A Network Attack Detection Method and System Based on Distributed Smart Probes

Abstract

This invention provides a network attack detection method and system based on distributed intelligent probes. It receives real-time traffic data synchronously collected by distributed intelligent probes at various network nodes, models the interaction relationships between nodes in the real-time traffic data, identifies traffic communication patterns between different network nodes, and generates a traffic correlation graph containing node connection relationships and communication frequencies. Based on the traffic correlation graph, it mines abnormal communication paths, extracting node communication sequences with abnormal patterns by analyzing the deviation degree of node connection relationships and the fluctuation characteristics of communication frequencies. It then performs pattern matching processing between the node communication sequences and attack behavior templates in a preset attack feature library, calculates the sequence matching similarity, and generates an attack matching score set. Finally, it determines the network attack type and the location information of the attack source node, generating a network attack detection result. This invention improves the practicality and effectiveness of network attack detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network attack detection method and system based on distributed smart probes. Background Technology

[0002] With the rapid development of network technology and the popularization of network applications, network attack detection technology plays an increasingly important role in ensuring network security. Network attack detection technology refers to the technology of identifying potential attack behaviors and issuing alarms by analyzing network traffic data. At present, common network attack detection technologies mostly adopt centralized traffic collection or anomaly detection methods based on single indicators, and identify known attack patterns through preset rules or feature matching. However, when facing complex network attacks with dynamic propagation characteristics, traditional detection methods are difficult to effectively capture the complete evolution process of the attack path, resulting in the need to improve the accuracy and comprehensiveness of attack detection. At the same time, there are also limitations in attack type identification and attack source location. Summary of the Invention

[0003] In view of this, the present invention provides a network attack detection method and system based on distributed smart probes.

[0004] The technical solution of this invention is implemented as follows:

[0005] On one hand, embodiments of the present invention provide a network attack detection method based on distributed intelligent probes. The method includes: receiving real-time traffic data synchronously collected by distributed intelligent probes at various nodes in the network, wherein the real-time traffic data carries node identification information and collection timestamps, and the node identification information is used to distinguish the traffic sources of different network nodes; performing node interaction relationship modeling processing on the real-time traffic data to identify traffic communication patterns between different network nodes and generate a traffic association map containing node connection relationships and communication frequencies; performing abnormal communication path mining based on the traffic association map, and extracting node communication sequences with abnormal patterns by analyzing the deviation degree of node connection relationships and the fluctuation characteristics of communication frequencies; performing pattern matching processing on the node communication sequences with attack behavior templates in a preset attack feature library, calculating sequence matching similarity and generating an attack matching score set; determining the network attack type and attack source node location information according to the attack matching score set, and generating a network attack detection result containing attack type identifiers and source node coordinates.

[0006] On the other hand, embodiments of the present invention provide a computer system including a memory and a processor, wherein the memory stores a computer program that can run on the processor, and the processor executes the program to implement the steps in the above-described method.

[0007] The network attack detection method based on distributed intelligent probes provided by this invention receives real-time traffic data synchronously collected by distributed intelligent probes at various nodes in the network. This data carries node identification information and collection timestamps, enabling comprehensive coverage of network traffic without blind spots. This avoids the problems of limited coverage and susceptibility to single-point failures in traditional centralized collection methods, providing a comprehensive data foundation for subsequent attack detection. By modeling the interaction relationships between nodes in the real-time traffic data, the method identifies the traffic communication patterns between different network nodes and generates a traffic correlation graph containing node connection relationships and communication frequencies. This integrates scattered traffic data into a structured graph representation, allowing network communication patterns to be fully presented through both the structural features of node connections and the quantitative features of communication frequencies. This overcomes the limitation of traditional isolated indicator analysis, which struggles to capture the overall communication patterns of the network. This method mines abnormal communication paths based on traffic correlation graphs. By analyzing the deviation of node connection relationships and the fluctuation characteristics of communication frequency, it extracts node communication sequences with abnormal patterns. This allows it to capture the complete propagation path of attacks from the dynamic evolution of network communication, rather than just identifying single-point anomalies. Furthermore, by combining structural and quantitative anomaly judgments, it effectively distinguishes normal business fluctuations from attack path characteristics, improving the accuracy of anomaly identification. The method performs pattern matching processing between node communication sequences and attack behavior templates in a pre-set attack feature library, calculating sequence matching similarity and generating an attack matching score set. This achieves a holistic comparison of attack behavior rather than static feature matching, capturing the dynamic evolution of attacks and avoiding missed detections due to attack variants. The score set also provides multiple candidate bases for subsequent attack type determination, enhancing the reliability of detection results. Based on the attack matching score set, it determines the network attack type and the location information of the attack source node, generating network attack detection results containing attack type identifiers and source node coordinates. This achieves a complete link from anomaly discovery to attack attribution, solving the problem of traditional technologies that only alert to anomalies but cannot accurately locate the attack type and source. This provides clear targets for subsequent defense responses, improving the practicality and effectiveness of network attack detection. Attached Figure Description

[0008] Figure 1 This is a schematic diagram illustrating the implementation process of a network attack detection method based on a distributed smart probe, provided in an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of the composition structure of a network attack detection device provided in an embodiment of the present invention.

[0010] Figure 3 This is a schematic diagram of the hardware entity of a computer system provided in an embodiment of the present invention.

[0011] Figure 4 This is a schematic diagram of a distributed smart probe provided in an embodiment of the present invention. Detailed Implementation

[0012] This invention provides a network attack detection method based on distributed smart probes, which can be executed by a processor of a computer system. The computer system can refer to devices with data processing capabilities, such as servers, laptops, tablets, and desktop computers.

[0013] Figure 1 This is a schematic diagram illustrating the implementation process of a network attack detection method based on distributed smart probes provided in an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes the following steps:

[0014] Step S100: Receive real-time traffic data synchronously collected by distributed smart probes at various nodes in the network. The real-time traffic data carries node identification information and collection timestamp. The node identification information is used to distinguish the traffic source of different network nodes.

[0015] Real-time traffic data refers to the traffic information generated at each node during network operation, reflecting the flow of data within the network. Node identification information, such as IP address and MAC address, is used to uniquely identify each node in the network, enabling precise differentiation of the traffic source from different network nodes. The collection timestamp records the specific moment the traffic data was collected, providing a basis for subsequent time-based analysis. Distributed smart probes are devices with intelligent data collection capabilities distributed across various network nodes, synchronously collecting real-time traffic data from each node according to a unified time standard.

[0016] Step S200: Perform inter-node interaction modeling on real-time traffic data, identify traffic communication patterns between different network nodes, and generate a traffic correlation graph that includes node connection relationships and communication frequencies.

[0017] Inter-node interaction modeling is a process of in-depth mining and analysis of real-time traffic data, aiming to identify the interaction patterns and relationships between different network nodes. Traffic communication patterns are the regularities and characteristics exhibited when different nodes interact with each other, such as whether the communication frequency between nodes is stable, whether the communication time is periodic, and the type of protocol used. A traffic correlation graph is a tool that graphically displays the connections and communication frequencies between network nodes. The vertices of the graph represent network nodes, the edges represent the connections between nodes, and the edge attributes include information such as weighted communication frequency and protocol type distribution. By modeling the inter-node interaction relationships of real-time traffic data, we can more clearly grasp the communication patterns between various nodes in the network, which helps to promptly detect abnormal communication behavior.

[0018] In one implementation, step S200 may include the following steps S210 to S260:

[0019] Step S210: Perform session segmentation processing on the real-time traffic data. Based on the node identification information and the collection timestamp, the traffic data is aggregated into a set of session units with bidirectional transmission process. Each session unit contains the source node identifier, the destination node identifier, and the data packet transmission record sorted by timestamp.

[0020] Session segmentation is the process of dividing real-time traffic data into independent session units according to predefined rules. A session unit is a group of traffic data with bidirectional transmission, representing a complete communication process between two nodes. The source node identifier and destination node identifier are used to identify the node initiating the session and the receiving node, respectively. These two identifiers clearly define the start and end points of the communication. The timestamp-sorted data packet transmission record documents the transmission order and time information of the data packets during the session.

[0021] Step S220: Extract the dynamic interaction features of each session unit in the session unit set. The dynamic interaction features include session duration, data packet interval fluctuation sequence and protocol type distribution. The session duration is calculated by the difference between the timestamps of the first and last data packets, and the data packet interval fluctuation sequence is generated by sorting the timestamp differences of adjacent data packets.

[0022] Dynamic interaction characteristics refer to the dynamic changes exhibited by a session unit during communication, reflecting the real-time state and behavioral patterns of the session. Session duration is the length of time a session lasts from start to finish, calculated by the difference in timestamps between the first and last data packets. Data packet interval fluctuation sequence reflects the variation in time intervals between adjacent data packets; this sequence is generated by sorting the timestamp differences of adjacent data packets, reflecting the stability and regularity of data packet transmission. Protocol type distribution represents the proportion of data packets of different protocol types within a session unit, reflecting the protocol type characteristics used by the session.

[0023] In one implementation, step S220 may include the following steps S221 to S227:

[0024] Step S221: For each session unit, extract the difference between the timestamp of the first data packet collection and the timestamp of the last data packet collection to obtain the session duration parameter based on the smallest timestamp unit.

[0025] The session duration parameter measures the duration of a session unit from start to finish, using the smallest timestamp unit as a reference. The session duration parameter is obtained by acquiring the timestamps of the first and last data packets in each session unit and calculating the difference between them. In a financial transaction network, the session duration parameter for each transaction can be calculated in this way.

[0026] Step S222: Arrange the data packet transmission records of each session unit in ascending order of the collection timestamp, calculate the timestamp difference between adjacent data packets and form an ordered sequence as the data packet interval fluctuation sequence.

[0027] The packet interval fluctuation sequence is an ordered sequence reflecting the variation in time intervals between adjacent data packets. First, the data packet transmission records of each session unit need to be sorted in ascending order according to their acquisition timestamps to ensure the data packet order matches the actual transmission order. Then, the timestamp differences between adjacent data packets are calculated, and these differences are grouped into an ordered sequence; this sequence is the packet interval fluctuation sequence. In an IoT network, sensor nodes periodically send data packets to the data center. For a session unit of a sensor node, after sorting its data packet transmission records in ascending order by acquisition timestamp, the timestamp differences between adjacent data packets are calculated, and the resulting difference sequence is the packet interval fluctuation sequence for that session unit. By analyzing this sequence, the stability and regularity of data packet transmission can be understood. If the values ​​in the sequence fluctuate significantly, it indicates unstable data packet transmission, potentially due to network congestion, equipment failure, or other problems; if the sequence values ​​are relatively stable, it indicates that data packet transmission is relatively normal.

[0028] Step S223: Traverse the data packet transmission records in the session unit, identify the application layer protocol type field of each data packet, count the number of occurrences of different protocol types, and generate a protocol type counter.

[0029] The application layer protocol type field is a field in a data packet that identifies the type of application layer protocol used by the packet, such as HTTP, FTP, and SMTP. By traversing the data packet transmission records in a session unit, identifying the application layer protocol type field of each data packet, and counting the occurrences of different protocol types, a protocol type counter can be generated. For example, after traversing the data packet transmission records within a session unit, it will be found that the number of occurrences of data packets of different protocol types varies. Counting the occurrences of these different protocol types yields a protocol type counter containing various protocol types and their corresponding occurrence counts. This counter can be used to analyze the frequency and distribution of different application layer protocols in the network. For abnormal protocol usage, such as a sudden and significant increase or decrease in the occurrence of a certain protocol, further investigation and analysis can be conducted to determine whether there are network security threats or abnormal business operations.

[0030] Step S224: Normalize the protocol type counter, calculate the ratio of the number of occurrences of each protocol to the total number of data packets, and obtain the protocol type distribution.

[0031] Normalization is the process of converting the count data in a protocol type counter into relative proportion data. By calculating the ratio of the frequency of each protocol occurrence to the total number of data packets, the protocol type distribution can be obtained. This distribution reflects the proportional relationship between different protocol types of data packets within a session unit. Assuming the session unit contains a certain number of data packets, with different protocol types appearing at varying frequencies, the proportion of each protocol type within the entire session unit can be obtained by dividing the frequency of each protocol type by the total number of data packets. Summarizing the proportions of all protocol types yields the protocol type distribution. Analyzing this distribution allows us to understand whether the usage ratios of different application layer protocols in the network meet normal business needs. A sudden and significant change in the proportion of a particular protocol may indicate abnormal business activities or security threats in the network.

[0032] Step S225: Smooth the data packet interval fluctuation sequence to eliminate instantaneous noise interference and obtain the filtered interval fluctuation sequence.

[0033] Smoothing is a filtering operation performed on the packet interval fluctuation sequence to eliminate potential transient noise interference. Transient noise interference can be caused by sudden network events, brief equipment failures, etc., and this noise can affect the accurate analysis of packet interval fluctuations. Smoothing makes the sequence smoother, highlighting its true fluctuation characteristics. Smoothing methods include moving average and exponential smoothing. Taking the moving average method as an example, this method selects a window of a certain length, averages the data within the window, and uses the average value to replace the data at the center of the window, thus achieving the purpose of smoothing the sequence. As the window gradually moves across the sequence, the average value is continuously calculated to obtain the smoothed sequence. In this way, transient noise interference in the packet interval fluctuation sequence can be eliminated, making the sequence more stable and facilitating accurate analysis of the stability and regularity of packet transmission.

[0034] Step S226: Use an autoregressive moving average model to predict the trend of the filtered interval fluctuation sequence, calculate the probability distribution of data packet arrival time within the future preset window, and generate time series prediction features.

[0035] The Autoregressive Moving Average (ARMA) model is a time series forecasting model that combines the characteristics of the Autoregressive (AR) and Moving Average (MA) models, enabling effective prediction of time series data. By using the ARMA model to predict the trend of filtered interval fluctuation sequences, the probability distribution of data packet arrival times within a preset window can be calculated. The preset window is the future time period to be predicted, such as several future time units. The time series forecast feature is a feature generated based on the prediction results, reflecting the distribution of future data packet arrival times. During prediction, the ARMA model uses historical data and model parameters to predict future data. For the filtered interval fluctuation sequence, the model analyzes the historical fluctuation patterns of the sequence, then predicts the possible distribution of data packet arrival times within the preset window and calculates the corresponding probabilities. Integrating this probability distribution information generates the time series forecast feature. This feature can be used to predict future network traffic changes, helping network administrators to allocate and manage network resources in advance to cope with potential network congestion or traffic peaks.

[0036] Step S227: Integrate the session duration parameter, the filtered interval fluctuation sequence, the protocol type proportion distribution, and the time series prediction features into a structured feature vector, which serves as the storage carrier for dynamic interaction features.

[0037] A structured feature vector is a vector containing multiple feature information, effectively integrating session duration parameters, filtered interval fluctuation sequences, protocol type proportion distributions, and time series prediction features. By combining these different types of feature information into a structured feature vector, dynamic interaction features can be conveniently stored and processed. In a network security detection system, a corresponding structured feature vector is generated for each session unit. Each element in this vector represents a corresponding dynamic interaction feature, such as a session duration parameter, a value in the filtered interval fluctuation sequence, or the proportion of a specific protocol type in the protocol type proportion distribution. Integrating these feature information into a unified structured feature vector can serve as the storage carrier for the dynamic interaction features of that session unit. Subsequently, when performing machine learning model training, anomaly detection, and other operations, this structured feature vector can be directly used as input data, improving the efficiency and accuracy of data processing.

[0038] Step S230: Construct a node association matrix based on dynamic interaction features. The row dimension of the matrix corresponds to the source node identifier set, and the column dimension corresponds to the destination node identifier set. The matrix elements are filled with the cumulative frequency of node interaction events in the session unit.

[0039] A node association matrix is ​​a matrix used to represent the relationships between network nodes. Its row dimension corresponds to the source node identifier set, and its column dimension corresponds to the destination node identifier set. The values ​​of the matrix elements are filled with the cumulative frequency of node interaction events in a session unit, reflecting the frequency of interaction between two nodes. In a social network, the interaction between user nodes can be viewed as node interaction events. The source node identifier set contains all node identifiers that initiate the interaction, and the destination node identifier set contains all node identifiers that receive the interaction. By counting the number of interactions between the source and destination nodes in each session unit and accumulating these counts in the corresponding positions in the node association matrix, a complete node association matrix can be obtained. This matrix can intuitively display the frequency of interaction between various nodes in the network, which is of great significance for detecting abnormal node interaction behavior. For example, if the interaction frequency between two nodes in the matrix suddenly increases or decreases significantly, it may mean that there is abnormal business activity or security threat between these two nodes.

[0040] In one implementation, step S230 may include the following steps S231 to S237:

[0041] Step S231: Extract a unique set of identifiers from the source node identifiers and destination node identifiers of all session units, construct a list of node identifiers, and assign a matrix index value to each identifier.

[0042] The unique identifier set is a set of non-repeating identifiers extracted from the source and destination node identifiers of all session units. Constructing the node identifier list involves arranging these unique identifiers in a specific order, assigning a matrix index value to each identifier for easy location and manipulation within the matrix. In a complex network environment, a session unit may involve multiple different source and destination nodes, potentially containing duplicate identifiers. By extracting the unique identifier set, duplicate identifiers can be removed, resulting in a set containing all distinct node identifiers. These identifiers are then arranged sequentially to form the node identifier list, with each identifier assigned a unique matrix index value; for example, the first identifier has an index value of 0, the second identifier has an index value of 1, and so on. This allows for rapid location of the corresponding position in the matrix when constructing the node association matrix, improving the efficiency and accuracy of matrix construction.

[0043] Step S232: Initialize a square matrix with dimensions matching the length of the node identifier list as the node association matrix framework, and set all initial element values ​​of the matrix to zero.

[0044] The node association matrix framework is a square matrix whose dimensions match the length of the node identifier list. Initializing all matrix elements to zero ensures accurate recording of the cumulative frequency of node interaction events during subsequent element filling. Assuming the node identifier list contains a certain number of node identifiers, the initialized node association matrix framework is a square matrix with the same dimensions as that number, where each element is initially zero. This matrix framework provides the foundation for subsequently filling in the cumulative frequency of node interaction events. In subsequent steps, the corresponding element values ​​in the matrix are updated based on the interactions between nodes within the session unit, resulting in the final node association matrix.

[0045] Step S233: Traverse the set of session units. For each session unit, find the corresponding matrix index based on the source node identifier and the destination node identifier, and increment the element value at the corresponding position in the node association matrix frame by 1.

[0046] During the traversal of the session unit set, for each session unit, the corresponding matrix index is looked up in the node identifier list based on its source node identifier and destination node identifier. Then, the value of the element at the corresponding position in the node association matrix frame is incremented by 1 to record the interaction events between nodes. In an enterprise network, there are multiple session units, each representing an interaction between two nodes. For each session unit, its source node identifier and destination node identifier are first determined, and then the matrix indices corresponding to these two identifiers are found in the node identifier list. For example, if the matrix index corresponding to the source node identifier is i and the matrix index corresponding to the destination node identifier is j, then the value of the element in the i-th row and j-th column of the node association matrix frame is incremented by 1. By traversing all session units and continuously updating the values ​​of the matrix elements, a node association matrix reflecting the frequency of interactions between nodes can be obtained.

[0047] Step S234: Merge session units that contain the same source-destination node identifier pairs, and accumulate the number of their interaction events as the update value of the matrix elements.

[0048] In a real-world network environment, multiple session units (SMUs) may exist that contain the same source-destination node identifier pairs. These SMUs represent multiple interactions between the same two nodes. Merging these SMUs involves accumulating the number of their interaction events and using this accumulated count as the update value for the matrix elements. In a network, there may be multiple SMUs between node A and node B, each representing one interaction between them. Merging these SMUs containing nodes A and B, counting the total number of their interaction events, and then updating the corresponding positions of nodes A and B in the node association matrix with this total count allows for a more accurate reflection of the actual frequency of interactions between nodes, avoiding inaccurate matrix element values ​​due to duplicate recording.

[0049] Step S235: Introduce feature correlation weights, calculate feature contribution based on the proportion distribution of protocol types in dynamic interaction features and time series prediction features, and generate node pair interaction weight coefficients.

[0050] Feature correlation weights are used to measure the influence of different features in dynamic interaction features on node interaction relationships. Calculating the feature contribution based on the protocol type distribution and time-series prediction features in dynamic interaction features is to determine the magnitude of these two features' roles in node interaction relationships. By calculating the feature contribution, node pair interaction weight coefficients can be generated. The protocol type distribution reflects the proportion of protocol types used in communication between nodes; different protocol types may have different importance and influence on node interaction. Time-series prediction features reflect the distribution of future data packet arrival times between nodes, which also affects the interaction relationships between nodes. By analyzing and calculating these two features, their feature contribution in node interaction is determined, and then node pair interaction weight coefficients are generated based on these feature contribution values. These coefficients can be used to adjust the element values ​​in the node correlation matrix to more accurately reflect the true interaction relationships between nodes.

[0051] Step S236: Multiply the matrix element values ​​with the corresponding node pair interaction weight coefficients to obtain the weighted interaction frequency, and update the node association matrix elements.

[0052] The weighted interaction frequency is obtained by multiplying the element values ​​in the node association matrix with the corresponding node pair interaction weight coefficients. Updating the node association matrix elements with this weighted interaction frequency allows the matrix to more accurately reflect the true interaction relationships between nodes. In the previous steps, we obtained the node association matrix and node pair interaction weight coefficients. For each element in the matrix, multiplying it with its corresponding node pair interaction weight coefficient yields a new value, which is the weighted interaction frequency. This weighted interaction frequency then replaces the original element values ​​in the matrix, completing the matrix element update. This method takes into account the characteristic correlations of interactions between different node pairs, making the node association matrix more accurately reflect the actual importance and influence of interactions between nodes.

[0053] Step S237: Remove the interaction records of node pairs with a weighted interaction frequency lower than a preset threshold by matrix sparsification, retain the significantly related node connection relationships, and generate a sparse node association matrix.

[0054] Matrix sparsification is a process of optimizing the node association matrix. By removing interaction records of node pairs with weighted interaction frequencies below a preset threshold, redundant information in the matrix can be reduced, while significant node connections are preserved. The preset threshold is a pre-defined value used to determine whether the interaction between node pairs is significant. In a network, the interaction relationships between nodes can be very complex, with a large number of interaction records. However, many of these interactions may have low frequencies and minimal impact on the overall operation and security of the network. By setting a preset threshold, interaction records of node pairs with weighted interaction frequencies below that threshold are removed from the matrix, retaining only those node connections with high weighted interaction frequencies and significant relationships. The resulting sparse node association matrix is ​​more concise, facilitating subsequent analysis and processing, and also highlighting important node connections in the network.

[0055] Step S240: Perform time window normalization on the node association matrix, calculate the proportion of interaction frequency of each node pair to the total interaction frequency within the unit monitoring period, and generate a node communication frequency distribution matrix.

[0056] Time window normalization is a further processing step of the node association matrix. By statistically analyzing the proportion of interaction frequency of each node pair within a unit monitoring period to the total interaction frequency, the inter-node communication frequency distribution matrix can be obtained. The unit monitoring period is a pre-defined time range within which the interaction frequency of node pairs is statistically analyzed. The total interaction frequency is the sum of the interaction frequencies of all node pairs within that unit monitoring period. For each element in the node association matrix, the interaction frequency of its corresponding node pair within the unit monitoring period is divided by the total interaction frequency; the resulting proportion is the element value of that node pair in the inter-node communication frequency distribution matrix. This normalization process converts the interaction frequency of node pairs into a relative proportion, facilitating comparisons of communication frequencies between different node pairs. The inter-node communication frequency distribution matrix provides a more intuitive view of the communication frequency distribution among node pairs in the network, aiding in the analysis of network traffic distribution and usage patterns.

[0057] Step S250: Introduce a spatiotemporal correlation weight factor, dynamically adjust the matrix element weights according to the node's hierarchical position in the network topology and historical interaction stability, and generate a weighted node correlation matrix.

[0058] The spatiotemporal correlation weighting factor considers the hierarchical position of nodes in the network topology and the stability of historical interactions. Depending on the hierarchical position of a node in the network topology, nodes at different levels may have different impacts and importance on the network; for example, core nodes and edge nodes have different roles and statuses. Historical interaction stability reflects whether the interactions between nodes have been stable in the past; stable interactions may have higher weights in the current network. By introducing the spatiotemporal correlation weighting factor, the weights of elements in the node correlation matrix can be dynamically adjusted to generate a weighted node correlation matrix. For each element in the matrix, the corresponding spatiotemporal correlation weighting factor is calculated based on the hierarchical position of its corresponding node in the network topology and the stability of its historical interactions. Then, the element value is multiplied by the weighting factor to obtain the adjusted element value. In this way, the matrix can more accurately reflect the true correlations between nodes, while taking into account the spatial structure and temporal interaction stability of the network.

[0059] Step S260: Construct a traffic association graph by fusing the weighted node association matrix and the communication frequency distribution matrix. The vertices of the graph represent network nodes, and the vertex attributes include node identifier and hierarchical position. The edges represent node connection relationships, and the edge attributes include weighted communication frequency and protocol type distribution.

[0060] Constructing a traffic correlation graph by fusing the weighted node correlation matrix and the communication frequency distribution matrix integrates information from these two matrices to graphically represent the connections and communication characteristics between network nodes. Vertices in the traffic correlation graph represent network nodes, with attributes including node identifier and hierarchical position. The node identifier uniquely identifies the node, and the hierarchical position reflects the node's position within the network topology. Edges represent the connections between nodes, with attributes including weighted communication frequency and protocol type distribution. The weighted communication frequency reflects the actual frequency of communication between nodes, taking into account factors such as spatiotemporal correlation; the protocol type distribution reflects the proportion of different protocol types used in communication between nodes. By fusing the information from the weighted node correlation matrix and the communication frequency distribution matrix, and filling in the node and edge attributes, a complete traffic correlation graph can be constructed.

[0061] Step S300: Based on the traffic correlation graph, perform abnormal communication path mining. By analyzing the deviation of node connection relationships and the fluctuation characteristics of communication frequency, extract node communication sequences with abnormal patterns.

[0062] Anomaly communication path mining is the process of identifying abnormal communication paths within a network based on traffic correlation graphs. Analyzing the deviation of node connections involves comparing the current node connections with those under normal conditions; analyzing communication frequency fluctuations involves observing changes in communication frequency over time to determine if abnormal fluctuations exist. Through these two analyses, node communication sequences with abnormal patterns are extracted. In a normal network, the connections and communication frequencies between nodes typically exhibit certain regularities and stability. If a node's connection suddenly changes, deviating significantly from normal conditions, or if the communication frequency fluctuates abnormally, such as a sudden and substantial increase or decrease, then abnormal communication behavior may exist. By conducting in-depth analysis of traffic correlation graphs, these abnormal node connections and communication frequency fluctuations are identified, and node communication sequences with abnormal patterns are extracted. These sequences may represent anomalies such as attacks or unauthorized access within the network.

[0063] In one implementation, step S300 may include the following steps S310-S360:

[0064] Step S310: Construct a dynamic communication baseline model. The dynamic communication baseline model integrates the temporal correlation and spatial topological dependence of the historical communication behavior of nodes. It learns the probability distribution of node connection relationships and the time-varying characteristics of communication frequency under normal communication mode through a non-parametric kernel density estimation method, and generates a baseline parameter set containing the node pair association probability matrix and time-varying frequency parameters.

[0065] The dynamic communication baseline model is a model used to describe normal network communication patterns, integrating the temporal correlation and spatial topological dependence of historical node communication behavior. Temporal correlation reflects the changing patterns of node communication behavior over time, while spatial topological dependence reflects the impact of node positional relationships within the network topology on communication. Using a nonparametric kernel density estimation method, the probability distribution of node connection relationships and the time-varying characteristics of communication frequency under normal communication patterns are learned, generating a baseline parameter set containing the node pair association probability matrix and time-varying frequency parameters. The nonparametric kernel density estimation method is a density estimation method that does not rely on specific distribution assumptions and can adaptively estimate probability distributions based on historical data. In constructing the dynamic communication baseline model, historical node communication data is first collected, including time-series data of node connection relationships and communication frequencies. This data is then analyzed, considering the temporal correlation and spatial topological dependence between nodes, and the nonparametric kernel density estimation method is used to learn the probability distribution of node connection relationships and the time-varying characteristics of communication frequency under normal communication patterns. The learned node pair association probability matrix and time-varying frequency parameters are then integrated to form the baseline parameter set. This baseline parameter set can serve as a benchmark for judging whether current network communication is normal.

[0066] In one implementation, step S310 may include the following steps S311 to S317:

[0067] Step S311: Collect historical traffic correlation graph data for multiple complete monitoring periods in the past. Each period's data includes a snapshot of node connection relationships and the corresponding communication frequency time series.

[0068] Historical traffic correlation graph data comprises network traffic information over multiple complete monitoring periods. Each period's data includes a snapshot of node connectivity and a corresponding communication frequency time series. The node connectivity snapshot reflects the connectivity between nodes in the network within a monitoring period, while the communication frequency time series records the changes in communication frequency between nodes over time within that monitoring period. By collecting this data from multiple complete monitoring periods, a wealth of information about normal network communication patterns can be obtained.

[0069] Step S312: Preprocess the historical data, remove abnormal communication records during known attack events, and retain the communication data marked as normal as the training sample set.

[0070] Preprocessing historical data ensures the quality of the training dataset used to build the model. Removing anomalous communication records during known attack events prevents these records from interfering with the model's learning of normal communication patterns. Retaining communication data marked as normal is crucial for the model to accurately learn normal network communication patterns. In real-world network operations, attack events may occur, and the communication records during these events differ significantly from normal communication patterns. By filtering historical data, communication records from known attack events are identified and removed, retaining only those marked as normal. This normal communication data forms the training dataset for subsequent training of the dynamic communication baseline model. This improves the model's accuracy and reliability, enabling it to better identify anomalous communication behaviors within the network.

[0071] Step S313: Calculate the shortest path distance between nodes based on the network topology and construct a spatial topology dependency matrix. The matrix elements represent the degree of connection between node pairs in the physical topology.

[0072] Calculating the shortest path distance between nodes based on network topology is to measure the relative positional relationship of nodes within the physical topology. A spatial topological dependency matrix is ​​constructed, where each element represents the degree of connection between node pairs within the physical topology. The network topology describes how nodes and links are connected in the network. Shortest path distances between nodes are calculated using graph theory algorithms such as Dijkstra's algorithm or the Floyd-Warshall algorithm. A shorter shortest path distance indicates a tighter connection between nodes. Based on the calculated shortest path distances, a spatial topological dependency matrix is ​​constructed, where each element represents the degree of connection between the corresponding node pair within the physical topology.

[0073] Step S314: Use time series decomposition method to decompose the communication frequency time series of each node pair into trend term, periodic term and random term, and separate the long-term change trend and periodic fluctuation characteristics of communication frequency.

[0074] Time series decomposition methods break down time series data into different components. By decomposing the communication frequency time series of each node pair into trend, periodic, and random components, the long-term trend and periodic fluctuation characteristics of the communication frequency can be separated. The trend component reflects the overall trend of communication frequency over a longer period, such as whether the communication frequency gradually increases or decreases over time. The periodic component reflects the periodic fluctuations of the communication frequency, such as daily, weekly, or monthly periodic changes. The random component represents random fluctuations that cannot be explained by the trend and periodic components. Commonly used time series decomposition methods include additive and multiplicative models. When decomposing the communication frequency time series of a node pair, choosing an appropriate decomposition method to separate the series into trend, periodic, and random components provides a clearer understanding of the patterns of communication frequency changes, offering more accurate information for subsequent analysis and modeling.

[0075] Step S315: For the preprocessed normal communication data, use the nonparametric kernel density estimation method to estimate the probability distribution of the occurrence of connection relationships and the conditional probability distribution of communication frequency for each node.

[0076] Nonparametric kernel density estimation is a density estimation method that does not rely on specific distribution assumptions. By processing preprocessed normal communication data, this method can estimate the probability distribution of connection relationships between each node pair and the conditional probability distribution of communication frequencies. For each node pair, the probability distribution of connection relationships reflects the likelihood of the connection occurring under normal conditions. The conditional probability distribution of communication frequencies reflects the distribution of communication frequencies for that node pair under certain conditions. When analyzing normal communication data, the data is input into the nonparametric kernel density estimation model, which adaptively estimates the probability distribution of connection relationships between each node pair and the conditional probability distribution of communication frequencies based on the characteristics of the data. This probability distribution information can be used in subsequent dynamic communication baseline models, providing a basis for determining whether current network communication is normal.

[0077] Step S316: Introduce a time decay factor to assign different weights to training samples from different historical periods. The weight of recent samples is higher than that of distant samples. Update the probability distribution model by estimating the weighted kernel density.

[0078] The time decay factor is introduced to account for the varying degrees of influence of training samples from different historical periods on the current model. Since network environments and communication patterns may change over time, recent training samples better reflect the current network situation; therefore, recent samples are given higher weights, while older samples are given lower weights. Updating the probability distribution model through weighted kernel density estimation involves updating the model based on nonparametric kernel density estimation, taking into account the sample weights. The time decay factor is a factor that gradually decreases over time; each sample is assigned a corresponding weight based on its timestamp. During weighted kernel density estimation, the sample weights are incorporated into the calculation process to update the probability distribution model. This allows the model to better adapt to dynamic changes in the network, improving its accuracy and real-time performance.

[0079] Step S317: Integrate the node pair association probability distribution, communication frequency time-varying parameters, and spatial topological dependency matrix to form the baseline parameter set of the dynamic communication baseline model.

[0080] The node pair association probability distribution, time-varying communication frequency parameters, and spatial topological dependency matrix are integrated to form the baseline parameter set of the dynamic communication baseline model. The node pair association probability distribution reflects the probability of node pairs forming connections under normal conditions; the time-varying communication frequency parameters reflect the characteristics of communication frequency changes over time; and the spatial topological dependency matrix reflects the tightness of node connections in the physical topology. Integrating these three aspects of information can comprehensively describe the normal communication patterns of the network. When constructing the dynamic communication baseline model, the calculated node pair association probability distribution, time-varying communication frequency parameters, and spatial topological dependency matrix are integrated to form a baseline parameter set containing all key information. This baseline parameter set can serve as a benchmark for judging whether current network communication is normal. By comparing the current traffic correlation graph with the baseline parameter set, abnormal communication behaviors in the network can be identified.

[0081] Step S320: The graph structure deviation algorithm is used to calculate the structural difference between the node pair association probability matrix of the current traffic association graph and the baseline parameter set. The node connection relationship is mapped to a low-dimensional feature space by the spectral clustering method. The Bach distance between the current distribution and the baseline distribution in the feature space is calculated as the node connection deviation.

[0082] The graph structure deviation algorithm is used to calculate the degree of difference between two graph structures. This algorithm calculates the structural difference between the current traffic association graph and the node pair association probability matrix in the baseline parameter set. Spectral clustering is a graph-based clustering algorithm that facilitates data analysis and comparison by mapping node connections to a low-dimensional feature space. The Bach distance between the current distribution and the baseline distribution in the feature space is calculated as the node connection deviation. Bach distance is a measure of the degree of difference between two probability distributions. In the calculation, the graph structure deviation algorithm is first used to analyze the structural difference between the current traffic association graph and the node pair association probability matrix. Then, spectral clustering is used to map the node connections from the original graph space to a low-dimensional feature space. In this low-dimensional feature space, the Bach distance between the current distribution (i.e., the distribution corresponding to the current traffic association graph) and the baseline distribution (i.e., the distribution corresponding to the node pair association probability matrix in the baseline parameter set) is calculated. A larger node connection deviation indicates a greater difference between the current node connections and the normal situation, potentially indicating abnormal communication behavior.

[0083] Step S330: Introduce the communication frequency fluctuation entropy index, perform complexity analysis on the communication frequency time series of each node connection, and calculate the irregularity of the sequence through the sample entropy algorithm. The higher the entropy value, the more severe the frequency fluctuation.

[0084] The communication frequency fluctuation entropy index is used to measure the complexity of the communication frequency time series of node connections. This index is introduced to analyze the complexity of the communication frequency time series of each node connection. The sample entropy algorithm is an algorithm used to calculate the degree of irregularity in a time series. A higher entropy value indicates more severe frequency fluctuations. In a network, the communication frequency time series of node connections may exhibit varying degrees of fluctuation. The communication frequency fluctuation entropy index can reflect the complexity of these fluctuations. Using the sample entropy algorithm to calculate the communication frequency time series, this algorithm analyzes the similarity and regularity between adjacent data points in the sequence. If the irregularity of the sequence is high, meaning the changes between data points are more random and complex, then the calculated entropy value will be higher, indicating more severe frequency fluctuations. By analyzing the communication frequency fluctuation entropy index, we can understand the stability of the communication frequency of node connections. For node connections with high entropy values, there may be problems such as network congestion and abnormal traffic, requiring further attention and analysis.

[0085] Step S340: Construct a multi-dimensional anomaly scoring mechanism, which obtains a comprehensive anomaly score by weighted summation of node connection deviation and communication frequency fluctuation entropy, with the weight coefficients dynamically adjusted according to the distinguishing ability of each indicator in historical attack samples.

[0086] The multi-dimensional anomaly scoring mechanism aims to more comprehensively and accurately assess network anomalies. A comprehensive anomaly score is obtained by weighted summation of node connection deviation and communication frequency fluctuation entropy, with the weighting coefficients dynamically adjusted based on the discriminative power of each indicator in historical attack samples. Node connection deviation reflects the degree of difference between the current node connection relationship and the normal situation, while communication frequency fluctuation entropy reflects the complexity of communication frequency fluctuations in node connections. By weighted summation of these two indicators, a comprehensive anomaly score can be obtained, more comprehensively reflecting network anomalies. The weighting coefficients are dynamically adjusted based on the discriminative power of each indicator in historical attack samples. In historical attack samples, different indicators may have different discriminative powers against attack behaviors. By analyzing historical attack samples, the importance of each indicator in distinguishing between normal and anomalies is determined, and the weighting coefficients are dynamically adjusted based on this importance. This allows the comprehensive anomaly score to more accurately reflect the actual anomalies in the network, improving the accuracy of anomaly detection.

[0087] In one implementation, step S340 may include the following steps S341 to S347:

[0088] Step S341: Collect a sample set of historical attack events. Each sample contains the node connection deviation, communication frequency fluctuation entropy and corresponding attack label at the time of the attack.

[0089] Collecting a historical attack event sample set is to obtain historical data for analyzing and adjusting weighting coefficients. Each sample contains node connection deviation, communication frequency fluctuation entropy, and a corresponding attack tag at the time of the attack. The attack tag identifies the attack type corresponding to that sample. During network operation, various attack events can occur. The node connection deviation and communication frequency fluctuation entropy at the time of these attack events are recorded, and each attack event is assigned an attack tag. These samples are collected to form a historical attack event sample set. This sample set can be used for subsequent analysis. By analyzing the data in the sample set, we can understand the performance of different indicators under different attack types, providing a basis for adjusting the weighting coefficients.

[0090] Step S342: Standardize the node connection deviation and communication frequency fluctuation entropy in the historical sample set, map the index values ​​to the [0, 1] interval, and eliminate the difference in dimensions.

[0091] Standardizing node connectivity deviation and communication frequency fluctuation entropy in historical sample sets aims to eliminate dimensional differences between various indicators, making them comparable. Mapping indicator values ​​to the [0, 1] interval allows for comparison and analysis of data on a uniform scale. A commonly used standardization method is min-max standardization, which maps the minimum value to 0, the maximum value to 1, and other data points proportionally to the [0, 1] interval. When standardizing node connectivity deviation and communication frequency fluctuation entropy in historical sample sets, the minimum and maximum values ​​of each indicator are first determined, and then the min-max standardization formula is used to transform each indicator value. This standardization process avoids analytical errors caused by dimensional differences, making subsequent analysis and calculations more accurate.

[0092] Step S343: Use the information gain ratio algorithm to calculate the ability of node connection deviation and communication frequency fluctuation entropy to distinguish attack tags. The higher the information gain ratio, the greater the contribution of this indicator in anomaly detection.

[0093] The Information Gain Ratio (IGR) algorithm is used to evaluate the ability of features to distinguish between different classification labels. This algorithm calculates the discriminative power of node connection deviation and communication frequency fluctuation entropy on attack labels. A higher IGR indicates a greater contribution of that indicator to anomaly detection. In a historical attack event sample set, each sample has an attack label and includes both node connection deviation and communication frequency fluctuation entropy. The IGR algorithm is used to analyze the discriminative power of these two indicators on the attack label. The algorithm calculates the IGR for each indicator at different values ​​for attack label classification. The IGR reflects the amount of information provided by the indicator during classification; a higher IGR indicates a stronger discriminative power for the attack label and a greater role in anomaly detection. By calculating the IGR, the importance of each indicator can be determined, providing a basis for subsequent adjustment of weight coefficients.

[0094] Step S344: Initialize the weight coefficients based on the information gain ratio results. Assign higher initial weights to indicators with higher discrimination capabilities. The sum of the weights of the two indicators is 1.

[0095] Initializing the weight coefficients based on the information gain ratio (IGR) results is to rationally allocate weights according to the discriminative power of the indicators. Indicators with high discriminative power are assigned higher initial weights, and the sum of the weights of the two indicators is 1. In the previous steps, the IIGR algorithm was used to calculate the discriminative power of node connection deviation and communication frequency fluctuation entropy on attack tags. According to the calculation results, indicators with high discriminative power are more accurate in distinguishing between normal and abnormal situations in anomaly detection, and therefore are assigned higher initial weights. At the same time, to ensure the rationality of the weights, the sum of the weights of the two indicators is 1. For example, if the IIGR of node connection deviation is higher than that of communication frequency fluctuation entropy, then the initial weight of node connection deviation will be relatively higher, and the initial weight of communication frequency fluctuation entropy will be relatively lower, but the sum of the weights of the two is always 1. Initializing the weight coefficients in this way allows the comprehensive anomaly score to better reflect the importance of different indicators.

[0096] Step S345: Construct a logistic regression classifier, using standardized node connection deviation and communication frequency fluctuation entropy as input features and attack labels as output targets, and train the logistic regression classifier using historical sample sets.

[0097] Logistic regression is a binary classification model. This classifier is constructed using standardized node connection deviation and communication frequency fluctuation entropy as input features, and attack labels as output targets. It is trained using a historical sample set, enabling it to learn the relationship between the input features and the attack labels. In previous steps, the node connection deviation and communication frequency fluctuation entropy have been standardized, resulting in standardized features. Simultaneously, each sample in the historical sample set has an attack label. Using the standardized features as input and the attack labels as output, the logistic regression classifier is trained using the historical sample set. During training, the logistic regression classifier adjusts its parameters to minimize the error between the predicted result and the actual attack label. Through training, the logistic regression classifier learns the mapping relationship between input features and attack labels, which is used for subsequent anomaly detection.

[0098] Step S346: Extract the feature coefficients of the trained logistic regression classifier, normalize them, and use them as dynamically adjusted weight coefficients to replace the initial weights.

[0099] Extracting the feature coefficients of the trained logistic regression classifier is to obtain the importance information of each input feature in the model. These feature coefficients are then normalized and used as dynamically adjusted weight coefficients, replacing the initial weights. During the training of the logistic regression classifier, the model assigns a feature coefficient to each input feature; this coefficient reflects the importance of that feature in the model. The feature coefficients of the trained logistic regression classifier are extracted and then normalized so that their sum is 1. These normalized feature coefficients can be used as dynamically adjusted weight coefficients, replacing the previously initialized weight coefficients. This allows the weight coefficients to be dynamically adjusted based on the model's training results, making the comprehensive anomaly score more accurately reflect the actual importance of different indicators in anomaly detection.

[0100] Step S347: For the current detection data, multiply the standardized node connection deviation by the corresponding weight coefficient, and add the standardized communication frequency fluctuation entropy multiplied by its weight coefficient to obtain the comprehensive anomaly score.

[0101] For the current detection data, the standardized node connection deviation is multiplied by its corresponding weight coefficient, and then the standardized communication frequency fluctuation entropy is multiplied by its weight coefficient to obtain the comprehensive anomaly score. In the previous steps, the node connection deviation and communication frequency fluctuation entropy have been standardized, and dynamically adjusted weight coefficients have been obtained. For the current detection data, the node connection deviation and communication frequency fluctuation entropy are first standardized, then multiplied by their respective weight coefficients, and finally the two products are added together to obtain the comprehensive anomaly score. The comprehensive anomaly score comprehensively considers the influence of both node connection deviation and communication frequency fluctuation entropy, and can more comprehensively reflect the current network communication anomalies. By comparing the comprehensive anomaly score with a preset threshold, it can be determined whether there is abnormal communication behavior in the current network.

[0102] Step S350: Sort the node connection edges in the traffic association graph based on the comprehensive anomaly score, and select the edges with scores higher than the dynamic threshold as abnormal connection edges. The dynamic threshold is adjusted in real time according to the current network load level by the adaptive control graph algorithm.

[0103] Sort node connections in the traffic correlation graph based on comprehensive anomaly scores to identify nodes with high levels of anomaly in the network. Edges with scores higher than a dynamic threshold are selected as anomalous connections. This dynamic threshold is adjusted in real-time based on the current network load using an adaptive control graph algorithm. In previous steps, a comprehensive anomaly score for each node connection was calculated. These scores are then sorted in descending order. The dynamic threshold is a threshold that adjusts in real-time based on the current network load, implemented using an adaptive control graph algorithm. This algorithm dynamically adjusts the threshold based on historical network data and the current load. Node connections with comprehensive anomaly scores higher than the dynamic threshold are selected as anomalous connections; these edges may represent abnormal communication behaviors in the network, such as attacks or unauthorized access. By adjusting the dynamic threshold in real-time, the algorithm can adapt to changes in network load, improving the accuracy of anomaly detection.

[0104] Step S360: In the traffic association graph, trace the connected subgraph containing abnormal connection edges. Starting from the abnormal connection edge, expand the adjacent nodes in sequence according to the communication time sequence, and extract the path containing at least three nodes and the proportion of abnormal connection edges exceeds the preset ratio as the node communication sequence.

[0105] Tracing connected subgraphs containing anomalous connection edges in a traffic correlation graph aims to identify node communication paths associated with these edges. Starting with an anomalous connection edge, adjacent nodes are expanded sequentially according to communication time, extracting paths containing at least three nodes with an anomalous connection edge ratio exceeding a preset proportion as node communication sequences. In a traffic correlation graph, anomalous connection edges may represent abnormal communication behavior. Starting with these anomalous connection edges, adjacent nodes are expanded sequentially according to communication time, forming a connected subgraph. Within this connected subgraph, paths containing at least three nodes with an anomalous connection edge ratio exceeding a preset proportion are selected. The preset proportion is a pre-defined value used to determine if the percentage of anomalous connection edges in the path is sufficiently high. The extracted node communication sequences may represent a complete anomalous communication process, containing anomalous interactions between multiple nodes. Analyzing these node communication sequences allows for a deeper understanding of the patterns and characteristics of anomalous communication behavior, providing a basis for subsequent attack type identification and attack source localization.

[0106] Step S400: Perform pattern matching processing between the node communication sequence and the attack behavior template in the preset attack feature library, calculate the sequence matching similarity, and generate an attack matching score set.

[0107] Pattern matching between node communication sequences and attack behavior templates in a pre-defined attack signature database is performed to identify whether patterns similar to known attack behaviors exist in the node communication sequences. Sequence matching similarity is calculated, and an attack matching score set is generated. The pre-defined attack signature database is a database containing various known attack behavior templates; each template describes the characteristics and patterns of a pre-defined attack behavior. Pattern matching between node communication sequences and attack behavior templates is performed, and sequence matching similarity is calculated by comparing the characteristics and patterns of the two. The sequence matching similarity reflects the degree of similarity between the node communication sequence and the attack behavior template. The matching similarity between each attack behavior template and the node communication sequence is used as a score to generate an attack matching score set.

[0108] In one implementation, step S400 may include the following steps S410-S460:

[0109] Step S410: Perform graph structure serialization transformation on the node communication sequence, mapping the node connection relationship and communication frequency attribute into a directed weighted sequence. The sequence elements include source node identifier, destination node identifier, communication frequency and timestamp offset.

[0110] Graph structure serialization is performed on node communication sequences to convert them into directed weighted sequences that are easier to process. Node connections are mapped to communication frequency attributes, resulting in a directed weighted sequence. Sequence elements include source node identifiers, destination node identifiers, communication frequency, and timestamp offsets. A node communication sequence is a graph structure containing information about nodes and edges. Graph structure serialization converts it into a directed weighted sequence. For each element in the sequence, the source and destination node identifiers determine the connection direction between nodes, the communication frequency reflects the frequency of communication between nodes, and the timestamp offset records the offset of the connection's occurrence time relative to the sequence's start time. In a network attack scenario, a node communication sequence may contain anomalous interactions between multiple nodes. Graph structure serialization of this sequence yields a directed weighted sequence, facilitating subsequent pattern matching with attack behavior templates.

[0111] In one implementation, step S410 may include the following steps S411 to S417:

[0112] Step S411: Traverse the node connection relationships in the node communication sequence, arrange the connection edges in ascending order according to the communication occurrence timestamp, and construct an ordered edge set.

[0113] The process iterates through the node connections in the node communication sequence, sorting the edges in ascending order by the communication timestamp to construct an ordered edge set. The node connections in the communication sequence may be unordered; by iterating through these connections, the timestamp of each connection is obtained. Then, the edges are sorted in ascending order according to the timestamps to construct an ordered edge set. In a network attack, communication between nodes may occur at different times. By sorting the edges by timestamp, an ordered edge set arranged according to the communication time sequence can be obtained, facilitating subsequent processing and analysis.

[0114] Step S412: Extract the source node identifier and destination node identifier for each connection edge, and query the communication frequency attribute of the corresponding edge from the traffic association graph.

[0115] Extracting the source and destination node identifiers for each connection edge is crucial for identifying its start and end nodes. Querying the communication frequency attribute of the corresponding edge from the traffic correlation graph reveals the frequency of communication for that connection edge. Within the ordered edge set, for each connection edge, its source and destination node identifiers are extracted; these identifiers uniquely identify each edge. Then, the communication frequency attribute corresponding to that connection edge is queried from the traffic correlation graph; this attribute reflects the frequency of communication of that connection edge within the network. By extracting the source, destination, and communication frequency attributes, necessary information can be provided for the subsequent construction of a directed weighted sequence.

[0116] Step S413: Calculate the difference between the timestamp of each connection edge and the start timestamp of the sequence to obtain the timestamp offset.

[0117] Calculate the difference between the timestamp of each connection edge and the start timestamp of the sequence to obtain the timestamp offset. The timestamp offset records the offset of the time when the connection edge occurred relative to the start time of the sequence, reflecting the position of the connection edge in the communication time sequence. In the ordered edge set, for each connection edge, obtain its communication occurrence timestamp and record the start timestamp of the sequence. Calculate the difference between the two to obtain the timestamp offset of the connection edge.

[0118] Step S414: Combine the source node identifier, destination node identifier, communication frequency, and timestamp offset into a quadruple structure, which serves as the basic element of the directed weighted sequence.

[0119] The source node identifier, destination node identifier, communication frequency, and timestamp offset are combined into a four-tuple structure, serving as the basic elements of the directed weighted sequence. In the previous steps, the source node identifier, destination node identifier, communication frequency, and timestamp offset of each connection edge have been extracted. This information is combined into a four-tuple structure, with each four-tuple representing an element in the directed weighted sequence. This four-tuple structure contains key information about the node connections, including the direction of the connection (determined by the source and destination node identifiers), the frequency of communication (represented by the communication frequency), and the time and location of the communication (represented by the timestamp offset). By arranging these four-tuple elements sequentially, a directed weighted sequence can be constructed, facilitating pattern matching with attack behavior templates in subsequent steps.

[0120] Step S415: Perform logarithmic normalization on the communication frequencies in the sequence elements to convert the original frequency values ​​into normalized frequency weights within a preset numerical range.

[0121] Logarithmic normalization of the communication frequencies in the sequence elements transforms the original communication frequency values ​​into normalized frequency weights within a predetermined numerical range. The original communication frequency values ​​may have a wide range and different magnitudes; logarithmic normalization maps them to a predetermined numerical range, facilitating subsequent calculations and comparisons. Logarithmic normalization typically uses a logarithmic function to transform the original frequency values, then applies a linear mapping to ensure the transformed values ​​fall within the predetermined range. In a directed weighted sequence, logarithmic normalization is performed on the communication frequencies of each sequence element to obtain normalized frequency weights. These weights can be used in the subsequent pattern matching process, giving the communication frequencies a more reasonable influence during matching.

[0122] Step S416: Perform feature smoothing on the ordered edge set, calculate the average frequency and frequency change gradient of node interactions within the window, and generate extended sequence elements containing local statistical features.

[0123] Feature smoothing of an ordered edge set aims to reduce noise and fluctuations in the data, making it smoother and more stable. It involves calculating the average frequency and frequency change gradient of node interactions within a window, generating extended sequence elements that incorporate local statistical features. Feature smoothing can employ methods such as moving averages to process communication frequency data within the ordered edge set. A fixed-size window is selected, and the average frequency and frequency change gradient of node interactions are calculated within the window. The average frequency reflects the overall frequency of node interactions within the window, while the frequency change gradient reflects the trend of frequency changes within the window. These local statistical features are combined with the original four-tuple elements to generate extended sequence elements that also incorporate local statistical features. These extended sequence elements provide more information, helping to improve the accuracy of pattern matching.

[0124] Step S417: Sort the extended sequence elements in ascending order by timestamp offset to obtain a directed weighted sequence with temporal correlation. The sequence length is equal to the number of connection edges in the node communication sequence.

[0125] Arranging the extended sequence elements in ascending order by timestamp offset ensures the directed weighted sequence has temporal correlation. The length of the resulting directed weighted sequence is equal to the number of connection edges in the node communication sequence. In the previous steps, extended sequence elements containing local statistical features were generated. Arranging these elements in ascending order by timestamp offset ensures that the elements in the sequence are arranged according to the chronological order of communication occurrence. This results in a directed weighted sequence with temporal correlation, better reflecting the actual communication process of the node communication sequence. The sequence length equal to the number of connection edges in the node communication sequence ensures that the sequence completely covers all connection information in the node communication sequence, providing a reliable data foundation for accurate pattern matching with attack behavior templates.

[0126] Step S420: Call the set of attack behavior templates in the preset attack feature library. Each template contains graph structure features, temporal behavior features and protocol interaction features of typical attack paths. The graph structure features represent the node connection relationship through an adjacency matrix, and the temporal behavior features represent the state transition probability through a Markov chain model.

[0127] The preset attack signature database is a collection of known attack behavior characteristics. Its attack behavior template set contains detailed information on various typical attacks. The graph structure features of typical attack paths reflect the connection methods and topological relationships between nodes involved in the attack process. Adjacency matrices are used to represent node connections, and the elements in the adjacency matrix explicitly indicate whether a connection exists between node pairs and the strength of that connection. Temporal behavior features describe the development pattern of the attack over time, using a Markov chain model to represent state transition probabilities. The Markov chain model can predict the probability of future state transitions based on the current state, thus characterizing the temporal changes in attack behavior. Protocol interaction features reflect the interaction patterns and characteristics of the network protocols used during the attack. In actual network security testing, calling the attack behavior template set in the preset attack signature database allows for comparison of directed weighted sequences with these templates to identify whether the current node communication sequence matches a known attack pattern. For example, when detecting the presence of a Distributed Denial-of-Service (DDoS) attack in a network, the corresponding attack behavior template will include features such as the connection relationships between nodes during the DDoS attack, the changing patterns of attack traffic over time, and the types of protocols used.

[0128] Step S430: Construct a bidirectional attention mechanism matching model, using the directed weighted sequence of node communication sequences as the query vector and the graph structure features of the attack behavior template as the key vector, and calculate the association weight between the sequence and the template in the node connection relationship through a multi-head attention layer.

[0129] The bidirectional attention mechanism matching model is used to analyze the association between sequences and templates, capturing their similarity from different perspectives. Using the directed weighted sequence of node communication sequences as the query vector means starting with this sequence to find the matching degree with the attack behavior template; using the graph structure features of the attack behavior template as the key vector is because graph structure features can reflect the core structural information of the template. The multi-head attention layer is a key part of this model, learning the association features in different semantic spaces through multiple parallel attention heads. Each attention head uses a different linear projection matrix to transform the query vector and key vector and calculate similarity, thus obtaining multiple sets of attention weight matrices. These matrices reflect the degree of association between sequence elements and template nodes in different semantic spaces. Through the calculation of the multi-head attention layer, the association weights between sequences and templates in node connection relationships can be captured more comprehensively.

[0130] In one implementation, step S430 may include the following steps S431 to S436:

[0131] Step S431: Initialize the bidirectional attention mechanism matching model, which includes a query vector encoding layer, a key vector encoding layer, a multi-head attention calculation layer, and a weight fusion layer.

[0132] Initializing the bidirectional attention mechanism matching model is the first step in building the model. This model consists of several key layers, each with its own function. The query vector encoding layer encodes the directed weighted sequence of node communication sequences, converting it into a vector representation suitable for model processing. The key vector encoding layer encodes the graph structure features of the attack behavior template, extracting key information. The multi-head attention computation layer is the core of the model, calculating the similarity between query and key vectors using multiple attention heads to obtain multiple sets of attention weight matrices. The weight fusion layer fuses these multiple attention weight matrices to obtain a comprehensive attention weight distribution. During initialization, the parameters and structure of each layer need to be determined, such as the number of neurons in the query and key vector encoding layers, and the number of attention heads in the multi-head attention computation layer. The settings of these parameters affect the model's performance and matching accuracy.

[0133] Step S432: Input the directed weighted sequence of the node communication sequence into the query vector encoding layer, convert the quadruple structure into a high-dimensional dense vector through the embedding layer, extract the temporal dependency features through the bidirectional LSTM network, and generate the sequence query vector.

[0134] After the directed weighted sequence of node communication is input into the query vector encoding layer, it first passes through the embedding layer. The embedding layer transforms the quadruple structure (containing source node identifier, destination node identifier, normalized frequency weight, and timestamp offset) in the directed weighted sequence into a high-dimensional dense vector. The quadruple structure is a discrete information representation; the embedding layer maps it to a continuous high-dimensional vector space, enabling the model to better process and analyze this information. A bidirectional LSTM (Long Short-Term Memory) network is a recurrent neural network capable of effectively processing sequential data and capturing long-distance dependencies within the sequence. In a bidirectional LSTM network, data can be passed not only from beginning to end but also from end to beginning, fully utilizing the contextual information of the sequence. The embedded vector is processed by the bidirectional LSTM network to extract temporal dependency features, i.e., the changing patterns and correlations of the sequence over time. The final generated sequence query vector contains key information and temporal features of the directed weighted sequence, used for subsequent matching calculations with attack behavior templates. In a time series of a cyberattack, the attack behaviors at different stages may be correlated. Bidirectional LSTM networks can capture these correlations, thereby improving the model's accuracy in identifying attack patterns.

[0135] Step S433: Input the adjacency matrix of the attack behavior template into the key vector encoding layer, learn the topological features of node connections through the graph convolutional network, and generate the template key vector. The hidden layer dimension of the GCN is consistent with the output dimension of the query vector encoding layer.

[0136] After the adjacency matrix of the attack behavior template is input into the key vector encoding layer, a Graph Convolutional Network (GCN) is used to learn the topological features of node connections. A Graph Convolutional Network is a neural network specifically designed for processing graph-structured data. It can extract topological features of the graph by passing information between nodes through a message-passing mechanism. In the key vector encoding layer, the Graph Convolutional Network processes the adjacency matrix, updating the feature representation of each node to include information from its surrounding nodes. The generated template key vector contains the topological features of node connections of the attack behavior template and is used for matching with the sequence query vector. To ensure compatibility between the query vector and the key vector in subsequent computations, the hidden layer dimension of the GCN is kept consistent with the output dimension of the query vector encoding layer. This ensures that the query vector and the key vector can perform effective similarity calculations in the multi-head attention computation layer.

[0137] Step S434: In the multi-head attention computation layer, the sequence query vector and the template key vector are similar to each other through multiple parallel attention heads. Each attention head uses a different linear projection matrix to learn the association features of different semantic spaces and generate multiple sets of attention weight matrices.

[0138] In a multi-head attention computation layer, multiple parallel attention heads process the sequence query vector and template key vector simultaneously. Each attention head uses a different linear projection matrix to transform the query vector and key vector, mapping them to different semantic spaces. In each semantic space, the similarity between the query vector and key vector is calculated, typically using methods such as dot products to measure similarity. In this way, each attention head can capture the association features between the sequence and the template in different aspects, generating a set of attention weight matrices. Multiple sets of attention weight matrices reflect the degree of matching between sequence elements and template nodes in different semantic spaces. For example, one attention head may focus more on the connection strength between nodes, while another attention head may focus more on the type and attributes of nodes. Through parallel computation of multiple attention heads, the association information between the sequence and the template can be captured more comprehensively, improving the accuracy of matching. In a complex network attack scenario, different attack patterns may exhibit similarity in different semantic spaces. The multi-head attention computation layer can perform matching from multiple perspectives, thereby better identifying attack behaviors.

[0139] Step S435: Perform weighted averaging and fusion of multiple attention weight matrices. The weight coefficients are dynamically allocated based on the accuracy of each attention head in historical matching tasks to generate a comprehensive attention weight distribution map.

[0140] Weighted averaging of multiple attention weight matrices integrates matching information from different attention heads to obtain a comprehensive attention weight distribution. The weight coefficients are dynamically allocated based on the accuracy of each attention head in historical matching tasks, meaning that attention heads that performed more accurately in historical matching tasks will receive higher weights. This approach fully leverages the strengths of each attention head, improving the overall matching accuracy. During weighted averaging, the accuracy of each attention head is first calculated based on historical data, and then the weight coefficient for each attention head is calculated based on the accuracy. The attention weight matrix generated by each attention head is multiplied by its corresponding weight coefficient, and the results are summed to obtain the comprehensive attention weight distribution map. This distribution map reflects the degree of matching between sequence elements and template nodes in the comprehensive semantic space, providing a foundation for subsequent normalization processing and matching scoring.

[0141] Step S436: Normalize the comprehensive attention weight distribution map using the softmax function to obtain the association weight between sequence elements and template nodes. The higher the weight value, the stronger the matching degree of the node connection pattern at the corresponding position.

[0142] Normalizing the comprehensive attention weight distribution map using the softmax function transforms it into a probability distribution, ensuring the sum of all element weights equals 1. The normalized weights visually represent the correlation between sequence elements and template nodes; higher weights indicate a stronger matching of node connection patterns. The softmax function is a commonly used normalization function that converts input values ​​into probability values, emphasizing larger values ​​and suppressing smaller values ​​through exponential and normalization operations. After obtaining the normalized association weights, the matching degree between the sequence and the template in node connection relationships can be determined based on the magnitude of the weight values.

[0143] Step S440: Introduce a dynamic time warping algorithm to non-linearly align the temporal behavior features of the sequence and the template, calculate the optimal matching path and the cumulative path distance on the time axis, and the smaller the distance value, the higher the temporal similarity.

[0144] Dynamic Time Warping (DTW) is an algorithm for handling non-linear alignment of time series data. In network attack detection, the temporal behavioral characteristics of sequences and templates may exhibit temporal scaling and distortion; for example, the occurrence time of an attack may be delayed or advanced. DTW aligns the temporal behavioral characteristics of sequences and templates by finding the optimal matching path on the timeline. During the calculation, the algorithm considers the feature values ​​at each time point in both the sequence and the template, calculates the cumulative distance of different matching paths, and finds the path with the smallest cumulative distance as the optimal matching path. The smaller the cumulative path distance, the higher the temporal similarity between the sequence and the template. For example, in a network attack scenario, the sequence represents the temporal characteristics of the currently detected attack behavior, and the template represents the temporal characteristics of a known attack pattern. DTW aligns the sequence and template on the timeline and calculates their temporal similarity. If the cumulative path distance is small, it indicates that the currently detected attack behavior is very similar to the known attack pattern in its temporal development, and may be the same type of attack.

[0145] Step S450: Calculate the graph structure similarity between the node communication sequence and the attack behavior template using a graph kernel function, and quantify the degree of topological matching between the node connection pattern in the sequence and the template graph structure using a random walk kernel method.

[0146] Graph kernel functions are functions used to calculate the similarity between graph structures. In network attack detection, graph kernel functions can be used to calculate the graph structure similarity between node communication sequences and attack behavior templates. The random walk kernel method is a commonly used graph kernel function calculation method. It quantifies the degree of topological matching between the node connection patterns in the sequence and the template graph structure by simulating a random walk process on the graph. During the random walk, starting from a node, the next node is randomly selected with a certain probability. Through multiple walks, the structural information of the graph can be obtained. By comparing the similarity between the node communication sequence and the attack behavior template during the random walk process, their graph structure similarity can be calculated. For example, in a network attack scenario, the node communication sequence and the attack behavior template can be regarded as two graph structures. The random walk kernel method can be used to calculate the degree of topological matching between these two graph structures in terms of node connection patterns. If the graph structure similarity is high, it means that the node connection patterns of the node communication sequence are very similar to the graph structure of the attack behavior template, and there may be a match in the attack behavior.

[0147] Step S460: Integrate association weights, temporal similarity, and graph structure similarity, and generate a comprehensive matching score through a weighted voting mechanism. The comprehensive matching scores of all attack behavior templates constitute the attack matching score set, and the weight coefficients are dynamically adjusted according to the historical attack detection accuracy.

[0148] The fusion of association weights, temporal similarity, and graph structure similarity aims to comprehensively consider the matching performance of sequences and templates across different aspects, generating a more comprehensive overall matching score. A weighted voting mechanism assigns different weights to each matching indicator, and the association weights, temporal similarity, and graph structure similarity are weighted and summed to obtain the overall matching score. The weight coefficients are dynamically adjusted based on historical attack detection accuracy, meaning that matching indicators that have performed more accurately in historical detections will receive higher weights. The overall matching scores of all attack behavior templates constitute an attack matching score set, which allows for rapid comparison of the degree of matching between sequences and different attack behavior templates. For example, in long-term network attack detection, if the association weight is found to be more accurate in identifying a certain type of attack, then its weight coefficient will be relatively higher during the fusion process. By dynamically adjusting the weight coefficients, the accuracy of the overall matching score can be improved, leading to better identification of network attack types.

[0149] Step S500: Determine the network attack type and attack source node location information based on the attack matching score set, and generate a network attack detection result containing the attack type identifier and source node coordinates.

[0150] The ultimate goal of network attack detection is to determine the type of network attack and the location of the attack source node based on the attack matching score set. The attack matching score set reflects the degree of matching between node communication sequences and different attack behavior templates. By comparing the scores in the score set, the most matching attack behavior template can be determined, thus identifying the network attack type. The attack source node location information is obtained by analyzing node communication sequences and network topology to identify the starting node of the attack. The generated network attack detection result includes an attack type identifier and source node coordinates. The attack type identifier clarifies the specific type of attack, such as a DDoS attack or SQL injection attack, while the source node coordinates indicate the location of the attack source within the network topology. In practical network security management, this information is crucial for taking targeted defensive measures and responding to incidents.

[0151] In one implementation, step S500 may include the following steps S510-S570:

[0152] Step S510: Implement dynamic threshold filtering on the attack matching score set, set the initial threshold to the mean of all scores plus one standard deviation, and select attack behavior templates with scores higher than the threshold to form a candidate attack template set.

[0153] Dynamic threshold filtering of the attack matching score set aims to select the most likely matching templates from numerous attack behavior templates. An initial threshold is set as the mean of all scores plus one standard deviation; this is a statistically based filtering method. The mean reflects the average level of the score set, while the standard deviation reflects the dispersion of the scores. Using the mean plus one standard deviation as the threshold filters out attack behavior templates with higher scores, indicating a relatively high match with the node communication sequence. Attack behavior templates with scores above this threshold are selected to form a candidate attack template set; the templates in this set are the most likely attack patterns to match the current node's communication sequence. In actual network attack detection, the attack matching score set may contain a large number of scores; dynamic threshold filtering can quickly narrow down the scope, improving the efficiency of subsequent analysis.

[0154] Step S520: Extract the attack type identifier, typical attack feature vector and historical detection accuracy for each template in the candidate attack template set. The typical attack feature vector includes attack path length, protocol type distribution and node type preference.

[0155] Extracting the attack type identifier, typical attack feature vector, and historical detection accuracy for each template in the candidate attack template set is for further analysis of the characteristics and performance of the candidate attack templates. The attack type identifier clearly identifies the attack type represented by each template, such as port scanning attacks or malware propagation attacks. The typical attack feature vector contains key attack characteristics; the attack path length reflects the number of nodes involved in the attack and the complexity of the connection relationships; the protocol type distribution reflects the proportion and characteristics of the network protocols used in the attack; and the node type preference indicates which types of nodes the attack tends to target. The historical detection accuracy is the accuracy of the template in past detection tasks, reflecting the template's reliability. By extracting this information, candidate attack templates can be compared and analyzed more deeply, providing a basis for determining the final attack type. For example, when analyzing a candidate attack template, if its attack path length is long, the proportion of a specific protocol in the protocol type distribution is high, and the historical detection accuracy is also high, then the attack type represented by this template is more likely to be the type of current network attack.

[0156] Step S530: Perform multi-dimensional feature comparison on the candidate attack template set and node communication sequence, calculate the cosine similarity between the template typical attack feature vector and the sequence feature vector, and perform weighted fusion with the attack matching score to generate a comprehensive confidence score.

[0157] Multi-dimensional feature comparison of candidate attack template sets and node communication sequences is performed to comprehensively evaluate the matching degree between templates and sequences. The cosine similarity between the template's typical attack feature vector and the sequence's feature vector is calculated. Cosine similarity is a vector similarity metric that measures the similarity between two vectors by calculating the cosine of the angle between them; a value closer to 1 indicates a higher similarity. Weighted fusion combining the attack matching score and the template-sequence score comprehensively considers their performance in feature matching and overall matching. During weighted fusion, different weights are assigned to cosine similarity and the attack matching score, and the two indicators are weighted and summed according to their importance to generate a comprehensive confidence score. A higher comprehensive confidence score indicates a higher degree of matching between the candidate attack template and the node communication sequence, and is more likely to represent the current network attack type. In actual network attack detection, multi-dimensional feature comparison and weighted fusion can more accurately assess the attack type, avoiding the limitations of single-indicator evaluation. For example, a candidate attack template may have a high attack matching score but a low cosine similarity, indicating that although the overall matching is good, there may be differences in feature details. Weighted fusion can take both factors into account to obtain a more accurate comprehensive confidence score.

[0158] In one implementation, step S530 may include the following steps S531 to S535:

[0159] Step S531: Convert the node communication sequence into a sequence feature vector with the same dimensions as the attack behavior template. The vector elements include the number of path nodes, communication frequency distribution, protocol type ratio, and time span parameters.

[0160] Converting node communication sequences into sequence feature vectors of the same dimensions as the attack behavior template facilitates feature comparison. Vector elements include the number of path nodes, communication frequency distribution, protocol type ratio, and time span parameter. These elements reflect the key characteristics of the node communication sequence. The number of path nodes indicates the number of nodes involved in the attack path; the communication frequency distribution reflects the frequency and regularity of communication between nodes; the protocol type ratio reflects the proportion of different protocol types used in the communication; and the time span parameter records the duration of the attack. By converting the node communication sequence into such a feature vector, it can be directly compared with the typical attack feature vector of the attack behavior template. In actual network attack detection, node communication sequences may exist in different forms; converting them into feature vectors unifies the data format and improves the accuracy of feature comparison.

[0161] Step S532: Extract the typical attack feature vector of each template from the candidate attack template set, ensuring that the dimension and scale are consistent with the sequence feature vector.

[0162] Extracting typical attack feature vectors from each template in the candidate attack template set, and ensuring consistency in dimension and scale with the sequence feature vectors, is crucial for effective feature matching. Consistent dimension means both vectors contain the same number of elements, each representing the same feature information; consistent scale means the elements have the same value range and unit. When extracting typical attack feature vectors, the information in the templates needs to be organized and transformed to make it comparable to the sequence feature vectors. For example, if the communication frequency distribution in the sequence feature vectors is represented by the number of data packets per second, then the communication frequency distribution in the typical attack feature vectors in the candidate attack template set should also be represented in the same unit. By ensuring consistency in dimension and scale, the cosine similarity between the two vectors can be accurately calculated, improving the accuracy of feature matching.

[0163] Step S533: Calculate the directional similarity between the sequence feature vector and the typical attack feature vector of each template, normalize the directional similarity, and convert it into a feature matching score in the [0, 1] interval.

[0164] The directional similarity between the sequence feature vector and the typical attack feature vector of each template is calculated, typically using cosine similarity. Cosine similarity calculates the cosine of the angle between two vectors; the closer the value is to 1, the more similar the directions of the two vectors. Normalizing the directional similarity to a feature matching score in the [0, 1] interval makes the scores comparable and intuitive. Normalization can be achieved using methods such as linear transformations to map the cosine similarity value to the [0, 1] interval. A higher feature matching score indicates a higher similarity between the sequence feature vector and the typical attack feature vector of the template, meaning a better match between the node communication sequence and the attack behavior template in terms of features.

[0165] Step S534: Obtain the attack matching score of each template in the candidate attack template set, and sum the score and the feature matching score by dynamic weight allocation. The weight allocation is dynamically adjusted according to the standard deviation of the feature matching score. The higher the feature discrimination, the greater the weight.

[0166] The attack matching score of each template in the candidate attack template set is obtained and then weighted and summed with the feature matching score using dynamic weight allocation. This is to comprehensively consider the performance of the template and sequence in terms of overall matching degree and feature matching degree. The dynamic weight allocation is dynamically adjusted based on the standard deviation of the feature matching score. The standard deviation reflects the dispersion of the feature matching score; the higher the feature's discriminative power (i.e., the larger the standard deviation), the more significant the difference between different templates, and the greater its weight. In this way, weights can be reasonably allocated according to the discriminative power of features, improving the accuracy of the weighted summation. For example, if a feature has high discriminative power among different templates, then the weight of its matching score will be relatively high during the weighted summation to highlight the importance of that feature.

[0167] Step S535: Multiply the weighted sum by the historical detection accuracy of the template to obtain the overall confidence score.

[0168] The overall confidence score is obtained by multiplying the weighted sum by the template's historical detection accuracy. Historical detection accuracy reflects the template's reliability in past detection tasks; multiplying the weighted sum by this accuracy further improves the accuracy of the overall confidence score. A high historical detection accuracy indicates the template is reliable in identifying attack types, and multiplying it by the weighted sum enhances its influence in the final evaluation. The overall confidence score comprehensively considers the overall matching degree between the template and the sequence, feature matching degree, and the template's historical detection accuracy, making it an important indicator for evaluating the degree of matching between candidate attack templates and node communication sequences. In actual network attack detection, comparing the overall confidence scores of different candidate attack templates can determine the most likely attack type.

[0169] Step S540: Use a weighted voting mechanism to determine the final network attack type. The voting weight of each template in the candidate template set is the product of its comprehensive confidence score and historical detection accuracy. The attack type with the most votes is taken as the final result.

[0170] Using a weighted voting mechanism to determine the final network attack type is a decision-making method that comprehensively considers multiple factors. The voting weight of each template in the candidate template set is the product of its overall confidence score and its historical detection accuracy. This means that templates with higher overall confidence scores and higher historical detection accuracy have greater voting weights. By associating the voting weight of each template with its corresponding attack type, the voting weights of all candidate templates are accumulated, and the attack type with the highest number of votes is taken as the final result. This weighted voting mechanism fully considers the matching degree between the template and the node communication sequence, as well as the reliability of the template itself. In real-world network attack scenarios, different candidate attack templates may have different matching degrees and historical performance for the same node communication sequence. For example, one template may have a high overall confidence score but a relatively low historical detection accuracy; while another template may have a slightly lower overall confidence score but a very high historical detection accuracy. The weighted voting mechanism can balance these two factors, more accurately determining the final network attack type.

[0171] Step S550: Implement hierarchical attack source tracing, analyze the location attributes of the starting node of the node communication sequence in the network topology, distinguish edge access nodes, core forwarding nodes and terminal nodes, and adopt differentiated tracing strategies for different types of nodes.

[0172] Hierarchical attack source tracing is an effective method for tracking attack sources based on network topology. It analyzes the location attributes of the starting node in the network topology of the node communication sequence, classifying network nodes into edge access nodes, core forwarding nodes, and terminal nodes. Edge access nodes are typically the entry points for network connections to the outside world, such as firewalls and routers in enterprise networks; core forwarding nodes are responsible for high-speed forwarding of data within the network, such as core switches in data centers; and terminal nodes are devices directly connected to users or applications, such as computers and servers. Different types of nodes have different characteristics and functions, thus requiring differentiated tracing strategies. For edge access nodes, which are directly connected to the external network, they may be more vulnerable to external attacks; tracing should focus on their access port information and access authentication status. Core forwarding nodes play a crucial forwarding role in the network; tracing can be done by retrieving their routing tables to trace the original entry interface of the data packets and upstream forwarding nodes. Terminal nodes are the ultimate target or origin of the attack; tracing can be done by checking for abnormal process activity and abnormal network connections. Through hierarchical attack source tracing, targeted tracing can be performed based on the characteristics of different nodes, improving the efficiency and accuracy of tracing.

[0173] In one implementation, step S550 may include the following steps S551-S556:

[0174] Step S551: Analyze the network topology data, construct a node attribute classification model, and classify network nodes into three categories: edge access nodes, core forwarding nodes, and terminal nodes based on the node's IP address range, subnet mask, gateway configuration, and routing table information.

[0175] Analyzing network topology data is fundamental for implementing hierarchical attack source tracing. By collecting IP address ranges, subnet masks, gateway configurations, and routing table information of nodes in the network, a node attribute classification model can be constructed. IP address ranges reflect a node's approximate location and network affiliation; subnet masks determine the network and host portions of the IP address; gateway configurations indicate the node's connection method to the external network; and routing table information records the routing relationships between nodes. Using this information, network nodes can be classified into three categories: edge access nodes, core forwarding nodes, and terminal nodes. For example, a node with a defined IP address range and connected to an external network might be an edge access node; a node located in the network core and responsible for forwarding large amounts of data might be a core forwarding node; and a node directly connected to user equipment might be a terminal node. The node attribute classification model can be constructed using machine learning algorithms, such as decision trees and support vector machines, to accurately classify unknown nodes by learning and classifying known node attributes.

[0176] Step S552: Extract the first node in the node communication sequence as the starting node and query its category label in the node attribute classification model.

[0177] The first node in the node communication sequence is extracted as the starting node because it is usually the initiation point of an attack or the earliest node to participate in an attack. Querying its category label in the node attribute classification model determines the type of the starting node: edge access node, core forwarding node, or terminal node. The location information of the first node in the node communication sequence can be determined using methods such as timestamps. After determining the starting node, its relevant information is input into the node attribute classification model, and its category label is obtained based on the model's classification results.

[0178] Step S553: ​​When the starting node is an edge access node, it is directly included in the attack source candidate set and its access port information and access authentication status are marked.

[0179] When the starting node is an edge access node, it is highly likely to be the entry point for attacks because it is directly connected to the external network; therefore, it is directly included in the attack source candidate set. Simultaneously, its access port information and access authentication status are tagged. Access port information indicates which port the attack entered the network through, which is crucial for tracing the attack source and preventing subsequent attacks. Access authentication status reflects whether the node's access has been legitimately authenticated. An abnormal authentication status may indicate unauthorized access, further increasing the likelihood that the node is an attack source.

[0180] Step S554: When the starting node is a core forwarding node, retrieve its routing table, trace the original entry interface of the data packet and the upstream forwarding node, add the upstream node to the attack source candidate set, and recursively perform this process until the edge access node or terminal node is found.

[0181] When the originating node is a core forwarding node, since it is primarily responsible for data forwarding, an attack may originate from its upstream node. Therefore, its routing table is retrieved to trace the original ingress interface of the data packet and its upstream forwarding node. The routing table records routing information between nodes; by querying the routing table, it can be determined which interface the data packet entered from the core forwarding node, and the upstream node connected to that interface. The upstream node is added to the attack source candidate set, and this process is repeated recursively, continuously tracing the source of the data packet until the edge access node or terminal node is found.

[0182] Step S555: When the starting node is an end node, check whether there are abnormal process activities and abnormal network connections. If so, mark it directly as a candidate node for attack source; otherwise, trace its gateway node.

[0183] When the starting node is an end node, it's necessary to check for abnormal process activity and network connections. Abnormal process activity might include running unknown or malicious programs; abnormal network connections might manifest as communication with suspicious IP addresses. If these anomalies exist, the end node is likely the source of the attack and should be directly marked as a candidate attack source node. If no anomalies are found, it's necessary to trace its gateway node, as the attack may have propagated to this end node through the gateway node.

[0184] Step S556: Sort all nodes in the attack source candidate set in ascending order by access timestamp, and construct a source tracing path tree. The root node of the tree is the sequence start node, and the leaf nodes are potential attack sources.

[0185] Arranging all nodes in the attack source candidate set in ascending order of their access timestamps is to sort the nodes according to the chronological order of the attacks, facilitating the construction of a source tracing tree. A source tracing tree is a tree structure where the root node is the sequence start node, representing the starting point of the attack; leaf nodes are potential attack sources, representing possible attack initiation nodes. By constructing a source tracing tree, the propagation path of the attack and possible attack sources can be clearly shown. When arranging nodes, the access timestamp records the time when a node accesses the network, and the ascending order ensures that the construction of the source tracing tree conforms to the actual propagation process of the attack. When constructing the source tracing tree, starting from the root node, child nodes are added step by step according to the connection relationships and chronological order between nodes until all attack source candidate nodes are included in the tree.

[0186] Step S560: Verify the communication behavior characteristics of candidate attack source nodes. By comparing the degree of matching between their data packet interaction characteristics during the attack period and the typical attack initiation feature library, normal business nodes are excluded and the real attack source node is locked.

[0187] Verifying the communication behavior characteristics of candidate attack source nodes is crucial for identifying the true attack source node. By comparing the packet interaction characteristics of candidate attack source nodes during the attack period with a database of typical attack initiation characteristics, it's possible to determine if a node is indeed the attack source. The database of typical attack initiation characteristics is a collection of typical characteristics for various attack types, including packet size, frequency, protocol type, and communication direction. During the attack period, the packet interaction characteristics of candidate attack source nodes are recorded, such as packet sending and receiving frequencies and protocol type distribution. These characteristics are then compared with the database of typical attack initiation characteristics. A high degree of match indicates the node is likely the attack source; a low degree of match suggests the node may be a normal business node and can be excluded.

[0188] Step S570: Integrate the final network attack type identifier, the coordinates of the attack source node in the network topology, the comprehensive confidence score, and the attack path visualization data to generate a standardized network attack detection result report.

[0189] This system integrates the final network attack type identifier, the coordinates of the attack source node within the network topology, the overall confidence score, and attack path visualization data to generate a standardized network attack detection report. The final network attack type identifier clearly identifies the specific type of attack, such as DDoS attack or SQL injection attack; the coordinates of the attack source node within the network topology indicate the specific location of the attack source, facilitating network administrators' location and handling; the overall confidence score reflects the reliability of the detection results; and the attack path visualization data visually demonstrates the attack's propagation path and impact range. Integrating this information into a standardized report provides network administrators and security personnel with comprehensive and accurate information, enabling them to take appropriate measures for attack prevention and mitigation. A unified format and template can be used when generating the report to ensure its standardization and readability. For example, the report can include a detailed description of the attack type, the location information of the attack source, an explanation of the overall confidence score, and a visualization chart of the attack path.

[0190] The various algorithms involved in the above descriptions of the embodiments of this invention can all be obtained from relevant content in the prior art. To save space, these will not be elaborated upon in the embodiments of this invention. Furthermore, those skilled in the art can supplement the details based on common knowledge in the field when implementing this invention. For example, based on common knowledge in the field, normalization can be used to eliminate dimensional conflicts before feature fusion, interpolation can be used to eliminate dimensional differences, thresholds can be reasonably set based on historical data, experience, or business scenario requirements, the model can be trained based on a general model training method, the number of layers in the model structure can be set based on actual needs, and activation functions can be selected, etc. This invention will not provide redundant descriptions of overly detailed implementation processes.

[0191] Figure 2 This is a schematic diagram of the composition structure of a network attack detection device provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the network attack detection device 200 includes:

[0192] The data acquisition module 210 is used to receive real-time traffic data synchronously collected by distributed smart probes at various nodes of the network. The real-time traffic data carries node identification information and collection timestamp. The node identification information is used to distinguish the traffic source of different network nodes.

[0193] The graph construction module 220 is used to model the interaction relationship between nodes in the real-time traffic data, identify the traffic communication patterns between different network nodes, and generate a traffic association graph that includes node connection relationships and communication frequencies.

[0194] The sequence extraction module 230 is used to mine abnormal communication paths based on the traffic association map. By analyzing the deviation of node connection relationships and the fluctuation characteristics of communication frequency, it extracts node communication sequences with abnormal patterns.

[0195] The matching calculation module 240 is used to perform pattern matching processing on the node communication sequence and the attack behavior template in the preset attack feature library, calculate the sequence matching similarity and generate an attack matching score set.

[0196] The attack identification module 250 is used to determine the network attack type and attack source node location information based on the attack matching score set, and generate a network attack detection result containing the attack type identifier and source node coordinates.

[0197] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the apparatus provided by the present invention can be used to perform the methods described in the method embodiments above. For technical details not disclosed in the apparatus embodiments of the present invention, please refer to the descriptions of the method embodiments of the present invention for understanding.

[0198] Figure 3 A hardware entity diagram of a computer system provided as an embodiment of the present invention, such as... Figure 3 As shown, the hardware entity of the computer system 1000 includes a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can run on the processor 1001, and the processor 1001 executes the program to implement the steps in the method of any of the above embodiments.

[0199] Figure 4 The process is as follows:

[0200] Step 1: Report the characteristic data of various types of communication traffic collected;

[0201] Step 2: Pass the data through to the system's communication server;

[0202] Step 3: Upload the data to the "Network Topology Traffic Analysis and Management" module;

[0203] Step 4: "Network Topology Analysis and Management" performs graphical modeling based on the reported communication traffic characteristic data, and conducts real-time security analysis based on the feature library and algorithm repository. If security defense is required after analysis, the security defense command is sent to the "Security Defense Management" module.

[0204] Step 5: "Security Defense Management" issues security defense commands to network devices and probes for execution.

Claims

1. A method for detecting network attacks based on distributed intelligent probes, characterized in that, The method comprises: receiving real-time traffic data synchronously collected at nodes of a network by distributed intelligent probes, the real-time traffic data carrying node identification information and collection timestamps, the node identification information being used to distinguish traffic sources of different network nodes; modeling inter-node interaction of the real-time traffic data, identifying traffic communication modes between different network nodes, and generating a traffic correlation graph containing node connection relationships and communication frequencies; mining abnormal communication paths based on the traffic correlation graph, extracting node communication sequences with abnormal modes by analyzing the deviation degree of node connection relationships and the fluctuation characteristics of communication frequencies; performing mode matching processing on the node communication sequences and attack behavior templates in a preset attack feature library, calculating sequence matching similarity and generating an attack matching degree score set; determining network attack types and attack source node positioning information according to the attack matching degree score set, and generating a network attack detection result containing attack type identification and source node coordinates.

2. The method of claim 1, wherein, The modeling inter-node interaction of the real-time traffic data, identifying traffic communication modes between different network nodes, and generating a traffic correlation graph containing node connection relationships and communication frequencies comprises: performing session division processing on the real-time traffic data, aggregating traffic data into a set of session units with bidirectional transmission processes according to the node identification information and collection timestamps, each session unit containing source node identification, destination node identification, and data packet transmission records sorted by timestamps; extracting dynamic interaction features of each session unit in the set of session units, the dynamic interaction features including session duration, data packet interval fluctuation sequence, and protocol type proportion distribution, wherein the session duration is calculated by the timestamp difference between the first and last data packets, and the data packet interval fluctuation sequence is generated by sorting adjacent data packet timestamp differences; constructing a node association matrix based on the dynamic interaction features, the matrix row dimension corresponding to the source node identification set, the column dimension corresponding to the destination node identification set, and the matrix elements filled by the cumulative frequency of node interaction events in the session unit; performing time window normalization processing on the node association matrix, calculating the proportion of interaction frequency of each node pair in the total interaction frequency within a unit monitoring period, and generating an inter-node communication frequency distribution matrix; introducing a spatiotemporal correlation weight factor, dynamically adjusting the weight of matrix elements according to the hierarchical position and historical interaction stability of nodes in the network topology, and generating a weighted node association matrix; constructing a traffic correlation graph by fusing the weighted node association matrix and the communication frequency distribution matrix, the graph vertices representing network nodes, the vertex attributes containing node identification and hierarchical position, the edges representing node connection relationships, and the edge attributes containing weighted communication frequency and protocol type proportion distribution.

3. The method of claim 2, wherein, The extracting dynamic interaction features of each session unit in the set of session units, the dynamic interaction features including session duration, data packet interval fluctuation sequence, and protocol type proportion distribution comprises: For each session unit, the difference between the first packet collection timestamp and the last packet collection timestamp is extracted to obtain a session duration parameter based on the smallest unit of timestamp; The packet transmission records of each session unit are arranged in ascending order of collection timestamp, the timestamp difference between adjacent packets is calculated and an ordered sequence is formed as the packet interval fluctuation sequence; The packet transmission records in the session unit are traversed, the application layer protocol type field of each packet is identified, the occurrence times of different protocol types are counted, and a protocol type counter is generated; Normalization operation is performed on the protocol type counter to calculate the ratio of the occurrence times of each protocol type to the total number of packets, and a protocol type proportion distribution is obtained; The packet interval fluctuation sequence is smoothed to eliminate transient noise interference, and a filtered interval fluctuation sequence is obtained; An autoregressive moving average model is used to predict the trend of the filtered interval fluctuation sequence, calculate the data packet arrival time distribution probability in the future preset window, and generate a time series prediction feature; The session duration parameter, the filtered interval fluctuation sequence, the protocol type proportion distribution and the time series prediction feature are integrated into a structured feature vector as a storage carrier of dynamic interaction features.

4. The method of claim 3, wherein, The node association matrix is constructed based on the dynamic interaction features, the row dimension of the matrix corresponds to the source node identifier set, the column dimension corresponds to the destination node identifier set, and the matrix elements are filled by the cumulative frequency of node interaction events in the session unit, including: Extract the unique identifier set from the source node identifier and the destination node identifier of all session units, construct a node identifier list and assign a matrix index value to each identifier; Initialize a square matrix with a dimension matching the length of the node identifier list as the node association matrix framework, and set all initial element values of the matrix to zero; Traverse the session unit set, for each session unit, find the corresponding matrix index according to the source node identifier and the destination node identifier, and increase the element value at the corresponding position in the node association matrix framework by 1; Merge the session units containing the same source-destination node identifier pair, and accumulate the number of interaction events as the update value of the matrix element; Introduce feature association weight, calculate feature contribution based on protocol type proportion distribution and time series prediction feature in dynamic interaction feature, and generate node pair interaction weight coefficient; Multiply the matrix element value and the corresponding node pair interaction weight coefficient to obtain the weighted interaction frequency, and update the node association matrix element; Remove the node pair interaction records with weighted interaction frequency below the preset threshold through matrix sparsification processing, retain the significantly associated node connection relationship, and generate a sparse node association matrix.

5. The method of claim 1, wherein, The abnormal communication path is mined based on the traffic association graph, the deviation degree of node connection relationship and the fluctuation characteristics of communication frequency are analyzed, and the node communication sequence with abnormal mode is extracted, including: A dynamic communication baseline model is constructed, which integrates the time sequence correlation and spatial topology dependency of historical communication behaviors of nodes, learns the probability distribution of node connection relationship and the time-varying characteristics of communication frequency under normal communication mode by a non-parametric kernel density estimation method, and generates a baseline parameter set including a node pair correlation probability matrix and a time-varying frequency parameter; The structural difference between the current flow correlation graph and the node pair correlation probability matrix in the baseline parameter set is calculated, the node connection relationship is mapped to a low-dimensional feature space, and the Bhattacharyya distance between the current distribution and the baseline distribution in the feature space is calculated as the node connection deviation degree; A communication frequency fluctuation entropy index is introduced, the complexity of the communication frequency time series of each node connection is analyzed, the irregularity of the sequence is calculated by a sample entropy algorithm, and the higher the entropy value, the more intense the frequency fluctuation; A multi-dimensional abnormal score mechanism is constructed, the node connection deviation degree and the communication frequency fluctuation entropy are summed by weighting to obtain a comprehensive abnormal score, and the weight coefficient is dynamically adjusted according to the discrimination ability of each index in the historical attack sample; Based on the comprehensive abnormal score, the node connection edges in the flow correlation graph are sorted, the edges with a score higher than a dynamic threshold are selected as abnormal connection edges, and the dynamic threshold is adjusted in real time according to the current load level of the network by an adaptive control chart algorithm; In the flow correlation graph, a connected subgraph containing abnormal connection edges is tracked, the adjacent nodes are expanded in sequence according to the communication time sequence with the abnormal connection edges as the starting point, and a path containing at least three nodes and having an abnormal connection edge ratio exceeding a preset proportion is extracted as a node communication sequence.

6. The method of claim 5, wherein, The dynamic communication baseline model is constructed, which integrates the time sequence correlation and spatial topology dependency of historical communication behaviors of nodes, learns the probability distribution of node connection relationship and the time-varying characteristics of communication frequency under normal communication mode by a non-parametric kernel density estimation method, and generates a baseline parameter set including a node pair correlation probability matrix and a time-varying frequency parameter, including: Historical flow correlation graph data of multiple complete monitoring periods are collected, each period of data includes a node connection relationship snapshot and a corresponding communication frequency time series; The historical data are preprocessed, abnormal communication records during known attack events are excluded, and communication data marked as normal state are retained as a training sample set; The shortest path distance between nodes is calculated based on the network topology structure, a spatial topology dependency matrix is constructed, and the matrix elements represent the connection tightness of node pairs in the physical topology; A time series decomposition method is used to decompose the communication frequency time series of each node pair into a trend item, a periodic item and a random item, and separate the long-term change trend and periodic fluctuation characteristics of the communication frequency; For the preprocessed normal communication data, a non-parametric kernel density estimation method is used to estimate the occurrence probability distribution of each node pair connection relationship and the conditional probability distribution of the communication frequency; A time decay factor is introduced, different weights are given to training samples of different historical periods, the weight of recent samples is higher than that of distant samples, and the probability distribution model is updated by weighted kernel density estimation; The node pair correlation probability distribution, the communication frequency time-varying parameter and the spatial topology dependency matrix are integrated to form the baseline parameter set of the dynamic communication baseline model.

7. The method of claim 6, wherein, The multi-dimensional anomaly scoring mechanism is constructed, the node connection deviation degree and the communication frequency fluctuation entropy are weighted and summed to obtain a comprehensive anomaly score, and the weight coefficient is dynamically adjusted according to the discrimination ability of each index in the historical attack sample, including: Collecting a historical attack event sample set, each sample containing node connection deviation degree, communication frequency fluctuation entropy and corresponding attack label when the attack occurs; Standardizing the node connection deviation degree and the communication frequency fluctuation entropy in the historical sample set; Calculate the discrimination ability of node connection deviation degree and communication frequency fluctuation entropy to attack label, the higher the information gain ratio, the greater the contribution of the index to anomaly detection; Initialize the weight coefficient according to the information gain ratio result; A logistic regression classifier is constructed, the standardized node connection deviation degree and the communication frequency fluctuation entropy are used as input features, and the attack label is used as output target, and the logistic regression classifier is trained through the historical sample set; Extract the feature coefficient of the trained logistic regression classifier, normalize it and use it as the dynamically adjusted weight coefficient to replace the initial weight; For the current detection data, multiply the standardized node connection deviation degree by the corresponding weight coefficient, add the standardized communication frequency fluctuation entropy multiplied by its weight coefficient, and obtain the comprehensive anomaly score.

8. The method of claim 1, wherein, The node communication sequence is matched with the attack behavior template in the preset attack feature library, the sequence matching similarity is calculated, and an attack matching degree score set is generated, including: The node communication sequence is graph-structured serialized, the node connection relationship and the communication frequency attribute are mapped into a directed weighted sequence, and the sequence element contains the source node identifier, the destination node identifier, the communication frequency and the timestamp offset; Call the attack behavior template set in the preset attack feature library, each template contains the graph structure feature of the typical attack path, the time sequence behavior feature and the protocol interaction feature, the graph structure feature represents the node connection relationship through the adjacency matrix, and the time sequence behavior feature represents the state transition probability through the Markov chain model; A bidirectional attention mechanism matching model is constructed, the directed weighted sequence of the node communication sequence is used as the query vector, the graph structure feature of the attack behavior template is used as the key vector, and the correlation weight of the sequence and the template on the node connection relationship is calculated through the multi-head attention layer; The dynamic time warping algorithm is introduced to nonlinearly align the time sequence behavior features of the sequence and the template, calculate the optimal matching path and the path cumulative distance on the time axis, and the smaller the distance value, the higher the time sequence similarity; The graph kernel function is used to calculate the graph structure similarity of the node communication sequence and the attack behavior template, and the random walk kernel method is used to quantify the topological matching degree of the node connection mode in the sequence and the template graph structure; The correlation weight, the time sequence similarity and the graph structure similarity are fused, and a comprehensive matching score is generated through a weighted voting mechanism, the comprehensive matching scores of all attack behavior templates constitute the attack matching degree score set, and the weight coefficient is dynamically adjusted according to the historical attack detection accuracy.

9. The method of claim 8, wherein, The node communication sequence is subjected to graph structure serialization conversion, and node connection relationships and communication frequency attributes are mapped into a directed weighted sequence, sequence elements including source node identification, destination node identification, communication frequency, and timestamp offset, comprising: Traverse node connection relationships in the node communication sequence, arrange connection edges in ascending order of communication occurrence timestamp, and construct an ordered edge set; Extract source node identification and destination node identification for each connection edge, and query communication frequency attributes of the corresponding edge from a traffic association graph; Calculate the difference between the timestamp of each connection edge and the starting timestamp of the sequence to obtain the timestamp offset; Combine the source node identification, destination node identification, communication frequency, and timestamp offset into a four-tuple structure as a basic element of the directed weighted sequence; Perform logarithmic normalization processing on the communication frequency in the sequence element to convert the original frequency value into a normalized frequency weight in a preset numerical interval; Smooth the ordered edge set, calculate the average frequency and frequency change gradient of node interaction within a window, and generate an extended sequence element containing local statistical features; Arrange the extended sequence elements in ascending order of timestamp offset to obtain a directed weighted sequence with time sequence correlation, and the sequence length is equal to the number of connection edges in the node communication sequence.

10. A computer system comprising a memory and a processor, said memory storing a computer program operable on the processor, characterised in that, The processor implements the steps in the method of any one of claims 1 to 9 when executing the program.

Images