Method and system for detecting internet of things botnet by fusing multi-dimensional information

Abstract

This application relates to the field of network detection, specifically disclosing a method and system for detecting IoT botnets that integrates multi-dimensional information. First, it transforms raw traffic data into structured network flow records through flow feature aggregation, laying the foundation for deep analysis. Second, it constructs a time-series dynamic communication graph from these timestamped flow records, thereby transforming isolated network events into a network topology that reflects the interaction relationships and behavioral evolution between devices. Finally, it introduces a time-graph attention mechanism to perform time-aware aggregation learning on the nodes and their neighborhood information in the dynamic graph. This mechanism can adaptively focus on key cooperative communication behaviors, deeply integrating multi-dimensional information such as node topology, interaction content, and temporal evolution to generate highly discriminative feature representations. This effectively identifies the covert and cooperative attack patterns of botnets, improving the accuracy and robustness of detection.

Description

Technical Field

[0001] This application relates to the field of network detection, and more specifically, to a method and system for detecting IoT botnets that integrates multi-dimensional information. Background Technology

[0002] With the rapid development of information technology, the Internet of Things (IoT) has permeated all aspects of social production and daily life. While providing convenience, the massive number of IoT devices, due to their inherent weaknesses such as limited computing resources, weak security protection capabilities, and untimely firmware updates, have become a primary target for cyber attackers. Attackers hijack and control a large number of IoT devices by implanting malicious programs, forming massive botnets. These botnets can not only launch distributed denial-of-service attacks, causing critical network services to be paralyzed, but are also used to carry out malicious activities such as spamming, data theft, and phishing, posing a serious threat to global cyberspace security.

[0003] Currently, botnet detection methods mainly include signature-based, statistical feature-based, and traditional machine learning-based techniques. Signature-based methods identify attacks by matching known malicious code or communication protocol characteristics, but they cannot detect zero-day attacks that exploit unknown vulnerabilities or employ polymorphic or metamorphic techniques, and their generalization ability is poor. Statistical feature-based and traditional machine learning methods typically analyze network traffic, extracting statistical features (such as packet length, protocol type, and port number) of individual traffic streams or data packets for classification. However, these methods have significant limitations. The core problem is that they often simplify complex network communication into isolated, static data points for analysis, resulting in a single dimension of feature extraction and an inability to effectively capture the complex temporal and topological dependencies within traffic data. Specifically, on the one hand, botnet attack behaviors, such as scanning, infection, command and control communication, and coordinated attacks, have a clear chronological order and evolutionary pattern. Traditional methods ignore the continuity of these interactions over time, making it difficult to identify coordinated attacks with long incubation periods and covert behavior. On the other hand, a botnet is essentially a network of devices controlled centrally or decentralizedly by servers, and the communication behavior between its members inevitably exhibits a specific structure in the network topology (such as star topology, multi-layer star topology, etc.). Traditional methods sever the communication connections between devices and fail to discover the organization and coordination of botnets from the perspective of the global network structure, resulting in low detection accuracy and frequent false positives and false negatives.

[0004] Therefore, an optimized IoT botnet detection scheme that integrates multi-dimensional information is desired. Summary of the Invention

[0005] To address the aforementioned technical problems, this application is proposed. Embodiments of this application provide a method and system for detecting IoT botnets that integrates multi-dimensional information.

[0006] According to one aspect of this application, a method for detecting IoT botnets that integrates multi-dimensional information is provided, comprising:

[0007] Obtain raw Pcap traffic data;

[0008] The raw Pcap traffic data is processed into a structured NetFlow record set.

[0009] A time-series dynamic communication graph is constructed based on the structured NetFlow record set to obtain a dynamic communication graph;

[0010] The dynamic communication graph is sampled for interactive data to obtain interactive batch data;

[0011] The interactive batch data is subjected to node-time joint feature encoding to obtain an entity-time feature matrix;

[0012] Temporal graph attention aggregation is performed on the entity-temporal feature matrix to obtain the aggregated neighborhood representation;

[0013] Based on the aggregated neighborhood representation, the initial features of the target node are updated with a time-aware representation to obtain the final time-aware representation.

[0014] Traffic classification and risk assessment are performed on the final time-aware representation to obtain classification results, which are used to indicate whether the input traffic is botnet traffic.

[0015] According to another aspect of this application, an IoT botnet detection system integrating multi-dimensional information is provided, comprising:

[0016] The raw Pcap traffic acquisition module is used to acquire raw Pcap traffic data.

[0017] The traffic data structuring module is used to perform structuring processing on the raw Pcap traffic data to obtain a structured NetFlow record set;

[0018] A dynamic communication graph construction module is used to construct a time-series dynamic communication graph based on the structured NetFlow record set to obtain a dynamic communication graph;

[0019] An interactive data sampling module is used to sample interactive data from the dynamic communication graph to obtain interactive batch data.

[0020] The joint feature encoding module is used to perform node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix.

[0021] The temporal graph aggregation module is used to perform temporal graph attention aggregation on the entity-temporal feature matrix to obtain the aggregated neighborhood representation;

[0022] The time-aware module is used to update the initial features of the target node with a time-aware representation based on the aggregated neighborhood representation to obtain the final time-aware representation;

[0023] The traffic risk assessment module is used to classify and assess the traffic risk of the final time-aware representation to obtain a classification result, which is used to indicate whether the input traffic is botnet traffic.

[0024] Compared with existing technologies, this application provides an IoT botnet detection method and system that integrates multi-dimensional information. First, it transforms raw traffic data into structured network flow records through flow feature aggregation, laying the foundation for deep analysis. Second, it constructs a time-series dynamic communication graph from these timestamped flow records, thereby transforming isolated network events into a network topology that reflects the interaction relationships and behavioral evolution between devices. Finally, it introduces a time-graph attention mechanism to perform time-aware aggregation learning on the nodes and their neighborhood information in the dynamic graph. This mechanism can adaptively focus on key cooperative communication behaviors, deeply integrating multi-dimensional information such as node topology, interaction content, and temporal evolution to generate highly discriminative feature representations. This effectively identifies the covert and cooperative attack patterns of botnets, improving the accuracy and robustness of detection. Attached Figure Description

[0025] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0026] Figure 1 This is a flowchart of an IoT botnet detection method that integrates multi-dimensional information according to an embodiment of this application;

[0027] Figure 2 This is a schematic diagram of data flow in the IoT botnet detection method that integrates multi-dimensional information according to an embodiment of this application;

[0028] Figure 3This is a flowchart illustrating the process of structuring the original Pcap traffic data to obtain a structured NetFlow record set in the IoT botnet detection method that integrates multi-dimensional information according to embodiments of this application.

[0029] Figure 4 This is a flowchart illustrating the process of performing temporal graph attention aggregation on the entity-temporal feature matrix to obtain the aggregated neighborhood representation in the IoT botnet detection method that integrates multi-dimensional information according to embodiments of this application.

[0030] Figure 5 This is a flowchart illustrating how the IoT botnet detection method based on the aggregated neighborhood representation updates the initial features of a target node to obtain the final time-aware representation, according to an embodiment of this application.

[0031] Figure 6 This is a block diagram of an IoT botnet detection system that integrates multi-dimensional information according to an embodiment of this application. Detailed Implementation

[0032] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0033] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0034] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0035] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0036] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0037] The main technical problem faced by existing botnet detection technologies is that they typically analyze network traffic as isolated static data points, thus ignoring the temporal evolution of attack behavior and the topological correlation between devices. This makes it difficult to identify highly coordinated and complex malicious activities. To address these issues, this application proposes a multi-dimensional information-integrated IoT botnet detection method. This method first starts with raw Pcap traffic data, transforming it into a structured NetFlow record set containing key statistical information such as duration and bidirectional traffic through session-based aggregation and computation, laying the data foundation for subsequent analysis. Then, based on this, the method constructs a time-series dynamic communication graph from IP entities and their interactions in the network, transforming discrete traffic data into graph data that fully reflects the network topology and the evolution of communication behavior. On this dynamic graph, the method further employs node-time joint encoding and utilizes a core time-graph attention aggregation mechanism to intelligently learn and aggregate key interaction information that changes over time within the target node's neighborhood. Finally, by fusing and aggregating neighborhood information with node characteristics, a final time-aware representation is generated that deeply includes topological structure, interaction content, and temporal evolution patterns. Based on this, accurate traffic classification and risk assessment are performed, thus effectively overcoming the shortcomings of traditional methods with their single feature dimension and achieving accurate capture of complex botnet behavior.

[0038] The technical solution of this application proposes an IoT botnet detection method that integrates multi-dimensional information. Figure 1 This is a flowchart of an IoT botnet detection method that integrates multi-dimensional information according to an embodiment of this application. Figure 2 This is a schematic diagram of the data flow in the IoT botnet detection method that integrates multi-dimensional information according to an embodiment of this application. Figure 1 and Figure 2As shown, the IoT botnet detection method integrating multi-dimensional information according to an embodiment of this application includes the following steps: S100, acquiring raw Pcap traffic data; S200, performing structured processing on the raw Pcap traffic data to obtain a structured NetFlow record set; S300, constructing a time-series dynamic communication graph based on the structured NetFlow record set to obtain a dynamic communication graph; S400, sampling interactive data from the dynamic communication graph to obtain interactive batch data; S500, performing node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix; S600, performing time-graph attention aggregation on the entity-time feature matrix to obtain an aggregated neighborhood representation; S700, updating the initial features of the target node with a time-aware representation based on the aggregated neighborhood representation to obtain a final time-aware representation; S800, performing traffic classification and risk determination on the final time-aware representation to obtain a classification result, wherein the classification result is used to indicate whether the input traffic is botnet traffic.

[0039] Specifically, in steps S100 and S200, raw Pcap traffic data is acquired, and the raw Pcap traffic data is processed to obtain a structured NetFlow record set. It should be understood that since raw Pcap traffic data is the underlying, packet-by-packet record of network communication, its data volume is extremely large and its format is unstructured. Direct analysis not only incurs huge computational overhead but also makes it difficult to reveal the complete interactive session behavior between devices, failing to provide effective support for subsequent correlation analysis. Therefore, in the technical solution of this application, after acquiring the raw Pcap traffic data, the raw Pcap traffic data is processed to obtain a structured NetFlow record set, thereby transforming massive, discrete data packets into structured network flow records containing key statistical features at the communication session level. This reduces the complexity of data processing and provides a regular, efficient, and information-dense data foundation for subsequent construction of time-series dynamic communication graphs and in-depth mining of botnet topology and behavioral patterns.

[0040] Figure 3 This is a flowchart illustrating the process of structuring the raw Pcap traffic data to obtain a structured NetFlow record set in the IoT botnet detection method that integrates multi-dimensional information according to embodiments of this application. Figure 3 As shown, step S200 includes: S210, performing original packet grouping based on session 5-tuples on the original Pcap traffic data to obtain session packet groups; S220, performing flow feature aggregation and calculation on the session packet groups to obtain an aggregated flow feature set; S230, performing structured processing on the aggregated flow feature set to obtain the structured NetFlow record set.

[0041] Accordingly, in step S210, the original Pcap traffic data is grouped into session data packets based on session quintuples to obtain session data packet groups. It should be understood that since a single data packet in the original Pcap data only represents a momentary fragment of communication, it is discrete and isolated, and cannot directly reflect a complete, context-dependent interactive session between two network entities. Directly analyzing these isolated data packets makes it difficult to understand complex behaviors requiring continuous interaction, such as botnet command and control and coordinated attacks. Therefore, in the technical solution of this application, the original Pcap traffic data is grouped into session quintuples to effectively aggregate and correlate data packets scattered in the time series that belong to the same communication session. This allows the disordered data packet flow to be reconstructed into logical groups based on sessions as the basic unit, providing a clear and organized data foundation for subsequent accurate calculation of key flow characteristics such as session duration and bidirectional traffic. This is a key step in realizing the transformation from packet-level analysis to flow-level analysis.

[0042] More specifically, in a concrete example of this application, the packetization process is implemented through a processing module that initializes a data structure, such as a hash table or dictionary, for storing session packets. The module then parses each packet in the Pcap file one by one. For each packet, the module extracts the source IP address, destination IP address, source port number, destination port number, and protocol type from its IP header and transport layer header to form a unique session identifier, i.e., a 5-tuple. To ensure that bidirectional traffic is grouped into the same session, the module normalizes the 5-tuple, for example, by using the smaller value in the IP address and port number pair as the source, forming a unique session key. Further, using this 5-tuple as the key, a lookup is performed in the data structure. If the key already exists, the current packet is appended to the corresponding session packet group; if the key does not exist, a new entry is created, and the current packet becomes the first member of the new group. After traversing all Pcap packets, the data structure stores the set of all session packet groups divided by session, with each group containing all packets belonging to the same communication session. Once all data packets have been processed, the lists stored in the hash table constitute the final set of session data packet groups.

[0043] Accordingly, in step S220, flow feature aggregation and calculation are performed on the session data packet groups to obtain an aggregated flow feature set. It should be understood that although session data packet groups categorize data packets according to communication sessions, they are essentially still collections of original data packets with inconsistent data formats and redundant information, lacking quantitative features that can be directly used for machine learning models or graph structure analysis. Therefore, in the technical solution of this application, flow feature aggregation and calculation are further performed on the session data packet groups to obtain an aggregated flow feature set, thereby extracting a set of standardized statistical indicators that can summarize the core behavioral patterns of each session. This transforms each variable-length data packet sequence into a fixed-dimensional feature vector, which not only greatly compresses the data volume but, more importantly, abstracts communication behavior from the raw data level to a feature level containing key information such as time, direction, and traffic volume, providing high-quality input for subsequent risk modeling.

[0044] More specifically, in this embodiment of the application, the flow feature aggregation and calculation of the session data packet to obtain the aggregated flow feature set includes: extracting a first session packet from the session data packet; extracting time features from the first session packet to obtain the duration; determining and counting the direction of the first session packet to obtain the number of source-to-destination packets, the number of destination-to-source packets, the number of source-to-destination bytes, and the number of destination-to-source bytes; extracting the protocol and total amount of the first session packet to obtain the total number of packets and the total number of bytes; and combining the duration, the number of source packets, the number of source-to-destination bytes, the number of destination-to-source bytes, the total number of packets, and the total number of bytes to obtain an original feature record in the aggregated flow feature set.

[0045] Specifically, this aggregation and calculation process performs the following operations on session data packet groups. First, a session packet to be processed is extracted from the set of session data packet groups. Then, time features are extracted from this session packet by retrieving the timestamps of the first and last data packets within the packet and calculating the difference between them to obtain the duration of the session. Next, direction determination and counting are performed on the first session packet. Using the five-tuple of the session as a reference, all data packets within the packet are traversed. Based on the source IP and destination IP of each data packet, the number of source-to-destination packets and the number of destination-to-source packets are accumulated, along with the number of bytes in the corresponding direction, to obtain the number of source-to-destination bytes and the number of destination-to-source bytes. Simultaneously, protocol and total quantity extraction is performed on the first session packet. The protocol type of the session is recorded, and the total number of data packets within the packet is calculated to obtain the total number of packets. The length of all data packets is then added together to obtain the total number of bytes. Finally, the calculated duration, number of source-to-destination packets, number of destination-to-source packets, number of source-to-destination bytes, number of destination-to-source bytes, total number of packets, and total number of bytes are combined to form a structured original feature record, which is an element in the aggregated stream feature set. This process generates a corresponding original feature record for each session data packet group.

[0046] Accordingly, in step S230, the aggregated flow feature set is structured to obtain the structured NetFlow record set. It should be understood that although the aggregated flow feature set generated in the previous step contains quantified statistical information, the association between these feature records and the communication sessions they describe (i.e., the quintuples) is separate, and the data format does not yet follow common network traffic analysis standards, which is not conducive to direct calling and parsing by subsequent modules. Therefore, in the technical solution of this application, the aggregated flow feature set is further structured to obtain the structured NetFlow record set, thereby binding the identification information (quintuples) of each session with its corresponding statistical feature vector and uniformly encapsulating them into standardized data records. This generates a well-organized, self-contained, and machine-readable dataset, where each record completely describes the identity and behavioral characteristics of a network session, providing a direct and unambiguous data source for constructing a time-series dynamic communication graph.

[0047] More specifically, in a concrete example of this application, a NetFlow record data structure template is first defined. This template includes fields for source IP address, destination IP address, source port, destination port, protocol type, session start time, and all flow characteristics (such as duration, bidirectional packet count, and byte count) calculated in the previous step. Then, each original feature record in the aggregated flow feature set is traversed. For each record, the session packet group to which it belongs is traced back, and the corresponding 5-tuple information and the session start timestamp are extracted. Next, a new NetFlow record is instantiated, and the extracted 5-tuple information, start timestamp, and all statistical feature values ​​from the currently traversed original feature record are filled into the corresponding fields of the NetFlow record template. Finally, this fully filled NetFlow record is added to a final set. This process is repeated until all original feature records have been processed, and the final set is the structured NetFlow record set.

[0048] Specifically, in step S300, a dynamic communication graph is constructed based on the structured NetFlow record set to obtain a dynamic communication graph. It should be understood that although the structured NetFlow record set provides quantified data at the session level, it is essentially a discrete, flat list of records, unable to intuitively reveal the complex topological connections between network entities and the dynamic evolution of these relationships over time. The cooperative nature of botnets is precisely reflected in the network structure and communication timing among their members. Therefore, in the technical solution of this application, a dynamic communication graph is further constructed based on the structured NetFlow record set to obtain a dynamic communication graph, thereby transforming independent traffic events into a comprehensive data model that can uniformly represent the network topology, interaction relationships, and temporal behavior. This elevates the botnet detection problem from analyzing isolated data records to analyzing network structure and dynamic evolution patterns at a higher dimension, providing a necessary data structure foundation for subsequent in-depth mining of cooperative attack characteristics using advanced technologies such as graph neural networks.

[0049] More specifically, in this embodiment, constructing a time-series dynamic communication graph based on the structured NetFlow record set to obtain a dynamic communication graph includes: traversing each structured NetFlow record in the structured NetFlow record set, mapping the source IP address and destination IP address in the structured NetFlow record to nodes of the dynamic communication graph; based on each structured NetFlow record, creating a directed edge between the corresponding source IP address node and destination IP address node according to its start time, and attaching the original feature record in the structured NetFlow record as an attribute to the directed edge. That is, specifically, firstly, a dynamic graph data structure supporting time attributes is initialized. Then, each structured NetFlow record in the structured NetFlow record set is traversed. For each record, its source IP address and destination IP address are extracted. Next, these two IP addresses are mapped to nodes of the dynamic communication graph; if a corresponding IP node does not yet exist in the graph, a new node is created. Next, based on this NetFlow record, a directed edge is created between the node corresponding to the source IP address and the node corresponding to the destination IP address, according to the session start time recorded in the record. This edge represents a communication event that occurs at a specific point in time. Finally, the complete original feature records contained in the NetFlow record (such as duration, number of bidirectional packets, and number of bytes) are appended as an attribute set to this newly created directed edge. By repeating this operation on all NetFlow records, a complete dynamic communication graph with temporal sequence and rich attribute information is finally constructed.

[0050] Specifically, in step S400, interaction data is sampled from the dynamic communication graph to obtain interaction batch data. It should be understood that since the dynamic communication graph constructed in the previous step completely records the interactions of all entities in the network over the entire time span, its scale can be very large. Figure 1 Loading and inputting all data into a single deep learning model for training would result in unacceptable memory consumption and computational overhead, making model training impractical in real-world applications. Therefore, in this application's solution, the dynamic communication graph is further sampled for interactive data to obtain interactive batch data. This decomposes the massive and continuous graph data into a series of small, discretized, and computationally processable data units. This enables efficient and scalable batch model training, making deep feature learning on large-scale network graphs possible with limited computational resources, and providing a standardized input format for subsequent node feature encoding and attention aggregation steps.

[0051] More specifically, in a concrete example of this application, the sampling process first sorts all interaction events (i.e., directed edges with timestamps) in the dynamic communication graph according to their occurrence timestamps. Then, the system sequentially and non-overlaps interaction events are extracted from this time-ordered list of interaction events according to a preset batch size, forming batches of interaction data. For example, if the batch size is set to 256, the system will extract the first 256 earliest interaction events to form the first batch, then extract the 257th to 512th interaction events to form the second batch, and so on, until all interaction events are assigned to their respective batches. Each generated batch of interaction data is a set containing several interaction records. Each record explicitly defines the source node identifier, target node identifier, timestamp of the interaction, and the original feature record attached to the interaction edge. This series of generated batches of interaction data will serve as the input stream for subsequent processing modules.

[0052] Specifically, in step S500, the interaction batch data is subjected to node-time joint feature encoding to obtain an entity-time feature matrix. It should be understood that, since node identifiers (such as IP addresses) and interaction timestamps in the interaction batch data are discrete, non-numerical raw information, they cannot be directly used by subsequent deep learning models (such as attention networks) for mathematical operations and feature learning. The model needs a unified numerical representation that can simultaneously capture the static attributes of nodes and the dynamic temporal sequence of interactions. Therefore, in the technical solution of this application, the interaction batch data is further subjected to node-time joint feature encoding to obtain an entity-time feature matrix, thereby transforming the original node identifiers and time information into high-dimensional, semantically rich continuous features. This provides the model with an input that integrates two core information points: who is interacting and when they are interacting, enabling the subsequent attention mechanism to learn spatiotemporal dependencies and laying the foundation for accurately identifying dynamically evolving zombie network behavior patterns.

[0053] More specifically, in this embodiment of the application, performing node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix includes: extracting corresponding static basic feature vectors from the node basic feature matrix based on the node identifiers of each interactive event in the interactive batch data to obtain a searched basic feature set; performing interactive time feature encoding on the timestamps of each interactive event in the interactive batch data to obtain an encoded time vector set; and performing spatiotemporal feature vector joint on the searched basic feature set and the encoded time vector set to obtain the entity-time feature matrix.

[0054] Specifically, a pre-defined node feature matrix is ​​needed, storing the static feature vector of each node in the network. When an interaction batch of data is input, the system first searches the node feature matrix based on the node identifiers of each interaction event in the batch, extracting the static feature vectors corresponding to all participating nodes to form a post-search feature set. Simultaneously, the timestamps of each interaction event in the batch are encoded using interaction time features. This step maps each scalar timestamp to a high-dimensional time feature vector using a time encoding function (e.g., a periodic function based on sine and cosine functions). All these time vectors constitute the encoded time vector set. Finally, the post-search feature set and the encoded time vector set are joined in a spatiotemporal feature vector union. For each interaction in the batch, the system concatenates or performs other fusion operations on the static feature vectors of the participating nodes and the time feature vector of that interaction, thereby generating a unified feature vector for each participating entity at a specific time point. All these combined vectors together constitute the final entity-time feature matrix for subsequent processing.

[0055] Specifically, in step S600, the entity-time feature matrix is ​​subjected to temporal graph attention aggregation to obtain an aggregated neighborhood representation. It should be understood that since the entity-time feature matrix generated in the previous step only provides an independent representation of each node at a specific interaction moment, it has not effectively integrated the contextual information of the surrounding neighborhood of that node. The collaborative behavior of a botnet is precisely reflected in the interaction patterns between a node and its neighboring nodes (especially C&C servers or other controlled hosts). Simply processing the features of a single node cannot capture this crucial local network dynamic. Therefore, in the technical solution of this application, the entity-time feature matrix is ​​further subjected to temporal graph attention aggregation to obtain an aggregated neighborhood representation. This allows the model to adaptively learn and focus on the neighboring nodes that have the greatest influence on the target node at a specific time point, and to aggregate information with weights based on their importance. This generates a highly condensed and discriminative neighborhood context vector, which not only contains the features of the neighbors but also reflects the dynamic correlation strength between them and the target node at a specific time, providing a core basis for accurately identifying collaborative attack patterns.

[0056] Figure 4 This is a flowchart illustrating the process of performing temporal graph attention aggregation on the entity-time feature matrix to obtain the aggregated neighborhood representation in the IoT botnet detection method that integrates multi-dimensional information according to embodiments of this application. Figure 4As shown, step S600 includes: S610, constructing a query matrix, a key matrix, and a value matrix based on the entity-time feature matrix; S620, extracting the target node query vector from the query matrix based on the target node index; S630, extracting a set of neighbor node key vectors and a set of neighbor node value vectors from the key matrix and value vectors based on the neighbor node index set; S640, performing neighbor attention weight calculation based on scaling dot product on the target node query vector and the set of neighbor node key vectors to obtain an attention weight vector; S650, performing information weighted aggregation based on attention weight on the set of neighbor node value vectors based on attention weight to obtain the aggregated neighborhood representation.

[0057] In step S610, a query matrix, a key matrix, and a value matrix are constructed based on the entity-time feature matrix. It should be understood that while the input entity-time feature matrix provides a unified feature representation of the interaction of each node at a specific time point, the attention mechanism needs to distinguish between a node's role as an information querier, as a key attribute being matched, and as content being aggregated. In other words, since the entity-time feature matrix generated in the previous step is a unified representation, it does not distinguish between a node's different roles as an information querier (target node) and an information provider (neighbor node). Directly using this single representation for similarity calculation and information aggregation would limit the model's expressive power, making it unable to effectively handle these three different functions simultaneously, and unable to learn more complex interaction patterns. Therefore, in the technical solution of this application, a query matrix, a key matrix, and a value matrix are further constructed based on the entity-time feature matrix to linearly project the original unified feature space into three different, functionally specialized subspaces. This provides specialized input for subsequent attention calculations, enabling the model to learn how to match relevant key attributes based on query requirements and aggregate the most valuable content, greatly enhancing the model's ability to learn complex spatiotemporal dependencies.

[0058] More specifically, in a concrete example of this application, the construction process is implemented by applying three independent learnable linear transformation layers. The system first initializes three distinct weight matrices, optimized during model training, denoted as the query weight matrix W. q Key weight matrix W k Sum weight matrix W v Subsequently, the system performs matrix multiplication operations between the input entity-time feature matrix and the three weight matrices. Specifically, the entity-time feature matrix and the query weight matrix W... q Multiplying them together yields the query matrix Q; the entity-time feature matrix and the key weight matrix W. kMultiplying them together yields the key matrix K; the entity-time feature matrix and the value weight matrix W. v Multiplying them together yields the value matrix V. Through this process, each original entity-time feature vector is projected to generate its corresponding query vector, key vector, and value vector for different purposes. These three final generated matrices will serve as the direct input for scaling dot product attention calculation.

[0059] In step S620, the target node query vector is extracted from the query matrix based on the target node index. It should be understood that since the query matrix constructed in the previous step is a set of data structures containing the query representations of all nodes in the current interaction batch, and the attention score is calculated based on the relationship between a single target node and its neighboring nodes, it is necessary to accurately separate the specific vector representing the current computational focus from this set. Therefore, in the technical solution of this application, the target node query vector is further extracted from the query matrix based on the target node index, thereby providing a clear query benchmark as the starting point for relational measurement for each independent neighborhood aggregation operation. This ensures that subsequent attention weight calculations revolve around a unique target node, providing the necessary and unique input for accurately evaluating the association strength between this specific node and other nodes in its neighborhood at a specific time point.

[0060] More specifically, in a concrete example of this application, the extraction process is a direct index lookup operation. When processing an interactive batch, each node in the batch is treated as a target node and its neighborhood is aggregated. Once a target node is identified, its row index in the query matrix is ​​obtained. This index is consistent with the node's index in the entity-time feature matrix. Subsequently, the system uses this index to perform a row selection operation in the query matrix, directly locating and copying the row vector corresponding to that index. This extracted row vector is the query vector of the current target node, which will be used to perform a dot product operation with the key vectors of all the target node's neighbors.

[0061] In step S630, a set of neighbor node key vectors and a set of neighbor node value vectors are extracted from the key matrix and value vectors based on the neighbor node index set. It should be understood that since the key matrix and value matrix constructed in the previous step contain representations of all nodes in the current interaction batch, and the core of attention aggregation is to calculate the relationship between a target node and its directly connected neighbor nodes, using the keys and values ​​of all nodes indiscriminately will introduce interference from irrelevant nodes, making it impossible to correctly learn the dependencies in the local topology. Therefore, in the technical solution of this application, a set of neighbor node key vectors and a set of neighbor node value vectors are further extracted from the key matrix and value matrix based on the neighbor node index set, thereby accurately and exclusively separating the neighborhood information directly related to the current target node. This provides a clean and focused subset of data for subsequent attention weight calculation and weighted aggregation, ensuring that the model only interacts with information within the local neighborhood of the target node, which is a necessary prerequisite for realizing graph structure-aware aggregation.

[0062] More specifically, in a concrete example of this application, the extraction process is a batch indexing operation. When processing a target node, the index set of its neighbor nodes at that point in time is first obtained. This index set is a list containing the row numbers of all neighbor nodes in the key and value matrices. Subsequently, using this index set, a multi-row selection operation is performed on the key matrix to extract the row vectors corresponding to all indices at once. These extracted key vectors together constitute the neighbor node key vector set. At the same time, using the exact same neighbor node index set, the same multi-row selection operation is performed on the value matrix to extract the row vectors corresponding to all indices, thus forming the neighbor node value vector set. Finally, the system obtains two vector sets that correspond one-to-one with the neighbor nodes, which are used for subsequent attention score calculation and information weighted summation, respectively.

[0063] In step S640, a scaling dot product-based neighbor attention weight calculation is performed on the target node query vector and the set of neighbor node key vectors to obtain an attention weight vector. It should be understood that since the influence of the target node's neighbor nodes on its state is not equal, the interaction information of certain key neighbors (such as the command and control server in a botnet) has a much higher discriminative value than that of other neighbors, and simply averaging or summing all neighbor information would obscure these key signals. Therefore, in the technical solution of this application, a scaling dot product-based neighbor attention weight calculation is further performed on the target node query vector and the set of neighbor node key vectors to obtain an attention weight vector, thereby dynamically and data-driven quantifying the relative importance or association strength of each neighbor node to the target node in the current interaction context. This generates a normalized weight distribution that explicitly guides the resource allocation in the subsequent information aggregation process, enabling the model to focus its attention on the most informative neighbors, providing a quantitative basis for achieving differentiated and focused neighborhood information fusion.

[0064] More specifically, in a concrete example of this application, the weight calculation process first performs a dot product operation on the target node query vector with each key vector in the set of neighbor node key vectors. This operation is implemented by performing a matrix multiplication of the target node query vector with the transpose of the entire set of neighbor node key vectors, resulting in a raw, unnormalized attention score vector, where each component corresponds to the similarity score between a neighbor node and the target node. Subsequently, each component of this raw attention score vector is uniformly divided by a preset scaling factor, which is the square root of the key vector dimension. This step aims to adjust the range of scores to prevent the gradient vanishing in the subsequent Softmax function due to excessively large dot product results, thus ensuring the stability of the training process. Finally, the scaled attention score vector is input into a Softmax function, which exponentially and normallyizes all scores, outputting a final attention weight vector. Each element in this vector is between 0 and 1, and the sum of all elements is 1, precisely representing the weight assigned to each neighbor node's value vector in the current context.

[0065] In step S650, based on the attention weight vector, the set of neighbor node value vectors is aggregated using attention weight-based information weighting to obtain the aggregated neighborhood representation. It should be understood that since the attention weight vector calculated in the previous step only quantifies the importance of neighbor nodes, the actual information carried by the neighbor nodes (i.e., their value vectors) has not been effectively utilized, and the target node still lacks a comprehensive representation that can summarize its dynamic local environment. Therefore, in the technical solution of this application, the set of neighbor node value vectors is further aggregated using attention weight-based information weighting to obtain the aggregated neighborhood representation. This puts the calculated importance weights into practice, selectively and proportionally fusing information from different neighbors. In this way, a single, highly condensed context vector can be generated. This vector not only contains the collective information of the neighborhood, but more importantly, it emphasizes the contributions of key neighbors through weighting, thereby accurately capturing the local network dynamics most influential on the current target node.

[0066] More specifically, in a concrete example of this application, the information weighted aggregation process is a linear combination operation. First, the attention weight vector obtained in the previous step and the set of neighbor node value vectors are used as input. This set of neighbor node value vectors can be viewed as a matrix, where each row is a neighbor node's value vector. Next, each scalar weight in the attention weight vector is multiplied by its corresponding value vector in the set of neighbor node value vectors, i.e., the corresponding value vector is scaled using that weight. This operation is performed in parallel on all neighbor nodes, generating a new set of weighted value vectors. Finally, all the weighted value vectors in this new set are summed element-wise to obtain a final, single vector. This vector is the aggregated neighborhood representation, which is mathematically a weighted average of the neighbor node value vectors, with the weights dynamically determined by the attention mechanism.

[0067] Specifically, in step S700, based on the aggregated neighborhood representation, the initial features of the target node are updated with a time-aware representation to obtain the final time-aware representation. It should be understood that since the aggregated neighborhood representation only summarizes the influence from the surrounding environment, while the initial state and features of the target node itself are also indispensable components in judging its behavioral attributes, using only neighborhood information for judgment would lose the node's identity and behavioral baseline. Therefore, in the technical solution of this application, the initial features of the target node are further updated with a time-aware representation based on the aggregated neighborhood representation to obtain the final time-aware representation, thereby effectively combining the node's own features with the features of its dynamic local network environment. This generates a more comprehensive and powerful final feature representation that includes both individual node information and time-varying neighborhood context, providing the richest discriminative basis for subsequent classification decisions.

[0068] Figure 5 This is a flowchart illustrating the process of updating the initial features of a target node with a time-aware representation based on the aggregated neighborhood representation, according to an embodiment of the IoT botnet detection method that integrates multi-dimensional information, to obtain the final time-aware representation. (See flowchart for example.) Figure 5 As shown, step S700 includes: S710, extracting initial features of the target node from the entity-time feature matrix; S720, performing feature fusion on the aggregated neighborhood representation and the initial features of the target node to obtain the final time-aware representation.

[0069] In step S710, initial features of the target node are extracted from the entity-time feature matrix. It should be understood that subsequent feature fusion steps require two independent inputs: an aggregated neighborhood representation representing the external environment and an initial representation representing the node itself. Therefore, in the technical solution of this application, initial features of the target node are further extracted from the entity-time feature matrix to provide a reference vector representing the node's own state and attributes for the final representation update. This ensures that the node's own identity information is preserved and utilized before fusing neighborhood information, providing a necessary foundation for constructing a comprehensive feature representation that includes both self-awareness and environmental perception.

[0070] More specifically, in a concrete example of this application, the extraction process is a direct index lookup operation. When processing the current target node, the row index of that node in the entity-time feature matrix is ​​already held. Using this index, a row selection operation is performed in the entity-time feature matrix to directly locate and copy the row vector corresponding to that index. This extracted vector is the initial feature vector of the target node at the current interaction time point, incorporating its static attributes and time encoding. It will be directly passed to the subsequent feature fusion module for merging with the aggregated neighborhood representation.

[0071] In step S720, feature fusion is performed on the aggregated neighborhood representation and the initial features of the target node to obtain the final time-aware representation. It should be understood that simple feature fusion methods, such as linear combination or splicing, treat the aggregated neighborhood representation and the initial features of the target node as isolated entities, making it difficult to capture the deep, intrinsic correspondence between them regarding geometric shape and distribution structure. This is especially true in complex botnet scenarios, where the influence of the neighborhood (e.g., C&C servers) on the target node (e.g., controlled hosts) often manifests as a structural, non-linear distortion rather than a superficial association. Therefore, in the technical solution of this application, feature fusion is further performed on the aggregated neighborhood representation and the initial features of the target node to obtain the final time-aware representation. This elevates feature interaction from the traditional linear combination paradigm to the realm of geometric alignment and manifold transformation in the learned non-Euclidean space. A globally optimal non-linear distortion scheme is calculated through optimal transmission to simulate the structural influence of one feature space on another. In this way, it is possible to capture the continuous deformation of the target node's feature manifold under the influence of the neighboring feature manifold, and generate a final representation that deeply encodes the structural interaction information between the two, thereby greatly improving the ability to identify covert cooperative attack patterns.

[0072] Specifically, in this embodiment, feature fusion of the aggregated neighborhood representation and the initial features of the target node to obtain the final time-aware representation includes: performing feature manifold local encoding on the aggregated neighborhood representation and the initial features of the target node using one-dimensional convolutional encoding to generate an aggregated neighborhood local encoding vector set and a target node local encoding vector set, respectively; calculating the feature alignment cost matrix between the aggregated neighborhood local encoding vector set and the target node local encoding vector set to obtain the neighborhood representation-target node initial feature feature alignment cost matrix; determining the optimal transfer mapping matrix of the neighborhood representation-target node initial features based on the neighborhood representation-target node initial feature feature alignment cost matrix; performing feature manifold alignment on the target node local encoding vector set based on the optimal transfer mapping matrix of the neighborhood representation-target node initial features to obtain the target node reconstructed local encoding vector set; and performing fine-grained interactive fusion of the aggregated neighborhood local encoding vector set and the target node reconstructed local encoding vector set to obtain the final time-aware representation.

[0073] Accordingly, one-dimensional convolutional coding is used to perform local feature manifold coding on the aggregated neighborhood representation and the initial features of the target node, generating the aggregated neighborhood local coding vector set and the target node local coding vector set, respectively, as expressed by the following formula:

[0074]

[0075] Where V1 and V2 are the aggregated neighborhood representation and the initial features of the target node, respectively, w1 and w2 are learnable convolutional kernels, and Conv 1D This is a one-dimensional convolutional encoding, where H1 and H2 are the aggregated neighborhood local encoding vector set and the target node local encoding vector set, respectively. and These are the k-th aggregated neighborhood representation local granularity encoding vector and the k-th initial feature local granularity encoding vector of the target node, respectively, where K is the number of vectors in the aggregated neighborhood local encoding vector set and the target node local encoding vector set.

[0076] It is understandable that, since the aggregated neighborhood representation and the initial features of the target node, when used as one-dimensional feature vectors, are considered isolated points in a high-dimensional space, they are flat and lack internal structure. This representation cannot directly support subsequent geometric alignment and manifold transformations in non-Euclidean space, as these advanced interactive operations require features to have a localized and ordered structure. Therefore, in the technical solution of this application, one-dimensional convolutional encoding is used to perform local feature manifold encoding on the aggregated neighborhood representation and the initial features of the target node, generating aggregated neighborhood local encoding vector sets and target node local encoding vector sets, respectively. This treats these two flat feature vectors as one-dimensional signals, and the sliding window operation of the convolutional kernel effectively captures the local dependencies and combination patterns within the features, thereby achieving the localization of the feature manifold. In this way, the originally unstructured vectors can be transformed into a set of ordered, context-information-containing locally granular encoded vectors. This is not only for feature extraction, but its deeper significance lies in the discretization sampling of an implicit, continuous feature manifold, laying a structured data foundation for subsequent geometric space measurement and alignment.

[0077] Accordingly, the feature alignment cost matrix between the aggregated neighborhood local encoding vector set and the target node local encoding vector set is calculated to obtain the neighborhood representation-target node initial feature feature alignment cost matrix, expressed by the following formula:

[0078]

[0079] Where ||·|2 is the L2 norm, MLP θ It is a multilayer perceptron, <·,·> are vector inner products, ‖·‖ is the vector norm 1, λ represents the coefficient balancing similarity and semantic difference, and C ij The element at position (i,j) in the neighborhood representation-target node initial feature alignment cost matrix.

[0080] It should be understood that since the aggregated neighborhood local encoding vector set and the target node local encoding vector set generated in the previous step are two independent, discrete feature manifolds, their geometric correspondence has not yet been established. To perform structural alignment and distortion, a criterion for quantifying the ease of matching between them is necessary. Therefore, in the technical solution of this application, the feature alignment cost matrix between the aggregated neighborhood local encoding vector set and the target node local encoding vector set is further calculated to obtain the neighborhood representation-target node initial feature alignment cost matrix. This defines a distance or cost metric between the two discrete feature manifolds, thereby constructing a geometric blueprint for the entire interaction process. In this way, a neighborhood representation-target node initial feature alignment cost matrix can be obtained, where each element precisely quantifies the cost required to match any sampling point on the aggregated neighborhood representation manifold with any sampling point on the target node's initial feature manifold, providing the most fundamental and essential input information for subsequently solving the optimal transport mapping.

[0081] Accordingly, based on the neighborhood representation-target node initial feature alignment cost matrix, the optimal transmission mapping matrix for the neighborhood representation-target node initial features is determined, expressed by the following formula:

[0082]

[0083] H(T)=-∑ ij T ij log2T ij

[0084] Where H(·) is the entropy regularization, and T ij Let A be the element at position (i,j) in T, and let A be the adjacency constraint matrix if and only if and A is topologically adjacent in the characteristic manifold ij =1, otherwise A ij =0, ⊙ represents positional dot product, ∈ represents entropy regularization coefficient to ensure smoothness and differentiability, γ represents trainable weights, arg min represents the minimum value corresponding to T, and T is the neighborhood representation-target node initial feature transfer mapping matrix. s The neighborhood representation is the optimal transfer mapping matrix for the initial features of the target node.

[0085] It should be understood that the neighborhood representation-target node initial feature alignment cost matrix generated in the previous step only provides the pairwise matching cost between local granular encoding vectors. Traditional interaction mechanisms, such as attention mechanisms, often only normalize local similarities, which is insufficient to determine a globally optimal solution that maps the overall shape of one feature distribution to another feature distribution with the minimum total cost. Therefore, in the technical solution of this application, based on the neighborhood representation-target node initial feature alignment cost matrix, the optimal transfer mapping matrix for the neighborhood representation-target node initial features is determined. This introduces optimal transfer theory to seek a globally optimal joint probability distribution matching scheme that satisfies the mass conservation constraint. In this way, a soft transfer mapping matrix can be efficiently obtained using numerical methods such as the Sinhorn algorithm with entropy regularization. This matrix accurately describes how to transfer or reshape the distribution shape of the target node's initial features into the distribution shape of the aggregated neighborhood representation with the minimum total cost, providing a specific and optimal transformation basis for subsequent feature manifold alignment operations.

[0086] Accordingly, based on the neighborhood representation-target node initial feature optimal transfer mapping matrix, the target node local coding vector set is aligned with the feature manifold to obtain the target node reconstructed local coding vector set, expressed by the following formula:

[0087]

[0088] in, For matrix multiplication, Reconstruct the local granularity coding vector of the j-th target node in the local coding vector set after reshaping the initial features.

[0089] It should be understood that the neighborhood representation-target node initial feature optimal transfer mapping matrix determined in the previous step is only an abstract scheme or geometric blueprint describing how to transport feature distributions at the lowest cost. The target node's local encoding vector set itself has not actually changed, and its feature manifold remains in its original, unaligned state with the neighborhood. Therefore, in the technical solution of this application, based on the aforementioned neighborhood representation-target node initial feature optimal transfer mapping matrix, feature manifold alignment is performed on the target node's local encoding vector set to obtain the target node's reconstructed local encoding vector set. This performs the crucial feature manifold alignment operation, implementing the optimal transfer scheme and performing a principled, continuous geometric transformation on the target node's feature manifold. In this way, a new reconstructed set can be generated from a geometric perspective through a centroid projection method. The reconstructed local encoding vector of each target node in this set is a weighted average of all vectors in the original target node feature set. The weights are provided by the optimal transfer mapping matrix. The final reconstructed set can be regarded as the result of the geometric deformation of the target node feature manifold under the influence of the gravitational field of the aggregated neighborhood feature manifold in order to align with it. It is no longer an isolated self-representation, but contains contextual information after deep structural alignment with the neighborhood.

[0090] Accordingly, the aggregated neighborhood local encoding vector set and the target node reconstructed local encoding vector set are subjected to fine-grained interactive fusion to obtain the final time-aware representation, expressed by the following formula:

[0091]

[0092] G = {g1, g2, ..., g} n}

[0093] v inter =LSTM(G)

[0094] Where [·; ·] represents vector concatenation, W g Let g1, g2, g3 be the trainable weight matrix, g4 be the sigmoid function, and G be the set of neighborhood representation-target node initial feature cross-encoding vectors. i ,g n These are the 1st, 2nd, ith, and nth neighborhood representation-target node initial feature cross-coding vectors in the set of neighborhood representation-target node initial feature cross-coding vectors, respectively. LSTM is a forward LSTM encoder. inter This is the final time-aware representation.

[0095] It should be understood that since the previous step only generated two independent encoded vector sets representing the original neighborhood state and the aligned target node state respectively, the changes generated by the interaction process itself—namely, the original state, the aligned state, and the differences between them—have not yet been explicitly captured and modeled into a unified feature representation. Therefore, in the technical solution of this application, the aggregated neighborhood local encoded vector set and the target node reconstructed local encoded vector set are further subjected to fine-grained interactive fusion to obtain the final time-aware representation. This allows for the explicit modeling and capture of the deep changes caused by the manifold alignment interaction process by constructing a high-dimensional interaction tensor that simultaneously encodes the original neighborhood state, the aligned target node state, and the differences between them. In this way, a learnable aggregation module can adaptively extract and integrate the most critical interaction signals for the botnet detection task from this high-dimensional interaction tensor, ultimately generating a compact, information-rich, and comprehensive time-aware representation that encodes all dynamic information of the feature manifold alignment process.

[0096] Specifically, in step S800, the final time-aware representation is subjected to traffic classification and risk determination to obtain a classification result. The classification result is used to indicate whether the input traffic is botnet traffic. It should be understood that since the final time-aware representation is a feature vector that fully encodes the spatiotemporal topology and interaction characteristics of nodes in a high-dimensional space, it is still an abstract, continuous numerical expression and has not yet been mapped to specific, discrete risk categories (such as botnet traffic or benign traffic), and therefore cannot be directly used for the final risk determination. Therefore, in the technical solution of this application, the final time-aware representation is further subjected to traffic classification and risk determination to obtain a classification result, thereby establishing a nonlinear mapping decision model from a complex feature space to a predefined label space. In this way, the abstract feature vector containing rich information can be transformed into a clear and interpretable classification conclusion, directly indicating the nature of the analyzed traffic, thus achieving the final goal of the entire botnet detection process.

[0097] More specifically, in this embodiment, traffic classification and risk determination are performed on the final time-aware representation to obtain a classification result, including: inputting the final time-aware representation into a classification layer to obtain a predicted probability distribution. Notably, the classification layer is a feedforward network with a Softmax activation function; and taking the category with the highest probability in the predicted probability distribution as the classification result. That is, the traffic classification and risk determination process first inputs the final time-aware representation into a feedforward network with a Softmax activation function, which serves as the classification layer. Inside this feedforward network, the final time-aware representation first passes through one or more linear transformation layers, which map its features to a new vector with a dimension equal to the number of categories to be classified. This vector logically represents the score for each category. Subsequently, this score vector is fed into a Softmax activation function, which exponentially and normally processes each element in the score vector, thereby outputting a predicted probability distribution. This predicted probability distribution is a vector whose elements sum to 1, and the value of each element corresponds to the probability that the input traffic belongs to a specific category (e.g., botnet traffic or benign traffic). Finally, the system identifies the category with the highest probability value in the predicted probability distribution as the final classification result, thereby completing the risk assessment of the traffic.

[0098] In summary, the IoT botnet detection method integrating multi-dimensional information according to the embodiments of this application is explained. It transforms raw traffic data into structured network flow records through flow feature aggregation, laying the foundation for deep analysis. Secondly, it constructs a time-series dynamic communication graph from these timestamped flow records, thereby transforming isolated network events into a network topology that reflects the interaction relationships and behavioral evolution between devices. Finally, it introduces a time-graph attention mechanism to perform time-aware aggregation learning on the nodes and their neighborhood information in the dynamic graph. This mechanism can adaptively focus on key collaborative communication behaviors, deeply integrating multi-dimensional information such as node topology, interaction content, and temporal evolution to generate highly discriminative feature representations, thereby effectively identifying the covert and collaborative attack patterns of botnets and improving the accuracy and robustness of detection.

[0099] Furthermore, an IoT botnet detection system that integrates multi-dimensional information is also provided.

[0100] Figure 6 This is a block diagram of an IoT botnet detection system that integrates multi-dimensional information according to an embodiment of this application. Figure 6As shown, the IoT botnet detection system 100, which integrates multi-dimensional information according to an embodiment of this application, includes: a raw Pcap traffic acquisition module 110 for acquiring raw Pcap traffic data; a traffic data structuring module 120 for performing structuring processing on the raw Pcap traffic data to obtain a structured NetFlow record set; a dynamic communication graph construction module 130 for constructing a time-series dynamic communication graph based on the structured NetFlow record set to obtain a dynamic communication graph; an interaction data sampling module 140 for performing interaction data sampling on the dynamic communication graph to obtain interaction batch data; and joint features. The encoding module 150 is used to perform node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix; the time graph aggregation module 160 is used to perform time graph attention aggregation on the entity-time feature matrix to obtain an aggregated neighborhood representation; the time-aware module 170 is used to update the initial features of the target node with a time-aware representation based on the aggregated neighborhood representation to obtain a final time-aware representation; and the traffic risk determination module 180 is used to perform traffic classification and risk determination on the final time-aware representation to obtain a classification result, wherein the classification result is used to indicate whether the input traffic is botnet traffic.

[0101] As described above, the IoT botnet detection system 100 integrating multi-dimensional information according to the embodiments of this application can be implemented in various wireless terminals, such as servers with IoT botnet detection algorithms integrating multi-dimensional information. In one possible implementation, the IoT botnet detection system 100 integrating multi-dimensional information according to the embodiments of this application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the IoT botnet detection system 100 integrating multi-dimensional information can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the IoT botnet detection system 100 integrating multi-dimensional information can also be one of many hardware modules of the wireless terminal.

[0102] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting an Internet of Things botnet by fusing multi-dimensional information, the method comprising: include: Obtain raw Pcap traffic data; The raw Pcap traffic data is processed into a structured NetFlow record set. A time-series dynamic communication graph is constructed based on the structured NetFlow record set to obtain a dynamic communication graph; The dynamic communication graph is sampled for interactive data to obtain interactive batch data; The interactive batch data is subjected to node-time joint feature encoding to obtain an entity-time feature matrix; Temporal graph attention aggregation is performed on the entity-temporal feature matrix to obtain the aggregated neighborhood representation; Based on the aggregated neighborhood representation, the initial features of the target node are updated with a time-aware representation to obtain the final time-aware representation. The final time-aware representation is subjected to traffic classification and risk assessment to obtain a classification result, which is used to indicate whether the input traffic is botnet traffic. Based on the aggregated neighborhood representation, the initial features of the target node are updated with a time-aware representation to obtain the final time-aware representation, including: Extract initial features of the target node from the entity-time feature matrix; The final time-aware representation is obtained by fusing features between the aggregated neighborhood representation and the initial features of the target node. This includes: performing local feature manifold encoding on the aggregated neighborhood representation and the initial features of the target node using one-dimensional convolutional encoding to generate an aggregated neighborhood local encoding vector set and a target node local encoding vector set, respectively; calculating the feature alignment cost matrix between the aggregated neighborhood local encoding vector set and the target node local encoding vector set to obtain the neighborhood representation-target node initial feature feature alignment cost matrix, thereby defining a distance or cost metric between the two discretized feature manifolds, thus constructing a geometric blueprint for the entire interaction process, as expressed by the following formula: in, It is a 2-norm. It is a multilayer perceptron. It is a vector dot product. It is the vector norm 1. A coefficient representing a balance between similarity and semantic difference. For neighborhood representation - target node initial feature feature alignment cost matrix The elements of the position; based on the neighborhood representation-target node initial feature alignment cost matrix, determine the optimal transmission mapping matrix of the neighborhood representation-target node initial features, thereby introducing optimal transmission theory to seek a globally optimal joint probability distribution matching scheme that satisfies the mass conservation constraint, expressed by the following formula: in, For entropy regularization, for middle The element at position, It is an adjacency constraint matrix if and only if and When topologically adjacent in a characteristic manifold ,otherwise , For positional product, The entropy regularization coefficient ensures smoothness and differentiability. For trainable weights, To obtain the minimum value , The neighborhood representation-target node initial feature transfer mapping matrix, The neighborhood representation-target node initial feature optimal transfer mapping matrix is ​​used. Based on the neighborhood representation-target node initial feature optimal transfer mapping matrix, the target node local coding vector set is aligned with the feature manifold to obtain the target node reconstructed local coding vector set. The aggregated neighborhood local coding vector set and the target node reconstructed local coding vector set are fused in a fine-grained interactive manner to obtain the final time-aware representation. 2.The method of claim 1, wherein, The raw Pcap traffic data is structured to obtain a structured NetFlow record set, including: The raw Pcap traffic data is processed into session packet packets based on session 5-tuples. The session data packets are subjected to flow feature aggregation and calculation to obtain an aggregated flow feature set; The aggregated stream feature set is then structured to obtain the structured NetFlow record set. 3.The method of claim 2, wherein, The session data packet groups are subjected to flow feature aggregation and calculation to obtain an aggregated flow feature set, including: Extract the first session packet from the session data packet; The duration is obtained by extracting time features from the first session group; The first session packet is subjected to direction determination and counting to obtain the number of source-to-destination packets, the number of destination-to-source packets, the number of source-to-destination bytes, and the number of destination-to-source bytes; The protocol and total number of packets are extracted from the first session group to obtain the total number of packets and the total number of bytes. The duration, number of source packets, number of bytes from source to destination, number of bytes from destination to source, total number of packets, and total number of bytes are combined to obtain an original feature record in the aggregated stream feature set. 4.The method of claim 1, wherein, Based on the structured NetFlow recordset, a time-series dynamic communication graph is constructed to obtain a dynamic communication graph, including: Traverse each structured NetFlow record in the structured NetFlow record set and map the source IP address and destination IP address in the structured NetFlow record to nodes in the dynamic communication graph; Based on each structured NetFlow record, a directed edge is created between the corresponding source IP address node and the target IP address node according to its start time, and the original feature record in the structured NetFlow record is attached to the directed edge as an attribute. 5.The method of claim 1, wherein, Perform node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix, including: Based on the node identifiers of each interactive event in the interactive batch data, the corresponding static basic feature vectors are extracted from the node basic feature matrix to obtain the searched basic feature set. The timestamps of each interactive event in the interactive batch data are encoded using interactive time features to obtain an encoded time vector set. The entity-time feature matrix is ​​obtained by combining the searched basic feature set and the encoded time vector set with spatiotemporal feature vectors. 6.The method of claim 1, wherein, The entity-time feature matrix is ​​subjected to temporal graph attention aggregation to obtain the aggregated neighborhood representation, including: Based on the entity-time feature matrix, construct the query matrix, key matrix, and value matrix; Extract the target node query vector from the query matrix based on the target node index; Based on the neighbor node index set, extract the neighbor node key vector set and the neighbor node value vector set from the key matrix and value vector; The attention weight vector is obtained by performing a scaling dot product-based neighbor attention weight calculation on the target node query vector and the set of neighbor node key vectors. Based on the attention weight vector, the set of neighbor node value vectors is aggregated using information weighting based on attention weight to obtain the aggregated neighborhood representation. 7.The method of claim 1, wherein, The final time-aware representation is subjected to traffic classification and risk assessment to obtain classification results, including: The final time-aware representation is input into the classification layer to obtain the predicted probability distribution; The category with the highest probability in the predicted probability distribution is taken as the classification result.

8. The IoT botnet detection method integrating multi-dimensional information according to claim 7, characterized in that, The classification layer is a feedforward network with a Softmax activation function.

9. A system for detecting an Internet of Things botnet by fusing multi-dimensional information, configured to perform the method according to any one of claims 1 to 8. include: The raw Pcap traffic acquisition module is used to acquire raw Pcap traffic data. The traffic data structuring module is used to perform structuring processing on the raw Pcap traffic data to obtain a structured NetFlow record set; A dynamic communication graph construction module is used to construct a time-series dynamic communication graph based on the structured NetFlow record set to obtain a dynamic communication graph; An interactive data sampling module is used to sample interactive data from the dynamic communication graph to obtain interactive batch data. The joint feature encoding module is used to perform node-time joint feature encoding on the interactive batch data to obtain an entity-time feature matrix. The temporal graph aggregation module is used to perform temporal graph attention aggregation on the entity-temporal feature matrix to obtain the aggregated neighborhood representation; The time-aware module is used to update the initial features of the target node with a time-aware representation based on the aggregated neighborhood representation to obtain the final time-aware representation; The traffic risk assessment module is used to classify and assess the traffic risk of the final time-aware representation to obtain a classification result, which is used to indicate whether the input traffic is botnet traffic.

Images