:

[0138] Traverse each node and sort them in ascending order according to their node layer identifier Layer to obtain the sequence L that represents the dynamics of the data packet (that is, the sequence that represents the dynamic changes of the graph structure). Figure 6 This is a schematic diagram of the sequence changes obtained by the algorithm. The red arrows indicate the increasing relationship of the number of layers:

[0139] S4. Original feature extraction. Newly arrived data packets are immediately updated to the interaction flow and their original features are extracted. The specific extraction steps are as follows:

[0140] S41. Packet-level feature extraction. Extract the packet p in the interactive flow i The first m bytes of (satisfying m=n*n), fill with zeros if insufficient, and construct a matrix as its feature. The construction is as follows, where By i is the original bit vector.

[0141] By i =(by i1 ,by i2 ,....,by im );

[0142] The characteristic matrix constructed in this way is:

[0143]

[0144] Convert the bytes into corresponding values (0-255) and generate a grayscale image of size n*n according to the corresponding values i .

[0145] For example, assume that the byte stream of the data packet is as follows (only the first 9 bytes are given here):

[0146] [0xA6,0xD4,0xE2,0x9C,0x59,0x73,0xA6,0xA9,0xB2]

[0147] Convert to a matrix:

[0148]

[0149] Generate the corresponding grayscale image as Figure 7 shown.

[0150] S42. Image dimensionality reduction and feature enhancement. Use layered sampling and feature enhancement to highlight image features, and use a lightweight encoder to reduce the image dimensionality. The specific process is as follows:

[0151] (1) Input image I i ∈R n×n Perform three average pooling operations in sequence to generate a multi-scale feature map:

[0152] S i1 =AvgPool(I i )∈R n / 2×n / 2 ;

[0153] S i2 =AvgPool(S1)∈R n / 4×n / 4 ;

[0154] S i3 =AvgPool(S2)∈R n / 8×n / 8 ;

[0155] Feature reorganization, upsampling all scales to the original resolution and splicing them into multi-channel features F∈R n×n×4 ;

[0156] (2) Feature enhancement to highlight important areas:

[0157] Calculate the feature weight matrix A, A∈R n×n ;

[0158] A=Sigmoid(Conv 1×1 (F));

[0159] Conv 1×1 Convolution operation fuses multi-channel features into a single-channel weight map:

[0160]

[0161] Where W conv ∈R 4 is the convolution kernel weight, and the four channel features of each spatial position are weighted summed.

[0162] Feature Enhancement:

[0163] Multiply the weights by the original image element-wise:

[0164] I enhanced =I i ⊙(1+A)∈R n×n ;

[0165] (3) Lightweight encoder dimensionality reduction:

[0166] Image I enhanced Flattened to n 2 dimensional vector, through the sparse projection matrix Dimensionality reduction:

[0167]

[0168] x i That is the data packet p i The eigenvector of .

[0169] S5. Detection of spatiotemporal attention mechanism based on dynamic graphs.

[0170] A dynamic interaction flow graph is constructed in real time based on the time step of the data packet arrival. The structure in the graph is input into the detection model in the form of a graph matrix, and the nodes correspond to the characteristics of the data packet (this has been introduced in detail in S42 and will not be repeated here). In each interaction flow, each time a data packet arrives, the graph generated in the previous order is reconstructed. The reconstruction process has been explained in detail in S34. The detection flow chart is as follows Figure 9 As shown. The following is the model construction process:

[0171] In the current time step, the set of bidirectional interaction flows F is updated, and its graph structure representation is updated at the same time. f ={V,E}.

[0172] Based on the S35 algorithm, the node sequence L{v1,v2,...,v n};

[0173] Converted into critical path P = [v1, v2, ..., v n ];

[0174] The node feature is X={x v |v∈V};

[0175] S51. Path-aware coding;

[0176] Positional encoding:

[0177]

[0178] i represents the position of the node in the path, j is the feature dimension index, and d is the feature dimension;

[0179] For each node in the path, this embodiment considers the w nodes before and after it as context and calculates the local relationship between the node and its surrounding nodes.

[0180] Context coding C(v i ) is defined as:

[0181]

[0182] W c The context feature conversion matrix converts the original features into a form suitable for interacting with the central node;

[0183] Among them, the context attention weight α a Defined as:

[0184]

[0185] The path-aware feature is represented as Defined as:

[0186]

[0187] Idx(v) is the position of node v on path P.

[0188] S52. Key node perception;

[0189] The definition of key nodes is the nodes with in-degree 2 and out-degree 2 in the dynamic graph G. Its set K is:

[0190] K={v∈V key |d in (v)=2∨d out (v) = 2};

[0191] For d in (v) = 2 while d out Node v with (v)≠2 is defined as the sink point. The characteristics of the sink point Defined as:

[0192]

[0193] For d out (v) = 2 while d in(v)≠2, the node v is defined as the bifurcation point, the bifurcation point characteristics Defined as:

[0194]

[0195] Based on the node feature h of the key node v Defined as:

[0196]

[0197] || is the vector horizontal splicing operation.

[0198] Gating-based feature fusion feature mechanism:

[0199]

[0200] Calculate the fusion weight g of path features and key node features v , σ is the sigmoid function.

[0201] S53. Temporal attention mechanism, the temporal attention calculation process is as follows Figure 8 As shown;

[0202] Given the current fusion feature and historical fusion characteristics Its temporal attention is calculated as follows:

[0203] For the current path P t For each node v in:

[0204]

[0205] in is the fusion feature of node v at time step tj, that is Attention weight normalization:

[0206]

[0207] Aggregation based on historical status:

[0208]

[0209] Time Enhancement Features:

[0210]

[0211] S54. Spatial Attention Mechanism

[0212]

[0213] Among them, the time decay term exp(-τΔt i,j), τ is the learnable decay rate parameter, Δt i,j =t i -t j is the time difference, is the input feature vector of node i; is the input feature vector of node j.

[0214] Use softmax to compare neighbor nodes j∈N i (N i The attention coefficients of node j (i) are normalized so that the normalized weights reflect the relative importance of node j to i.

[0215]

[0216] Spatial feature aggregation:

[0217]

[0218] S55 spatiotemporal feature aggregation and classification;

[0219] Aggregate spatial and temporal features:

[0220]

[0221] Generate full image features:

[0222]

[0223] Real-time classification layer:

[0224]

[0225] The parameters are determined during the training process, and the loss function in the classification task is as follows:

[0226] Loss=-y true logy-(1-y true )log(1-y);

[0227] y true ∈{0,1}: true label (0 for normal, 1 for malicious);

[0228] y∈[0, 1]: The probability of malicious traffic output by the model in real time.

[0229] The above are merely preferred embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A real-time malicious traffic blocking method based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism, characterized by: The following steps are involved: Acquire data packets of port host traffic interaction in real time, perform flow matching on the data packets based on flow matching rules, and update the interaction flow set according to the matching results; According to the updated information of the interaction flow set, a dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set is obtained; Obtaining original features of the data packet and performing enhancement processing and dimensionality reduction processing to obtain a data packet feature vector; A detection model based on a dynamic spatiotemporal attention fusion mechanism is constructed, and the data packet feature vector is combined with the dynamic interactive flow graph structure to determine whether it is malicious traffic, and real-time blocking is achieved based on the judgment results.

2. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1 is characterized in that: The process of performing flow matching on the data packet based on the flow matching rule and updating the interactive flow set according to the matching result includes: Determine whether the update time of each interactive flow in the interactive flow set exceeds the timeout threshold. If so, remove the corresponding interactive flow from the interactive flow set. If not, generate a candidate flow set for the newly arrived data packet. Determine whether there is a matching interactive flow in the interactive flow set. If so, update the interactive flow. If not, create a new interactive flow. The candidate flow set includes the original data packet mapping and the corresponding reverse data packet.

3. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 2 is characterized in that: If there is a match between the interactive flow in the interactive flow set and the candidate flow set, it is determined that there is a matching interactive flow, and the packet direction identifier is given by comparing the source port information and destination port information in the new packet quintuple with the source port information and destination port information of the first packet in the matching interactive flow.

4. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1 is characterized in that: According to the updated information of the interaction flow set, the process of obtaining the dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set includes: If the flow identifier of the interaction flow has not changed, a new node is added to the dynamic interaction flow graph and the internal edges and inter-edges are updated according to the grouping logic and edge definition; if the flow identifier of the interaction flow has changed, it is divided into multiple groups based on the direction attribute of the data packet, and continuous nodes are connected in timestamp order within the group to form internal edges. Inter-edges are established between adjacent groups according to the number of data packets, and finally the dynamic interaction flow graph structure is obtained.

5. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 4 is characterized in that: The Hamiltonian path of the dynamic interactive flow graph structure is obtained through a graph acquisition sequence algorithm to obtain a dynamic change sequence representing the graph structure.

6. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1 is characterized in that: The process of obtaining a data packet feature vector includes: extracting the first m bytes of the data packet, constructing a matrix as a feature matrix and generating a corresponding grayscale image, performing three-time average pooling on the grayscale image in sequence to generate a multi-scale feature map, performing feature reorganization on the multi-scale feature map to obtain multi-channel features, fusing the multi-channel features into a single-channel weight map through a convolution operation, multiplying the single-channel weight map by the grayscale image element by element, and then performing dimensionality reduction through a lightweight encoder to obtain a data packet feature vector.

7. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1 is characterized in that: The data packet feature vector and the dynamic interaction flow graph structure are input into a detection model based on a dynamic spatiotemporal attention fusion mechanism, and the data packet feature vector is directly embedded into the corresponding node of the dynamic interaction flow graph structure to obtain a graph node with features.

8. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 7 is characterized in that: The detection model is based on the Hamiltonian path sequence of the dynamic interactive flow graph structure, adds position encoding and context encoding to the graph nodes with features to generate path-aware features; identifies key nodes in the dynamic graph based on preset node in-degree and preset node out-degree and calculates their features to obtain key node features; uses a gating mechanism to fuse path features and key node features to obtain enhanced feature representation.

9. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 8 is characterized in that: The detection model obtains the temporal enhancement features and spatial aggregation features of the enhanced feature representation through the temporal attention mechanism and the spatial attention mechanism respectively, fuses the temporal enhancement features and the spatial aggregation features to obtain the spatiotemporal feature representation, and inputs the spatiotemporal feature representation into the classifier to obtain the probability of malicious traffic.

Images