Network attack detection method and system based on distributed intelligent probe

Abstract

The invention provides a network attack detection method and system based on a distributed intelligent probe, and the method comprises the steps: receiving real-time flow data synchronously collected by the distributed intelligent probe at each node of a network, carrying out the inter-node interaction relation modeling processing of the real-time flow data, recognizing a flow communication mode between different network nodes, and carrying out the detection of the network attack. Generating a flow association map containing the node connection relationship and the communication frequency; carrying out abnormal communication path mining based on the flow association map, and extracting a node communication sequence with an abnormal mode by analyzing the deviation degree of a node connection relationship and the fluctuation characteristics of communication frequency; performing pattern matching processing on the node communication sequence and an attack behavior template in a preset attack feature library, calculating sequence matching similarity and generating an attack matching degree score set; and determining a network attack type and attack source node positioning information, and generating a network attack detection result. According to the invention, the practicability and effectiveness of network attack detection are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network attack detection method and system based on a distributed intelligent probe. BACKGROUND

[0002] With the rapid development of network technology and the popularity of network applications, network attack detection technology plays an increasingly important role in network security. Network attack detection technology refers to a technology that identifies potential attack behaviors through analysis of network traffic data and issues an alarm. Currently, common network attack detection technologies mostly use centralized traffic collection or single-index-based anomaly detection methods to identify known attack patterns through preset rules or feature matching. However, when facing complex network attacks with dynamic propagation characteristics, traditional detection methods are difficult to effectively capture the complete evolution process of attack paths, resulting in the need to improve the accuracy and comprehensiveness of attack detection. In addition, there are limitations in attack type identification and attack source positioning. SUMMARY

[0003] Therefore, the present application provides a network attack detection method and system based on a distributed intelligent probe.

[0004] The technical scheme of the present application embodiment is implemented as follows: On the one hand, the present application embodiment provides a network attack detection method based on a distributed intelligent probe, which comprises the following steps: receiving real-time traffic data synchronously collected by a distributed intelligent probe at each node of a network, wherein the real-time traffic data carries node identification information and a collection timestamp, and the node identification information is used to distinguish the traffic sources of different network nodes; performing inter-node interaction relationship modeling processing on the real-time traffic data, identifying the traffic communication mode between different network nodes, and generating a traffic correlation graph containing node connection relationships and communication frequencies; performing abnormal communication path mining based on the traffic correlation graph, extracting node communication sequences with abnormal patterns by analyzing the deviation degree of node connection relationships and the fluctuation characteristics of communication frequencies; performing pattern matching processing on the node communication sequences and attack behavior templates in a preset attack feature library, calculating sequence matching similarity and generating an attack matching degree score set; determining network attack types and attack source node positioning information according to the attack matching degree score set, and generating a network attack detection result containing attack type identification and source node coordinates.

[0005] On the other hand, the present application embodiment provides a computer system comprising a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor implements the steps in the above method when executing the program.

[0006] The application provides a network attack detection method based on a distributed intelligent probe, real-time traffic data synchronously collected at each node of the network by the distributed intelligent probe is received, the data carries node identification information and a collection timestamp, the network global traffic can be covered without any dead angle, the problems of limited coverage and being vulnerable to single-point failure in the traditional centralized collection mode are avoided, and a comprehensive data basis is provided for subsequent attack detection. Through node-to-node interaction relationship modeling processing of the real-time traffic data, the traffic communication mode between different network nodes is identified, a traffic correlation graph containing node connection relationship and communication frequency is generated, scattered traffic data is integrated into a structured graph representation, the network communication mode can be completely presented through the structural characteristics of node connection and the quantitative characteristics of communication frequency, and the limitation that the traditional isolated index analysis cannot capture the overall communication law of the network is broken. Abnormal communication path mining is performed based on the traffic correlation graph, node communication sequences with abnormal modes are extracted by analyzing the deviation degree of node connection relationship and the fluctuation characteristics of communication frequency, the complete propagation path of the attack can be captured from the dynamic evolution process of network communication, rather than only identifying single-point anomalies, and the abnormality is determined in combination with the structural dimension and the quantitative dimension, normal business fluctuations and attack path characteristics are effectively distinguished, and the accuracy of abnormality identification is improved. The node communication sequence is subjected to mode matching processing with an attack behavior template in a preset attack feature library, a sequence matching similarity is calculated and an attack matching degree score set is generated, overall comparison of attack behaviors rather than static feature matching is realized, the dynamic evolution process of the attack can be captured, missing detection caused by attack variants is avoided, the score set provides multiple candidate bases for subsequent attack type determination, and the reliability of the detection result is enhanced. Network attack types and attack source node positioning information are determined according to the attack matching degree score set, a network attack detection result containing attack type identification and source node coordinates is generated, the complete link from abnormality discovery to attack attribution is realized, the problem that only abnormality is alarmed but the attack type and the source cannot be accurately positioned in the traditional technology is solved, explicit targets are provided for subsequent defense response, and the practicability and effectiveness of network attack detection are improved. BRIEF DESCRIPTION OF DRAWINGS

[0007] Figure 1 An implementation flowchart of a network attack detection method based on a distributed intelligent probe provided by the embodiment of the application is shown.

[0008] Figure 2 A component structure diagram of a network attack detection device provided by the embodiment of the application is shown.

[0009] Figure 3 A hardware entity diagram of a computer system provided by the embodiment of the application is shown.

[0010] Figure 4 A working diagram of a distributed intelligent probe provided by the embodiment of the application is shown. DETAILED DESCRIPTION

[0011] The embodiment of the present application provides a network attack detection method based on a distributed intelligent probe, which can be executed by a processor of a computer system. The computer system can be a server, a notebook computer, a tablet computer, a desktop computer or the like device with data processing capability.

[0012] Figure 1 An implementation flowchart of the network attack detection method based on the distributed intelligent probe is shown in the figure, and the method comprises the following steps: Figure 1 Step S100: Real-time traffic data synchronously collected by the distributed intelligent probe at each node of the network is received, the real-time traffic data carries node identification information and a collection timestamp, and the node identification information is used to distinguish the traffic sources of different network nodes.

[0013] The real-time traffic data is traffic information generated at each node in real time during network operation, and reflects the flow state of data in the network. The node identification information is specific information used to uniquely identify each node in the network, such as the IP address and MAC address of the node, and the node identification information can accurately distinguish the traffic sources generated by different network nodes. The collection timestamp records the specific time when the traffic data is collected, and provides a basis for subsequent analysis of the traffic data in the time dimension. The distributed intelligent probe is a device with intelligent collection function distributed at each node of the network, and can synchronously collect the real-time traffic data of each node according to a unified time standard.

[0014] Step S200: The real-time traffic data is subjected to inter-node interaction relationship modeling processing, the traffic communication mode between different network nodes is identified, and a traffic correlation graph containing node connection relationship and communication frequency is generated.

[0015] The inter-node interaction relationship modeling processing is a process of in-depth mining and analysis of the real-time traffic data, and aims to find out the interaction rules and relationships between different network nodes. The traffic communication mode is the rules and characteristics presented when different nodes interact with traffic, such as whether the communication frequency between nodes is stable, whether the communication time is periodic, and the protocol type used for communication. The traffic correlation graph is a tool for displaying the connection relationship and communication frequency between network nodes in a graphical form, wherein the vertices of the graph represent network nodes, the edges represent the connection relationship between nodes, and the attributes of the edges contain weighted communication frequency and protocol type proportion distribution and the like information. Through the inter-node interaction relationship modeling processing of the real-time traffic data, the communication mode between each node in the network can be more clearly grasped, which is helpful to timely discover abnormal communication behaviors.

[0016] ​As an implementation form, step S200 can include steps S210-S260: Step S210: performing session division processing on real-time traffic data, and aggregating the traffic data into a set of session units with bidirectional transmission processes according to node identification information and collection timestamps, each session unit containing a source node identification, a destination node identification, and packet transmission records sorted by timestamps.

[0017] The session division processing is a process of dividing real-time traffic data according to a set rule to form independent session units. The session unit is a set of traffic data with bidirectional transmission processes, representing a complete communication process between two nodes. The source node identification and the destination node identification are used to identify the node initiating the session and the node receiving the session, respectively, and through the two identifications, the starting node and the ending node of the communication can be determined. The packet transmission records sorted by timestamps record the transmission order and time information of the packets in the session process.

[0018] Step S220: extracting dynamic interaction features of each session unit in the set of session units, the dynamic interaction features including a session duration, a packet interval fluctuation sequence, and a protocol type proportion distribution, wherein the session duration is calculated by a difference between a timestamp of a first packet and a timestamp of a last packet, and the packet interval fluctuation sequence is generated by sorting timestamp differences between adjacent packets.

[0019] The dynamic interaction features are dynamic change features of the session unit in the communication process, which can reflect the real-time state and behavior pattern of the session. The session duration is a length of time from the beginning to the end of a session, which can be obtained by calculating a difference between a timestamp of a first packet and a timestamp of a last packet. The packet interval fluctuation sequence is a change of time intervals between adjacent packets, which is generated by sorting timestamp differences between adjacent packets, and can reflect the stability and regularity of packet transmission. The protocol type proportion distribution is a proportion of different protocol types of packets in a session unit, which reflects the protocol type features of the session.

[0020] As an implementation form, step S220 can include steps S221-S227: Step S221: for each session unit, extracting a difference between a timestamp of a first packet and a timestamp of a last packet to obtain a session duration parameter with a timestamp minimum unit as a reference.

[0021] The session duration parameter measures the time from the beginning to the end of a session unit based on the minimum unit of timestamp. By obtaining the collection timestamp of the first data packet and the collection timestamp of the last data packet in each session unit, and calculating the difference between them, the session duration parameter of the session unit can be obtained. In a financial transaction network, the session duration parameter of each transaction corresponding to the session unit can be calculated in this way.

[0022] Step S222: Arrange the data packet transmission records of each session unit in ascending order of collection timestamp, calculate the timestamp difference of adjacent data packets and form an ordered sequence as the data packet interval fluctuation sequence.

[0023] The data packet interval fluctuation sequence is an ordered sequence reflecting the change of time interval between adjacent data packets. First, the data packet transmission records of each session unit need to be arranged in ascending order of collection timestamp to ensure that the order of data packets conforms to the actual transmission order. Then, the timestamp difference of adjacent data packets is calculated, and these differences are composed into an ordered sequence, which is the data packet interval fluctuation sequence. In an Internet of Things network, sensor nodes periodically send data packets to the data center. For a session unit of a sensor node, after arranging the data packet transmission records in ascending order of collection timestamp, the timestamp difference of adjacent data packets is calculated, and the difference sequence obtained is the data packet interval fluctuation sequence of the session unit. By analyzing this sequence, the stability and regularity of data packet transmission can be understood. If the values in the sequence fluctuate greatly, it means that the data packet transmission is unstable, and there may be problems such as network congestion and device failure; if the sequence values are relatively stable, it indicates that the data packet transmission is relatively normal.

[0024] Step S223: Traverse the data packet transmission records in the session unit, identify the application layer protocol type field of each data packet, count the number of occurrences of different protocol types, and generate a protocol type counter.

[0025] The application layer protocol type field is a field in the data packet used to identify the application layer protocol type used by the data packet, such as HTTP, FTP, SMTP, etc. By traversing the data packet transmission record in the session unit, the application layer protocol type field of each data packet is identified, and the number of occurrences of different protocol types is counted, so that a protocol type counter can be generated. For example, in a session unit, after traversing the data packet transmission record, it is found that the number of occurrences of data packets of different protocol types is different. By counting the number of occurrences of different protocol types, a protocol type counter containing various protocol types and their corresponding occurrence numbers can be obtained. This counter can be used to analyze the frequency and distribution of different application layer protocols in the network. For abnormal protocol usage, such as a sudden significant increase or decrease in the number of occurrences of a certain protocol, further investigation and analysis can be performed to determine whether there is a network security threat or abnormal business operation.

[0026] Step S224: Normalization operation is performed on the protocol type counter to calculate the ratio of the number of occurrences of each protocol to the total number of data packets, and a protocol type proportion distribution is obtained.

[0027] The normalization operation is a process of converting the count data in the protocol type counter into relative proportion data. By calculating the ratio of the number of occurrences of each protocol to the total number of data packets, a protocol type proportion distribution can be obtained. This distribution reflects the proportional relationship of data packets of different protocol types in a session unit. Suppose that the session unit contains a certain number of data packets, and the number of occurrences of data packets of different protocol types is also different. By dividing the number of occurrences of each protocol type by the total number of data packets, the proportion of the protocol type in the entire session unit can be obtained. By summarizing the proportion of all protocol types, a protocol type proportion distribution is obtained. By analyzing this proportion distribution, it can be determined whether the use proportion of different application layer protocols in the network meets the normal business requirements. If the proportion of a certain protocol suddenly changes significantly, it may indicate that there is abnormal business activity or security threat in the network.

[0028] Step S225: The data packet interval fluctuation sequence is smoothed to eliminate transient noise interference, and a filtered interval fluctuation sequence is obtained.

[0029] The smoothing processing is a filtering operation on the data packet interval fluctuation sequence to eliminate possible transient noise interference in the sequence. Transient noise interference can be caused by sudden situations in the network, temporary equipment failures, etc. These noises will affect the accurate analysis of the data packet interval fluctuation. Through smoothing processing, the sequence can be made smoother, highlighting its real fluctuation characteristics. The smoothing processing method is, for example, moving average method, exponential smoothing method, etc. Taking the moving average method as an example, the method will select a certain length of window, calculate the average of the data in the window, and replace the data at the center position of the window with the average value, so as to achieve the purpose of smoothing the sequence. With the window moving on the sequence, the average value is calculated continuously, and the smoothed sequence can be obtained. In this way, the transient noise interference in the data packet interval fluctuation sequence can be eliminated, and the sequence is more stable, which is convenient for subsequent accurate analysis of the stability and regularity of data packet transmission.

[0030] Step S226: Adopting the autoregressive moving average model to predict the trend of the filtered interval fluctuation sequence, calculating the data packet arrival time distribution probability in the future preset window, and generating the time series prediction feature.

[0031] The autoregressive moving average model (ARMA) is a time series prediction model that combines the characteristics of autoregressive model (AR) and moving average model (MA), which can effectively predict time series data. By adopting the autoregressive moving average model to predict the trend of the filtered interval fluctuation sequence, the data packet arrival time distribution probability in the future preset window can be calculated. The preset window is the future time period that needs to be predicted, such as a certain number of time units in the future. The time series prediction feature is a feature generated according to the prediction result, reflecting the distribution of future data packet arrival time. When predicting, the autoregressive moving average model will predict future data based on historical data and model parameters. For the filtered interval fluctuation sequence, the model will analyze the historical fluctuation rules of the sequence, then predict the possible distribution of data packet arrival time in the future preset window, and calculate the corresponding probability. Integrating these probability distribution information, the time series prediction feature can be generated. This feature can be used to predict the future network traffic changes, helping network administrators to allocate and manage network resources in advance to cope with possible network congestion or traffic peaks.

[0032] Step S227: Integrating the session duration parameter, the filtered interval fluctuation sequence, the protocol type proportion distribution and the time series prediction feature into a structured feature vector as a storage carrier of dynamic interaction features.

[0033] The structured feature vector is a vector containing multiple feature information. The session duration parameter, the filtered interval fluctuation sequence, the protocol type proportion distribution, and the time sequence prediction feature are effectively integrated. By combining these different types of feature information into a structured feature vector, dynamic interaction features can be conveniently stored and processed. In a network security detection system, for each session unit, a corresponding structured feature vector is generated. Each element in this vector represents a corresponding dynamic interaction feature, such as the session duration parameter, a value in the filtered interval fluctuation sequence, the proportion of a certain protocol type in the protocol type proportion distribution, etc. Integrating these feature information together to form a unified structured feature vector can serve as a storage carrier for the dynamic interaction features of the session unit. Subsequently, when performing machine learning model training, anomaly detection, etc., the structured feature vector can be directly used as input data, improving the efficiency and accuracy of data processing.

[0034] Step S230: Construct a node association matrix based on dynamic interaction features. The row dimension of the matrix corresponds to the source node identifier set, and the column dimension corresponds to the destination node identifier set. The matrix elements are filled by the cumulative frequency of node interaction events in the session unit.

[0035] The node association matrix is a matrix used to represent the association relationship between network nodes. Its row dimension corresponds to the source node identifier set, and its column dimension corresponds to the destination node identifier set. The value of the matrix element is filled by the cumulative frequency of node interaction events in the session unit, which reflects the interaction frequency between two nodes. In a social network, the interaction between user nodes can be regarded as a node interaction event. The source node identifier set contains all the node identifiers that initiate the interaction, and the destination node identifier set contains all the node identifiers that receive the interaction. By counting the number of interactions between the source node and the destination node in each session unit and accumulating these numbers in the corresponding positions of the node association matrix, a complete node association matrix can be obtained. This matrix can intuitively show the interaction frequency between nodes in the network, which is of great significance for discovering abnormal node interaction behavior. For example, if the interaction frequency between two nodes in the matrix suddenly increases or decreases significantly, it may mean that there is abnormal business activity or security threat between the two nodes.

[0036] As an implementation, step S230 can include steps S231-S237: Step S231: Extract a unique identifier set from the source node identifiers and destination node identifiers of all session units, construct a node identifier list and assign a matrix index value to each identifier.

[0037] The unique identification set is a set of non-repeated identifications extracted from the source node identifications and the destination node identifications of all session units. The construction of the node identification list is to arrange these unique identifications in a certain order to form a list, and the allocation of the matrix index value to each identification is to facilitate the positioning and operation in the matrix. In a complex network environment, a session unit may involve multiple different source nodes and destination nodes, and there may be repeated identifications. By extracting the unique identification set, the repeated identifications can be removed to obtain a set containing all different node identifications. Then these identifications are arranged in order to form a node identification list, and a unique matrix index value is allocated to each identification, for example, the index value of the first identification is 0, the index value of the second identification is 1, and so on. In this way, when constructing the node association matrix later, the corresponding position in the matrix can be quickly located according to the index value of the node identification, improving the efficiency and accuracy of matrix construction.

[0038] Step S232: initialize a square matrix with a dimension matching the length of the node identification list as the node association matrix framework, and set the initial element values of the matrix to zero.

[0039] The node association matrix framework is a square matrix with a dimension matching the length of the node identification list. The initial element values of the matrix are set to zero, which is to accurately record the cumulative frequency of node interaction events when filling the matrix elements later. Assuming that the node identification list contains a certain number of node identifications, the initialized node association matrix framework is a square matrix with the same dimension as the number, and each element in the matrix has an initial value of zero. This matrix framework provides a basis for filling the cumulative frequency of node interaction events later. In the subsequent steps, according to the interaction between nodes in the session unit, the corresponding element values in the matrix are updated to obtain the final node association matrix.

[0040] Step S233: traverse the session unit set, for each session unit, find the corresponding matrix index according to the source node identification and the destination node identification, and increase the element value at the corresponding position in the node association matrix framework by 1.

[0041] In the process of traversing the session unit set, for each session unit, the corresponding matrix index is found in the node identifier list according to its source node identifier and destination node identifier. Then the element value at the corresponding position in the node association matrix framework is increased by 1 to record the interaction events between nodes. In an enterprise network, there are multiple session units, each of which represents an interaction between two nodes. For each session unit, first determine its source node identifier and destination node identifier, and then find the corresponding matrix index of the two identifiers in the node identifier list. For example, the source node identifier corresponds to the matrix index i, and the destination node identifier corresponds to the matrix index j. Then the element value of the i-th row and j-th column in the node association matrix framework is increased by 1. By traversing all the session units, the values of the matrix elements are constantly updated, and finally a node association matrix reflecting the interaction frequency between nodes can be obtained.

[0042] Step S234: Merge the session units containing the same source-destination node identifier pair, and accumulate the number of interaction events as the update value of the matrix element.

[0043] In the actual network environment, there may be multiple session units containing the same source-destination node identifier pair, which represent multiple interactions between the same two nodes. Merging these session units means accumulating the number of interaction events, and then using the accumulated number as the update value of the matrix element. In a network, there may be multiple session units between node A and node B, each of which represents an interaction between them. Merge these session units containing node A and node B, count the total number of interaction events, and then update this total number to the position of node A and node B in the node association matrix. Through this merging process, the actual interaction frequency between nodes can be more accurately reflected, and the inaccuracy of the matrix element value caused by repeated recording can be avoided.

[0044] Step S235: Introduce feature association weight, calculate feature contribution based on protocol type proportion distribution in dynamic interaction feature and time sequence prediction feature, and generate node pair interaction weight coefficient.

[0045] The feature correlation weight is a weight used to measure the influence degree of different features in the dynamic interaction feature on the node interaction relationship. The feature contribution degree is calculated based on the protocol type proportion distribution and the time sequence prediction feature in the dynamic interaction feature, in order to determine the role of the two features in the node interaction relationship. By calculating the feature contribution degree, the node pair interaction weight coefficient can be generated. The protocol type proportion distribution reflects the proportion of the protocol types used in the communication between nodes, and different protocol types may have different importance and influence degree on the node interaction. The time sequence prediction feature reflects the distribution of the future data packet arrival time between nodes, which also affects the interaction relationship between nodes. By analyzing and calculating the two features, the feature contribution degree of them in the node interaction is determined, and then the node pair interaction weight coefficient is generated according to the feature contribution degree. This coefficient can be used to adjust the element value in the node association matrix to more accurately reflect the real interaction relationship between nodes.

[0046] Step S236: Perform product operation on the matrix element value and the corresponding node pair interaction weight coefficient to obtain the weighted interaction frequency, and update the node association matrix element.

[0047] The product operation of the element value in the node association matrix and the corresponding node pair interaction weight coefficient results in the weighted interaction frequency. By updating the node association matrix element with the weighted interaction frequency, the matrix can more accurately reflect the real interaction relationship between nodes. In the previous steps, the node association matrix and the node pair interaction weight coefficient have been obtained. For each element in the matrix, multiply it by the corresponding node pair interaction weight coefficient to obtain a new value, which is the weighted interaction frequency. Then replace the original element value in the matrix with the weighted interaction frequency to complete the update of the matrix element. In this way, the feature correlation between different node pairs can be considered, and the node association matrix can better reflect the actual importance and influence of the interaction between nodes.

[0048] Step S237: Remove the node pair interaction records with a weighted interaction frequency lower than a preset threshold through matrix sparsification processing, and retain the significantly associated node connection relationship to generate a sparse node association matrix.

[0049] The matrix sparsification process is an optimization process for the node association matrix. By removing the interaction records of node pairs with weighted interaction frequencies below a preset threshold, the redundant information in the matrix can be reduced, and the significant association of node connection relationships can be preserved. The preset threshold is a pre-set value used to determine whether the interaction between node pairs has significant meaning. In a network, the interaction relationships between nodes can be very complex, and there are a large number of interaction records, but many of them have low interaction frequencies and have little impact on the overall operation and security of the network. By setting a preset threshold, the interaction records of node pairs with weighted interaction frequencies below the threshold are removed from the matrix, and only those node connection relationships with high weighted interaction frequencies and significant associations are retained. The resulting sparse node association matrix is more concise, facilitating subsequent analysis and processing, and highlighting important node connection relationships in the network.

[0050] Step S240: Time window normalization processing is performed on the node association matrix to calculate the proportion of the interaction frequency of each node pair in the unit monitoring period to the total interaction frequency, and a node communication frequency distribution matrix is generated.

[0051] The time window normalization process is a further processing process for the node association matrix. By calculating the proportion of the interaction frequency of each node pair in the unit monitoring period to the total interaction frequency, a node communication frequency distribution matrix can be obtained. The unit monitoring period is a pre-set time range, and the interaction frequency of node pairs is calculated within this time range. The total interaction frequency is the sum of the interaction frequencies of all node pairs in the unit monitoring period. For each element in the node association matrix, divide the interaction frequency of the corresponding node pair in the unit monitoring period by the total interaction frequency, and the resulting proportion value is the element value of the corresponding node pair in the node communication frequency distribution matrix. Through this normalization process, the interaction frequency of node pairs can be converted into a relative proportion, facilitating the comparison of communication frequencies between different node pairs. The node communication frequency distribution matrix can more intuitively show the communication frequency distribution of node pairs in the network, and help analyze the traffic distribution and usage patterns of the network.

[0052] Step S250: Introduce a spatio-temporal correlation weight factor to dynamically adjust the weight of the matrix elements according to the hierarchical position of the node in the network topology and the historical interaction stability, and generate a weighted node association matrix.

[0053] The spatiotemporal correlation weight factor is a weight factor considering the hierarchical position of the node in the network topology and the historical interaction stability. According to the hierarchical position of the node in the network topology, the influence and importance of nodes at different levels on the network may be different, for example, the roles and positions of core nodes and edge nodes are different. The historical interaction stability reflects whether the past interaction between nodes is stable, and the stable interaction relationship may have a higher weight in the current network. By introducing the spatiotemporal correlation weight factor, the element weight in the node correlation matrix is dynamically adjusted, and a weighted node correlation matrix can be generated. For each element in the matrix, according to the hierarchical position of the node corresponding to the element in the network topology and the historical interaction stability, the corresponding spatiotemporal correlation weight factor is calculated, and then the element value is multiplied by the weight factor to obtain the adjusted element value. In this way, the matrix can more accurately reflect the real correlation relationship between nodes, while considering the spatial structure of the network and the interaction stability over time.

[0054] Step S260: fuse the weighted node correlation matrix and the communication frequency distribution matrix to construct a traffic correlation graph, the vertices of the graph represent network nodes, the vertex attributes include node identification and hierarchical position, the edges represent node connection relationship, and the edge attributes include weighted communication frequency and protocol type proportion distribution.

[0055] Fusing the weighted node correlation matrix and the communication frequency distribution matrix to construct a traffic correlation graph is to integrate the information in the two matrices to display the connection relationship and communication characteristics between network nodes in a graphical manner. The vertices of the traffic correlation graph represent network nodes, and the attributes of the vertices include node identification and hierarchical position. The node identification is used to uniquely identify the node, and the hierarchical position reflects the hierarchical structure of the node in the network topology. The edges represent the connection relationship between nodes, and the attributes of the edges include weighted communication frequency and protocol type proportion distribution. The weighted communication frequency reflects the actual communication frequency between nodes, considering factors such as spatiotemporal correlation; the protocol type proportion distribution reflects the proportion of the protocol type used in the communication between nodes. By fusing the information in the weighted node correlation matrix and the communication frequency distribution matrix, and filling the attributes of nodes and edges, a complete traffic correlation graph can be constructed.

[0056] Step S300: based on the traffic correlation graph, abnormal communication path mining is performed, and the node communication sequence with abnormal pattern is extracted by analyzing the deviation degree of node connection relationship and the fluctuation characteristics of communication frequency.

[0057] Abnormal communication path mining is a process of finding abnormal communication paths in a network based on traffic correlation graph. Analyzing the deviation of node connection relationship is to compare the difference between the current node connection relationship and the node connection relationship under normal circumstances; analyzing the fluctuation characteristics of communication frequency is to observe the change of communication frequency over time to determine whether there is abnormal fluctuation. Through the analysis of these two aspects, the node communication sequence with abnormal mode is extracted. In a normal network, the connection relationship between nodes and the communication frequency usually have certain regularity and stability. If the connection relationship of a node suddenly changes and deviates greatly from the normal situation, or the communication frequency shows abnormal fluctuation, such as sudden large increase or decrease, then there may be abnormal communication behavior. By in-depth analysis of the traffic correlation graph, the abnormal node connection relationship and communication frequency fluctuation are found out, and the node communication sequence with abnormal mode is extracted, which may represent the attack behavior, illegal access and other abnormal situations in the network.

[0058] As an implementation, step S300 can include steps S310-S360: Step S310: Construct a dynamic communication baseline model, which integrates the time sequence correlation and spatial topology dependency of node historical communication behavior, learns the probability distribution of node connection relationship and the time-varying characteristics of communication frequency under normal communication mode by non-parametric kernel density estimation method, and generates a baseline parameter set containing node pair correlation probability matrix and time-varying frequency parameters.

[0059] The dynamic communication baseline model is a model used to describe the normal communication mode of the network, which integrates the time sequence correlation and spatial topology dependency of node historical communication behavior. The time sequence correlation reflects the change law of node communication behavior in time, and the spatial topology dependency reflects the influence of the position relationship of nodes in the network topology on communication. By non-parametric kernel density estimation method, the probability distribution of node connection relationship and the time-varying characteristics of communication frequency under normal communication mode are learned, and a baseline parameter set containing node pair correlation probability matrix and time-varying frequency parameters is generated. Non-parametric kernel density estimation method is a density estimation method independent of specific distribution assumption, which can adaptively estimate probability distribution according to historical data. In constructing the dynamic communication baseline model, first, collect the historical communication data of nodes, including the time series data of node connection relationship and communication frequency. Then, analyze these data, consider the time sequence correlation and spatial topology dependency between nodes, and use non-parametric kernel density estimation method to learn the probability distribution of node connection relationship and the time-varying characteristics of communication frequency under normal communication mode. The node pair correlation probability matrix and time-varying frequency parameters learned are integrated together to form the baseline parameter set. This baseline parameter set can be used as a benchmark to judge whether the current network communication is normal.

[0060] As an implementation, step S310 can include steps S311-S317: Step S311: Collect historical traffic correlation graph data of multiple complete monitoring periods in the past, each period data containing a node connection relationship snapshot and a corresponding communication frequency time series.

[0061] The historical traffic correlation graph data is the network traffic information in multiple complete monitoring periods in the past, each period data containing a node connection relationship snapshot and a corresponding communication frequency time series. The node connection relationship snapshot reflects the connection relationship between nodes in the network in a monitoring period, and the communication frequency time series records the change of communication frequency between nodes over time in the monitoring period. By collecting these data of multiple complete monitoring periods in the past, a large amount of information under normal communication mode of the network can be obtained.

[0062] Step S312: Preprocess the historical data, eliminate abnormal communication records during known attack events, and retain communication data marked as normal state as a training sample set.

[0063] The preprocessing of historical data is to ensure the quality of the training sample set used to build the model. Eliminating abnormal communication records during known attack events is to avoid interference of these abnormal data on learning normal communication mode by the model. Retaining communication data marked as normal state as a training sample set is to enable the model to accurately learn the normal communication mode of the network. In the actual network operation process, some attack events may occur, and the communication records during these events are quite different from the normal communication mode. By screening the historical data, the communication records during known attack events are identified and eliminated, and only the communication data marked as normal state is retained. These normal communication data constitute the training sample set, which is used for subsequent training of the dynamic communication baseline model. This can improve the accuracy and reliability of the model, so that it can better identify abnormal communication behavior in the network.

[0064] Step S313: Calculate the shortest path distance between nodes based on the network topology structure, construct a spatial topology dependence matrix, and the matrix elements represent the connection closeness of node pairs in the physical topology.

[0065] The shortest path distance between nodes is calculated based on the network topology structure, which measures the relative position relationship of nodes in the physical topology. A spatial topology dependency matrix is constructed, and the matrix elements represent the connection tightness of node pairs in the physical topology. The network topology structure describes the connection mode of nodes and links in the network. The shortest path distance between nodes is calculated by using the shortest path algorithm in graph theory, such as Dijkstra algorithm or Floyd-Warshall algorithm. The shorter the shortest path distance, the tighter the connection between nodes. According to the calculated shortest path distance, a spatial topology dependency matrix is constructed, and each element in the matrix represents the connection tightness of the corresponding node pair in the physical topology.

[0066] Step S314: using time series decomposition method to decompose the communication frequency time series of each node pair into trend item, periodic item and random item, and separate the long-term change trend and periodic fluctuation characteristics of communication frequency.

[0067] The time series decomposition method is a method of decomposing time series data into different components. By decomposing the communication frequency time series of each node pair into trend item, periodic item and random item, the long-term change trend and periodic fluctuation characteristics of communication frequency can be separated. The trend item reflects the overall change trend of communication frequency in a long time, for example, whether the communication frequency is gradually increasing or decreasing over time. The periodic item reflects the periodic fluctuation of communication frequency, for example, the periodic change every day, every week or every month. The random item is the random fluctuation that cannot be explained by the trend item and the periodic item. Common time series decomposition methods include additive model and multiplicative model. When decomposing the communication frequency time series of node pairs, select the appropriate decomposition method to decompose the series into trend item, periodic item and random item. Through this decomposition, the change rule of communication frequency can be more clearly understood, providing more accurate information for subsequent analysis and modeling.

[0068] Step S315: using non-parametric kernel density estimation method to estimate the appearance probability distribution of each node pair connection relationship and the conditional probability distribution of communication frequency respectively for the preprocessed normal communication data.

[0069] The non-parametric kernel density estimation method is a density estimation method that does not rely on specific distribution assumptions. By using this method to process the preprocessed normal communication data, the occurrence probability distribution of the connection relationship of each node pair and the conditional probability distribution of the communication frequency can be estimated respectively. For each node pair, the occurrence probability distribution of the connection relationship reflects the possibility of the connection relationship of the node pair in the normal situation. The conditional probability distribution of the communication frequency reflects the distribution of the communication frequency of the node pair under certain conditions. When analyzing the normal communication data, the data is input into the non-parametric kernel density estimation model, and the model will adaptively estimate the occurrence probability distribution of the connection relationship of each node pair and the conditional probability distribution of the communication frequency according to the characteristics of the data. These probability distribution information can be used for subsequent dynamic communication baseline model, to provide basis for judging whether the current network communication is normal.

[0070] Step S316: Introduce a time decay factor to give different weights to training samples in different historical periods, and the weight of recent samples is higher than that of long-term samples. Update the probability distribution model through weighted kernel density estimation.

[0071] The time decay factor is introduced to consider that the influence of training samples in different historical periods on the current model is different. Since the network environment and communication mode may change over time, recent training samples can better reflect the current network situation, so recent samples are given higher weights and long-term samples are given lower weights. The probability distribution model is updated through weighted kernel density estimation, which is based on non-parametric kernel density estimation and considers the weight of the sample for updating. The time decay factor is a factor that gradually decreases over time, and each sample is assigned a corresponding weight according to its timestamp. When performing weighted kernel density estimation, the weight of the sample is included in the calculation process to update the probability distribution model. This can make the model more adaptable to the dynamic changes of the network and improve the accuracy and real-time performance of the model.

[0072] Step S317: Integrate the node pair association probability distribution, communication frequency time-varying parameter and spatial topology dependence matrix to form a baseline parameter set of the dynamic communication baseline model.

[0073] The node pair association probability distribution, the time-varying parameter of the communication frequency, and the spatial topology dependence matrix are integrated together to form a baseline parameter set of the dynamic communication baseline model. The node pair association probability distribution reflects the probability of the connection relationship of the node pair under normal circumstances, the time-varying parameter of the communication frequency reflects the variation characteristics of the communication frequency with time, and the spatial topology dependence matrix reflects the connection tightness of the node in the physical topology. The integration of the information in these three aspects can comprehensively describe the normal communication mode of the network. In constructing the dynamic communication baseline model, the node pair association probability distribution, the time-varying parameter of the communication frequency, and the spatial topology dependence matrix calculated are integrated to form a baseline parameter set containing all key information. The baseline parameter set can be used as a benchmark for judging whether the current network communication is normal. By comparing the current traffic association graph with the baseline parameter set, abnormal communication behavior in the network can be identified.

[0074] Step S320: The graph structure deviation algorithm is used to calculate the structural difference between the current traffic association graph and the node pair association probability matrix in the baseline parameter set. The node connection relationship is mapped to a low-dimensional feature space through the spectral clustering method, and the Bhattacharyya distance between the current distribution and the baseline distribution in the feature space is calculated as the node connection deviation.

[0075] The graph structure deviation algorithm is an algorithm for calculating the difference between two graph structures. The algorithm is used to calculate the structural difference between the current traffic association graph and the node pair association probability matrix in the baseline parameter set. The spectral clustering method is a graph-based clustering algorithm that maps the node connection relationship to a low-dimensional feature space, making it easier to analyze and compare data. The Bhattacharyya distance between the current distribution and the baseline distribution in the feature space is calculated as the node connection deviation. The Bhattacharyya distance is a measure of the difference between two probability distributions. In the calculation, first, the graph structure deviation algorithm is used to analyze the structural difference between the current traffic association graph and the node pair association probability matrix. Then, the spectral clustering method is used to map the node connection relationship from the original graph space to a low-dimensional feature space. In this low-dimensional feature space, the Bhattacharyya distance between the current distribution (i.e., the distribution corresponding to the current traffic association graph) and the baseline distribution (i.e., the distribution corresponding to the node pair association probability matrix in the baseline parameter set) is calculated. The larger the node connection deviation, the greater the difference between the current node connection relationship and the normal situation, indicating that there may be abnormal communication behavior.

[0076] Step S330: The communication frequency fluctuation entropy index is introduced to analyze the complexity of the communication frequency time series of each node connection. The irregularity of the sequence is calculated by the sample entropy algorithm, and the higher the entropy value, the more intense the frequency fluctuation.

[0077] The communication frequency fluctuation entropy index is an index for measuring the complexity of the communication frequency time series of node connections. The index is introduced to analyze the complexity of the communication frequency time series of node connections. The sample entropy algorithm is an algorithm for calculating the irregularity of a time series. The irregularity of the communication frequency time series is calculated by the algorithm, and the higher the entropy value, the more intense the frequency fluctuation. In the network, the communication frequency time series of node connections may have different degrees of fluctuation. The communication frequency fluctuation entropy index can reflect the complexity of such fluctuations. The sample entropy algorithm is used to calculate the communication frequency time series, which analyzes the similarity and regularity between adjacent data points in the sequence. If the irregularity of the sequence is high, that is, the change between data points is random and complex, the entropy value calculated will be high, indicating that the frequency fluctuation is more intense. By analyzing the communication frequency fluctuation entropy index, the stability of the communication frequency of node connections can be understood. For node connections with high entropy values, there may be network congestion, abnormal traffic, and other problems that need further attention and analysis.

[0078] Step S340: Construct a multi-dimensional anomaly scoring mechanism, and obtain a comprehensive anomaly score by weighted summation of the node connection deviation and the communication frequency fluctuation entropy. The weight coefficient is dynamically adjusted according to the discrimination ability of each index in the historical attack sample.

[0079] The multi-dimensional anomaly scoring mechanism is constructed to more comprehensively and accurately evaluate the abnormal situation in the network. The node connection deviation and the communication frequency fluctuation entropy are combined by weighted summation to obtain a comprehensive anomaly score, and the weight coefficient is dynamically adjusted according to the discrimination ability of each index in the historical attack sample. The node connection deviation reflects the difference between the current node connection relationship and the normal situation, and the communication frequency fluctuation entropy reflects the fluctuation complexity of the communication frequency of node connections. By weighted summation of these two indexes, a comprehensive anomaly score can be obtained, which more comprehensively reflects the abnormal situation of the network. The determination of the weight coefficient is dynamically adjusted according to the discrimination ability of each index in the historical attack sample. In the historical attack sample, the discrimination ability of different indexes for attack behavior may be different. By analyzing the historical attack sample, the importance of each index in distinguishing between normal and abnormal situations is determined, and the weight coefficient is dynamically adjusted according to the importance. In this way, the comprehensive anomaly score can more accurately reflect the actual abnormal situation of the network, and the accuracy of anomaly detection can be improved.

[0080] As an implementation, step S340 can include the following steps S341-S347: Step S341: Collect a historical attack event sample set, each sample containing the node connection deviation, the communication frequency fluctuation entropy, and the corresponding attack label when the attack occurs.

[0081] The historical attack event sample set is collected to obtain historical data for analyzing and adjusting the weight coefficients. Each sample contains the node connection deviation, the communication frequency fluctuation entropy at the time of attack occurrence, and the corresponding attack label. The attack label is used to identify the attack type corresponding to the sample. During the operation of the network, various attack events occur, and the node connection deviation and the communication frequency fluctuation entropy at the time of attack occurrence are recorded. Each attack event is assigned an attack label. These samples are collected to form the historical attack event sample set. This sample set can be used for subsequent analysis. By analyzing the data in the sample set, the performance of different indicators under different attack types is understood, and the weight coefficients are adjusted.

[0082] Step S342: Standardize the node connection deviation and the communication frequency fluctuation entropy in the historical sample set to map the indicator values to the [0, 1] interval and eliminate the dimensional differences.

[0083] The node connection deviation and the communication frequency fluctuation entropy in the historical sample set are standardized to eliminate the dimensional differences between different indicators and make them comparable. Mapping the indicator values to the [0, 1] interval allows data to be compared and analyzed on a unified scale. A commonly used standardization method is the min-max standardization method, which maps the minimum value of the data to 0 and the maximum value to 1, and other data points are proportionally mapped to the [0, 1] interval. When standardizing the node connection deviation and the communication frequency fluctuation entropy in the historical sample set, first determine the minimum and maximum values of each indicator, then use the min-max standardization formula to convert each indicator value. Through this standardization, analysis errors caused by dimensional differences can be avoided, making subsequent analysis and calculation more accurate.

[0084] Step S343: Calculate the discrimination ability of the node connection deviation and the communication frequency fluctuation entropy to the attack label using the information gain ratio algorithm. The higher the information gain ratio, the greater the contribution of the indicator to anomaly detection.

[0085] The information gain ratio algorithm is an algorithm for evaluating the distinguishing ability of features on classification labels. The algorithm is used to calculate the distinguishing ability of the node connection deviation and the communication frequency fluctuation entropy on the attack label. The higher the information gain ratio, the greater the contribution of the index to anomaly detection. In the historical attack event sample set, each sample has an attack label, and contains two indexes of node connection deviation and communication frequency fluctuation entropy. Using the information gain ratio algorithm, the distinguishing ability of the two indexes on the attack label is analyzed. The algorithm calculates the information gain ratio of each index on the attack label classification under different values. The information gain ratio reflects the amount of information provided by the index in the classification process. The higher the information gain ratio, the stronger the distinguishing ability of the index on the attack label, and the greater the role in anomaly detection. By calculating the information gain ratio, the importance of each index can be determined to provide a basis for subsequent adjustment of the weight coefficient.

[0086] Step S344: Initialize the weight coefficient according to the information gain ratio result. The index with high distinguishing ability is given a higher initial weight, and the sum of the weights of the two indexes is 1.

[0087] The weight coefficient is initialized according to the information gain ratio result, in order to reasonably allocate the weight according to the distinguishing ability of the index. The index with high distinguishing ability is given a higher initial weight, and the sum of the weights of the two indexes is 1. In the previous steps, the distinguishing ability of the node connection deviation and the communication frequency fluctuation entropy on the attack label has been calculated using the information gain ratio algorithm. According to the calculation result, the index with high distinguishing ability can more accurately distinguish between normal and abnormal situations in anomaly detection, and therefore is given a higher initial weight. At the same time, in order to ensure the rationality of the weight, the sum of the weights of the two indexes is 1. For example, if the information gain ratio of the node connection deviation is higher than that of the communication frequency fluctuation entropy, the initial weight of the node connection deviation will be relatively high, and the initial weight of the communication frequency fluctuation entropy will be relatively low, but the sum of the weights of the two indexes is always 1. By initializing the weight coefficient in this way, the comprehensive anomaly score can better reflect the importance of different indexes.

[0088] Step S345: Construct a logistic regression classifier, taking the standardized node connection deviation and communication frequency fluctuation entropy as input features, and taking the attack label as output target, and training the logistic regression classifier through the historical sample set.

[0089] The logistic regression classifier is a binary classification model. The classifier is built with the standardized node connection deviation and communication frequency fluctuation entropy as input features, and the attack label as output target. The logistic regression classifier is trained on the historical sample set so that it can learn the relationship between the input features and the attack label. In the previous steps, the node connection deviation and communication frequency fluctuation entropy have been standardized to obtain standardized features. At the same time, each sample in the historical sample set has an attack label. The standardized features are used as input, and the attack label is used as output. The historical sample set is used to train the logistic regression classifier. During training, the logistic regression classifier adjusts the parameters of the model to minimize the error between the predicted results and the actual attack label. Through training, the logistic regression classifier can learn the mapping relationship between the input features and the attack label, which is used for subsequent anomaly detection.

[0090] Step S346: Extract the feature coefficients of the trained logistic regression classifier, and normalize them as dynamic adjustment weight coefficients to replace the initial weights.

[0091] Extracting the feature coefficients of the trained logistic regression classifier is to obtain the importance information of each input feature in the model. After normalizing these feature coefficients as dynamic adjustment weight coefficients, replace the initial weights. During the training of the logistic regression classifier, the model assigns a feature coefficient to each input feature, which reflects the importance of the feature in the model. Extract the feature coefficients of the trained logistic regression classifier, and then normalize these coefficients so that their sum is 1. The normalized feature coefficients can be used as dynamic adjustment weight coefficients to replace the previously initialized weight coefficients. In this way, according to the training results of the model, the weight coefficients can be dynamically adjusted, so that the comprehensive anomaly score can more accurately reflect the actual importance of different indicators in anomaly detection.

[0092] Step S347: For the current detection data, multiply the standardized node connection deviation by the corresponding weight coefficient, and add the standardized communication frequency fluctuation entropy multiplied by its weight coefficient to obtain the comprehensive anomaly score.

[0093] For the current detection data, the standardized node connection deviation is multiplied by the corresponding weight coefficient, and the standardized communication frequency fluctuation entropy is multiplied by its weight coefficient to obtain a comprehensive abnormal score. In the previous steps, the node connection deviation and the communication frequency fluctuation entropy have been standardized, and the dynamically adjusted weight coefficients have been obtained. For the current detection data, first, the node connection deviation and the communication frequency fluctuation entropy are standardized, then multiplied by the corresponding weight coefficients respectively, and finally the two products are added to obtain the comprehensive abnormal score. The comprehensive abnormal score considers the influence of both the node connection deviation and the communication frequency fluctuation entropy, and can more comprehensively reflect the abnormal situation of the current network communication. By comparing the comprehensive abnormal score with the preset threshold, it can be judged whether the current network has abnormal communication behavior.

[0094] Step S350: Sort the node connection edges in the traffic correlation graph based on the comprehensive abnormal score, select the edges with scores higher than the dynamic threshold as abnormal connection edges, and the dynamic threshold is adjusted in real time by the adaptive control chart algorithm according to the current load level of the network.

[0095] The node connection edges in the traffic correlation graph are sorted based on the comprehensive abnormal score, in order to find the node connection edges with higher abnormal degree in the network. The edges with scores higher than the dynamic threshold are selected as abnormal connection edges, and the dynamic threshold is adjusted in real time by the adaptive control chart algorithm according to the current load level of the network. In the previous steps, the comprehensive abnormal score of each node connection edge has been calculated. These scores are sorted in descending order to sort the node connection edges. The dynamic threshold is a threshold that is adjusted in real time according to the current load level of the network, and the adaptive control chart algorithm is used to realize the dynamic adjustment of the threshold. The adaptive control chart algorithm dynamically adjusts the size of the threshold according to the historical data and the current load of the network. The node connection edges with scores higher than the dynamic threshold are selected as abnormal connection edges, which may represent abnormal communication behaviors in the network, such as attacks, illegal access, etc. By adjusting the dynamic threshold in real time, the network load can be adapted, and the accuracy of anomaly detection can be improved.

[0096] Step S360: Trace the connected subgraph containing the abnormal connection edges in the traffic correlation graph, take the abnormal connection edges as the starting point, expand the adjacent nodes in the communication time sequence, and extract the path containing at least three nodes and the abnormal connection edges accounting for more than a preset proportion as the node communication sequence.

[0097] In the traffic correlation graph, the connected subgraph containing the abnormal connection edge is tracked to find the node communication path related to the abnormal connection edge. Starting from the abnormal connection edge, the adjacent nodes are expanded in sequence according to the communication time sequence, and the path containing at least three nodes and the abnormal connection edge accounting for more than a preset proportion is extracted as the node communication sequence. In the traffic correlation graph, the abnormal connection edge may be a manifestation of abnormal communication behavior. Starting from these abnormal connection edges, according to the communication time sequence, the adjacent nodes are expanded in sequence to form a connected subgraph. In this connected subgraph, the path containing at least three nodes and the abnormal connection edge accounting for more than a preset proportion is screened out. The preset proportion is a pre-set value for judging whether the proportion of the abnormal connection edge in the path is high enough. The extracted node communication sequence may represent a complete abnormal communication process, containing abnormal interactions between multiple nodes. By analyzing these node communication sequences, the patterns and characteristics of abnormal communication behavior can be better understood, providing a basis for subsequent attack type identification and attack source positioning.

[0098] Step S400: Perform pattern matching processing on the node communication sequence and the attack behavior template in the preset attack feature library, calculate the sequence matching similarity, and generate an attack matching degree score set.

[0099] The pattern matching processing of the node communication sequence and the attack behavior template in the preset attack feature library is to identify whether there is a similar pattern in the node communication sequence as the known attack behavior. The sequence matching similarity is calculated and an attack matching degree score set is generated. The preset attack feature library is a database containing various known attack behavior templates, each attack behavior template describing the characteristics and patterns of a preset attack behavior. The pattern matching processing of the node communication sequence and the attack behavior template is to compare their characteristics and patterns, calculate the sequence matching similarity. The sequence matching similarity reflects the similarity between the node communication sequence and the attack behavior template. The matching similarity of each attack behavior template and the node communication sequence is taken as a score to generate an attack matching degree score set.

[0100] As an implementation, step S400 can include the following steps S410-S460: Step S410: Perform graph structure serialization conversion on the node communication sequence, map the node connection relationship and communication frequency attribute into a directed weighted sequence, and the sequence element contains the source node identifier, the destination node identifier, the communication frequency and the timestamp offset.

[0101] The graph structure serialization conversion of the node communication sequence is to convert the node communication sequence of the graph structure into a directed weighted sequence convenient for processing. The node connection relationship and the communication frequency attribute are mapped into a directed weighted sequence, and the sequence element contains the source node identifier, the destination node identifier, the communication frequency and the timestamp offset. The node communication sequence is a graph structure containing the information of nodes and connection edges. Through the graph structure serialization conversion, it is converted into a directed weighted sequence. For each element in the sequence, the source node identifier and the destination node identifier determine the connection direction between nodes, the communication frequency reflects the communication frequency between nodes, and the timestamp offset records the time offset of the connection occurrence relative to the starting time of the sequence. In a network attack scenario, the node communication sequence may contain abnormal interactions between multiple nodes. The graph structure serialization conversion of this sequence obtains a directed weighted sequence, which is convenient for subsequent pattern matching processing with the attack behavior template.

[0102] As an implementation, step S410 can include steps S411-S417: Step S411: traverse the node connection relationship in the node communication sequence, arrange the connection edges in ascending order of communication occurrence timestamp, and construct an ordered edge set.

[0103] The node connection relationship in the node communication sequence can be unordered, and by traversing these connection relationships, the communication occurrence timestamp of each connection edge is obtained. Then the connection edges are arranged in ascending order according to the timestamp, and an ordered edge set is constructed. In a network attack process, the communication between nodes can occur at different times. By sorting the connection edges according to the timestamp, an ordered edge set arranged according to the communication time sequence can be obtained, which is convenient for subsequent processing and analysis.

[0104] Step S412: extract the source node identifier and the destination node identifier for each connection edge, and query the communication frequency attribute of the corresponding edge from the traffic association graph.

[0105] The source node identifier and the destination node identifier are extracted for each connection edge in order to determine the starting and ending nodes of the connection edge. The communication frequency attribute of the corresponding edge is queried from the traffic association graph in order to obtain the communication frequency information of the connection edge. In the ordered edge set, for each connection edge, its source node identifier and destination node identifier are extracted, which can uniquely determine a connection edge. Then the communication frequency attribute corresponding to the connection edge is queried from the traffic association graph, which reflects the communication frequency of the connection edge in the network. By extracting the source node identifier, the destination node identifier and the communication frequency attribute, necessary information can be provided for subsequent construction of a directed weighted sequence.

[0106] Step S413: Calculate the difference between the timestamp of each connection edge and the sequence start timestamp, to obtain the timestamp offset.

[0107] Calculate the difference between the timestamp of each connection edge and the sequence start timestamp, to obtain the timestamp offset. The timestamp offset records the offset of the time when the connection edge occurs relative to the sequence start time, reflecting the position of the connection edge in the communication timing. In the ordered edge set, for each connection edge, obtain its communication occurrence timestamp, and record the sequence start timestamp at the same time. Calculate the difference between the two to obtain the timestamp offset of the connection edge.

[0108] Step S414: Combine the source node identifier, destination node identifier, communication frequency and timestamp offset into a four-tuple structure as the basic element of the directed weighted sequence.

[0109] Combine the source node identifier, destination node identifier, communication frequency and timestamp offset into a four-tuple structure as the basic element of the directed weighted sequence. In the previous steps, the source node identifier, destination node identifier, communication frequency and timestamp offset of each connection edge have been extracted. Combine these information into a four-tuple structure, and each four-tuple represents an element in the directed weighted sequence. This four-tuple structure contains the key information of node connection, including the direction of connection (determined by the source node identifier and destination node identifier), the frequency of communication (represented by the communication frequency) and the time position of communication (represented by the timestamp offset). By arranging these four-tuple elements in sequence, a directed weighted sequence can be formed, which is convenient for subsequent pattern matching with attack behavior templates.

[0110] Step S415: Perform logarithmic normalization processing on the communication frequency in the sequence element, to convert the original frequency value into a normalized frequency weight in a preset numerical interval.

[0111] Perform logarithmic normalization processing on the communication frequency in the sequence element, to convert the original frequency value into a normalized frequency weight in a preset numerical interval. The original communication frequency value may have a large range and different magnitudes, and through logarithmic normalization processing, it can be mapped to a preset numerical interval, which is convenient for subsequent calculation and comparison. Logarithmic normalization processing usually uses a logarithmic function to transform the original frequency value, and then linearly maps the transformed value to fall within the preset numerical interval. In the directed weighted sequence, perform logarithmic normalization processing on the communication frequency in each sequence element to obtain the normalized frequency weight. This weight can be used in the subsequent pattern matching process, so that the communication frequency has a more reasonable influence in the matching process.

[0112] Step S416: Feature smoothing is performed on the ordered edge set, the average frequency of node interaction within the window and the frequency change gradient are calculated, and an extended sequence element containing local statistical features is generated.

[0113] Feature smoothing is performed on the ordered edge set to reduce noise and fluctuations in the data, making the data smoother and more stable. The average frequency of node interaction within the window and the frequency change gradient are calculated to generate an extended sequence element containing local statistical features. Feature smoothing can use methods such as moving average to process the communication frequency data in the ordered edge set. A fixed size window is selected, and the average frequency and frequency change gradient of node interaction within the window are calculated. The average frequency reflects the overall frequency of node interaction within the window, and the frequency change gradient reflects the trend of frequency change within the window. These local statistical features are combined with the original quadruple elements to generate an extended sequence element containing local statistical features. These extended sequence elements can provide more information and help improve the accuracy of pattern matching.

[0114] Step S417: The extended sequence elements are arranged in ascending order of timestamp offset to obtain a directed weighted sequence with temporal correlation, and the sequence length is equal to the number of connection edges in the node communication sequence.

[0115] The extended sequence elements are arranged in ascending order of timestamp offset to ensure that the directed weighted sequence has temporal correlation. The length of the directed weighted sequence obtained is equal to the number of connection edges in the node communication sequence. In the previous steps, extended sequence elements containing local statistical features have been generated. These elements are arranged in ascending order of timestamp offset to arrange the elements in the sequence in chronological order of communication occurrence. The directed weighted sequence obtained has temporal correlation and can better reflect the actual communication process of the node communication sequence. The length of the sequence is equal to the number of connection edges in the node communication sequence, ensuring that the sequence completely covers all connection information in the node communication sequence, providing a reliable data foundation for accurate pattern matching with attack behavior templates in the subsequent steps.

[0116] Step S420: Call the attack behavior template set in the preset attack feature library, each template contains the graph structure features, timing behavior features and protocol interaction features of the typical attack path, the graph structure features represent the node connection relationship through the adjacency matrix, and the timing behavior features represent the state transition probability through the Markov chain model.

[0117] The preset attack feature library is a database storing a plurality of known attack behavior features. The attack behavior template set in the preset attack feature library contains detailed information of various typical attacks. The graph structure feature of the typical attack path reflects the connection mode and topological relationship between the nodes involved in the attack process. The connection relationship between nodes is represented by an adjacency matrix. The elements in the adjacency matrix can explicitly represent whether there is a connection between the node pairs and the strength of the connection. The timing behavior feature describes the development law of the attack in the time dimension. The state transition probability is represented by a Markov chain model. The Markov chain model can predict the transition possibility of the future state based on the current state, thereby describing the timing change of the attack behavior. The protocol interaction feature reflects the interaction mode and characteristics of the network protocol used in the attack process. In actual network security detection, the attack behavior template set in the preset attack feature library can be called to compare the directed weighted sequence with the template, so as to identify whether the current node communication sequence matches the known attack mode. For example, when detecting whether there is a distributed denial of service (DDoS) attack in the network, the corresponding attack behavior template will contain feature information such as the connection relationship between nodes in the DDoS attack process, the variation law of attack traffic over time, and the protocol type used.

[0118] Step S430: Constructing a bidirectional attention mechanism matching model, taking the directed weighted sequence of the node communication sequence as a query vector and the graph structure feature of the attack behavior template as a key vector, and calculating the association weight of the sequence and the template in the node connection relationship through a multi-head attention layer.

[0119] The bidirectional attention mechanism matching model is a model for analyzing the association relationship between the sequence and the template, and can capture the similarity between the two from different angles. Taking the directed weighted sequence of the node communication sequence as the query vector means taking the sequence as the starting point to find the matching degree with the attack behavior template. Taking the graph structure feature of the attack behavior template as the key vector is because the graph structure feature can reflect the core structure information of the template. The multi-head attention layer is the key part of the model, which learns the association features in different semantic spaces through multiple parallel attention heads. Each attention head uses a different linear projection matrix to transform the query vector and the key vector and calculate the similarity, thereby obtaining multiple sets of attention weight matrices. These matrices reflect the association degree of the sequence elements and the template nodes in different semantic spaces. Through the calculation of the multi-head attention layer, the association weight of the sequence and the template in the node connection relationship can be more comprehensively captured.

[0120] As an implementation manner, step S430 can include steps S431-S436: Step S431: Initializing the bidirectional attention mechanism matching model, which includes a query vector encoding layer, a key vector encoding layer, a multi-head attention calculation layer, and a weight fusion layer.

[0121] Initializing the bidirectional attention mechanism matching model is the first step in building the model, which is composed of multiple key layers, each with its corresponding function. The query vector encoding layer is used to encode the directed weighted sequence of node communication sequences into a vector representation suitable for model processing. The key vector encoding layer is responsible for encoding the graph structure features of the attack behavior template and extracting key information. The multi-head attention calculation layer is the core of the model, which calculates the similarity between the query vector and the key vector through multiple attention heads to obtain multiple sets of attention weight matrices. The weight fusion layer is used to fuse multiple sets of attention weight matrices to obtain a comprehensive attention weight distribution. During initialization, the parameters and structure of each layer need to be determined, such as the number of neurons in the query vector encoding layer and the key vector encoding layer, the number of attention heads in the multi-head attention calculation layer, etc. The setting of these parameters will affect the performance and matching effect of the model.

[0122] Step S432: Input the directed weighted sequence of node communication sequences into the query vector encoding layer, convert the four-tuple structure into a high-dimensional dense vector through the embedding layer, extract the time-dependent features through the bidirectional LSTM network, and generate the sequence query vector.

[0123] After inputting the directed weighted sequence of node communication sequences into the query vector encoding layer, it first passes through the embedding layer. The role of the embedding layer is to convert the four-tuple structure (including source node identifier, destination node identifier, normalized frequency weight, and timestamp offset) in the directed weighted sequence into a high-dimensional dense vector. The four-tuple structure is a discrete information representation form, which can be mapped to a continuous high-dimensional vector space through the embedding layer, so that the model can better process and analyze this information. The bidirectional LSTM network (Long Short-Term Memory, long short-term memory network) is a recurrent neural network that can effectively process sequence data and capture long-distance dependencies in the sequence. In the bidirectional LSTM network, data can not only be transmitted from front to back, but also from back to front, which can fully utilize the context information of the sequence. By processing the embedded vector through the bidirectional LSTM network, the time-dependent features of the sequence are extracted, that is, the change rule and correlation of the sequence in the time dimension. The final generated sequence query vector contains the key information and time-dependent features of the directed weighted sequence, which is used for subsequent matching calculation with the attack behavior template. In the time sequence of a network attack, different stages of attack behavior may be related to each other, and the bidirectional LSTM network can capture these correlation information, thereby improving the recognition accuracy of the model to the attack pattern.

[0124] Step S433: input the adjacency matrix of the attack behavior template into the key vector encoding layer, learn the topological features of node connection through the graph convolutional network, generate the template key vector, and the hidden layer dimension of the GCN is consistent with the output dimension of the query vector encoding layer.

[0125] After inputting the adjacency matrix of the attack behavior template into the key vector encoding layer, the graph convolutional network (GCN) is used to learn the topological features of node connection. The graph convolutional network is a neural network specially designed for processing graph structure data, which can pass information between nodes of the graph through the message passing mechanism, thereby extracting the topological structure features of the graph. In the key vector encoding layer, the graph convolutional network processes the adjacency matrix, updates the feature representation of each node to include the information of the surrounding nodes. The generated template key vector contains the node connection topological features of the attack behavior template, which is used for matching with the sequence query vector. In order to ensure the compatibility of the query vector and the key vector in the subsequent calculation, the hidden layer dimension of the GCN is consistent with the output dimension of the query vector encoding layer. In this way, the query vector and the key vector can be effectively calculated in the multi-head attention calculation layer.

[0126] Step S434: in the multi-head attention calculation layer, the sequence query vector and the template key vector are calculated for similarity through multiple parallel attention heads, each attention head uses different linear projection matrices to learn the correlation features in different semantic spaces, and multiple sets of attention weight matrices are generated.

[0127] In the multi-head attention calculation layer, multiple parallel attention heads process the sequence query vector and the template key vector simultaneously. Each attention head uses different linear projection matrices to transform the query vector and the key vector, mapping them into different semantic spaces. In each semantic space, the similarity between the query vector and the key vector is calculated, usually using methods such as dot product to measure the similarity. In this way, each attention head can capture the correlation features of the sequence and the template in different aspects, generating a set of attention weight matrices. Multiple sets of attention weight matrices reflect the matching degree of sequence elements and template nodes in different semantic spaces. For example, one attention head may focus more on the connection strength between nodes, and another attention head may focus more on the type and attributes of nodes. Through the parallel calculation of multiple attention heads, the correlation information between the sequence and the template can be captured more comprehensively, and the matching accuracy can be improved. In a complex network attack scenario, different attack patterns may exhibit similarity in different semantic spaces, and the multi-head attention calculation layer can match from multiple angles, thereby better identifying attack behaviors.

[0128] Step S435: Weighted average fusion is performed on the multiple sets of attention weight matrices, and the weight coefficients are dynamically allocated according to the accuracy of each attention head in historical matching tasks to generate a comprehensive attention weight distribution map.

[0129] The weighted average fusion of the multiple sets of attention weight matrices is performed to integrate the matching information obtained by different attention heads and obtain a comprehensive attention weight distribution. The weight coefficients are dynamically allocated according to the accuracy of each attention head in historical matching tasks, which means that the attention head that performs more accurately in historical matching tasks will obtain a higher weight. In this way, the advantages of each attention head can be fully utilized to improve the accuracy of comprehensive matching. When performing weighted average fusion, the accuracy of each attention head is first calculated according to historical data, and then the weight coefficient of each attention head is calculated according to the accuracy. The attention weight matrix generated by each attention head is multiplied by the corresponding weight coefficient, and then the results are added to obtain the comprehensive attention weight distribution map. This distribution map reflects the matching degree of the sequence elements and the template nodes in the comprehensive semantic space, providing a basis for subsequent normalization processing and matching scoring.

[0130] Step S436: The comprehensive attention weight distribution map is normalized by a softmax function to obtain the association weight of the sequence elements and the template nodes, and the higher the weight value, the stronger the matching degree of the node connection mode at the corresponding position.

[0131] The comprehensive attention weight distribution map is normalized by a softmax function to convert the comprehensive attention weight distribution into a probability distribution form, so that the sum of the weight values of all elements is 1. The weight value after normalization can directly represent the association degree of the sequence elements and the template nodes, and the higher the weight value, the stronger the matching degree of the node connection mode at the corresponding position. The softmax function is a commonly used normalization function that converts the input numerical value into a probability value. Through exponential operation and normalization operation, the proportion of larger numerical values is highlighted and the proportion of smaller numerical values is suppressed. After obtaining the normalized association weight, the matching situation of the sequence and the template in the node connection relationship can be judged according to the size of the weight value.

[0132] Step S440: The dynamic time warping algorithm is introduced to perform nonlinear alignment on the time sequence behavior characteristics of the sequence and the template, calculate the optimal matching path and path cumulative distance on the time axis, and the smaller the distance value, the higher the time sequence similarity.

[0133] Dynamic Time Warping (DTW) is an algorithm for processing non-linear alignment of time series data. In network attack detection, the timing behavior characteristics of sequences and templates may have time stretching and deformation, for example, the occurrence time of attack behavior may be delayed or advanced. Dynamic time warping algorithm can align the timing behavior characteristics of sequences and templates by finding the optimal matching path on the time axis. In the calculation process, the algorithm will consider the feature values of each time point in the sequence and template, and find the path with the minimum cumulative distance as the optimal matching path by calculating the cumulative distance of different matching paths. The smaller the path cumulative distance, the higher the timing similarity between the sequence and the template. For example, in a network attack scenario, the sequence represents the timing characteristics of the currently detected attack behavior, and the template represents the timing characteristics of the known attack pattern. Through the dynamic time warping algorithm, the sequence and the template can be aligned on the time axis, and the timing similarity between them can be calculated. If the path cumulative distance is very small, it means that the timing development rule of the currently detected attack behavior is very similar to the known attack pattern, and it may be the same type of attack.

[0134] Step S450: Calculate the graph structure similarity between the node communication sequence and the attack behavior template using the graph kernel function, and quantify the topological matching degree of the node connection mode in the sequence and the template graph structure by the random walk kernel method.

[0135] The graph kernel function is a function for calculating the similarity between graph structures. In network attack detection, the graph kernel function can be used to calculate the graph structure similarity between the node communication sequence and the attack behavior template. The random walk kernel method is a commonly used method for calculating the graph kernel function, which quantifies the topological matching degree of the node connection mode in the sequence and the template graph structure by simulating the random walk process on the graph. In the random walk process, starting from a node, the next node is randomly selected according to a certain probability for walking, and the structure information of the graph can be obtained by multiple walks. By comparing the similarity of the node communication sequence and the attack behavior template in the random walk process, the graph structure similarity between them can be calculated. For example, in a network attack scenario, the node communication sequence and the attack behavior template can be regarded as two graph structures, and the topological matching degree of the node connection mode between the two graph structures can be calculated by the random walk kernel method. If the graph structure similarity is high, it means that the node connection mode of the node communication sequence is very similar to the graph structure of the attack behavior template, and there may be a match of attack behavior.

[0136] Step S460: Fuse the correlation weight, timing similarity and graph structure similarity, generate a comprehensive matching score by weighted voting mechanism, the comprehensive matching scores of all attack behavior templates constitute an attack matching degree score set, and the weight coefficient is dynamically adjusted according to the historical attack detection accuracy.

[0137] The fusion of the correlation weight, the timing similarity and the graph structure similarity is to comprehensively consider the matching of the sequence and the template in different aspects, and to generate a more comprehensive comprehensive matching score. By a weighted voting mechanism, different weights are assigned to each matching index, and the correlation weight, the timing similarity and the graph structure similarity are weighted and summed according to the weights to obtain the comprehensive matching score. The weight coefficient is dynamically adjusted according to the historical attack detection accuracy, which means that the matching index that performs more accurately in the historical detection will obtain a higher weight. The comprehensive matching scores of all attack behavior templates constitute an attack matching degree score set, and through this set, the matching degree of the sequence and different attack behavior templates can be quickly compared. For example, in the long-term network attack detection process, if it is found that the correlation weight is more accurate in identifying a certain type of attack, then in the fusion process, the weight coefficient of the correlation weight will be relatively high. By dynamically adjusting the weight coefficient, the accuracy of the comprehensive matching score can be improved, and the network attack type can be better identified.

[0138] Step S500: determining the network attack type and the attack source node positioning information according to the attack matching degree score set, and generating a network attack detection result containing the attack type identifier and the source node coordinates.

[0139] Determining the network attack type and the attack source node positioning information according to the attack matching degree score set is the final goal of network attack detection. The attack matching degree score set reflects the matching degree of the node communication sequence and different attack behavior templates, and by comparing the scores in the score set, the most matched attack behavior template can be determined, so that the network attack type can be determined. The attack source node positioning information is found out by analyzing the node communication sequence and the network topology structure. The generated network attack detection result contains the attack type identifier and the source node coordinates. The attack type identifier clearly indicates the specific type of attack, such as DDoS attack, SQL injection attack, etc., and the source node coordinates indicate the location of the attack source in the network topology. In actual network security management, these information is very important for taking targeted defense measures and emergency response.

[0140] As an implementation manner, step S500 can include the following steps S510-S570: Step S510: performing dynamic threshold screening on the attack matching degree score set, setting the initial threshold as the mean of all scores plus one standard deviation, and selecting the attack behavior templates with scores higher than the threshold to form a candidate attack template set.

[0141] The dynamic threshold screening is performed on the attack matching score set in order to screen out the most likely matching templates from numerous attack behavior templates. The initial threshold is set as the mean value of all scores plus one standard deviation, which is a screening method based on statistical analysis. The mean value reflects the average level of the score set, and the standard deviation reflects the dispersion degree of the scores. The mean value plus one standard deviation is used as the threshold, so that the attack behavior templates with higher scores can be screened out, and these templates have a relatively high matching degree with the node communication sequence. The attack behavior templates with scores higher than the threshold are selected to form a candidate attack template set, and the templates in this set are the most likely attack patterns matching the current node communication sequence. In actual network attack detection, the attack matching score set may contain a large number of scores, and the dynamic threshold screening can quickly narrow the range and improve the efficiency of subsequent analysis.

[0142] Step S520: Extract the attack type identifier, typical attack feature vector and historical detection accuracy corresponding to each template in the candidate attack template set. The typical attack feature vector includes attack path length, protocol type distribution and node type preference.

[0143] The attack type identifier, typical attack feature vector and historical detection accuracy corresponding to each template in the candidate attack template set are extracted in order to further analyze the characteristics and performance of the candidate attack templates. The attack type identifier clearly identifies the attack type represented by each template, such as port scanning attack, malware propagation attack, etc. The typical attack feature vector contains key feature information of the attack, the attack path length reflects the number of nodes involved in the attack process and the complexity of the connection relationship, the protocol type distribution reflects the proportion and characteristics of the network protocols used by the attack, and the node type preference indicates which types of nodes the attack is more inclined to target. The historical detection accuracy is the accuracy of the template in past detection tasks, which reflects the reliability of the template. By extracting these information, the candidate attack templates can be compared and analyzed more deeply, and the basis for determining the final attack type is provided. For example, when analyzing a candidate attack template, if its attack path length is long, the proportion of a certain specific protocol in the protocol type distribution is high, and the historical detection accuracy is also high, then the attack type represented by the template is more likely to be the type of the current network attack.

[0144] Step S530: Perform multi-dimensional feature comparison between the candidate attack template set and the node communication sequence, calculate the cosine similarity between the template typical attack feature vector and the sequence feature vector, and combine the attack matching degree score for weighted fusion to generate a comprehensive confidence score.

[0145] The multi-dimensional feature comparison between the candidate attack template set and the node communication sequence is performed in order to comprehensively evaluate the matching degree of the template and the sequence. The cosine similarity of the typical attack feature vector of the template and the sequence feature vector is calculated. The cosine similarity is a vector similarity measurement method, which measures the similarity of two vectors by calculating the cosine value of the included angle, and the value closer to 1 indicates a higher similarity. The weighted fusion of the attack matching degree score is combined in order to comprehensively consider the performance of the template and the sequence in feature matching and overall matching degree. When weighted fusion, different weights are assigned to the cosine similarity and the attack matching degree score, and the weighted sum is calculated according to the importance of the two indicators to generate a comprehensive confidence score. The higher the comprehensive confidence score, the higher the matching degree of the candidate attack template and the node communication sequence, and the more likely it is the type of current network attack. In actual network attack detection, multi-dimensional feature comparison and weighted fusion can more accurately evaluate the attack type and avoid the limitations of single indicator evaluation. For example, a candidate attack template has a high attack matching degree score, but a low cosine similarity, indicating that although the overall matching degree is good, there may be differences in feature details. Through weighted fusion, both factors can be considered to obtain a more accurate comprehensive confidence score.

[0146] As an implementation, step S530 can include the following steps S531-S535: Step S531: convert the node communication sequence into a sequence feature vector of the same dimension as the attack behavior template, and the vector elements include the number of path nodes, communication frequency distribution, protocol type proportion, and time span parameters.

[0147] Converting the node communication sequence into a sequence feature vector of the same dimension as the attack behavior template is to facilitate feature comparison. The vector elements include the number of path nodes, communication frequency distribution, protocol type proportion, and time span parameters, which reflect the key features of the node communication sequence. The number of path nodes indicates the number of nodes involved in the attack path, the communication frequency distribution reflects the frequency and regularity of communication between nodes, the protocol type proportion reflects the proportion of the protocol type used in communication, and the time span parameter records the duration of the attack behavior. By converting the node communication sequence into such a feature vector, it can be directly compared with the typical attack feature vector of the attack behavior template. In actual network attack detection, the node communication sequence may exist in different forms, and by converting it into a feature vector, the data format can be unified and the accuracy of feature comparison can be improved.

[0148] Step S532: extract the typical attack feature vector of each template from the candidate attack template set to ensure that the dimension and dimension of the sequence feature vector are consistent.

[0149] The typical attack feature vector of each template is extracted from the candidate attack template set, and the dimension and dimension of the sequence feature vector are ensured to be consistent, in order to ensure the effectiveness of the feature comparison. The consistency of the dimension means that the two vectors contain the same number of elements, and each element represents the same feature information; the consistency of the dimension means that the value range and unit of the element are the same. When extracting the typical attack feature vector, the information in the template needs to be sorted and converted to make it comparable with the sequence feature vector. For example, if the communication frequency distribution in the sequence feature vector is represented by the number of data packets per second, the communication frequency distribution in the typical attack feature vector in the candidate attack template set should also be represented in the same unit. By ensuring the consistency of the dimension and the dimension, the cosine similarity between the two vectors can be accurately calculated, and the accuracy of the feature comparison can be improved.

[0150] Step S533: Calculate the direction similarity of the sequence feature vector and the typical attack feature vector of each template, and normalize the direction similarity to convert it into a feature matching score in the interval [0, 1].

[0151] The direction similarity of the sequence feature vector and the typical attack feature vector of each template is calculated, usually using cosine similarity to measure. Cosine similarity calculates the cosine value of the included angle between two vectors, and the closer the value is to 1, the more similar the direction of the two vectors is. The direction similarity is normalized to convert it into a feature matching score in the interval [0, 1], in order to make the score comparable and intuitive. Normalization can use linear transformation and other methods to map the value of cosine similarity to the interval [0, 1]. The higher the feature matching score, the higher the similarity between the sequence feature vector and the typical attack feature vector of the template, that is, the better the matching degree of the node communication sequence and the attack behavior template in the feature.

[0152] Step S534: Obtain the attack matching degree score of each template in the candidate attack template set, and perform weighted summation on the score and the feature matching score through dynamic weight allocation, and the weight allocation is dynamically adjusted according to the standard deviation of the feature matching score, and the higher the feature discrimination, the greater the weight.

[0153] The attack matching degree score of each template in the candidate attack template set is obtained, and the feature matching score is weighted and summed by dynamic weight distribution, in order to comprehensively consider the performance of the template and the sequence in the overall matching degree and the feature matching degree. The dynamic weight distribution is dynamically adjusted according to the standard deviation of the feature matching score. The standard deviation reflects the dispersion degree of the feature matching score. The higher the feature discrimination, that is, the larger the standard deviation, the more obvious the difference between the features in different templates, and the larger the weight. In this way, the weight can be reasonably allocated according to the discrimination ability of the feature, and the accuracy of the weighted sum can be improved. For example, if the discrimination of a certain feature between different templates is very high, the weight of the feature matching score in the weighted sum will be relatively high, so as to highlight the importance of the feature.

[0154] Step S535: multiply the weighted sum result by the historical detection accuracy of the template to obtain a comprehensive confidence score.

[0155] The weighted sum result is multiplied by the historical detection accuracy of the template to obtain a comprehensive confidence score. The historical detection accuracy reflects the reliability of the template in past detection tasks. Multiplying the weighted sum result by the historical detection accuracy can further improve the accuracy of the comprehensive confidence score. If the historical detection accuracy of a template is high, it means that the template is reliable in identifying attack types, and multiplying it by the weighted sum result can enhance the influence of the template in the final evaluation. The comprehensive confidence score comprehensively considers the overall matching degree of the template and the sequence, the feature matching degree, and the historical detection accuracy of the template, and is an important indicator for evaluating the matching degree of the candidate attack template and the node communication sequence. In actual network attack detection, by comparing the comprehensive confidence scores of different candidate attack templates, the most likely attack type can be determined.

[0156] Step S540: determine the final network attack type by using a weighted voting mechanism. The voting weight of each template in the candidate template set is the product of its comprehensive confidence score and historical detection accuracy, and the attack type with the highest votes is taken as the final result.

[0157] The weighted voting mechanism is used to determine the final network attack type, which is a decision-making method considering multiple factors. The voting weight of each template in the candidate template set is the product of its comprehensive confidence score and historical detection accuracy, which means that the template with higher comprehensive confidence score and higher historical detection accuracy has larger voting weight. By associating the voting weight of each template with its corresponding attack type, the voting weights of all candidate templates are accumulated, and the attack type with the highest votes is taken as the final result. This weighted voting mechanism fully considers the matching degree of the template and the node communication sequence and the reliability of the template itself. In actual network attack scenarios, different candidate attack templates may have different matching degrees and historical performances for the same node communication sequence. For example, one template has a higher comprehensive confidence score but a relatively lower historical detection accuracy, while another template has a slightly lower comprehensive confidence score but a higher historical detection accuracy. Through the weighted voting mechanism, these two factors can be balanced to more accurately determine the final network attack type.

[0158] Step S550: Implement hierarchical attack source tracing, analyze the location attribute of the starting node of the node communication sequence in the network topology, and distinguish edge access nodes, core forwarding nodes and terminal nodes, and different types of nodes adopt differentiated tracing strategies.

[0159] Implementing hierarchical attack source tracing is an effective method of tracking attack sources based on network topology structure. By analyzing the location attribute of the starting node of the node communication sequence in the network topology, the network nodes are divided into edge access nodes, core forwarding nodes and terminal nodes. Edge access nodes are usually the entrance of network connection with external, such as firewall, router and other devices in enterprise network; core forwarding nodes are responsible for high-speed forwarding of internal data in network, such as core switches in data center; terminal nodes are devices directly connected with users or application programs, such as computers, servers, etc. Different types of nodes have different characteristics and functions, so differentiated tracing strategies are adopted. For edge access nodes, they are directly connected with external network and may be more susceptible to external attacks, so the access port information and access authentication state can be focused on during tracing; core forwarding nodes play a key role in forwarding in network, so the original entry interface and upstream forwarding node of data packet can be traced by calling their routing forwarding table during tracing; terminal nodes are the final target or source of attack, so abnormal process activity and abnormal network connection can be checked during tracing. Through hierarchical attack source tracing, the nodes can be traced according to their characteristics, improving the efficiency and accuracy of tracing.

[0160] As an implementation, step S550 can include steps S551-S556: Step S551: Analyze the network topology data, build a node attribute classification model, and divide the network nodes into three categories: edge access nodes, core forwarding nodes, and terminal nodes, by IP address segment, subnet mask, gateway configuration, and routing table information of the nodes.

[0161] Analyzing the network topology data is the basis for implementing hierarchical attack source tracing. By collecting the IP address segment, subnet mask, gateway configuration, and routing table information of the nodes in the network, a node attribute classification model is built. The IP address segment can reflect the approximate location and attribution range of the node in the network; the subnet mask is used to determine the network part and host part of the IP address; the gateway configuration indicates the connection mode of the node to the external network; and the routing table information records the routing relationship between nodes. Using this information, the network nodes can be divided into three categories: edge access nodes, core forwarding nodes, and terminal nodes. For example, a node with a set IP address segment and connected to an external network may be an edge access node; a node located in the network core and responsible for a large amount of data forwarding may be a core forwarding node; and a node directly connected to a user device may be a terminal node. The node attribute classification model can be built using machine learning algorithms such as decision tree, support vector machine, etc., through the learning and classification of known node attributes to achieve accurate classification of unknown nodes.

[0162] Step S552: Extract the first node in the node communication sequence as the starting node, and query its class label in the node attribute classification model.

[0163] The first node in the node communication sequence is extracted as the starting node because the starting node is usually the starting point of the attack or the node that participates in the attack earliest. Querying its class label in the node attribute classification model can determine the type of the starting node, i.e., edge access node, core forwarding node, or terminal node. In the node communication sequence, the location information of the first node can be determined by time stamp, etc. After determining the starting node, its related information is input into the node attribute classification model, and the class label is obtained according to the classification result of the model.

[0164] Step S553: When the starting node is an edge access node, it is directly included in the attack source candidate set, and its access port information and access authentication state are marked.

[0165] When the starting node is an edge access node, it is directly included in the attack source candidate set because it is directly connected to the external network and is likely to be the entry point of the attack. At the same time, its access port information and access authentication state are marked. The access port information can indicate which port the attack enters the network through, which is important for investigating the source of the attack and preventing subsequent attacks. The access authentication state can reflect whether the access of the node is through legal authentication. If the authentication state is abnormal, there may be illegal access, which further increases the possibility of the node as an attack source.

[0166] Step S554: When the starting node is a core forwarding node, the routing forwarding table of the node is called to trace the original entry interface and upstream forwarding node of the data packet. The upstream node is added to the attack source candidate set, and the process is recursively performed until the edge access node or terminal node is found.

[0167] When the starting node is a core forwarding node, since the core forwarding node is mainly responsible for data forwarding, the attack may be initiated from its upstream node. Therefore, the routing forwarding table of the node is called to trace the original entry interface and upstream forwarding node of the data packet. The routing forwarding table records the routing information between nodes. By querying the routing forwarding table, it can be determined from which interface the data packet enters the core forwarding node, and the upstream node connected by the interface. The upstream node is added to the attack source candidate set, and the process is recursively performed to continuously trace the source of the data packet until the edge access node or terminal node is found.

[0168] Step S555: When the starting node is a terminal node, check whether it has abnormal process activity and abnormal network connection. If it does, it is directly marked as an attack source candidate node. Otherwise, trace its gateway node.

[0169] When the starting node is a terminal node, it needs to be checked whether it has abnormal process activity and abnormal network connection. Abnormal process activity may include running some unknown or malicious programs; abnormal network connection may be manifested as communication with some suspicious IP addresses. If these abnormal conditions exist, it means that the terminal node is likely to be an attack source and is directly marked as an attack source candidate node. If no abnormal conditions are found, the gateway node of the terminal node needs to be traced, because the attack may be propagated to the terminal node through the gateway node.

[0170] Step S556: All nodes in the attack source candidate set are arranged in ascending order of access timestamp, and a trace path tree is constructed. The root node of the tree is the sequence starting node, and the leaf node is the potential attack source.

[0171] All nodes in the attack source candidate set are arranged in ascending order of access timestamp, so as to sort the nodes according to the order of attack occurrence, facilitating the construction of a tracing path tree. The tracing path tree is a tree structure, the root node of the tree is the sequence starting node, representing the starting point of the attack; the leaf node is the potential attack source, representing the possible attack starting node. By constructing the tracing path tree, the propagation path of the attack and the possible attack source can be clearly displayed. When arranging the nodes, the access timestamp can record the time when the node accesses the network, and the ascending order can make the construction of the tracing path tree conform to the actual propagation process of the attack. When constructing the tracing path tree, starting from the root node, according to the connection relationship and time sequence between nodes, the child nodes are gradually added until all attack source candidate nodes are included in the tree.

[0172] Step S560: Communication behavior feature verification is performed on the candidate attack source nodes, the matching degree of the data packet interaction features of the candidate attack source nodes in the attack occurrence period and the typical attack initiation feature library is compared, normal business nodes are excluded, and the real attack source nodes are locked.

[0173] The communication behavior feature verification is performed on the candidate attack source nodes, so as to filter out the real attack source nodes from the candidate attack source nodes. By comparing the matching degree of the data packet interaction features of the candidate attack source nodes in the attack occurrence period and the typical attack initiation feature library, it can be judged whether the node is an attack source. The typical attack initiation feature library is a database containing typical features of various attack types, including data packet size, frequency, protocol type, communication direction, etc. In the attack occurrence period, the data packet interaction features of the candidate attack source nodes are recorded, such as data packet sending and receiving frequency, data packet protocol type distribution, etc. These features are compared with the typical attack initiation feature library. If the matching degree is high, it means that the node is likely to be an attack source; if the matching degree is low, it means that the node is likely to be a normal business node and can be excluded.

[0174] Step S570: The final network attack type identification, the coordinate position of the attack source node in the network topology, the comprehensive confidence score and the attack path visualization data are integrated to generate a standardized network attack detection result report.

[0175] The final network attack type identification, the coordinate position of the attack source node in the network topology, the comprehensive confidence score, and the attack path visualization data are integrated to generate a standardized network attack detection result report. The final network attack type identification clearly indicates the specific type of attack, such as DDoS attack, SQL injection attack, etc. The coordinate position of the attack source node in the network topology indicates the specific location of the attack source, facilitating positioning and processing by network administrators. The comprehensive confidence score reflects the reliability of the detection result. The attack path visualization data can visually display the propagation path and impact range of the attack. Integrating these information into a standardized report can provide comprehensive and accurate information to network administrators and security personnel, facilitating them to take appropriate measures for attack prevention and processing. When generating the report, a unified format and template can be used to make the report standardized and readable. For example, the report can include detailed description of attack type, location information of attack source, explanation of comprehensive confidence score, and visualization chart of attack path, etc.

[0176] In the above introduction of the embodiments of the present application, various algorithms involved can be known from related contents in the prior art. In order to save space, the embodiments of the present application will not be expanded too much. In addition, those skilled in the art can supplement details according to common knowledge in the art when implementing the present application. For example, according to common knowledge in the art, normalization can be used to eliminate dimensional conflict before feature fusion, interpolation can be used to eliminate dimensional difference, threshold can be reasonably set based on historical data, experience or business scenario requirements, model training can be based on general model training method, number of layers in model structure can be set based on actual needs, and activation function can be selected, etc. The present application will not introduce redundant details of the implementation process.

[0177] Figure 2 A component structure diagram of a network attack detection device provided by the embodiments of the present application is shown in Figure 2 As shown in the figure, the network attack detection device 200 includes: A data acquisition module 210 is configured to receive real-time traffic data synchronously collected by distributed intelligent probes at each node in the network. The real-time traffic data carries node identification information and collection timestamps. The node identification information is used to distinguish the traffic sources of different network nodes. A graph construction module 220 is configured to model the inter-node interaction relationship of the real-time traffic data, identify the traffic communication mode between different network nodes, and generate a traffic association graph containing node connection relationships and communication frequencies. A sequence extraction module 230 is configured to mine abnormal communication paths based on the traffic association graph, analyze the deviation degree of node connection relationships and the fluctuation characteristics of communication frequencies, and extract node communication sequences with abnormal patterns. The matching calculation module 240 is configured to perform pattern matching processing on the node communication sequence and an attack behavior template in a preset attack feature library, calculate a sequence matching similarity, and generate an attack matching degree score set. The attack identification module 250 is configured to determine a network attack type and attack source node positioning information according to the attack matching degree score set, and generate a network attack detection result containing the attack type identifier and the source node coordinates.

[0178] The above description of the device embodiments is similar to the description of the method embodiments, and has similar beneficial effects to the method embodiments. In some embodiments, the device provided by the embodiments of the application has the functions or includes the modules for executing the methods described in the above method embodiments. For technical details not disclosed in the device embodiments of the application, please refer to the description of the method embodiments of the application.

[0179] Figure 3 A hardware entity schematic diagram of a computer system provided by the embodiments of the application is shown in FIG. 10. Figure 3 As shown in FIG. 10, the hardware entity of the computer system 1000 includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program capable of running on the processor 1001, and the processor 1001 implements the steps in the method of any of the above embodiments when executing the program.

[0180] Figure 4 The flow of the method is as follows: Step 1: report the collected feature data of various communication flows; Step 2: transmit to the communication server of the system; Step 3: upload the data to the network topology flow analysis management module; Step 4: the network topology analysis management module performs graph modeling according to the reported feature data of the communication flow, and performs real-time security analysis according to the feature library and the algorithm library. If security defense is required after analysis, the security defense instruction is issued to the security defense management module; Step 5: the security defense management module issues the security defense instruction to the network device and the probe for execution.

Claims

1. A network attack detection method based on distributed smart probes, characterized in that, The method includes: Receive real-time traffic data synchronously collected by distributed smart probes at various nodes in the network. The real-time traffic data carries node identification information and collection timestamp. The node identification information is used to distinguish the traffic source of different network nodes. The real-time traffic data is modeled to identify the traffic communication patterns between different network nodes, and a traffic correlation graph containing node connection relationships and communication frequencies is generated. Based on the traffic correlation map, abnormal communication paths are mined. By analyzing the deviation of node connection relationships and the fluctuation characteristics of communication frequency, node communication sequences with abnormal patterns are extracted. The node communication sequence is matched with the attack behavior template in the preset attack feature library to calculate the sequence matching similarity and generate an attack matching score set. Based on the attack matching score set, the network attack type and attack source node location information are determined, and a network attack detection result containing the attack type identifier and source node coordinates is generated.

2. The method according to claim 1, characterized in that, The process of modeling the inter-node interaction relationships of the real-time traffic data, identifying traffic communication patterns between different network nodes, and generating a traffic correlation graph containing node connection relationships and communication frequencies includes: The real-time traffic data is processed by session segmentation. Based on the node identification information and the collection timestamp, the traffic data is aggregated into a set of session units with bidirectional transmission process. Each session unit contains a source node identifier, a destination node identifier, and data packet transmission records sorted by timestamp. Extract the dynamic interaction features of each session unit in the session unit set. The dynamic interaction features include session duration, data packet interval fluctuation sequence and protocol type distribution. The session duration is calculated by the difference between the timestamps of the first and last data packets, and the data packet interval fluctuation sequence is generated by sorting the timestamp differences of adjacent data packets. Based on the dynamic interaction features, a node association matrix is ​​constructed. The row dimension of the matrix corresponds to the source node identifier set, and the column dimension corresponds to the destination node identifier set. The matrix elements are filled with the cumulative frequency of node interaction events in the session unit. The node association matrix is ​​normalized by time window, and the proportion of the interaction frequency of each node pair to the total interaction frequency within the unit monitoring period is statistically analyzed to generate a communication frequency distribution matrix between nodes. A spatiotemporal correlation weighting factor is introduced to dynamically adjust the weights of matrix elements based on the hierarchical position of nodes in the network topology and the stability of historical interactions, thereby generating a weighted node correlation matrix. The weighted node association matrix and the communication frequency distribution matrix are combined to construct a traffic association graph. The vertices of the graph represent network nodes, and the vertex attributes include node identifier and hierarchical position. The edges represent node connection relationships, and the edge attributes include weighted communication frequency and protocol type distribution.

3. The method according to claim 2, characterized in that, The step of extracting dynamic interaction features of each session unit in the session unit set includes session duration, data packet interval fluctuation sequence, and protocol type distribution, including: For each session unit, the difference between the timestamp of the first data packet collection and the timestamp of the last data packet collection is extracted to obtain the session duration parameter based on the smallest timestamp unit; The data packet transmission records of each session unit are arranged in ascending order of the collection timestamp. The timestamp difference between adjacent data packets is calculated and formed into an ordered sequence, which serves as the data packet interval fluctuation sequence. Iterate through the data packet transmission records in the session unit, identify the application layer protocol type field of each data packet, count the number of times different protocol types appear, and generate a protocol type counter. Normalize the protocol type counters and calculate the ratio of the number of occurrences of each protocol type to the total number of data packets to obtain the protocol type distribution. The data packet interval fluctuation sequence is smoothed to eliminate instantaneous noise interference, resulting in a filtered interval fluctuation sequence. An autoregressive moving average model is used to predict the trend of the filtered interval fluctuation sequence, calculate the probability distribution of data packet arrival time within a preset window, and generate time series prediction features. The session duration parameter, the filtered interval fluctuation sequence, the protocol type proportion distribution, and the time series prediction features are integrated into a structured feature vector, which serves as the storage carrier for dynamic interaction features.

4. The method according to claim 3, characterized in that, The construction of a node association matrix based on the dynamic interaction features, where the row dimension corresponds to the source node identifier set and the column dimension corresponds to the destination node identifier set, and the matrix elements are filled with the cumulative frequency of node interaction events in the session unit, includes: Extract a unique set of identifiers from the source node identifiers and destination node identifiers of all session units, construct a list of node identifiers, and assign a matrix index value to each identifier; Initialize a square matrix with dimensions matching the length of the node identifier list as the node association matrix framework, with all initial element values ​​set to zero; Traverse the set of session units. For each session unit, find the corresponding matrix index based on the source node identifier and the destination node identifier, and increment the element value at the corresponding position in the node association matrix frame by 1. Session units containing the same source-destination node identifier pairs are merged, and the cumulative number of their interaction events is used as the updated value of the matrix elements; Introducing feature correlation weights, the feature contribution is calculated based on the proportion distribution of protocol types in dynamic interaction features and time series prediction features, and node pair interaction weight coefficients are generated. Multiply the matrix element values ​​with the corresponding node interaction weight coefficients to obtain the weighted interaction frequency, and update the node association matrix elements. By removing node pairs whose weighted interaction frequency is below a preset threshold through matrix sparsification, and retaining the significantly related node connections, a sparse node association matrix is ​​generated.

5. The method according to claim 1, characterized in that, The abnormal communication path mining based on the traffic correlation map, by analyzing the deviation of node connection relationships and the fluctuation characteristics of communication frequency, extracts node communication sequences with abnormal patterns, including: A dynamic communication baseline model is constructed, which integrates the temporal correlation and spatial topological dependence of the historical communication behavior of nodes. The probability distribution of node connection relationships and the time-varying characteristics of communication frequency under normal communication mode are learned through the non-parametric kernel density estimation method, and a baseline parameter set containing the node pair association probability matrix and time-varying frequency parameters is generated. Calculate the structural difference between the node pair association probability matrix of the current traffic association map and the baseline parameter set, map the node connection relationship to a low-dimensional feature space, and calculate the Bach distance between the current distribution and the baseline distribution in the feature space as the node connection deviation. The communication frequency fluctuation entropy index is introduced to perform complexity analysis on the communication frequency time series of each node connection. The irregularity of the sequence is calculated by the sample entropy algorithm. The higher the entropy value, the more severe the frequency fluctuation. A multi-dimensional anomaly scoring mechanism is constructed, which obtains a comprehensive anomaly score by weighted summation of node connection deviation and communication frequency fluctuation entropy. The weight coefficients are dynamically adjusted according to the distinguishing ability of each indicator in historical attack samples. The nodes in the traffic correlation graph are sorted based on the comprehensive anomaly score. Edges with scores higher than the dynamic threshold are selected as abnormal connection edges. The dynamic threshold is adjusted in real time according to the current network load level by an adaptive control graph algorithm. In the traffic association graph, trace the connected subgraph containing abnormal connection edges. Starting from the abnormal connection edge, expand the adjacent nodes in sequence according to the communication time sequence, and extract the path containing at least three nodes and the proportion of abnormal connection edges exceeds the preset ratio as the node communication sequence.

6. The method according to claim 5, characterized in that, The construction of a dynamic communication baseline model integrates the temporal correlation and spatial topological dependence of historical node communication behavior. It learns the probability distribution of node connection relationships and the time-varying characteristics of communication frequency under normal communication patterns using a non-parametric kernel density estimation method, generating a baseline parameter set containing a node pair association probability matrix and time-varying frequency parameters, including: Collect historical traffic correlation graph data from multiple complete monitoring periods. Each period's data includes a snapshot of node connection relationships and the corresponding communication frequency time series. Historical data is preprocessed to remove abnormal communication records during known attack events, and communication data marked as normal is retained as the training sample set. Based on the network topology, the shortest path distance between nodes is calculated, and a spatial topology dependency matrix is ​​constructed. The matrix elements represent the degree of connection between node pairs in the physical topology. The communication frequency time series of each node pair is decomposed into trend, periodic and random components using the time series decomposition method, thus separating the long-term trend and periodic fluctuation characteristics of the communication frequency. For the preprocessed normal communication data, the nonparametric kernel density estimation method is used to estimate the probability distribution of the occurrence of connection relationships and the conditional probability distribution of communication frequency for each node. A time decay factor is introduced to assign different weights to training samples from different historical periods, with recent samples having a higher weight than older samples. The probability distribution model is updated by estimating the weighted kernel density. The node pair association probability distribution, communication frequency time-varying parameters, and spatial topological dependency matrix are integrated to form the baseline parameter set of the dynamic communication baseline model.

7. The method according to claim 6, characterized in that, The constructed multi-dimensional anomaly scoring mechanism obtains a comprehensive anomaly score by weighted summation of node connection deviation and communication frequency fluctuation entropy. The weight coefficients are dynamically adjusted based on the discriminative power of each indicator in historical attack samples, including: Collect a sample set of historical attack events. Each sample contains the node connection deviation, communication frequency fluctuation entropy and corresponding attack label at the time of the attack. The node connection deviation and communication frequency fluctuation entropy in the historical sample set are standardized. The ability of computing node connection deviation and communication frequency fluctuation entropy to distinguish attack tags is calculated. The higher the information gain ratio, the greater the contribution of this indicator in anomaly detection. Initialize the weight coefficients based on the information gain ratio results; A logistic regression classifier is constructed, with standardized node connection deviation and communication frequency fluctuation entropy as input features and attack labels as output targets. The logistic regression classifier is trained using historical sample sets. Extract the feature coefficients of the trained logistic regression classifier, normalize them, and use them as dynamically adjusted weight coefficients to replace the initial weights. For the current detection data, the standardized node connection deviation is multiplied by the corresponding weight coefficient, and the standardized communication frequency fluctuation entropy is multiplied by its weight coefficient to obtain the comprehensive anomaly score.

8. The method according to claim 1, characterized in that, The step of performing pattern matching processing between the node communication sequence and attack behavior templates in a preset attack feature library, calculating sequence matching similarity, and generating an attack matching score set includes: The node communication sequence is converted into a graph structure serialization, which maps the node connection relationship and communication frequency attribute into a directed weighted sequence. The sequence element includes source node identifier, destination node identifier, communication frequency and timestamp offset. Call the attack behavior template set in the preset attack feature library. Each template contains graph structure features, temporal behavior features and protocol interaction features of typical attack paths. The graph structure features represent the node connection relationship through an adjacency matrix, and the temporal behavior features represent the state transition probability through a Markov chain model. A bidirectional attention mechanism matching model is constructed, which uses the directed weighted sequence of node communication sequence as the query vector and the graph structure features of the attack behavior template as the key vector. The association weight between the sequence and the template in the node connection relationship is calculated through a multi-head attention layer. A dynamic time warping algorithm is introduced to nonlinearly align the temporal behavior features of the sequence and the template, calculate the optimal matching path and the cumulative path distance on the time axis, and the smaller the distance value, the higher the temporal similarity. The graph kernel function is used to calculate the graph structure similarity between the node communication sequence and the attack behavior template, and the random walk kernel method is used to quantify the degree of topological matching between the node connection pattern in the sequence and the template graph structure. By integrating association weights, temporal similarity, and graph structure similarity, a comprehensive matching score is generated through a weighted voting mechanism. The comprehensive matching scores of all attack behavior templates constitute the attack matching score set, and the weight coefficients are dynamically adjusted based on the historical attack detection accuracy.

9. The method according to claim 8, characterized in that, The graph structure serialization transformation of the node communication sequence maps the node connection relationship and communication frequency attribute into a directed weighted sequence. The sequence elements include source node identifier, destination node identifier, communication frequency, and timestamp offset, including: Traverse the node connection relationships in the node communication sequence, sort the connection edges in ascending order according to the communication occurrence timestamp, and construct an ordered edge set; Extract the source node identifier and destination node identifier for each connection edge, and query the communication frequency attribute of the corresponding edge from the traffic association graph; Calculate the difference between the timestamp of each connection edge and the start timestamp of the sequence to obtain the timestamp offset; The source node identifier, destination node identifier, communication frequency, and timestamp offset are combined into a quadruple structure, which serves as the basic element of the directed weighted sequence. Logarithmic normalization is performed on the communication frequencies in the sequence elements to convert the original frequency values ​​into normalized frequency weights within a preset numerical range. The ordered edge set is smoothed by feature smoothing, the average frequency and frequency change gradient of node interactions within the window are calculated, and an extended sequence element containing local statistical features is generated. The extended sequence elements are sorted in ascending order by timestamp offset to obtain a directed weighted sequence with temporal correlation. The sequence length is equal to the number of connection edges in the node communication sequence.

10. A computer system comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method according to any one of claims 1 to 9.

Images