A network data classification method based on artificial intelligence

Abstract

This invention proposes an artificial intelligence-based network data classification method. The method includes: acquiring raw connection data and constructing a structured protocol field graph; aggregating the structured protocol field graph through a multi-layer graph convolutional network to generate connection semantic embedding vectors; enhancing the connection semantic embedding vectors with contextual protocol semantic embedding to obtain enhanced connection semantic vectors; aggregating the connection semantic vectors by host and time window, and introducing protocol attention masks and behavior residual sparsity regularization to obtain a host behavior tensor and a protocol attention score matrix; generating behavior semantic vectors by aggregating the host behavior tensor, and introducing connection semantic distribution constraints to generate host behavior semantic vectors; and outputting the classification score of host behavior based on the host behavior semantic vectors using an attention-guided classifier. This invention can significantly improve the comprehensiveness and reliability of network threat detection and business traffic insight.

Description

Technical Field

[0001] This invention belongs to the field of network data classification, and in particular relates to a network data classification method based on artificial intelligence. Background Technology

[0002] With the continuous rise in the proportion of encrypted communication and the large-scale deployment of new multiplexing protocols such as HTTP / 3-QUIC, network traffic has exhibited complex characteristics of high encryption, high concurrency, and multiple protocol overlays. Traditional classification methods that rely solely on ports, keywords, or shallow statistical information experience a sharp drop in accuracy when faced with encrypted payloads and dynamic field reuse, while deep packet inspection is difficult to deploy comprehensively due to privacy compliance and computational overhead. Furthermore, modern attacks and business behaviors often span multiple connections: from DNS queries and TLS connection establishment to data push, forming a complete chain process, modeling only isolated connections cannot reveal their global intent; this leads to both errors and omissions in threat detection, and even normal business operations are easily misjudged. While some existing machine learning-based solutions introduce neural network feature extraction, they mostly remain at the single-connection level, lacking host-time dimension behavior aggregation and context alignment; moreover, model outputs are often presented as labels or scores, lacking readable reasoning paths, making it difficult to meet the hard requirements for interpretability in scenarios such as enterprise auditing and compliance forensics.

[0003] Therefore, network data classification urgently needs a new technical framework that can robustly extract semantics in encrypted and protocol variation environments, characterize behavioral sequences across connections, and provide structured interpretations of the results. Summary of the Invention

[0004] The purpose of this invention is to propose a network data classification method based on artificial intelligence to solve the above-mentioned problems.

[0005] To achieve the above objectives, this invention provides a network data classification method based on artificial intelligence, the method comprising: Obtain the raw connection data and construct a structured protocol field graph; The structured protocol field graph is aggregated using a multi-layer graph convolutional network to generate connection semantic embedding vectors. The connection semantic embedding vector is enhanced by context protocol semantic embedding to obtain an enhanced connection semantic vector; The connection semantic vectors are aggregated by host and time window, and a protocol attention mask and behavior residual sparse regularization are introduced to obtain the generated host behavior tensor and protocol attention score matrix. Based on the host behavior tensor, a behavior semantic vector is generated by aggregating the tensor, and a connection semantic distribution constraint is introduced to generate the host behavior semantic vector. Based on the host behavior semantic vector, an attention-guided classifier is used to output the classification score of the host behavior.

[0006] Furthermore, each node in the structured protocol field graph corresponds to a protocol field, and the node attributes are the numerical / category / text vector representation of the field and the field type label; the edges between nodes represent the logical or protocol dependencies between fields.

[0007] Furthermore, the step of aggregating the structured protocol field graph through a multi-layer graph convolutional network to generate connection semantic embedding vectors specifically includes: Suppose the structured protocol field diagram has There are 10 field nodes, and the initial feature dimension of each node is 1000. This forms the initial feature matrix; Based on the initial feature matrix, the neighbor nodes are aggregated using the adjacency matrix in each layer through graph convolution operations to update the node embedding; The connection embeddings are concatenated using max pooling and average pooling to generate a unified connection embedding, resulting in a connection semantic embedding vector.

[0008] Furthermore, the step of performing context protocol semantic embedding enhancement on the connection semantic embedding vector to obtain an enhanced connection semantic vector specifically includes: The connection semantic embedding vector is multiplebroadcast to each node and concatenated with the original node features to form a context-aware input; Based on the context-aware input, the following convolutional embedding process is designed to update node representations: ; in, This is the normalized adjacency matrix; For trainable graph convolution weights; It is a non-linear activation function; To embed connection semantics into vectors Control items mapped to the node dimension use a shared perceptual vector approach. The regularization control coefficient determines the degree to which the contextual intent affects the semantic update of the node; After the node representations are updated, an attention-based weighted aggregation method is used to merge the updated node representations into an enhanced connection semantic vector.

[0009] Furthermore, the enhanced connection semantic vectors exhibit separability for connections with the same field structure but different behavioral intentions. At the same time, they can automatically amplify the semantics of important fields during model training and adapt to cross-protocol and multi-mode network connection classification scenarios.

[0010] Further, the steps of aggregating the connection semantic vectors by host and time window, and introducing protocol attention mask and behavior residual sparse regularization to obtain the host behavior tensor and protocol attention score matrix specifically include: Assume the entire network has First, based on the source IP address in the connection metadata, all connections are categorized by host to form a host set. Each host corresponds to several connections; Within the sliding window, the enhanced connection semantic vectors of each host are collected sequentially. The behavior sequence is obtained by sorting the time sequence in ascending order. Where the sequence length is less than the maximum step size; Pad with a zero vector; if it exceeds the limit, only keep the nearest one. strip; Introduce protocol attention masks to enhance key information; introduce behavioral residual sparse regularization to highlight transitions. A weighted sequence is generated and filled into a three-dimensional tensor to generate a host behavior tensor. At the same time, the protocol attention score matrix is ​​recorded.

[0011] Furthermore, the protocol attention mask introduces protocol-aware attention. Each connection is weighted, with the weight jointly determined by the connection semantics and protocol type, specifically as follows: ; in, It is a learnable embedding of protocol type (dimension) (This is achieved through table lookup) For parameter vectors; Sigmoid is used to guarantee High-risk protocols or abnormal semantic vectors are automatically assigned higher weights. The behavioral residual sparse regularization applies a method during the training phase to the vector differences of consecutive connections within the same entity. Regularization encourages models to focus on behavioral transitions, specifically: ; in, For behavior residual sparse regularization; , Let be the host behavior tensor of host i at time steps j and j-1; wherein, if the host makes repeated indiscriminate requests within a period of time, the adjacent difference approaches zero, and the behavior residual sparse regularization prompts the model to reduce its gradient contribution, thereby reducing redundancy; when a scan → login or DNS → TLS jump occurs, the difference increases.

[0012] Furthermore, the step of generating a host behavior semantic vector by aggregating the host behavior tensor and introducing connection semantic distribution constraints specifically includes: The host behavior tensor is weighted and aggregated based on the protocol attention score matrix to obtain the attention-guided behavior semantic vector for each host. A connection semantic distribution constraint is introduced onto the behavior semantic vector and then concatenated to generate a host behavior semantic vector; wherein the connection semantic distribution constraint is modified by designing a regular vector based on the connection semantic distribution constraint, and the regular vector is used to characterize the semantic variance in the connection sequence.

[0013] Furthermore, the step of outputting a classification score of the host behavior based on the host behavior semantic vector and by using an attention-guided classifier specifically includes: The host behavior semantic vector is fed into a set of parallel feedforward encoding modules for feature transformation to obtain the host behavior semantic representation. Design an attention weighting mechanism among hosts to enable the attention-guided classifier to consider the local host group behavior trends during classification and output the classification score of host behavior.

[0014] Furthermore, the inter-host attention weighting mechanism is calculated based on a cross-host architecture attention correction term; the cross-host architecture attention correction term is calculated as follows: Average pooling is performed on the host behavior semantic representations of all hosts to obtain the host group behavior center; Calculate the cosine difference between the current host behavior semantic representation and the host group row-centered value as a cross-host architecture attention correction term:

[0015] in, , is an adjustable coefficient, ranging from [0,1].

[0016] The beneficial technical effects of the present invention are at least as follows: The intelligent network data classification method provided by this invention is based on a three-level progressive architecture of "connection semantics—behavioral sequence—host profiling". First, a protocol field graph is constructed at the connection level, and context-injected graph neural networks are used to dynamically reconstruct the semantic embeddings of fields, solving the feature mismatch problem caused by protocol diversity and field drift. Then, multiple connections are aggregated into a time-series tensor according to host and time window, introducing protocol attention and residual sparsity regularization to highlight key connections with attack or anomaly characteristics, completing a structured expression of complex behavioral chains. Next, host behavioral semantic vectors are obtained through weighted aggregation and variance characterization, and cross-host comparative attention is added to the classification network to achieve simultaneous identification of isolated anomalies and group anomalies. Finally, the system outputs traceable classification results and key connection indexes, providing a direct chain of evidence for security operations and compliance audits. The overall solution balances high accuracy, real-time performance, and interpretability, and is particularly suitable for production environments with high encryption traffic, high protocol mixing, and a large number of concurrent hosts, significantly improving the comprehensiveness and reliability of network threat detection and business traffic insights. Attached Figure Description

[0017] The present invention will be further described with reference to the accompanying drawings, but the embodiments in the drawings do not constitute any limitation on the present invention. For those skilled in the art, other drawings can be obtained based on the following drawings without creative effort.

[0018] Figure 1 This is a flowchart of a network data classification method based on artificial intelligence according to the present invention. Detailed Implementation

[0019] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0020] like Figure 1 As shown in the figure, an embodiment of the present invention provides a network data classification method based on artificial intelligence, the method comprising the following steps S1-S5: S1. Obtain the original connection data and construct a structured protocol field graph; aggregate the structured protocol field graph through a multi-layer graph convolutional network to generate connection semantic embedding vectors.

[0021] Specifically, the goal of this step is to obtain raw connection data from a real network environment, extract the structured semantic vector of each connection through protocol field graph modeling and graph neural network feature learning, and provide reproducible basic input for subsequent multi-connection behavior modeling.

[0022] In actual deployment, connection data is collected as follows: Data collection modules are deployed on egress firewalls, core switches, or mirror probes, and network traffic is captured in real time using tools such as NetFlow, sFlow, or dedicated packet capture tools (such as TShark and nDPI). For each complete connection, a five-tuple of information (source IP, destination IP, source port, destination port, and protocol type) and its protocol payload are recorded. For example, a typical HTTPS connection record includes the following fields: source IP is 192.168.1.8, destination IP is 203.0.113.10, protocol is TCP, source port is 443, destination port is 53128, and the payload includes the TLSClientHello message field, encryption algorithm family, domain name SNI, etc. After all fields are processed by a protocol parser (such as the Wireshark protocol stack or nDPI library), a uniform data structure is output, and the field type is automatically marked as numeric, categorical, or text.

[0023] Furthermore, in the field preprocessing stage: Numeric fields (such as port numbers and sequence numbers) retain their original values ​​directly. Categorical fields (such as protocol type, TCPFlag) use One-Hot or categorical index encoding; Text fields (such as HTTP paths and SNIs) are embedded into fixed-length vectors using encoding models based on Word2Vec or BERT; ultimately, each field forms a unified vector representation, which facilitates subsequent calculations.

[0024] The processed field results are constructed into a structured protocol field graph. Each node in this graph corresponds to a protocol field, and the node attributes are the field's numerical / category / text vector representation and field type label; the edges between nodes represent the logical or protocol dependencies between fields, for example: TCPFlags are strongly correlated with sequence numbers in terms of timing. The HTTP method field and the request path field have a contextual dependency; The fields in SNI and ClientHello are fixedly bound. The edge weight consists of two parts: one is the structural dependency parsed from the protocol specification (such as mandatory field combinations), and the other is the statistical co-occurrence frequency of fields in millions of connection data (such as the probability of two fields appearing simultaneously in the same connection). After standard normalization, weighted directed edges are generated. The final constructed protocol field graph is used to represent the contextual structure and semantic coupling between fields in each connection.

[0025] Furthermore, the graph structure is input into a multi-layer graph convolutional network (GCN). Let the graph have... There are 10 field nodes, and the initial feature dimension of each node is 1000. To form the initial feature matrix Through graph convolution operations, neighboring nodes are aggregated using the adjacency matrix in each layer, and the node embeddings are updated. The specific update formula is as follows: ; in, It is the first The node feature matrix of the layer, This is the trainable weight matrix for this layer; For adjacency matrices with self-loops, For the adjacency matrix of the protocol field graph, It is the identity matrix; yes The degree matrix; For example, ReLU is an activation function.

[0026] Number of convolutional layers in the graph For example, the output is the context-aware embedding vector for each node. These vectors fuse semantic information from the field itself and its neighboring fields. To aggregate node-level information into a unified representation at the connection level, connection embeddings are generated using a concatenation strategy combining max pooling and average pooling. ; in, It is the first The node at the th The final embedding of the layer, The operation takes the maximum response of each feature dimension, average pooling captures the overall distribution, and the result is obtained by concatenation. It is the semantic representation vector of the connection.

[0027] This step ultimately outputs two variables: the structured protocol field diagram. and connect semantic embedding vectors . It is a graph structure input used in subsequent behavior modeling steps; It is a vector form that connects semantic features and is one of the core inputs for the entire system to achieve intelligent network classification.

[0028] S2. Perform context protocol semantic embedding enhancement on the connection semantic embedding vector to obtain an enhanced connection semantic vector.

[0029] Specifically, the goal of this step is to further introduce contextual dependencies, scenario constraints, and network behavior intentions, while preserving the structural information of the protocol fields, thereby enhancing the connection semantic vector generated in the previous step. Enhanced reconstruction is performed to ultimately generate a connection semantic representation with global context awareness. This indicates that it will serve as the direct input for subsequent behavior recognition and connection classification, and is a core step in the entire scheme that connects the preceding and following steps.

[0030] In real-world network data scenarios, issues arise such as "same field structure but different behaviors." For example, two HTTPS connections may have the same protocol field graph structure, but one accesses an enterprise OA system while the other accesses an intranet penetration tool (such as frp). From the field graph perspective, there is no significant difference, and traditional field topology-based GCNs struggle to effectively distinguish between such connections with "same structure but different intentions." Therefore, this paper designs a dual-attention graph neural network mechanism (Context-Guided GNN) that integrates contextual semantics and connection structure to enhance the connection representation's ability to perceive behavioral intentions and protocol usage.

[0031] The input for this step is: The protocol field graph generated in the previous step includes node fields and their edge structure; : Connection semantic embedding vector generated by multi-layer GCN aggregation.

[0032] Furthermore, to ensure that each node embeds more comprehensive connection context information, this invention introduces a context injection mechanism. Specifically, this involves... The data is repeatedly broadcast to each node and concatenated with the original node features to form a context-aware input. : ; in, The original features of each field node, For the number of nodes in the field, To copy the connection vector This forms the context representation of each node. After concatenation... This means that each field simultaneously possesses its own structural characteristics and global context information.

[0033] Based on this context-enhanced feature, the convolutional embedding process is designed as shown in the figure below: ; in: This is the normalized adjacency matrix; For trainable graph convolution weights; It is a non-linear activation function; To be Control items mapped to the node dimension use a shared perceptual vector approach. The regularization control coefficient determines the degree to which the contextual intent affects the semantic update of the node.

[0034] The innovation lies in the addition of [something] to the formula. This is equivalent to introducing a "connection intent vector control channel" during the node update process, used to adjust whether the node update conforms to the semantic positioning of the connection in the global network behavior. For example, in connections with strong attack intent, this channel will push certain sensitive fields (such as request paths and DNS query names) closer to the abnormal semantic space, thereby improving the recognition ability of subsequent classification models.

[0035] Furthermore, after the node representations are updated, an attention-based weighted aggregation method is used to merge the node representations into the final connection semantic embedding: ; in, For the updated number Each field node represents... Based on and Relevance scoring function The attention machine , , All parameters are trainable and used to calculate the relevance of field nodes to global semantics. This approach strengthens the representation weight of important fields in the join representation, allowing context-sensitive fields such as "HTTP method," "SNI field," and "DNS query name" to occupy a higher proportion in the final representation, thus enhancing discriminative capabilities.

[0036] Final output To enhance the semantic vector of connections, it possesses the following characteristics: connections with the same field structure but different behavioral intentions. It exhibits separability; it can automatically amplify the semantics of important fields during model training; and it can adapt to cross-protocol and multi-mode network connection classification scenarios, such as the coexistence of plaintext and encryption protocols, covert communication based on DNS tunnels, and high-variable fields in P2P networks.

[0037] In summary, this step introduces global semantics and behavioral intent into the protocol field structure by using context-aware graph convolution, connection intent regularization, and attention aggregation mechanism. This significantly improves the fine-grainedness and generalization ability of network connection semantic modeling, and is the core module of this invention for dealing with the diversity of network protocols and the variability of attacks.

[0038] S3. Aggregate the connection semantic vectors by host and time window, and introduce protocol attention mask and behavior residual sparse regularization to obtain the generated host behavior tensor and protocol attention score matrix.

[0039] Specifically, this step involves the already obtained connection semantic representation. Based on this, host-level behavior sequences are constructed and converted into high-dimensional temporal tensors. This allows the model to observe "the collaborative behavior of multiple connections at the time axis and protocol level." This representation inherits the contextual semantics provided in step two and adds cross-connection temporal, protocol type, and behavioral differences information, which is crucial for identifying scenarios such as lateral movement, distributed scanning, and DNS tunneling. It serves as a bridge for subsequent classifiers to understand "behavioral intent."

[0040] enter: : The context semantic vector for each connection.

[0041] in, : Connection metadata, where proto is the protocol type number (TCP=1, UDP=2, QUIC=3...).

[0042] Furthermore, let the entire network have First, based on the source IP address in the connection metadata, all connections are categorized by host to form a host set. Each host corresponds to several connections. Then, within a sliding window (default 300s, step size 60s), the connection semantic vectors of each host are collected sequentially. The behavior sequence is obtained by sorting the time sequence in ascending order. If the sequence length is less than the maximum step size (Empirical value 64), pad with zero vector; if it exceeds, only keep the nearest one. This ensures that the tensor size is fixed and its real-time performance is controllable.

[0043] ① Protocol Attention Mask (Enhancing Key Information): To prevent massive normal ACKs and Keep-alives from preempting sequence capacity, protocol-aware attention is introduced. Each connection is weighted, with the weight jointly determined by the connection semantics and protocol type: ; It is a learnable embedding of protocol type (dimension) (This is achieved through table lookup) For parameter vectors; Sigmoid is used to guarantee High-risk protocols (such as QUIC-0RTT, UDP on unknown ports) or anomalous semantic vectors are automatically assigned higher weights. This is how they are constructed. It both reduces redundancy and highlights potential attack connections.

[0044] ② Behavioral residual sparse regularization (highlighting jumps): During the training phase, apply a sparse regularization to the vector differences of consecutive connections within the same entity. Regularization encourages models to focus on behavioral inflection points: ; If a host makes repeated indiscriminate requests over a period of time, the difference between adjacent values ​​approaches zero. The regularization term prompts the model to reduce its gradient contribution, thereby reducing redundancy. When there is a transition from scanning to login or from DNS to TLS, the difference increases, and the model is able to capture the real behavioral transition.

[0045] Fill the weighted sequence into the three-dimensional tensor: Tensor size Simultaneously record the protocol attention score matrix. This is for subsequent interpretable analysis.

[0046] Output : Host behavior tensor, which can be directly input into Transformer or TCN for behavior classification. Protocol attention score matrix, used only for reasoning interpretability or visualization.

[0047] By leveraging protocol attention masks and residual sparsity regularization, this step extends the semantics of a single connection into a structural tensor that expresses "behavioral rhythm," enabling the system to maintain high sensitivity to abnormal intents even in encrypted traffic, mixed protocols, and high-frequency short connection environments, providing high-quality temporal-semantic integrated input for subsequent classification decisions.

[0048] S4. Generate a behavior semantic vector by aggregating the host behavior tensor and introducing connection semantic distribution constraints to generate the host behavior semantic vector.

[0049] Specifically, the goal of this step is to: extract the host behavior tensor from the previous step. With connection attention matrix Based on this, a structured behavioral semantic modeling framework is constructed. This is used to characterize the multi-connection behavior pattern of a host within a certain time window. Firstly, this invention is based on... host behavior tensor We perform weighted aggregation to obtain the attention-guided behavioral semantic vector for each host. : ; in Indicates the host number. Indicates the host's number A connection. This step will... Linked vectors are aggregated into one The dimension vector represents the host's "compressed semantic behavior" within this time window. The attention weights are derived from step three and have been obtained through adaptive learning of the time-protocol-semantic structure.

[0050] To improve the discriminative power of this modeling vector, this invention... Based on this, we introduce connection semantic distribution constraints and design regularized vectors. This is used to characterize the semantic variance in the connected sequences and is embedded into the model as an independent feature: ; This vector measures the degree of change in the semantics of internal connections within a host, and can significantly distinguish between aggressive hosts (with drastic changes in behavior patterns) and stable hosts (with strong behavioral aggregation). By simultaneously considering... and This invention defines host behavior modeling features. for: ; Here This represents a vector concatenation operation, resulting in a vector of dimension . Host-level semantic representation. All vectors have been normalized.

[0051] Output : Host behavior semantic vector, which is the result of splicing together the behavior models of all hosts.

[0052] S5. Based on the host behavior semantic vector, output the classification score of the host behavior by using an attention-guided classifier.

[0053] Specifically, this step receives the host behavior semantic vector constructed in the previous step. By constructing a lightweight attention-guided classifier, host behavior can be discriminated and classified.

[0054] Furthermore, firstly, the input behavioral semantic vector is fed into a set of parallel feedforward encoding modules for feature transformation. This module consists of two linear layers (the input is...). Dimension, output is (Dimension), with the ReLU activation function in between: ; Here, , , where represents the weights and biases of the fully connected layer. Dimension The value is typically set to 128 or 256, and can be flexibly configured according to business deployment. This module's function is to extract deeper behavioral difference features and improve the model's non-linear expressive capability. Host behavior semantic representation.

[0055] To introduce an information-sharing mechanism across hosts, this invention designs an inter-host attention weighting mechanism, allowing the model to consider the behavioral trends of local host groups during classification. The formula is as follows: ; in, For host The classification result vector ( (Total number of behavior categories) , . It is a cross-host architecture attention correction term, and its calculation method is as follows: Representation for all hosts Perform average pooling to obtain the host group behavior center; Computer host The cosine difference from the center is used as a correction term: in , is an adjustable coefficient, ranging from [0,1].

[0056] The mechanism aims to enhance the model's ability to identify isolated or clustered abnormal behaviors by utilizing comparative information between host behaviors. It is particularly suitable for detection tasks in high-concurrency host environments such as enterprise networks and campus networks.

[0057] Final output The classification score vector for each host can be used for subsequent attack detection, auditing alerts, and alert tracing.

[0058] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of this invention. In practical applications, those skilled in the art can select some or all of the workflow to achieve the purpose of this embodiment according to actual needs, and no restrictions are imposed here.

[0059] In addition, for technical details not described in detail in this embodiment, please refer to the parameter operation method provided in any embodiment of the present invention, which will not be repeated here.

[0060] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0061] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0062] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0063] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A network data classification method based on artificial intelligence, characterized in that, The method includes: Obtain the raw connection data and construct a structured protocol field graph; The structured protocol field graph is aggregated using a multi-layer graph convolutional network to generate connection semantic embedding vectors. The connection semantic embedding vector is enhanced by context protocol semantic embedding to obtain an enhanced connection semantic vector; The connection semantic vectors are aggregated by host and time window, and a protocol attention mask and behavior residual sparse regularization are introduced to generate a host behavior tensor and a protocol attention score matrix. Based on the host behavior tensor, a behavior semantic vector is generated by aggregating the tensor, and a connection semantic distribution constraint is introduced to generate the host behavior semantic vector. Based on the host behavior semantic vector, an attention-guided classifier is used to output the classification score of the host behavior; The specific steps of aggregating the connection semantic vectors by host and time window, and introducing protocol attention masks and behavioral residual sparse regularization to generate host behavior tensors and protocol attention score matrices include: Assume the entire network has First, based on the source IP address in the connection metadata, all connections are categorized by host to form a host set. Each host corresponds to several connections; Within the sliding window, the enhanced connection semantic vectors of each host are collected sequentially. The behavior sequence is obtained by sorting the time sequence in ascending order. Where the sequence length is less than the maximum step size; Pad with a zero vector; if it exceeds the limit, only keep the nearest one. strip; Introducing protocol attention masks to enhance key information; During the model training phase, behavioral residual sparsity regularization is applied to the vector differences of consecutive connections on the same host to encourage the model to focus on behavioral inflection points. A weighted sequence is generated, and the weighted sequence is filled into a three-dimensional tensor to generate a host behavior tensor. At the same time, the protocol attention score matrix is ​​recorded. The protocol attention mask introduces protocol-aware attention. Each connection is weighted, with the weight jointly determined by the connection semantics and protocol type, specifically as follows: ； in, It is a learnable embedding of the protocol type. For parameter vectors; Guarantee using Sigmoid High-risk protocols or abnormal semantic vectors are automatically assigned higher weights. The behavioral residual sparse regularization applies a vector difference to consecutive connections on the same host during the training phase. Regularization encourages models to focus on behavioral transitions, specifically: ； in, is the sparse regularization term for the behavioral residual, where i is host i and j is the time step; , Let be the host behavior tensor of host i at time steps j and j-1; wherein, if the host makes repeated indiscriminate requests within a period of time, the adjacent difference approaches zero, and the behavior residual sparse regularization prompts the model to reduce its gradient contribution, thereby reducing redundancy; when a scan → login or DNS → TLS jump occurs, the difference increases.

2. The network data classification method based on artificial intelligence according to claim 1, characterized in that, Each node in the structured protocol field graph corresponds to a protocol field. The node attributes are the numerical / category / text vector representation of the field and the field type label. The edges between nodes represent the logical or protocol dependencies between fields.

3. The network data classification method based on artificial intelligence according to claim 1, characterized in that, The step of aggregating the structured protocol field graph using a multi-layer graph convolutional network to generate connection semantic embedding vectors specifically includes: Suppose the structured protocol field diagram has There are 10 field nodes, and the initial feature dimension of each node is 1000. This forms the initial feature matrix; Based on the initial feature matrix, the neighbor nodes are aggregated using the adjacency matrix in each layer through graph convolution operations to update the node embedding; The connection embeddings are concatenated using max pooling and average pooling to generate a unified connection embedding, resulting in a connection semantic embedding vector.

4. The network data classification method based on artificial intelligence according to claim 1, characterized in that, The step of performing context protocol semantic embedding enhancement on the connection semantic embedding vector to obtain the enhanced connection semantic vector specifically includes: The connection semantic embedding vector is repeatedly broadcast to each node and concatenated with the original node features to form a context-aware input; Based on the context-aware input The following convolutional embedding process is designed to update node representations: ； in, This is the normalized adjacency matrix; For trainable graph convolution weights; It is a non-linear activation function; To embed connection semantics into vectors Control items mapped to the node dimension use a shared perceptual vector approach. The regularization control coefficient determines the degree to which the contextual intent affects the semantic update of the node; After the node representations are updated, an attention-based weighted aggregation method is used to merge the updated node representations into an enhanced connection semantic vector.

5. The network data classification method based on artificial intelligence according to claim 1, characterized in that, The enhanced connection semantic vector exhibits separability for connections with the same field structure but different behavioral intentions. It can also automatically amplify the semantics of important fields during model training and adapt to cross-protocol and multi-modal network connection classification scenarios.

6. The network data classification method based on artificial intelligence according to claim 1, characterized in that, The step of generating a host behavior semantic vector by aggregating the host behavior tensor and introducing connection semantic distribution constraints specifically includes: The host behavior tensor is weighted and aggregated based on the protocol attention score matrix to obtain the attention-guided behavior semantic vector for each host. A connection semantic distribution constraint is introduced onto the behavior semantic vector and then concatenated to generate a host behavior semantic vector; wherein the connection semantic distribution constraint is modified by designing a regular vector based on the connection semantic distribution constraint, and the regular vector is used to characterize the semantic variance in the connection sequence.

7. The network data classification method based on artificial intelligence according to claim 1, characterized in that, The step of outputting a classification score for host behavior based on the host behavior semantic vector and through an attention-guided classifier specifically includes: The host behavior semantic vector is fed into a set of parallel feedforward encoding modules for feature transformation to obtain the host behavior semantic representation. Design an attention weighting mechanism among hosts to enable the attention-guided classifier to consider the local host group behavior trends during classification and output the classification score of host behavior.

8. The network data classification method based on artificial intelligence according to claim 7, characterized in that, The inter-host attention weighting mechanism is calculated based on a cross-host architecture attention correction term; the cross-host architecture attention correction term is calculated as follows: Average pooling is performed on the host behavior semantic representations of all hosts to obtain the host group behavior center; Calculate the cosine difference between the current host behavior semantic representation and the host group row-centered value as a cross-host architecture attention correction term: ; in, , is an adjustable coefficient, ranging from [0,1].

Images