Network encryption attack detection method based on dual-source flow diagram fusion

Abstract

The invention discloses a network encryption attack detection method based on dual-source flow diagram fusion, and the method comprises the steps: collecting IP-level data of campus network flow of a certain college, and carrying out the basic feature extraction of an original pcap flow packet; carrying out feature engineering on the extracted basic features, and carrying out malicious or benign preliminary screening through a random forest model; extracting IP node features and edge features from the benign traffic packets and the malicious traffic packets after preliminary screening; performing data processing on the extracted node features and edge features, and fusing the node features and the edge features into a graph; and executing real-time blocking through a firewall API according to the node malicious probability. According to the method, collaborative analysis is achieved through cross-graph fusion, ID conflicts are eliminated through a node offset mechanism to ensure topological fusion zero loss, the Markov edge features accurately capture an encrypted traffic behavior mode, the novel attack detection rate is improved by 46.5% compared with traditional single-graph modeling, and a brand new solution is provided for encryption threat detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for detecting network encryption attacks based on dual-source traffic graph fusion. Background Technology

[0002] With the continuous development and popularization of internet technology, the current network environment faces severe challenges such as complex traffic behavior and vulnerable security protection, and traditional security solutions have significant shortcomings. Firewall systems based on rule matching and static policies are difficult to adapt to dynamic and ever-changing traffic patterns, often leading to false blocking of network traffic or failure to detect new malicious attacks. Commercial intrusion detection solutions lack scenario optimization, have limited threat identification capabilities in mixed traffic, and have poor compatibility with network architecture. Furthermore, graph neural network methods in existing academic research do not fully consider network traffic characteristics, ignore the differences between subgraphs in various scenarios when constructing traffic graphs, and lack real-time linkage between detection results and firewall blocking actions. These shortcomings result in network security protection suffering from problems such as delayed response, high false positive rates, and inaccurate blocking, urgently requiring a malicious traffic protection solution that is deeply adapted to various scenarios and integrates intelligent detection and real-time blocking. Therefore, how to leverage existing technologies to deeply adapt to various scenarios and achieve intelligent detection and real-time blocking of encrypted malicious traffic has become a pressing technical problem to be solved. Summary of the Invention

[0003] Purpose of the invention: The purpose of this invention is to provide a network encryption attack detection method based on dual-source traffic graph fusion.

[0004] Technical solution: This invention is a network encryption attack detection method based on dual-source traffic graph fusion, comprising the following steps:

[0005] (1) Collect IP-level data of network traffic and extract basic features from raw pcap traffic packets;

[0006] (2) Perform feature engineering on the extracted basic features and use a random forest model for initial screening to determine whether the features are malicious or benign.

[0007] (3) Extract IP node features and edge features from the benign traffic packets and malicious traffic packets after initial screening, respectively;

[0008] (4) Perform data processing on the extracted node and edge features;

[0009] (5) Merge node and edge features into benign or malicious traffic subgraphs respectively, and then merge them into a single graph using cross-same-line fusion technology;

[0010] (6) A two-layer GCN is used to classify nodes in the fused graph. The first layer outputs 128-dimensional features, and the second layer optimizes the feature representation.

[0011] (7) Based on the probability of node malice, perform real-time blocking via firewall API.

[0012] Further, step (1) includes:

[0013] (1.1) Collection of self-built datasets: Normal traffic comes from the compliant traffic generated by students and teachers in the daily network use of the school, such as browsing, resource requests, and data transmission, which reflects the benign traffic characteristics of the campus network environment; Malicious traffic includes traffic generated by attacks such as penetration attacks, abnormal repeated requests, and malicious code propagation against the school's campus network, which reflects the typical malicious attack traffic patterns faced by the campus network.

[0014] (1.2) Traffic parsing and 5-tuple grouping: Parse each packet in the pcap file, extract the network layer and transport layer header information, construct 5-tuple identifiers, and divide the packets into independent flow sessions according to the 5-tuples. Each flow session contains a time-ordered sequence of packets.

[0015] (1.3) Basic feature extraction: Extract time sequence features, traffic features, packet length features and transport layer features from each session stream;

[0016] (1.4) Feature quantization and numericalization: converting non-numerical features into numerical representations;

[0017] (1.5) Structured storage: The extracted features are stored as structured table data D1, indexed by 5-tuples. Each row represents a stream session, and each column corresponds to a feature dimension.

[0018] Furthermore, step (2) involves feature engineering on the extracted basic features, including feature standardization, feature combination and derivation, and feature dimensionality reduction.

[0019] The feature standardization process includes Z-score standardization of numerical features in D1, such as packet length, flow duration, timestamp, and port, as shown in formula (1):

[0020]

[0021] Where μ is the characteristic mean and σ is the characteristic standard deviation.

[0022] Further, step (3) shown includes:

[0023] (3.1) IP node feature extraction steps: Process the initially screened dataset D3, treat each IP address as an independent node, aggregate all traffic packets involved by the IP through the dictionary structure ip_nodes, and extract three core features from the aggregated data: connection features, traffic features, and time series features to generate intermediate data D4;

[0024] (3.2) Edge feature extraction steps: Process the initially screened dataset D3, treat all traffic between two IPs as an edge, aggregate traffic using the dictionary structure edges, and extract three core features from the aggregated data: traffic features, time series features, and protocol features to generate dataset D5.

[0025] Further, step (4) shown includes:

[0026] (4.1) Node feature aggregation and standardization: The extracted D4 is processed in two stages. First, the feature data is aggregated using the source IP as the grouping key. Similar features are merged by summation and mean calculation to form an aggregated feature table with the source IP as the unique identifier. Then, the numerical features are standardized using the Z-score standardization method to unify the dimensions and map the feature values ​​to the standard normal distribution range to eliminate the scale difference between different features. Finally, each row of the standardized node features is assigned to an IP node, and the standardized feature values ​​are retained in each column to output the intermediate dataset D6.

[0027] (4.2) Edge feature cleaning and standardization: For the extracted D5, firstly, all transition probability feature columns starting with markov are extracted by filtering by column name. Then, the positive and negative infinity values ​​in the features are replaced with NaN and records with missing values ​​are deleted. Then, the same Z-score standardization strategy as the node features is adopted. The cleaned Markov features are scaled by StandardScaler to generate a standardized feature vector with a mean of 0 and a variance of 1. Finally, the standardized features and the flow identifier are recombined and stored as the labeled dataset D7.

[0028] Furthermore, step (4.2) applies Markov chains to the edge modeling of encrypted traffic to quantify the temporal patterns of attack behavior; it defines the protocol state or packet length interval of continuous data packets within a stream session as discrete states, calculates the transition probabilities between states, and generates a k-dimensional Markov feature vector m = [m1, m2, ..., m...]. k ].

[0029] Further, step (5) includes:

[0030] (5.1) Graph Construction: Based on the separation of benign traffic data and malicious traffic data, two completely independent graph structures are constructed, where the benign traffic graph is represented as G. b =(V b E b Malicious traffic is represented as G. m =(V m E m ), where v is the set of nodes and E is the set of edges;

[0031] (5.2) Node addition: For each record in dataset D6, extract the source IP address and the corresponding statistical feature vector. Where d0 is the original feature dimension, and node V = (IP, f) is added to the graph structure;

[0032] (5.3) Edge addition and feature fusion: Add edge e = (IP S IP d Add to graph G b = (V, E), and generate a fused feature vector e = φ(m, p) for each edge. s p d ), where formula (2) is the feature fusion function φ

[0033] φ(m, p) s p d ) = [m1, m2, ..., m k ,ψ(p s ), ψ(p d )]∈R k+2 (2)

[0034] Where ψ is the feature transformation function of the port value, k is the Markov feature dimension, m is the Markov feature vector, and p s and p d For port information, design a nonlinear mapping function ψ(p)=log(1+p / 1000) to convert the port number into behavioral semantic features.

[0035] (5.4) Format Transformation: By representing each undirected edge as two directed edges with opposite directions sharing the same fused edge feature e, and constructing the edge connection index matrix and the edge feature matrix, G is transformed into a fused edge with the same fused edge feature e. b and G m Transform into P b and P m ;

[0036] (5.5) Node feature fusion will integrate P b and P m The node feature matrices are vertically concatenated to form a unified node matrix X; S5.6 Edge feature fusion: for P m After applying a node offset to the edge connection index matrix, it is connected to P. b The edge indices are horizontally concatenated to form the index matrix E. index ;

[0037] (5.6) Label vector generation: Create a binary classification label vector, in which all nodes of the benign traffic graph are assigned a label value of 0 and all nodes of the malicious traffic graph are assigned a label value of 1;

[0038] (5.7) Unified Graph Construction: Based on the node feature matrix, index matrix, and label vector, a unified graph data object P that can be directly input into a graph neural network is generated. merged .

[0039] Further, step (6) includes:

[0040] (6.1) Feature transformation: For the fused image P merged Feature transformation is performed using formula (3).

[0041] h (1) =ReLU(GCNConv(X, E) index (3)

[0042] Among them, h (1) ∈R n×128 The first layer outputs 128-dimensional features, with ReLU as the activation function and GCNConv as the image convolution.

[0043] (6.2) Feature optimization: For the h output of the first layer (1) As input, using the same E index Image convolution is performed, and feature optimization is performed using formula (4).

[0044] h (2) =GCNConv(h (drop) E index (4)

[0045] Among them, h (2) ∈R n×128 The second layer outputs 128 dimensions of features;

[0046] (6.3) Classification decision: The 128-dimensional features are mapped to a 2-dimensional space through linear transformation;

[0047] z = Wh (2) +b

[0048] Where W∈R 2×128 Let b be the weight matrix, and b ∈ R. 2 Let z be the bias vector, z∈R n×2 Original category score;

[0049] (6.4) Probability Normalization: The logarithmic softmax function is used for probability normalization, as shown in formula (5):

[0050] p = log softmax(z) (5)

[0051] Where p∈R n×2 This represents the probability distribution of node categories.

[0052] Further, step (7) includes:

[0053] Implement a tiered response mechanism: when the probability of malicious activity is greater than 0.9, permanently block the data via the firewall API; when the probability is between 0.7 and 0.9, initiate rate limiting and monitoring and trigger administrator alerts; when the probability is less than 0.7, only logs are recorded to protect the scientific research data flow, thus establishing a linkage protection system that is deeply adapted to the campus network architecture.

[0054] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0055] (1) It pioneered the network traffic profile template technology, which establishes differentiated feature models for different types of devices (such as servers, terminal devices, IoT devices, etc.), accurately identifies traffic patterns in specific scenarios, ensures the continuity of core business through the built-in whitelist of key business data transmission, and can dynamically adjust the security threshold according to actual needs, completely solving the core pain point of "false blocking of key business traffic" in traditional solutions, and achieving a perfect balance between security protection and business operation.

[0056] (2) A dual-channel topology isolation and fusion architecture is proposed: benign traffic is independently modeled as subgraphs for different scenarios, and malicious traffic is isolated to form an attack subgraph. Collaborative analysis is achieved through cross-graph fusion. The node offset mechanism eliminates ID conflicts to ensure zero loss in topology fusion. Markov edge features accurately capture encrypted traffic behavior patterns, which improves the detection rate of new attacks by 46.5% compared with traditional single graph modeling, providing a brand-new solution for encrypted threat detection.

[0057] (3) Construct a millisecond-level response protection chain. The five-tuple streaming processing technology supports line-speed parsing of 10 Gigabit networks. The combination of double-layer GCN convolution and sparse matrix operation makes the single-node processing latency <200ms. The hierarchical response mechanism achieves precise prevention and control - when the probability of malice is >90%, it will be permanently blocked within 300ms. When the probability of malice is 70-90%, intelligent rate limiting will be initiated and real-time alarms will be triggered. When the probability of malice is <70%, only audit logs will be recorded. Compared with traditional solutions, the response time is shortened by 8 times, effectively curbing the spread of ransomware with an average encryption time of only 5 minutes.

[0058] (4) Achieving accurate identification through three-dimensional technological innovation: the port conversion function in the feature engineering dimension reduces the false alarm rate by 94.7%; the Markov edge feature fusion in the graph modeling dimension improves the detection rate of encryption attacks by 92%; and the 128-dimensional dual optimization layer in the GCN architecture dimension drives the accuracy rate to jump to 98.8%. In actual tests, a breakthrough was achieved with 100% detection of ransomware and zero false alarms of DDoS attacks. Attached Figure Description

[0059] Figure 1 This is a framework diagram of the method of the present invention;

[0060] Figure 2 Build a framework graph for the nodes;

[0061] Figure 3 Build a framework graph for the edges;

[0062] Figure 4 To generate a prediction flowchart;

[0063] Figure 5 This is a screenshot showing the effect of a self-built dataset.

[0064] Figure 6 This is a screenshot of the public dataset. Detailed Implementation

[0065] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0066] like Figure 1 As shown, the network encryption attack detection method based on dual-source traffic graph fusion described in this invention includes the following steps:

[0067] (1) Collect IP-level data of network traffic and extract basic features from raw pcap traffic packets;

[0068] (2) Perform feature engineering on the extracted basic features and use a random forest model for initial screening to determine whether the features are malicious or benign.

[0069] (3) Extract IP node features and edge features from the benign traffic packets and malicious traffic packets after initial screening, respectively;

[0070] (4) Perform data processing on the extracted node and edge features;

[0071] (5) Merge node and edge features into benign or malicious traffic subgraphs respectively, and then merge them into a single graph using cross-same-line fusion technology;

[0072] (6) A two-layer GCN is used to classify nodes in the fused graph. The first layer outputs 128-dimensional features, and the second layer optimizes the feature representation.

[0073] (7) Based on the probability of node malice, perform real-time blocking via firewall API.

[0074] The specific implementation method is as follows:

[0075] Build a self-built dataset, and as follows Figure 2 As shown, each data packet in the pcap file is parsed, the network layer and transport layer header information is extracted, a 5-tuple identifier is constructed, and the data packets are divided into independent flow sessions according to the 5-tuple. Each flow session contains a time-ordered sequence of data packets. The self-built dataset is shown in Table 1.

[0076] Table 1 Comparison of experimental results (self-built dataset)

[0077]

[0078] Extract timing features, traffic features, packet length features, and transport layer features from each session stream;

[0079] Non-numerical features are converted into numerical representations. For example, TCP flags are converted into numerical values ​​through bitwise operations, and protocol types are mapped to numerical values ​​through enumeration.

[0080] The extracted features are indexed by quintuples and stored as structured tabular data D1, where each row represents a streaming session and each column corresponds to a feature dimension.

[0081] The numerical features in D1, such as packet length, flow duration, timestamp size, and port, are standardized using Z-score, as shown in formula (1):

[0082]

[0083] Where μ is the characteristic mean and σ is the characteristic standard deviation;

[0084] New feature dimensions can be generated based on the original features, such as extracting hour information from timestamps and calculating the sum of source and destination ports.

[0085] By deleting irrelevant columns and handling missing and outlier values, the features are filtered and preprocessed to obtain intermediate data D2;

[0086] Load the normal traffic data and attack traffic data from the public dataset CIC-IDS-2017, as shown in Table 2. Process the public dataset CIC-IDS-2017 according to steps (1) and (2), train it using the random forest algorithm, and save the model as a persistent file; Figure 5 The image shown is a screenshot of the self-built dataset. Figure 6 This is a screenshot of the public dataset.

[0087] Table 2 Comparative Experiment Results (CIC-IDS-2017 Public Dataset)

[0088]

[0089] Compare the feature columns and feature order of the training dataset to ensure feature consistency; Initial screening for malicious / benign data: Load the pre-trained random forest model from the persistent file, use the loaded model to classify and predict the preprocessed self-built dataset, generate predicted labels, select samples with predicted labels of 0 from the self-built benign dataset to form a purified benign dataset, select samples with predicted labels of 1 from the self-built malicious dataset to form a purified malicious dataset, and save the purified benign and malicious datasets as intermediate dataset D3.

[0090] The initially screened dataset D3 is processed by treating each IP address (including source IP and destination IP) as an independent node. All traffic packets involved by that IP are aggregated through the dictionary structure ip_nodes. Three core features—connection features, traffic features, and time series features—are extracted from the aggregated data to generate intermediate data D4.

[0091] The initially screened dataset D3 is processed by treating all traffic between two IPs as an edge, aggregating traffic according to (source IP, destination IP) using the dictionary structure edges, and extracting three core features—traffic features, time series features, and protocol features—from the aggregated data to generate dataset D5.

[0092] like Figure 3 As shown, the extracted D4 is processed in two stages. First, the feature data is aggregated using the source IP as the grouping key. By summing and calculating the mean, similar features are merged to form an aggregated feature table with the source IP as the unique identifier. Then, the numerical features are standardized using the Z-score standardization method. The feature values ​​are mapped to the standard normal distribution interval using formula (1) to eliminate the scale difference between different features. Finally, each row of the standardized node features corresponds to an IP node, and each column retains the standardized feature value, outputting the intermediate dataset D6.

[0093] For the extracted D5, firstly, all transition probability feature columns starting with "markov" are extracted by filtering by column name. Then, the positive and negative infinity values ​​in the features are replaced with NaN and records with missing values ​​are deleted to ensure the effectiveness of the edge features. Subsequently, the same Z-score standardization strategy as the node features is adopted, and the cleaned Markov features are scaled by StandardScaler to generate a standardized feature vector with a mean of 0 and a variance of 1. Finally, the standardized features are recombined with the flow identifiers (source IP, destination IP, port number) and stored as the labeled dataset D7.

[0094] Based on the separation of benign and malicious traffic data, two completely independent graph structures are constructed, where the benign traffic graph is represented as G. b =(V b E bMalicious traffic is represented as G. m =(V m E m ), where v is the set of nodes and E is the set of edges;

[0095] For each record in dataset D6, extract the source IP address and the corresponding statistical feature vector. Where d0 is the original feature dimension, and node V = (IP, f) is added to the graph structure;

[0096] Let edge e = (IP) S IP d Add to graph G b = (V, E), and generate a fused feature vector e = φ(m, p) for each edge. s p d ), where formula (2) is the feature fusion function φ

[0097] φ(m, p) s p d ) = [m1, m2, ..., m k ,ψ(p s ), ψ(p d )]∈R k+2 (2)

[0098] Where ψ is the feature transformation function of the port value, k is the Markov feature dimension, m is the Markov feature vector, and p s and p d Port information;

[0099] By representing each undirected edge as two directed edges with opposite directions sharing the same fused edge feature e, and constructing the edge connection index matrix and the edge feature matrix, G is made possible. b and G m Transform into P b and P m ;

[0100] Node feature fusion will P b and P m The node feature matrices are vertically concatenated to form a unified node matrix X; S5.6 Edge feature fusion: for P m After applying a node offset to the edge connection index matrix, it is connected to P. b The edge indices are horizontally concatenated to form the index matrix E. index ;

[0101] Label vector generation: Create binary classification label vectors, where all nodes in the benign traffic graph are assigned a label value of 0 and all nodes in the malicious traffic graph are assigned a label value of 1.

[0102] like Figure 4As shown, the unified graph is constructed by generating a unified graph data object P that can be directly input into a graph neural network based on the node feature matrix, index matrix, and label vector. merged .

[0103] For the fused graph P merged Feature transformation is performed using formula (3).

[0104] h (1) =ReLU(GCNConv(X, E) index (3)

[0105] Among them, h (1) ∈R n×128 The first layer outputs 128-dimensional features, with ReLU as the activation function and GCNConv as the image convolution.

[0106] For the output h of the first layer (1) As input, using the same E index Image convolution is performed, and feature optimization is performed using formula (4).

[0107] h (2) =GCNConv(h (drop) E index (4)

[0108] Among them, h (2) ∈R n×128 The second layer outputs 128-dimensional features; through a linear transformation, the 128-dimensional features are mapped to a 2-dimensional space.

[0109] z = Wh (2) +b

[0110] Where W∈R 2×128 Let b be the weight matrix, and b ∈ R. 2 Let z be the bias vector, z∈R n×2 Original category score;

[0111] The probability is normalized using the logarithmic softmax function, as shown in formula (5):

[0112] p = log softmax(z) (5)

[0113] Where p∈R n×2 The probability distribution of node categories;

[0114] Implement a tiered response mechanism: when the probability of malicious activity is greater than 0.9, permanently block the data via the firewall API; when the probability is between 0.7 and 0.9, initiate rate limiting and monitoring and trigger administrator alerts; when the probability is less than 0.7, only logs are recorded to protect the scientific research data flow, thus establishing a linkage protection system that is deeply adapted to the campus network architecture.

Claims

1. A network encryption attack detection method based on dual-source traffic graph fusion, characterized in that, Includes the following steps: (1) Collect self-built IP-level data of campus network traffic and extract basic features from the original pcap traffic packets; (2) Perform feature engineering on the extracted basic features and use a random forest model for initial screening to determine whether the features are malicious or benign. (3) Extract IP node features and edge features from the benign traffic packets and malicious traffic packets after initial screening, respectively; (4) Perform data processing on the extracted node and edge features; (5) Merge node and edge features into benign or malicious traffic subgraphs respectively, and then merge them into a single graph using cross-same-line fusion technology; (6) A two-layer GCN is used to classify nodes in the fused graph. The first layer outputs 128-dimensional features, and the second layer optimizes the feature representation. (7) Based on the probability of node malice, perform real-time blocking via firewall API.

2. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (1) includes: (1.1) Collection of self-built datasets: Normal traffic includes browsing, resource requests and data transmission generated during daily network use, while malicious traffic includes traffic generated by attacks such as penetration attacks against the campus network, abnormal repeated requests, and malicious code propagation. (1.2) Traffic parsing and 5-tuple grouping: Parse each packet in the pcap file, extract the network layer and transport layer header information, construct 5-tuple identifiers, and divide the packets into independent flow sessions according to the 5-tuples. Each flow session contains a time-ordered sequence of packets. (1.3) Basic feature extraction: Extract time sequence features, traffic features, packet length features and transport layer features from each session stream; (1.4) Feature quantization and numericalization: converting non-numerical features into numerical representations; (1.5) Structured storage: The extracted features are stored as structured table data D1, indexed by 5-tuples. Each row represents a stream session, and each column corresponds to a feature dimension.

3. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (2) involves feature engineering of the extracted basic features, including feature standardization, feature combination and derivation, and feature dimensionality reduction. The feature standardization process includes Z-score standardization of numerical features in D1, such as packet length, flow duration, timestamp, and port, as shown in formula (1): Where μ is the characteristic mean and σ is the characteristic standard deviation.

4. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (3) shown includes: (3.1) IP node feature extraction steps: Process the initially screened dataset D3, treat each IP address as an independent node, aggregate all traffic packets involved by the IP through the dictionary structure ip_nodes, and extract three core features from the aggregated data: connection features, traffic features, and time series features to generate intermediate data D4; (3.2) Edge feature extraction steps: Process the initially screened dataset D3, treat all traffic between two IPs as an edge, aggregate traffic using the dictionary structure edges, and extract three core features from the aggregated data: traffic features, time series features, and protocol features to generate dataset D5.

5. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (4) shown includes: (4.1) Node feature aggregation and standardization: The extracted D4 is processed in two stages. First, the feature data is aggregated using the source IP as the grouping key. Similar features are merged by summation and mean calculation to form an aggregated feature table with the source IP as the unique identifier. Then, the numerical features are standardized using the Z-score standardization method to unify the dimensions and map the feature values ​​to the standard normal distribution range to eliminate the scale difference between different features. Finally, each row of the standardized node features is assigned to an IP node, and the standardized feature values ​​are retained in each column to output the intermediate dataset D6. (4.2) Edge feature cleaning and standardization: For the extracted D5, firstly, all transition probability feature columns starting with markov are extracted by filtering by column name. Then, the positive and negative infinity values ​​in the features are replaced with NaN and records with missing values ​​are deleted. Then, the same Z-score standardization strategy as the node features is adopted. The cleaned Markov features are scaled by StandardScaler to generate a standardized feature vector with a mean of 0 and a variance of 1. Finally, the standardized features and the flow identifier are recombined and stored as the labeled dataset D7.

6. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 5, characterized in that, Step (4.2) applies Markov chains to the edge modeling of encrypted traffic to quantify the temporal patterns of attack behavior; it defines the protocol state or packet length interval of continuous data packets within a stream session as discrete states, calculates the transition probabilities between states, and generates a k-dimensional Markov feature vector m = [m1, m2, ..., m]. k ].

7. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (5) includes: (5.1) Graph Construction: Based on the separation of benign traffic data and malicious traffic data, two completely independent graph structures are constructed, where the benign traffic graph is represented as G. b =(V b E b Malicious traffic is represented as G. m =(V m E m ), where v is the set of nodes and E is the set of edges; (5.2) Node addition: For each record in dataset D6, extract the source IP address and the corresponding statistical feature vector. Where d0 is the original feature dimension, and node V = (IP, f) is added to the graph structure; (5.3) Edge addition and feature fusion: Add edge e = (IP S IP d Add to graph G b = (v, E), and generate a fused feature vector e = φ(m, p) for each edge. s p d ), where formula (2) is the feature fusion function φ φ(m,p s ,p d )=[m1,m2,...,m k ,ψ(P s ),ψ(p d )]∈R k+2 (2) Where ψ is the feature transformation function of the port value, k is the Markov feature dimension, m is the Markov feature vector, and p s and p d For port information, design a nonlinear mapping function ψ(p)=log(1+p / 1000) to convert the port number into behavioral semantic features; (5.4) Format Transformation: By representing each undirected edge as two directed edges with opposite directions sharing the same fused edge feature e, and constructing the edge connection index matrix and the edge feature matrix, G is transformed into a fused edge with the same fused edge feature e. b and G m Transform into P b and P m ; (5.5) Node feature fusion will integrate P b and P m The node feature matrices are vertically concatenated to form a unified node matrix X; S5.6 Edge feature fusion: for P m After applying a node offset to the edge connection index matrix, it is connected to P. b The edge indices are horizontally concatenated to form the index matrix E. index ; (5.6) Label vector generation: Create a binary classification label vector, in which all nodes of the benign traffic graph are assigned a label value of 0 and all nodes of the malicious traffic graph are assigned a label value of 1; (5.7) Unified Graph Construction: Based on the node feature matrix, index matrix, and label vector, a unified graph data object P that can be directly input into a graph neural network is generated. merged .

8. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (6) includes: (6.1) Feature transformation: For the fused image P merged Feature transformation is performed using formula (3). h (1) =ReLU(GCNConv(X,E index )) (3) Among them, h (1) ∈R n×128 The first layer outputs 128-dimensional features, with ReLU as the activation function and GCNConv as the image convolution. (6.2) Feature optimization: For the h output of the first layer (1) As input, using the same E index Image convolution is performed, and feature optimization is performed using formula (4). h (2) =GCNConv(h (drop) ,E index ) (4) Among them, h (2) ∈R n×128 The second layer outputs 128 dimensions of features; (6.3) Classification decision: The 128-dimensional features are mapped to a 2-dimensional space through linear transformation; z=Wh (2) +b Where W∈R 2×128 Let b be the weight matrix, and b ∈ R. 2 Let z be the bias vector, z∈R n×2 Original category score; (6.4) Probability Normalization: The logarithmic softmax function is used for probability normalization, as shown in formula (5): p=log softmax(z) (5) Where p∈R n×2 This represents the probability distribution of node categories.

9. The network encryption attack detection method based on dual-source traffic graph fusion according to claim 1, characterized in that, Step (7) includes: Implement a tiered response mechanism: when the probability of malicious activity is greater than 0.9, permanently block the data via the firewall API; when the probability is between 0.7 and 0.9, initiate rate limiting and monitoring and trigger administrator alerts; when the probability is less than 0.7, only logs are recorded to protect the scientific research data flow, thus establishing a linkage protection system that is deeply adapted to the campus network architecture.

Images