A Real-Time Malicious Traffic Blocking Method Based on Dynamic Interactive Flow Graph and Spatiotemporal Attention Fusion Mechanism

Abstract

This invention discloses a real-time blocking method for malicious traffic based on a dynamic interactive flow graph and a spatiotemporal attention fusion mechanism. The method includes: acquiring data packets from port host traffic interactions and performing flow matching based on flow matching rules; updating the interactive flow set according to the matching results; obtaining the updated dynamic interactive flow graph structure for each interactive flow based on the updated information of the interactive flow set; acquiring the original features of the data packets and performing enhancement and dimensionality reduction processing to obtain data packet feature vectors; constructing a detection model based on a dynamic spatiotemporal attention fusion mechanism; combining the data packet feature vectors with the dynamic interactive flow graph structure to determine whether the traffic is malicious; and achieving real-time blocking based on the determination result. This invention constructs a dynamic interactive flow graph and embeds the processed features of the original data packets into graph nodes. It also constructs a dynamic spatiotemporal attention fusion model based on path and node awareness mechanisms to detect the graph structure in real time, enabling real-time blocking when malicious behavior occurs.

Description

Technical Field

[0001] This invention belongs to the field of malicious encrypted traffic detection technology, and in particular relates to a real-time blocking method for malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism. Background Technology

[0002] In the field of malicious encrypted traffic detection, existing original feature extraction techniques are mainly based on two analytical dimensions: packet-level analysis and flow-level analysis. Packet-level analysis extracts features from each packet. Existing technologies propose malicious traffic sample identification frameworks at the packet level, treating packet header information as sentences, with each two bytes considered a word. Word2Vec is used to construct word vector representations of the packet headers, and an LSTM-based learning model is used for binary classification detection. In flow-level analysis, a flow is a set of packets with identical or opposite quintuples. For flow-level detection, existing methods involve extracting the first two packets from each flow, with each packet having a fixed length of 100 bytes, and then using a shallow CNN to construct the detection model. Furthermore, packet-level analysis can also construct detection models by extracting statistical features of individual packets (such as packet length distribution and arrival time intervals), while flow-level analysis can construct detection models using the temporal features of the flow (such as flow duration and total bytes). Current research also includes combining packet-level and flow-level features to construct deep learning detection models.

[0003] In recent years, detection methods based on graph neural networks have constructed graph neural network models (such as GNN, GCN, GAT, etc.) by structuring traffic feature graphs. Existing technologies capture multi-dimensional features in client-server interactions by constructing a traffic interaction graph, and build a classification model based on GNN.

[0004] However, these methods generally have two technical limitations: first, existing graph construction methods require complete session data to generate effective features, making it impossible to implement a dynamic blocking mechanism against attacks; second, the extraction of interaction features from traffic interaction graphs is insufficient, making it impossible to effectively extract dynamic features of traffic interaction patterns.

[0005] To address the above technical limitations, this invention proposes a new real-time blocking technology based on dynamic interactive flow graphs and spatiotemporal attention fusion mechanisms. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention proposes a real-time blocking method for malicious traffic based on a dynamic interactive flow graph and a spatiotemporal attention fusion mechanism, thereby resolving the issues present in the prior art.

[0007] To achieve the above objectives, this invention provides a method for real-time blocking of malicious traffic based on a dynamic interactive flow graph and spatiotemporal attention fusion mechanism, comprising:

[0008] Real-time acquisition of data packets from port host traffic interactions; flow matching of the data packets based on flow matching rules; and updating of the interaction flow set based on the matching results.

[0009] Based on the update information of the interaction flow set, obtain the dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set;

[0010] The original features of the data packet are obtained and enhanced and reduced in dimensionality to obtain the data packet feature vector;

[0011] A detection model based on a dynamic spatiotemporal attention fusion mechanism is constructed. The model combines the data packet feature vector with the dynamic interactive flow graph structure to determine whether the traffic is malicious. Real-time blocking is achieved based on the determination result.

[0012] Optionally, the process of performing flow matching on the data packets based on flow matching rules and updating the interaction flow set according to the matching results includes:

[0013] Determine whether the update time of each interaction stream in the interaction stream set exceeds the timeout threshold. If it does, remove the corresponding interaction stream from the interaction stream set. If it does not exceed the timeout threshold, generate a candidate stream set for the newly arrived data packets. Determine whether there is a matching interaction stream in the interaction stream set. If there is, update the interaction stream. If not, create a new interaction stream. The candidate stream set includes the original data packet mapping and the corresponding reverse data packet.

[0014] Optionally, if there is a match between the interaction stream in the interaction stream set and the candidate stream set, it is determined that there is a matching interaction stream. The data packet direction identifier is given by comparing the source port information and destination port information in the five-tuple of the new data packet with the source port information and destination port information of the first data packet in the matching interaction stream.

[0015] Optionally, the process of obtaining the dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set based on the update information of the interaction flow set includes:

[0016] If the flow identifier of the interactive flow does not change, a new node is added to the dynamic interactive flow graph and the internal edges and inter-edges are updated according to the grouping logic and edge definition. If the flow identifier of the interactive flow changes, it is divided into multiple groups based on the direction attribute of the data packets. Within each group, consecutive nodes are connected in the order of timestamps to form internal edges. Inter-edges are established between adjacent groups according to the number of data packets, and finally the dynamic interactive flow graph structure is obtained.

[0017] Optionally, the Hamiltonian path of the dynamic interactive flow graph structure can be obtained through a graph acquisition sequence algorithm to obtain a dynamic change sequence representing the graph structure.

[0018] Optionally, the process of obtaining the data packet feature vector includes: extracting the first m bytes of the data packet, constructing a matrix as the feature matrix and generating a corresponding grayscale image, performing three average pooling operations on the grayscale image to generate a multi-scale feature map, performing feature recombination on the multi-scale feature map to obtain multi-channel features, fusing the multi-channel features into a single-channel weight map through convolution operations, multiplying the single-channel weight map element by element with the grayscale image, and then performing dimensionality reduction through a lightweight encoder to obtain the data packet feature vector.

[0019] Optionally, the data packet feature vector and the dynamic interactive flow graph structure are input into a detection model based on a dynamic spatiotemporal attention fusion mechanism, and the data packet feature vector is directly embedded into the corresponding node of the dynamic interactive flow graph structure to obtain a graph node with features.

[0020] Optionally, the detection model is based on the Hamiltonian path sequence of the dynamic interactive flow graph structure. Position encoding and context encoding are added to the graph nodes with features to generate path-aware features. Key nodes in the dynamic graph are identified based on preset node in-degree and preset node out-degree and their features are calculated to obtain key node features. The path features and key node features are fused using a gating mechanism to obtain enhanced feature representation.

[0021] Optionally, the detection model obtains temporal enhanced features and spatial aggregated features of the enhanced feature representation through temporal attention mechanism and spatial attention mechanism, respectively. The temporal enhanced features and the spatial aggregated features are fused to obtain a spatiotemporal feature representation. The spatiotemporal feature representation is then input into a classifier to obtain the probability of malicious traffic.

[0022] Compared with the prior art, the present invention has the following advantages and technical effects:

[0023] This invention constructs a dynamic interactive flow graph from real-time arriving data packets. Simultaneously, it employs feature enhancement and dimensionality reduction schemes to embed features of the original data packets into graph nodes. Based on path and node awareness mechanisms, it constructs a dynamic spatiotemporal attention fusion model to detect graph structure in real time, enabling real-time inspection of network traffic. In the event of malicious behavior, it issues real-time alerts and blocks interacting IPs. Attached Figure Description

[0024] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 This is a flowchart illustrating the usage background of an embodiment of the present invention;

[0026] Figure 2 This is a flowchart of the flow matching rules according to an embodiment of the present invention;

[0027] Figure 3 This is a schematic diagram of a data packet sequence according to an embodiment of the present invention;

[0028] Figure 4 This is a dynamic interactive flow diagram of an embodiment of the present invention;

[0029] Figure 5 This is a schematic diagram of the dynamic graph structure evolution process according to an embodiment of the present invention;

[0030] Figure 6 This is a schematic diagram of time series changes based on a dynamic graph, according to an embodiment of the present invention.

[0031] Figure 7 This is an example grayscale image of an embodiment of the present invention;

[0032] Figure 8 This is a flowchart of the time attention calculation according to an embodiment of the present invention;

[0033] Figure 9 This is a flowchart illustrating the detection process based on a dynamic interactive flow graph and spatiotemporal attention fusion mechanism, according to an embodiment of the present invention. Detailed Implementation

[0034] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0035] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0036] Example 1

[0037] like Figure 1 As shown, this embodiment provides a method for real-time blocking of malicious traffic based on a dynamic interactive flow graph and spatiotemporal attention fusion mechanism, including:

[0038] S1. Capture transmitted data packets within the switch port and use the acquired data packets to construct a set of data packet sequences, denoted as {p1, p2, ..., p...}. m}, where m is the number of data packets in the data packet set.

[0039] S12. Parse the data packets to construct the interactive stream.

[0040] Extracting the quintuple from the data packet allows us to represent the data packet as follows:

[0041] <Source_IP,Destination_IP,Source_Port,Destination_Port,Protocol>

[0042] The construction of an interactive stream set is defined as follows: an interactive stream is a data packet consisting of opposite or identical 5-tuples within a certain period of time. The interactive stream is defined as f, and its stream index is the 5-tuple (source address, source port, destination address, destination port, transport layer protocol) of the first data packet of the interactive stream.

[0043] For each data packet, p i This represents the i-th data packet, where p is set to direction d. i ∈{0,1},d i When the value is 0, it is defined as the positive direction. The direction of the first p (i.e., p1) is defined as the positive direction of the interactive flow.

[0044] Set a recent active time T for each interactive flow f active It is determined based on the timestamp of the most recently arrived data packet in the interaction stream, T. n The most recently arrived data packet, i.e., p n Timestamp.

[0045] T active =T n ;

[0046] Simultaneously set the collection update time T. update The current time is T current .

[0047] T update =T current -T active ;

[0048] The construction of the interaction stream set depends on the sequence of previously arrived data packets. The interaction stream set F is constructed by extracting the quintuples of the data packets.

[0049] F = {f1, f2, f3, ..., f n};

[0050] where f i represents the i-th interaction flow object, and a flow identifier Sign is set for it. The default identifier is 0, which means a unidirectional interaction flow, and 1 means a bidirectional interaction flow.

[0051] The parameters of data packet p are shown in Table 1:

[0052] Table 1

[0053]

[0054] The parameters of interaction flow object f are shown in Table 2:

[0055] Table 2 <​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​* If the direction of the first data packet is consistent with the direction of the first data packet, then set it to positive; otherwise, set it to negative, as follows:

[0067]

[0068] Record f * of (Sign before update) Add p to f * Update its T active and T update ;

[0069] Update(f*)if p∪p - ∈f * ;

[0070] Check the updated interaction flow f * logo If f * If the value before the update is already 1, then no update is performed; if the value is 0, then the updated value of f is checked. * If it is a two-way interactive stream, then update the stream identifier of the interactive stream simultaneously. The update logic is as follows:

[0071]

[0072] 2) If no matching interaction flow exists in the set of interaction flows, then create a new interaction flow f. * At the same time, update the identifier of the interaction stream.

[0073] f * ={p};

[0074]

[0075] For example, when a data packet arrives, the 5-tuple representation of data packet p is:

[0076] (srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP>;

[0077] When a data packet arrives, the update time of all interactive flows in the interactive flow set is checked first, and interactive flows that have timed out are removed. Based on the arriving data packet p, a candidate flow set is constructed as follows:

[0078]

[0079] Check if a matching interaction flow exists in the interaction flow set.

[0080] (1) If there is an interactive flow:

[0081] f = {p1, p2};

[0082] Where p1 is identified as:

[0083] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0084] p2 is identified as:

[0085] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0086] If p matches the interaction stream, and the interaction stream was originally a bidirectional interaction stream, it will remain a bidirectional interaction stream after the match.

[0087] (2) If there is an interactive flow:

[0088] f = {p1, p2};

[0089] Where p1 is identified as:

[0090] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0091] p2 is identified as:

[0092] <srcip:120.53.53.53,dstip:10.21.10.198,srcport:54323,dstport:20,protocol:TCP> ;

[0093] If p matches the interaction flow, and the interaction flow was originally a one-way interaction flow, it will remain a one-way interaction flow after matching.

[0094] (3) If there is an interactive flow:

[0095] f = {p1, p2};

[0096] Where p1 is identified as:

[0097] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0098] p2 is identified as:

[0099] <srcip:10.21.10.198,dstip:120.53.53.53,srcport:20,dstport:54323,protocol:TCP> ;

[0100] Then p matches the interaction flow, and the interaction flow was originally a one-way interaction flow, but after matching, it is changed to a two-way interaction flow.

[0101] (4) If there is no matching interactive flow in the set of interactive flows, then a new interactive flow is created. If the interactive flow contains only data packet p, then:

[0102] f = {p}.

[0103] S3. Dynamic Interaction Flow Graph Construction. Each time an interaction flow arrives at a data packet, the interaction flow set information is updated after the above process.

[0104] S31. Build or update the graph structure for the updated interaction flow f*. If the updated interaction flow identifier... The sequence number from 0 to 1 represents its initial construction graph structure, and if the updated interaction flow identifier... If the value changes from 1 to 1, then the graph structure is updated.

[0105]

[0106] From the moment a new interactive flow is created, its graph structure is constructed synchronously. If the flow identifier (Sign) of the interactive flow is not changed after a new data packet is added, the interactive flow is still updated. This is explained in detail in S32.

[0107] S32. Constructing the interactive flow f * The graph structure. The flow identifier of this interactive flow set is bidirectional, and F is assigned according to the direction. * The data is divided into K groups. Each group is a sequence of data packets traveling in the same direction within a certain time period, denoted as b. This sequence can consist of only one data packet. Note the distinction between this and a Burst (a Burst is a series of consecutive data packets transmitted in the same direction, and a sequence cannot contain only one data packet). The group set is represented as follows:

[0108] B = (b1, b1, ..., b k );

[0109] Wherein, each group b in the group set satisfies:

[0110] Same direction:

[0111] Maximum continuity: adjacent b directions are different, that is, Where last(b)k ) represents b k The last data packet, first(b k+1 ) represents b k+1 The first data packet.

[0112] Define graph nodes, where each data packet is mapped to a graph node v. i The original feature vector (which will be discussed in detail in S4) is mapped to a high-dimensional space through a fully connected layer:

[0113] x i =f θ (B' i )=σ(WB' i T +a);

[0114] Where W∈R d×m , a∈R d σ is the activation function.

[0115] Embed features into graph nodes.

[0116]

[0117] Construct a directed edge graph, where the edge set E consists of two parts: the internal edges of the group E. intra and the edge between groups E inter ;

[0118] E = E intra ∪E inter ;

[0119] Construct the internal edges of each group, connecting them in timestamp order. For each group b... k If its length |b k If |>1, then connect consecutive nodes:

[0120]

[0121] Construct edges between groups, for adjacent groups b k and b k+1 If adjacent groups each have only one node, then only one connection is made from b. k The last node to b k+1 The first node has a directed edge; otherwise, add a directed edge from node b. k The last node to b k+1 Directed edges between the last nodes:

[0122]

[0123] In summary, the graph structure can be represented as:

[0124]

[0125] For example, there is a bidirectional interaction flow, where the forward five-tuple is represented as <srcip: a, dstip: b, srcport: c, dstport: d, protocol: UDP>, and the reverse five-tuple is represented as <srcip: b, dstip: a, srcport: d, dstport: c, protocol: UDP>. Let the forward direction be 1 and the reverse direction be -1. The direction vector in the sequence is [1, -1, -1, 1, 1, 1, -1]. The forward direction is represented by a blue arrow, the reverse direction is represented by a yellow arrow, the blue solid circle represents the forward direction data packet, and the yellow solid circle represents the reverse direction data packet. Figure 3 It is the data packet sequence at a certain moment. Figure 4 It is the dynamic interaction flow graph constructed according to this data packet sequence.

[0126] S33. Dynamic graph sequence;

[0127] A dynamic graph sequence can be constructed based on the time step when each packet arrives:

[0128]

[0129] t j represents the time step when the jth data packet arrives. represents the dynamic graph structure corresponding to this time step. Based on the traffic detection scheme of this embodiment, the graph is reconstructed every time a data packet arrives in the interaction flow. As Figure 5 shown, starting from every time a data packet arrives, the evolution process of the dynamic graph structure is shown. For each time step when a data packet arrives, a dynamic graph is constructed.

[0130] S34. Graph acquisition sequence algorithm;

[0131] The dynamic interaction flow graph structure constructed based on the graph construction logic of S34 will always maintain a unique Hamiltonian path (passing through all the nodes in the graph and the path length is the number of nodes - 1). There is one and only one root node in this graph structure, and the in-degree and out-degree of the nodes are at most 2.

[0132] Here, the graph sequence algorithm is introduced to obtain the unique Hamiltonian path in each dynamic interaction flow graph. The input is the dynamic interaction flow graph The algorithm steps are as follows: ​(1) Construct a global parameter CurrentLayer to identify the current layer number, initially set to -1; set parameters for each node, there are three parameters: node layer number identifier Layer, initially set to 0; key node identifier Key, initially set to 0 (0 represents a normal node, 1 represents a merging node, 2 represents a fork node); node access identifier Visited, initially set to 0 (0 represents not yet visited, 1 represents visited).

[0134] (2) The node with an in-degree of 0 is designated as the root node. The root node's level is set to 0. A queue Q is set up, and the root node is initially added to the queue.

[0135] (3) The current queue Q is not empty:

[0136] The `CurrentLayer` is incremented by 1. The parameters of the head node are checked. If its `Visited` attribute is 0, the `Key` attribute is updated. If the node has only an in-degree of 2, its `Key` attribute is set to 1. If the node has only an out-degree of 2, its `Key` attribute is set to 2. If the `Visited` attribute is 0, it is updated to 1. The head node is dequeued, and its child nodes are enqueued. The child nodes' layer identifier `Layer` is set to `CurrentLayer`.

[0137] (4) The current queue Q is empty:

[0138] Traverse each node and sort it in ascending order according to its node layer identifier (Layer) to obtain a sequence L representing the dynamics of the data packets (i.e., a sequence representing the dynamic changes of the graph structure). Figure 6 This is a schematic diagram of the sequence changes obtained according to the algorithm. The red arrows indicate the increasing relationship of the layer number:

[0139] S4. Raw Feature Extraction. For newly arriving data packets, the interaction stream is updated immediately, and their raw features are extracted. The specific extraction steps are as follows:

[0140] S41. Packet-level feature extraction. Extracting data packets p from the interactive stream. i The first m bytes (satisfying m = n*n), padded with zeros if necessary, are used to construct a matrix as its feature. The construction is as follows, where By... i This is the original bit vector.

[0141] By i =(by i1 by i2 ,....,by im );

[0142] The characteristic matrix thus constructed is:

[0143]

[0144] Convert the bytes into corresponding numerical values ​​(0-255), and generate an n*n grayscale image I based on the numerical values. i .

[0145] For example, suppose the byte stream of the data packet is as follows (only the first 9 bytes are shown here):

[0146] [0xA6,0xD4,0xE2,0x9C,0x59,0x73,0xA6,0xA9,0xB2]

[0147] Convert to a matrix:

[0148]

[0149] Generate the corresponding grayscale image as follows Figure 7 As shown.

[0150] S42. Image Dimensionality Reduction and Feature Enhancement. Hierarchical sampling and feature enhancement are used to highlight image features, and a lightweight encoder is used to perform dimensionality reduction. The specific process is as follows:

[0151] (1) Input image I i ∈R n×n Perform three consecutive average pooling operations to generate multi-scale feature maps:

[0152] S i1 =AvgPool(I i )∈R n / 2×n / 2 ;

[0153] S i2 =AvgPool(S1)∈R n / 4×n / 4 ;

[0154] S i3 =AvgPool(S2)∈R n / 8×n / 8 ;

[0155] Feature recombination involves upsampling all scales to the original resolution and concatenating them into multi-channel features F∈R. n×n×4 ;

[0156] (2) Feature enhancement highlights important areas:

[0157] Calculate the feature weight matrix A, A∈R n×n ;

[0158] A = Sigmoid(Conv) 1×1 (F));

[0159] Conv 1×1 Convolution operations fuse multi-channel features into a single-channel weight map:

[0160]

[0161] Among them W conv ∈R 4 The weights are used to sum the features of the four channels at each spatial location.

[0162] Feature enhancement:

[0163] Multiply the weights element-wise with the original image:

[0164] I enhanced =I i ⊙(1+A)∈R n×n ;

[0165] (3) Lightweight encoder dimensionality reduction:

[0166] Image I enhanced Flattened to n 2 A dimensional vector, through a sparse projection matrix Dimensional reduction:

[0167]

[0168] x i That is, the data packet p i eigenvectors.

[0169] S5. Detection of spatiotemporal attention mechanism based on dynamic graph.

[0170] A dynamic interaction flow graph is constructed in real time based on the arrival time step of data packets. The structure in the graph is input into the detection model in the form of a graph matrix, and the nodes correspond to the features of the data packets (described in detail in S42, and will not be repeated here). In each interaction flow, the previously generated graph is reconstructed for each arriving data packet. The reconstruction process is explained in detail in S34. The detection flowchart is as follows: Figure 9 As shown. The following is the model construction process:

[0171] In the current time step, the bidirectional interaction flow set F is updated, and its graph structure representation is also updated. This results in graph G. f ={V,E}.

[0172] The node sequence L{v1,v2,...,v...} in the dynamic graph is obtained based on the S35 algorithm. n};

[0173] Transform into the critical path P = [v1, v2, ..., v n ];

[0174] The node features are X = {x} v |v∈V};

[0175] S51. Path-aware coding;

[0176] Location coding:

[0177]

[0178] i represents the position of the node in the path, j is the feature dimension index, and d is the feature dimension;

[0179] For each node in the path, this embodiment considers its preceding and following w nodes as context. The local relationships between the node and its surrounding nodes are calculated.

[0180] Context encoding C(v) i ) is defined as:

[0181]

[0182] W c The context feature transformation matrix transforms the original features into a form suitable for interaction with the central node.

[0183] Wherein, the context attention weight α a Defined as:

[0184]

[0185] Path-aware features are represented as Defined as:

[0186]

[0187] Idx(v) is the position of node v on path P.

[0188] S52. Critical Node Perception;

[0189] A critical node is defined as a node in a dynamic graph G with an in-degree of 2 and an out-degree of 2. Its set K is:

[0190] K = {v∈V} key |d in (v)=2∨d out (v)=2};

[0191] For d in (v) = 2 Simultaneously d out A node v whose (v) ≠ 2 is defined as a sink point. The characteristics of a sink point are... Defined as:

[0192]

[0193] For d out (v) = 2 Simultaneously d inA node v whose (v) ≠ 2 is defined as a bifurcation point. The characteristics of a bifurcation point are... Defined as:

[0194]

[0195] Therefore, based on the node characteristics h of the key nodes v Defined as:

[0196]

[0197] || represents the horizontal concatenation operation of vectors.

[0198] Gated feature fusion mechanism:

[0199]

[0200] Calculate the fusion weight g of path features and key node features. v σ is the sigmoid function.

[0201] S53. Temporal attention mechanism, the calculation process of temporal attention is as follows: Figure 8 As shown;

[0202] Given the current fusion features Features of integration with history Its time attention is calculated as follows:

[0203] For the current path P t Each node v in:

[0204]

[0205] in It is the fusion feature of node v at time step tj, that is Attention weight normalization:

[0206]

[0207] Aggregation based on historical states:

[0208]

[0209] Temporal augmentation features:

[0210]

[0211] S54. Spatial Attention Mechanism

[0212]

[0213] Among them, the time decay term exp(-τΔt) i,j), where τ is the learnable decay rate parameter, Δt i,j =t i -t j This is the time difference. Let i be the input feature vector of node i; Let be the input feature vector of node j.

[0214] Use softmax to evaluate neighbor nodes j∈N i (N i The attention coefficients of the set of neighboring nodes of i are normalized so that the normalized weights reflect the relative importance of node j to i.

[0215]

[0216] Spatial feature aggregation:

[0217]

[0218] S55 Spatiotemporal Feature Aggregation and Classification;

[0219] Aggregate spatial and temporal features:

[0220]

[0221] Generate full-image features:

[0222]

[0223] Real-time classification layer:

[0224]

[0225] The parameters are determined during training. The loss function for the classification task is as follows:

[0226] Loss = -y true logy-(1-y true log(1-y);

[0227] y true ∈{0,1}: True label (0 for normal, 1 for malicious);

[0228] y∈[0,1]: The probability of malicious traffic output by the model in real time.

[0229] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for real-time blocking of malicious traffic based on a dynamic interactive flow graph and spatiotemporal attention fusion mechanism, characterized in that, Includes the following steps: Real-time acquisition of data packets from port host traffic interactions; flow matching of the data packets based on flow matching rules; and updating of the interaction flow set based on the matching results. Based on the updated information of the interaction flow set, the dynamic interaction flow graph structure of each interaction flow in the updated interaction flow set is obtained. The process includes: If the flow identifier of the interactive flow remains unchanged, a new node is added to the dynamic interactive flow graph, and the internal edges and inter-edges are updated according to the grouping logic and edge definition. If the flow identifier of the interactive flow changes, it is divided into multiple groups based on the direction attribute of the data packets. Within each group, consecutive nodes are connected in timestamp order to form internal edges, and inter-edges are established between adjacent groups according to the number of data packets, thus obtaining the dynamic interactive flow graph structure. The flow identifier is used to identify the directional characteristics of the interactive flow. The original features of the data packet are obtained and enhanced and reduced in dimensionality to obtain the data packet feature vector; The data packet feature vector and the dynamic interactive flow graph structure are input into the detection model based on the dynamic spatiotemporal attention fusion mechanism. The data packet feature vector is directly embedded into the corresponding node of the dynamic interactive flow graph structure to obtain a graph node with features. The detection model is based on Hamiltonian path sequences of a dynamic interactive flow graph structure. It adds positional and contextual encoding to graph nodes with features to generate path-aware features. It identifies key nodes in the dynamic graph based on preset node in-degree and preset node out-degree and calculates their features to obtain key node features. It uses a gating mechanism to fuse path features and key node features to obtain enhanced feature representation. The detection model obtains temporal enhanced features and spatial aggregated features through temporal attention mechanism and spatial attention mechanism, respectively. The temporal enhanced features and spatial aggregated features are fused to obtain spatiotemporal feature representation. The spatiotemporal feature representation is input into the classifier to obtain the probability of malicious traffic. Real-time blocking is achieved based on the judgment result.

2. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1, characterized in that, The process of performing flow matching on the data packets based on flow matching rules and updating the interaction flow set according to the matching results includes: Determine whether the update time of each interaction stream in the interaction stream set exceeds the timeout threshold. If it does, remove the corresponding interaction stream from the interaction stream set. If it does not exceed the timeout threshold, generate a candidate stream set for the newly arrived data packets. Determine whether there is a matching interaction stream in the interaction stream set. If there is, update the interaction stream. If not, create a new interaction stream. The candidate stream set includes the original data packet mapping and the corresponding reverse data packet.

3. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 2, characterized in that, If there is a match between the interaction flow in the interaction flow set and the candidate flow set, it is determined that there is a matching interaction flow. The direction identifier of the data packet is given by comparing the source port information and destination port information in the five-tuple of the new data packet with the source port information and destination port information of the first data packet in the matching interaction flow.

4. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1, characterized in that, The Hamiltonian path of the dynamic interactive flow graph structure is obtained by using a graph acquisition sequence algorithm, thereby obtaining a dynamic change sequence representing the graph structure.

5. The method for real-time blocking of malicious traffic based on dynamic interactive flow graph and spatiotemporal attention fusion mechanism according to claim 1, characterized in that, The process of obtaining the data packet feature vector includes: extracting the first m bytes of the data packet, constructing a matrix as the feature matrix and generating a corresponding grayscale image, performing three average pooling operations on the grayscale image to generate a multi-scale feature map, recombining the features of the multi-scale feature map to obtain multi-channel features, fusing the multi-channel features into a single-channel weight map through convolution operations, multiplying the single-channel weight map element by element with the grayscale image, and then performing dimensionality reduction through a lightweight encoder to obtain the data packet feature vector.

Images