Encryption network flow detection method, device and program product based on improved multiple graphs

Abstract

The application provides an improved multi-graph-based encrypted network flow detection method, device and program product, which comprises the following steps: splitting the encrypted network flow to be detected into at least one bidirectional network flow; extracting the network flow features in each bidirectional network flow information to construct a multi-graph comprising at least one node pair; each node is constructed by a connection information feature in the network flow feature; each node pair is connected by a first type of edge and a second type of edge; inputting the multi-graph into a pre-trained encrypted network flow detection model to obtain a detection result corresponding to the encrypted network flow; the encrypted network flow detection model comprises a relational graph convolution network encoder and a multilayer perception classifier. The application can solve the problems of large consumption of computing resources and storage resources and poor practicability of existing encrypted network flow detection methods. The accuracy and practicability of encrypted network flow detection are enhanced, which provides a possibility for real-time monitoring and rapid response to potential security threats.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an encrypted network flow detection method, apparatus and program product based on improved multi-graph. Background Technology

[0002] With the increasing sophistication of cyberattacks and the widespread application of encryption technologies, the importance of detecting encrypted malicious traffic has become increasingly prominent. By monitoring and analyzing encrypted network traffic, security personnel can identify potential threats, detect abnormal behavior, and effectively prevent malicious attacks. However, the stealth and diversity of encrypted network flows make accurate identification of malicious activity extremely challenging. Therefore, achieving accurate detection of attack behaviors within encrypted network flows has become an urgent need in the current cybersecurity field.

[0003] Currently, existing methods for detecting encrypted network flows include: treating Transport Layer Security (TLS) network flows as nodes, establishing edges between nodes based on the same IP address, and constructing a multi-flow pruning graph based on similarity; and detecting encrypted network flows based on the multi-flow pruning graph.

[0004] However, with the growth of the internet and the widespread adoption of various online services, network traffic has experienced explosive growth, leading to a dramatic increase in the number of network flows. In this context, continuing to build a graph structure using network flows as nodes would result in an abnormally large graph, consuming significant computational and storage resources. Furthermore, a large-scale graph structure may also lead to inefficient subsequent traffic classification and detection, making real-time or near-real-time encrypted network flow detection difficult and thus reducing the practicality of traffic detection. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide an encrypted network flow detection method, apparatus, and program product based on an improved multi-graph approach to eliminate or improve one or more defects existing in the prior art. This addresses the problems of high computational and storage resource consumption and poor practicality in existing encrypted network flow detection methods.

[0006] One aspect of the present invention provides an encrypted network flow detection method based on an improved multigraph, the method comprising the following steps:

[0007] The encrypted network stream obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network stream, and the network stream features corresponding to each bidirectional network stream are extracted; the network stream features include connection information features and interaction information features;

[0008] A multigraph consisting of at least one pair of nodes is constructed based on the network flow features corresponding to each bidirectional network flow. Each node is constructed using connection information features. Each pair of nodes is connected by a first type of edge and a second type of edge. The first type of edge represents different bidirectional network flows between the pair of nodes. The number of first type edges between any pair of nodes is the same as the number of bidirectional network flows between the pair of nodes. The edge features of the first type of edge are the interaction information features of the corresponding bidirectional network flows. The edge features of the second type of edge are obtained by statistical analysis based on all interaction information features between the pair of nodes.

[0009] The multi-graph is input into a pre-trained encrypted network flow detection model to obtain the classification and detection results of the bidirectional network flow between each node pair. The encrypted network flow detection model includes a relational graph convolutional network encoder and a multilayer perceptron classifier. The relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multi-graph, update the node representation, and concatenate the updated node representations to obtain the interaction relationship representation between nodes. The interaction relationship representation is input into the multilayer perceptron classifier. The multilayer perceptron classifier is used to classify the interaction relationship representation to obtain the classification and detection results of the bidirectional network flow between each node pair.

[0010] In some embodiments of the present invention, the connection information features include source IP address, destination IP address, source port, destination port, and transport layer protocol information; the interaction information features include network flow duration, number of uplink data packets, number of downlink data packets, number of uplink bytes, and number of downlink bytes; constructing a multigraph including at least one node pair based on the network flow features corresponding to each bidirectional network flow includes: determining the number of network flows and the number of ports corresponding to each node based on the connection information features corresponding to each bidirectional network flow, as features of the node; establishing a first type of edge between nodes based on the bidirectional network flows between nodes, constructing node pairs and assigning corresponding edge features to each first type of edge; constructing a second type of edge between each node pair, and statistically calculating the edge features of the second type of edge based on the edge features of the first type of edge between node pairs.

[0011] In some embodiments of the present invention, the transport layer protocol information includes TCP and UDP protocols; based on the connection information characteristics corresponding to each bidirectional network stream, the number of network streams and the number of ports corresponding to each node are determined as the characteristics of the node, including:

[0012] Identify and count all sent and received TCP network flows to obtain the number of sent and received TCP network flows.

[0013] Determine the number of port numbers used for sending TCP network streams and the number of port numbers used for receiving TCP network streams;

[0014] Identify and count all sent and received UDP network streams to obtain the number of sent and received UDP network streams.

[0015] Determine the number of port numbers used to send UDP network streams and the number of port numbers used to receive UDP network streams.

[0016] In some embodiments of the present invention, the edge features of a second type of edge are statistically calculated based on the edge features of a first type of edge between node pairs, including:

[0017] For all first-type edges between node pairs, perform statistical calculations on edge features to obtain statistical results, including the sum, minimum, maximum, mean, and variance of each edge feature;

[0018] The statistical calculation results are used as the edge features of the second type of edge between the corresponding node pairs.

[0019] In some embodiments of the present invention, the training process of the encrypted network flow detection model includes:

[0020] Acquire training data; the training data includes: the sample interaction relationship representation corresponding to the malicious encrypted network stream, the sample interaction relationship representation corresponding to the benign encrypted network stream, and the corresponding true classification labels;

[0021] The training data is input into the initial multilayer perceptron classifier to obtain the training results;

[0022] The training results and the true classification labels are input into the cross-entropy loss function to obtain the loss result;

[0023] The loss result is used to iteratively train the initial multilayer perceptron classifier until the initial multilayer perceptron classifier converges, thus obtaining the multilayer perceptron classifier.

[0024] By combining a multilayer perceptron classifier with a relational graph convolutional network encoder, an encrypted network flow detection model is obtained.

[0025] In some embodiments of the present invention, obtaining training data includes:

[0026] Constructing sample multigraphs based on sample encrypted network streams;

[0027] The sample multigraph is input into the relational graph convolutional network encoder to obtain the updated node representation for each node in the sample multigraph.

[0028] By concatenating the updated node representations of each node in the sample multigraph, a representation of the sample interaction relationships is obtained, and the training data is constructed.

[0029] In some embodiments of the present invention, the encrypted network stream obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network stream, including: splitting the encrypted network stream according to the five-tuple, identifying different bidirectional network streams and splitting them; the five-tuple includes the source IP address, the destination IP address, the source port, the destination port and the transport layer protocol.

[0030] Another aspect of the present invention provides an encrypted network flow detection device based on an improved multigraph, comprising a processor, a memory, and a computer program / instructions stored in the memory, wherein the processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the encrypted network flow detection method based on the improved multigraph described above.

[0031] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instructions stored thereon, which, when executed by a processor, implements the steps of the previously described method for detecting encrypted network flows based on an improved multigraph.

[0032] Another aspect of the present invention provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of the previously described method for detecting encrypted network flows based on an improved multigraph.

[0033] The beneficial effects of the present invention include at least the following:

[0034] The present invention provides an improved multigraph-based encrypted network flow detection method and apparatus, which addresses the problems of high computational and storage resource consumption and poor practicality of existing encrypted network flow detection methods. By constructing independent nodes in the multigraph using connection information features from network flow characteristics, the multigraph focuses on the IP addresses and port numbers of communicating parties, rather than individual data packets or complete network flows. This significantly reduces the number of nodes in the graph, making the multigraph much smaller than a graph with network flow nodes, thus lowering the demand for computational and storage resources. Simultaneously, each node pair is connected by at least two edges, each representing a different interaction mode or feature, preserving necessary detailed information. This makes the constructed multigraph more concise yet still rich in key information. This achieves improved accuracy and practicality of encrypted network flow detection while reducing resource requirements and increasing processing speed. It enables efficient operation of encrypted network flow detection under limited resources and supports larger-scale application scenarios, providing the possibility for real-time monitoring and rapid response to potential security threats, thereby further enhancing network security protection capabilities.

[0035] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0036] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0037] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0038] Figure 1 This is a flowchart of an improved multigraph-based encrypted network flow detection method provided in an embodiment of the present invention.

[0039] Figure 2 This is a schematic diagram of nodes and edges in an improved multigraph provided by an embodiment of the present invention.

[0040] Figure 3 This is a schematic diagram of a relational graph convolutional network encoder provided in an embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0042] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0043] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0044] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0045] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0046] The following section provides a detailed description of the encrypted network flow detection method based on improved multigraphs provided in this application.

[0047] The execution subject of the encrypted network flow detection method based on improved multigraph provided in this application is an electronic device, which can be a terminal such as a computer, mobile phone, tablet computer, or camera, or it can be a server. This embodiment does not limit the implementation method of the electronic device.

[0048] This embodiment provides an encrypted network flow detection method based on an improved multi-graph approach, such as... Figure 1 As shown, the method includes at least steps S101 to S103:

[0049] Step S101: The encrypted network stream obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network stream, and the network stream features corresponding to each bidirectional network stream are extracted.

[0050] Encrypted network streams refer to data transmissions protected by encryption algorithms or technologies during network communication. They typically contain encrypted information transmitted between the source IP address and the destination IP address.

[0051] In some embodiments of the present invention, the encrypted network stream is obtained from the network monitoring system according to a preset time window, including communication data between at least two network devices.

[0052] The preset time window refers to a fixed time period set in advance when collecting encrypted network streams. It can be set to 5 minutes, 1 hour, or other time lengths determined according to actual needs. In practice, the selection of the preset time window can be determined according to the purpose of the analysis and the amount of data in the encrypted network stream to be processed, so as to ensure that enough information is captured without causing excessive data redundancy. This embodiment does not limit the value of the preset time window.

[0053] A network monitoring system refers to a system or tool used to monitor, collect, and analyze encrypted network flows, such as a network protocol analyzer (Wireshark) or a command-line tool (tcpdump). Network devices refer to various hardware facilities that participate in network communication, receiving, or sending encrypted network flows, including but not limited to routers, switches, servers, personal computers, and mobile devices.

[0054] In practice, encrypted network streams can also be extracted from pre-recorded encrypted network stream datasets or downloaded from the Internet. This embodiment does not limit the method of obtaining encrypted network streams.

[0055] In some embodiments of the present invention, the encrypted network stream is split according to a 5-tuple. The 5-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol.

[0056] Specifically, the encrypted network stream obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network stream, including: splitting the encrypted network stream according to the five-tuple, identifying different bidirectional network streams and splitting them.

[0057] In actual implementation, the method of splitting the encrypted network stream can also be adjusted according to actual needs. For example, the encrypted network stream can be split into multiple bidirectional network stream information groups according to the five-tuple and the location information of the network device. The location information corresponding to different bidirectional network stream information groups is different. This embodiment does not limit the implementation method of splitting the encrypted network stream into bidirectional network streams.

[0058] Furthermore, since the original encrypted network stream typically contains a large amount of redundant information, noise, and unstructured data, it can interfere with subsequent detection. Therefore, before splitting the encrypted network stream to obtain at least one bidirectional network stream, it is necessary to preprocess the encrypted network stream to remove unnecessary parts and retain key information, thereby improving the speed and accuracy of subsequent detection.

[0059] The preprocessing methods for encrypted network streams include, but are not limited to, data format standardization, data cleaning, and outlier handling. This embodiment does not limit the preprocessing methods for encrypted network streams.

[0060] After splitting the encrypted network stream into at least one bidirectional network stream, feature extraction is performed on each bidirectional network stream to obtain network stream features, and a multigraph is constructed based on the extracted network stream features.

[0061] In some embodiments of the present invention, network flow characteristics include connection information characteristics and interaction information characteristics. The connection information characteristics include source IP address, destination IP address, source port, destination port, and transport layer protocol information; the interaction information characteristics include network flow duration, number of uplink data packets, number of downlink data packets, number of uplink bytes, and number of downlink bytes.

[0062] Step S102: Construct a multigraph that includes at least one node pair based on the network flow features corresponding to each bidirectional network flow.

[0063] In a multigraph, each node is constructed using connectivity information features; each pair of nodes is connected by first-class edges and second-class edges.

[0064] In traditional encrypted network flow detection methods, each encrypted network flow (e.g., all packets from the start to the end of a session) is typically used as nodes in a graph. While this approach is intuitive, the number of encrypted network flows has exploded with the growth of the internet and the proliferation of online services. Continuing to build the graph using encrypted network flows as nodes leads to an abnormally large graph, requiring significant computational and storage resources. Furthermore, a large-scale graph structure can result in inefficient encrypted network flow detection, making real-time or near-real-time detection difficult and limiting its practicality.

[0065] Therefore, to address the technical problems of excessive resource consumption and low detection efficiency in existing technologies, some embodiments of this invention construct independent nodes in the multi-graph based on connection information features in network flow characteristics. By focusing on the IP addresses and port numbers of the communicating parties, rather than the fully encrypted network flow or each individual bidirectional network flow, the number of nodes in the multi-graph can be significantly reduced.

[0066] Meanwhile, to more effectively and completely represent the complex interaction patterns of encrypted network flows, each node pair is connected by at least two edges, each edge representing a different interaction pattern or feature, thus preserving necessary detailed information. This makes the constructed multigraph more concise yet still rich in key information, reducing system load, improving processing speed, and enhancing the accuracy and practicality of detection. This enables encrypted network flow detection to operate efficiently under limited resources and supports larger-scale application scenarios.

[0067] Specifically, in the multigraph, the first type of edge is used to represent different bidirectional network flows between node pairs. The number of first type edges between any node pair is the same as the number of bidirectional network flows between the node pairs. The edge features of the first type of edge are the interaction information features of the corresponding bidirectional network flows. The edge features of the second type of edge are obtained based on the statistics of all interaction information features between node pairs.

[0068] For example: Reference Figure 2 Let's take nodes A and B as examples. Node A's IP address is 192.168.1.1, and its port number is 47231. Node B's IP address is 192.168.1.2, and its port number is 80. There are three bidirectional network flows between nodes A and B: network flow 1, network flow 2, and network flow 3. Therefore, three first-type edges are constructed between nodes A and B, representing network flow 1, network flow 2, and network flow 3, respectively. A second-type edge is also constructed to represent statistical data on the interactive information characteristics of network flow 1, network flow 2, and network flow 3.

[0069] In some embodiments of the present invention, a multigraph comprising at least one node pair is constructed based on the network flow features corresponding to each bidirectional network flow, including at least the following steps S1021 to S1023:

[0070] Step S1021: Based on the connection information features corresponding to each bidirectional network flow, determine the number of bidirectional network flows and the number of ports corresponding to each node, which serve as the node's features. The connection information features include source port, destination port, and transport layer protocol information.

[0071] In some embodiments of the present invention, the transport layer protocol information includes TCP protocol and UDP protocol.

[0072] Accordingly, the bidirectional network flow corresponding to a node includes: the TCP network flow sent by the node, the TCP network flow received, the UDP network flow sent, and the UDP network flow received.

[0073] The number of bidirectional network flows includes: the number of TCP network flows sent by the node, the number of TCP network flows received, the number of UDP network flows sent, and the number of UDP network flows received.

[0074] The number of ports includes: the number of ports used to send TCP network streams, the number of ports used to receive TCP network streams, the number of ports used to send UDP network streams, and the number of ports used to receive UDP network streams.

[0075] Specifically, based on the connection information characteristics corresponding to each bidirectional network stream, the number of bidirectional network streams and the number of ports corresponding to each node are determined as the characteristics of the node, including: identifying and counting all sent and received TCP network streams to obtain the number of sent and received TCP network streams; determining the number of port numbers used by sent and received TCP network streams; identifying and counting all sent and received UDP network streams to obtain the number of sent and received UDP network streams; and determining the number of port numbers used by sent and received UDP network streams.

[0076] Step S1022: Based on the bidirectional network flow between nodes, establish the first type of edges between nodes, construct node pairs, and assign corresponding edge features to each first type of edge.

[0077] The edge features of the first type of edge include the interaction information features of the corresponding bidirectional network flow, including the network flow duration, the number of uplink data packets, the number of downlink data packets, the number of uplink bytes, and the number of downlink bytes. These edge features comprehensively describe the specific situation of each network flow, providing rich feature support for subsequent analysis and encrypted network flow detection, and helping to identify normal communication patterns and potential security threats.

[0078] Step S1023: Construct the second type of edge between each node pair, and statistically calculate the edge features of the second type of edge based on the edge features of the first type of edge between node pairs.

[0079] In some embodiments of the present invention, for all first-type edges between node pairs, edge characteristics (including sum, minimum, maximum, mean, and variance) are statistically calculated to define the edge characteristics of second-type edges. This not only preserves detailed information about individual network flows but also reflects the overall overview of interactions between node pairs, thereby enabling a more comprehensive and in-depth analysis.

[0080] Specifically, based on the edge features of the first type of edges between node pairs, the edge features of the second type of edges are statistically calculated, including: performing statistical calculations on the edge features of all first type edges between node pairs, including the sum, minimum, maximum, mean, and variance of each edge feature, and obtaining the statistical calculation results; and using the statistical calculation results as the edge features of the second type of edges between the corresponding node pairs.

[0081] Step S103: Input the multi-graph into the pre-trained encrypted network flow detection model to obtain the classification and detection results of the bidirectional network flow between each node pair.

[0082] The encrypted network flow detection model includes a Relational Graph Convolutional Network (RelationalGCN) encoder and a Multilayer Perceptron (MLP) classifier.

[0083] The relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multi-graph, update the node representation, concatenate the updated node representations to obtain the interaction relationship representation between nodes, and input the interaction relationship representation into the multilayer perceptron classifier.

[0084] like Figure 3As shown, for each node in the multigraph, features corresponding to the r1 network flow (in), r1 network flow (out), and r2 network flow are extracted respectively. These features reflect different interaction patterns of the node. The extracted features are transformed (e.g., linear transformation, convolution) to obtain intermediate feature representations. Then, the intermediate features are aggregated (shown as plus signs in the diagram) to obtain a comprehensive node representation. Finally, a nonlinear transformation (ReLU activation function) is applied to the aggregated features to obtain the final updated node representation.

[0085] After obtaining the updated node representations, the node representations of each node pair in the multigraph are concatenated to obtain the interaction relationship representations of the node pairs, in order to capture the interaction patterns between nodes.

[0086] For example: Select a node pair from a multigraph, including node A and node B; where the updated node of node A is represented as VA, and the updated node of node B is represented as VA; concatenate VA and VB to form a new vector, which is used to represent the interaction relationship between node A and node B.

[0087] After receiving the interaction relationship representation, the multilayer perceptron classifier is used to classify the interaction relationship representation and obtain the classification and detection results of the bidirectional network flow between each node pair.

[0088] In order to make the above process effective for encrypted network flow detection, in some embodiments of the present invention, it is necessary to train a multilayer perceptron classifier and combine the trained multilayer perceptron classifier with a relational graph convolutional network encoder to obtain an encrypted network flow detection model.

[0089] Specifically, the training process of the encrypted network flow detection model includes: acquiring training data; the training data includes: the sample interaction relationship representations corresponding to malicious encrypted network flows, the sample interaction relationship representations corresponding to benign encrypted network flows, and the corresponding true classification labels; inputting the training data into an initial multilayer perceptron classifier to obtain the training results; inputting the training results and the true classification labels into the cross-entropy loss function to obtain the loss results; using the loss results to iteratively train the initial multilayer perceptron classifier until the initial multilayer perceptron classifier converges to obtain the multilayer perceptron classifier; and combining the multilayer perceptron classifier with a relational graph convolutional network encoder to obtain the encrypted network flow detection model.

[0090] The process of acquiring training data includes: constructing a sample multigraph based on the sample encrypted network stream; inputting the sample multigraph into a relational graph convolutional network encoder to obtain the updated node representation corresponding to each node in the sample multigraph; concatenating the updated node representations of each node in the sample multigraph to obtain the sample interaction relation representation, and thus constructing the training data.

[0091] In practice, the sample encrypted network stream can be extracted from a pre-recorded sample encrypted network stream dataset or downloaded from the Internet. This embodiment does not limit the method of obtaining the sample encrypted network stream.

[0092] In summary, the encrypted network flow detection method based on improved multigraphs provided in this embodiment can solve the problems of high computational and storage resource consumption and poor practicality of existing encrypted network flow detection methods. By constructing independent nodes in the multigraph using connection information features from network flow characteristics, the multigraph focuses on the IP addresses and port numbers of the communicating parties, rather than individual data packets or complete network flows. This significantly reduces the number of nodes in the graph, making the multigraph much smaller than a graph with network flow nodes, thus lowering the demand for computational and storage resources. Simultaneously, each node pair is connected by at least two edges, each representing a different interaction mode or feature, preserving necessary detailed information. This makes the constructed multigraph more concise yet still rich in key information. This achieves improved accuracy and practicality of encrypted network flow detection while reducing resource requirements and increasing processing speed. It enables encrypted network flow detection to operate efficiently with limited resources and supports larger-scale application scenarios, providing the possibility for real-time monitoring and rapid response to potential security threats, thereby further enhancing network security protection capabilities.

[0093] Corresponding to the above method, the present invention also provides an encrypted network flow detection device based on improved multigraphs. The device includes a computer device, which includes a processor and a memory. The memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the encrypted network flow detection method based on improved multigraphs as described above.

[0094] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned encrypted network flow detection method based on improved multi-graph. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, register, floppy disk, hard disk, removable storage disk, CD-ROM, or any other form of storage medium known in the art.

[0095] This invention also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the steps of the aforementioned encrypted network flow detection method based on improved multi-graph.

[0096] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0097] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0098] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0099] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting encrypted network flows based on an improved multigraph, characterized in that, The method includes the following steps: The encrypted network stream obtained from the network monitoring system based on a preset time window is split into at least one bidirectional network stream, and the network stream features corresponding to each bidirectional network stream are extracted; the network stream features include connection information features and interaction information features; A multigraph comprising at least one pair of nodes is constructed based on the network flow features corresponding to each bidirectional network flow. Each node is constructed using the connection information features. Each pair of nodes is connected by a first type of edge and a second type of edge. The first type of edge represents different bidirectional network flows between the pair of nodes. The number of first type edges between any pair of nodes is the same as the number of bidirectional network flows between the pair of nodes. The edge features of the first type of edge are the interaction information features of the corresponding bidirectional network flows. The edge features of the second type of edge are obtained statistically based on all interaction information features between the pair of nodes. The multigraph is input into a pre-trained encrypted network flow detection model to obtain the classification and detection results of the bidirectional network flow between each node pair. The encrypted network flow detection model includes a relational graph convolutional network encoder and a multilayer perceptron classifier. The relational graph convolutional network encoder is used to aggregate the edge features corresponding to each node in the multigraph, update the node representation, and concatenate the updated node representations to obtain the interaction relationship representation between nodes. The interaction relationship representation is then input into the multilayer perceptron classifier. The multilayer perceptron classifier is used to classify the interaction relationship representation to obtain the classification and detection results of the bidirectional network flow between each node pair. The connection information features include source IP address, destination IP address, source port, destination port, and transport layer protocol information; the interaction information features include network flow duration, number of uplink data packets, number of downlink data packets, number of uplink bytes, and number of downlink bytes. The construction of a multigraph, comprising at least one pair of nodes, based on the network flow features corresponding to each bidirectional network flow includes: Based on the connection information characteristics corresponding to each bidirectional network flow, the number of network flows and the number of ports corresponding to each node are determined as the characteristics of the node. First-class edges between nodes are established based on bidirectional network flow between nodes, node pairs are constructed, and corresponding edge features are assigned to each first-class edge; Construct the second type of edge between each node pair, and statistically calculate the edge features of the second type of edge based on the edge features of the first type of edge between node pairs.

2. The method according to claim 1, characterized in that, The transport layer protocol information includes TCP and UDP protocols; the determination of the number of bidirectional network flows and the number of ports corresponding to each node as node characteristics based on the connection information characteristics corresponding to each bidirectional network flow includes: Identify and count all sent and received TCP network flows to obtain the number of sent and received TCP network flows. Determine the number of port numbers used for sending TCP network streams and the number of port numbers used for receiving TCP network streams; Identify and count all sent and received UDP network streams to obtain the number of sent and received UDP network streams. Determine the number of port numbers used to send UDP network streams and the number of port numbers used to receive UDP network streams.

3. The method according to claim 1, characterized in that, The edge features of the second type of edges are statistically calculated based on the edge features of the first type of edges between node pairs, including: For all Type I edges between node pairs, perform statistical calculations on edge features, including the sum, minimum, maximum, mean, and variance of each edge feature, to obtain the statistical results. The statistical calculation results are used as the edge features of the second type of edge between the corresponding node pairs.

4. The method according to claim 1, characterized in that, The training process of the encrypted network stream detection model includes: Acquire training data; the training data includes: the sample interaction relationship representation corresponding to the malicious encrypted network stream, the sample interaction relationship representation corresponding to the benign encrypted network stream, and the corresponding true classification labels; The training data is input into the initial multilayer perceptron classifier to obtain the training results; The training results and the true classification labels are input into the cross-entropy loss function to obtain the loss result; The initial multilayer perceptron classifier is iteratively trained using the loss result until the initial multilayer perceptron classifier converges, thus obtaining the multilayer perceptron classifier. The encrypted network flow detection model is obtained by combining the multilayer perceptron classifier with the relational graph convolutional network encoder.

5. The method according to claim 4, characterized in that, The acquisition of training data includes: Constructing sample multigraphs based on sample encrypted network streams; The sample multigraph is input into the relational graph convolutional network encoder to obtain the updated node representation corresponding to each node in the sample multigraph. By concatenating the updated node representations of each node in the sample multigraph, the sample interaction relationship representation is obtained, and the training data is constructed.

6. The method according to claim 1, characterized in that, The step of splitting the encrypted network stream obtained from the network monitoring system based on a preset time window into at least one bidirectional network stream includes: The encrypted network stream is split according to the five-tuple, and different bidirectional network streams are identified and split; the five-tuple includes the source IP address, destination IP address, source port, destination port and transport layer protocol.

7. A device for detecting encrypted network flows based on an improved multigraph, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 6.

9. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method described in any one of claims 1 to 6.

Images