A mimetic flow defense method and system based on dynamic graph residual contrast

Abstract

The present application relates to the technical field of network security protection, in particular to a method and system for mimetic flow defense based on dynamic graph residual contrast. The present application collects network flow logs to construct a dynamic graph sequence; obtains a node embedding matrix through a time series graph attention network coding, calculates node-level residuals and graph-level residuals, and weights and fuses them to construct a unified residual vector; inputs the unified residual vector sequence into a Transformer network, and outputs node-level anomaly scores and graph-level attack prediction probability distributions in parallel; fuses the two to calculate an anomaly intensity index, sets double thresholds to divide the flow into three categories; identifies abnormal nodes according to the node-level anomaly scores for uncertain abnormal flow and guides them to a standard mimetic execution body, guides high-risk flow to a heterogeneous induction execution body, and adjusts the response strategy according to the attack type. The present application improves the detection capability and defense flexibility for complex attacks.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security protection, in particular to a mimicry flow defense method and system based on dynamic graph residual comparison. BACKGROUND

[0002] With the increasing complexity of network attack means, the traditional detection method based on static features is insufficient in the face of complex scenes such as multi-stage attacks and horizontal penetration. The existing technology cannot effectively capture the dynamic evolution of network topology and the behavior dependence relationship between hosts.

[0003] The existing scheme mainly has the following defects: first, the model generally adopts a static structure, does not introduce dynamic modeling of the graph structure, and cannot identify the connection frequency and edge weight changes between hosts; second, the mimicry decision mechanism is relatively rigid, usually based on fixed traffic classification results to perform defense, without considering the dynamic adjustment of structural uncertainty; third, the model has poor interpretability, making it difficult to provide clear root cause analysis of abnormal behavior, limiting the attack tracing and strategy optimization capabilities. SUMMARY

[0004] The application provides a mimicry flow defense method and system based on dynamic graph residual comparison, aiming to solve the problems of insufficient modeling of the interaction relationship between hosts, rigid mimicry defense mechanism and lack of interpretability of the existing network flow detection method.

[0005] To achieve the above-mentioned purpose, the application provides the following technical solutions:

[0006] The application provides a mimicry flow defense method based on dynamic graph residual comparison, comprising:

[0007] S100: Collect network flow logs, construct a dynamic graph sequence according to time steps, the nodes in the graph are host IPs, the edges represent communication connections between hosts, and the edge weights are obtained by converting connection features through a mapping function;

[0008] S200: Encode the dynamic graph sequence through a time series graph attention network to obtain a node embedding matrix, calculate the difference between the current node embedding and the historical reference embedding to obtain a node-level residual, calculate the difference between the current graph embedding and the historical graph embedding to obtain a graph-level residual, and weightedly fuse the node-level residual and the graph-level residual to construct a unified residual vector;

[0009] S300: Input the unified residual vector sequence as a time series feature into a Transformer network, and output a node-level anomaly score and a graph-level attack prediction probability distribution in parallel;

[0010] S400: Fuse the node-level anomaly score and the graph-level attack prediction probability distribution to calculate an anomaly intensity index, and set double thresholds to divide the flow into normal flow, uncertain abnormal flow and high-risk flow;

[0011] S500: For uncertain abnormal traffic, identify abnormal nodes according to node-level anomaly scores and guide their traffic to standard quasiparticle executors, for high-risk traffic, guide to heterogeneous induction executors, adjust response strategies according to attack types.

[0012] As a preferred technical solution of the present application, the step of constructing a unified residual vector comprises:

[0013] Set the length of the historical time window, obtain the node embedding matrix of several time steps before the current time step and average to obtain the historical reference embedding, calculate the difference vector of the current node embedding and the historical reference embedding and obtain the node anomaly metric value by L2 norm;

[0014] Average pooling is performed on the node embedding matrix of each time step to obtain the graph embedding of each time step, the average of the graph embedding in the historical time window is obtained, and the difference vector of the current graph embedding and the historical graph embedding is calculated and the L2 norm is obtained. Graph anomaly metric value;

[0015] The node anomaly metric values of all nodes are averaged, and the average of the node anomaly metric values and the graph anomaly metric value are weighted and summed according to the set weight coefficient to obtain a unified residual vector.

[0016] As a preferred technical solution of the present application, the step of parallel outputting comprises:

[0017] The unified residual vector sequence is added with position coding and then sequentially outputted through a multi-head self-attention layer and a feedforward neural network layer to output a node representation sequence;

[0018] Each node representation is mapped through a linear layer and then obtained through a Sigmoid activation function to obtain a node-level anomaly score;

[0019] The node representation sequence is average-pooled to obtain a graph-level representation, which is mapped through a linear layer and then obtained through a Softmax function to obtain a graph-level attack prediction probability distribution.

[0020] As a preferred technical solution of the present application, the step of calculating the anomaly intensity indicator comprises: calculating the average of the node-level anomaly scores of all nodes, extracting the maximum probability value from the graph-level attack prediction probability distribution, and weighting and summing the average of the node-level anomaly scores and the maximum probability value according to the set weight coefficient to obtain the anomaly intensity indicator.

[0021] As a preferred technical solution of the present application, the double threshold value comprises a safety threshold value and a danger threshold value, when the anomaly intensity indicator is lower than the safety threshold value, it is determined as normal traffic, when the anomaly intensity indicator is higher than the danger threshold value, it is determined as high-risk traffic, and when the anomaly intensity indicator is between the safety threshold value and the danger threshold value, it is determined as uncertain abnormal traffic.

[0022] As a preferred technical solution of the present application, the step of identifying abnormal nodes comprises: setting a node anomaly threshold according to the statistical distribution of historical node-level anomaly scores, comparing the node-level anomaly scores of each node with the node anomaly threshold, marking the nodes with anomaly scores higher than the node anomaly threshold as abnormal nodes, guiding the traffic corresponding to the abnormal nodes to the standard quasipattern executor, and releasing the traffic corresponding to the non-abnormal nodes to the real system.

[0023] As a preferred technical solution of the present application, the standard quasipattern executor superimposes random delay disturbances subject to a normal distribution on the reference response time.

[0024] As a preferred technical solution of the present application, the heterogeneous induction executor adopts a different operating system version, kernel configuration or instruction set architecture from the production system.

[0025] As a preferred technical solution of the present application, the step of adjusting the response strategy comprises: determining the attack type with the highest probability from the graph-level attack prediction probability distribution, and adjusting the response parameters of the standard quasipattern executor or the heterogeneous induction executor according to the attack type.

[0026] The present application also proposes a quasipattern traffic defense system based on dynamic graph residual contrast, comprising:

[0027] A dynamic graph construction module is configured to collect network traffic logs, construct a dynamic graph sequence according to time steps, wherein the nodes in the graph are host IPs, the edges represent communication connections between hosts, and the edge weights are obtained by converting connection features through a mapping function;

[0028] A residual contrast module is configured to encode the dynamic graph sequence through a time series graph attention network to obtain a node embedding matrix, calculate the difference between the current node embedding and the historical baseline embedding to obtain a node-level residual, calculate the difference between the current graph embedding and the historical graph embedding to obtain a graph-level residual, and fuse the node-level residual and the graph-level residual to construct a unified residual vector;

[0029] A time series discrimination module is configured to input the unified residual vector sequence as time series features into a Transformer network and output a node-level anomaly score and a graph-level attack prediction probability distribution in parallel;

[0030] A risk grading module is configured to fuse the node-level anomaly score and the graph-level attack prediction probability distribution to calculate an anomaly intensity index, set a double threshold to divide the traffic into normal traffic, uncertain abnormal traffic and high-risk traffic;

[0031] A quasipattern response module is configured to identify abnormal nodes according to the node-level anomaly score for uncertain abnormal traffic and guide the traffic of the abnormal nodes to the standard quasipattern executor, guide the high-risk traffic to the heterogeneous induction executor, and adjust the response strategy according to the attack type.

[0032] The beneficial effects of the present application are:

[0033] 1. The present application simultaneously captures local host behavior changes and global topology structure deviations through node-level and graph-level dual residual mechanisms, and forms a unified residual vector to drive subsequent discrimination through weighted fusion. This dual-layer residual comparison mechanism significantly improves the recognition ability of multi-stage complex attacks such as horizontal movement and chain attacks, and has stronger structure perception ability than traditional single-layer feature detection methods.

[0034] 2. The present application is based on Transformer parallel output node-level anomaly score and graph-level attack prediction, combined with a double-threshold buffer strategy, which avoids the rigid decision of "single threshold decision". By setting a buffer area for uncertain abnormal traffic, the system can flexibly cope with ambiguous risk scenarios, effectively reduce the risk of misjudgment of two types of nodes with local anomalies but no significant graph-level, and high graph-level probability but scattered nodes, and significantly improve the robustness of defense decisions.

[0035] 3. The present application uses node-level anomaly score for accurate identification of abnormal nodes and selective diversion, and dynamically adjusts the parameters of the mimic response strategy according to the graph-level attack type prediction. This "node positioning + type fine-tuning" adaptive response mechanism not only ensures effective defense of suspicious traffic, but also avoids excessive interference with normal business, realizes deep coupling of detection results and defense execution, and improves the overall defense efficiency and anti-probing ability of the system. BRIEF DESCRIPTION OF DRAWINGS

[0036] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, which together with the embodiments of the present application, serve to explain the present application, and do not constitute a limitation of the present application. In the drawings:

[0037] Figure 1 is a model diagram of a mimic flow defense method based on dynamic graph residual comparison of the present application;

[0038] Figure 2 is a flowchart of a mimic flow defense method based on dynamic graph residual comparison of the present application;

[0039] Figure 3 is a structural schematic diagram of a mimic flow defense system based on dynamic graph residual comparison of the present application. DETAILED DESCRIPTION

[0040] The preferred embodiments of the present application are described below in conjunction with the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and do not limit the present application.

[0041] The present application provides a mimic flow defense method and system based on dynamic graph residual comparison, and the overall model architecture is as followsFigure 1 As shown. Figure 1 The technical process from network traffic collection, dynamic graph construction, residual contrast analysis, time sequence discrimination to paratope response is demonstrated, aiming to solve the problems of insufficient modeling of host interaction relationship, rigidity of paratope defense mechanism and lack of explainability of existing network traffic detection methods.

[0042] Embodiment one: as Figure 2 shown, a paratope traffic defense method based on dynamic graph residual contrast, comprising:

[0043] S100: collect network traffic logs, construct a dynamic graph sequence according to time steps, the nodes in the graph are host IPs, the edges represent the communication connection between hosts, and the edge weights are obtained by converting the connection features through a mapping function;

[0044] Specifically, first, the original network communication logs are collected and structured in real time. Each record of the network traffic log represents a connection event, including the following feature fields: timestamp, source IP address, destination IP address, source port, destination port, protocol type, packet length, TCP state, etc. These features are combined into a d-dimensional feature vector , wherein represents the time index:

[0045] ;

[0046] The entire input sequence is represented as:

[0047] ;

[0048] , wherein represents the length of the time sequence, is the connection event feature vector recorded at time step . This sequence is the basis for constructing a dynamic graph, which retains the fine-grained time sequence information of the original behavior.

[0049] For each time point , a directed and weighted graph is constructed, which is defined as:

[0050] ;

[0051] , wherein is the node set, is the edge set, is the adjacency matrix.

[0052] The construction method of each component is as follows:

[0053] The node set is obtained by collecting all the unique IP addresses in the network traffic logs at time All active unique host IP addresses constitute. Specifically, traverse all connection event records at time , extract all source IP addresses and destination IP addresses appearing therein, and form a node set after deduplication. Each node corresponds to a unique host IP address.

[0054] If there is a connection event from source IP to destination IP at time , a directed edge is established in the graph, with the direction of the edge pointing from the source IP to the destination IP. Such a directed edge can accurately depict the initiator and receiver relationship of network communication, and is helpful in identifying directed attack behaviors such as active scanning and one-way penetration.

[0055] For any edge , its weight is converted from the characteristics of the connection event by a mapping function to a real value. Specifically: if , then ; otherwise . Wherein represents the connection characteristics of node to node , including protocol type, port number, packet length, connection times, etc. The mapping function aggregates these multi-dimensional discrete or continuous characteristics into a single edge weight value.

[0056] In a specific embodiment, the mapping function can be implemented in a weighted summation manner:

[0057] ;

[0058] wherein is the numerical encoding of the protocol type (such as TCP=1, UDP=2), is the port similarity feature, is the number of packets in this time step, is the total byte count, is a preset weight coefficient. Through this mapping function, different types of connection events are converted into comparable edge weight values, thereby realizing quantitative representation of communication intensity and behavior patterns.

[0059] Through the above graph construction process, the system repeatedly performs the above construction operation for consecutive time steps to form a dynamic graph sequence:

[0060] ;

[0061] Each graph captures The communication topology structure and connection mode in the time network not only reserve the structural relationship between nodes, but also embody the evolution trajectory of network behavior over time. Compared with the traditional feature vector-based method, the dynamic graph sequence not only reserves the evolution information of the communication topology, but also effectively reveals the attack chain such as horizontal movement, probe scanning and the like across nodes, thereby providing a data basis with both structural and time sequence information for subsequent anomaly detection and attack identification.

[0062] In actual application, the time step can be flexibly set according to the characteristics of network traffic, for example, 1 second, 5 seconds or 1 minute, so as to balance the calculation efficiency and detection accuracy. For a high-speed network environment, a shorter time step is helpful to capture the rapid change of attack behavior; for a low-speed network or a scene requiring long-term monitoring, a longer time step can reduce the calculation overhead while maintaining the detection ability of slow evolution attacks.

[0063] S200: encoding the dynamic graph sequence by a time graph attention network to obtain a node embedding matrix, calculating a difference value between a current node embedding and a historical reference embedding to obtain a node-level residual, calculating a difference value between a current graph embedding and a historical graph embedding to obtain a graph-level residual, and constructing a unified residual vector by weighted fusion of the node-level residual and the graph-level residual;

[0064] Further, the step of constructing the unified residual vector comprises:

[0065] setting a historical time window length, obtaining node embedding matrices of a plurality of time steps before a current time step and averaging to obtain a historical reference embedding, calculating a difference vector between the current node embedding and the historical reference embedding and calculating an L2 norm to obtain a node anomaly metric value;

[0066] averaging-pooling the node embedding matrices of each time step to obtain a graph embedding of each time step, averaging the graph embeddings in the historical time window to obtain a historical graph embedding, calculating a difference vector between the current graph embedding and the historical graph embedding and calculating an L2 norm to obtain a graph anomaly metric value;

[0067] averaging the node anomaly metric values of all nodes, and weighted summing the average value of the node anomaly metric value and the graph anomaly metric value according to a set weight coefficient to obtain the unified residual vector.

[0068] Specifically, in order to identify abnormal evolution in the network structure, the application introduces a structural residual contrast mechanism. First, the dynamic graph of each time step t is encoded by a time graph attention network (TGAT) encoder. TGAT can capture the topological structure and time evolution characteristics of the graph at the same time, and map the high-dimensional graph structure data to a low-dimensional node representation. After encoding, a node embedding matrix is obtained , wherein each row corresponds to a node . In the low-dimensional representation vector of the moment. The embedding vector integrates the node's own features, neighbor node information, and connection edge weight information, and can comprehensively depict the behavior state of the node in the current network topology.

[0069] In order to detect whether the current graph structure deviates from the historical pattern, the application adopts a sliding window mechanism to calculate the historical benchmark embedding. Specifically, at the current time , the historical time window length is set to , the node embedding matrix of the past time steps is reviewed, and the average value thereof is calculated as the historical benchmark embedding:

[0070] ;

[0071] wherein is the historical benchmark embedding matrix of time , and represents the historical benchmark embedding vector of node . The historical benchmark integrates the overall trend of the recent network structure, and provides a comparison baseline for anomaly detection. By comparison with the recent history, the system can find out whether the current structure deviates from the recent overall trend, and is suitable for detecting gradually evolving structural anomalies or latent attacks. In actual applications, the selection of the window length K needs to balance the detection sensitivity and stability. A smaller K value (such as K=35) makes the system more sensitive to short-term changes, and is suitable for detecting sudden attacks; a larger K value (such as K=1020) can smooth short-term fluctuations, and is more suitable for identifying slowly evolving abnormal patterns.

[0072] By calculating the vector difference between the current node embedding and the historical benchmark embedding, the structural residual vector of each node is obtained. The residual reflects the instantaneous change amplitude of the node behavior:

[0073] ;

[0074] wherein is the residual vector of node . In order to facilitate measurement and subsequent processing, the L2 norm of the residual vector is further calculated as the abnormality measurement value of the node:

[0075] ;

[0076] The larger the value of , the more significant the deviation of the behavior of node at the current moment compared with its recent historical pattern. The measurement value can effectively identify local abnormal behaviors such as communication frequency mutation, connection object abnormal change, and protocol usage pattern deviation, and provide a quantitative basis for accurately positioning the abnormal host.

[0077] To capture the global structural changes, the graph-level residual needs to be further calculated. First, average pooling operation is performed on the node embedding matrix of each time step to obtain the graph embedding vector of each time step:

[0078] ;

[0079] wherein is the total number of nodes, represents the global graph embedding at the current moment , which aggregates the information of all nodes and reflects the state characteristics of the overall network.

[0080] Subsequently, the average value of the graph embedding in the historical time window is calculated as the historical graph embedding base

[0081] ;

[0082] wherein represents the historical average global state. Then, the difference between the current graph embedding and the historical graph embedding is calculated to obtain the graph-level residual vector:

[0083] ;

[0084] The L2 norm of the graph-level residual vector is further calculated to obtain the graph anomaly measure value:

[0085] ;

[0086] The graph-level residual can reflect the structural changes of the overall network topology, such as the addition of a large number of nodes, the overall change of connection mode, the sudden change of global communication strength, and other macroscopic abnormal phenomena.

[0087] To simultaneously perceive local node mutations and global semantic variations, the invention fuses node-level residuals and graph-level residuals to construct a unified residual vector. The specific steps are as follows:

[0088] First, the average of the node anomaly measure values of all nodes is calculated to obtain the overall abnormal intensity at the node level:

[0089] ;

[0090] Then, the average value of the node anomaly measure value is weighted and summed with the graph anomaly measure value according to the balance weight hyperparameter to obtain the unified residual vector :

[0091] ;

[0092] in To balance the weight hyperparameters, this is used to adjust the contribution of global and local anomalies in the final decision. When When the size is large, the system pays more attention to changes in the overall network topology; when When the value is lower, the system is more sensitive to abnormal behavior of individual nodes. In practical applications, this parameter can be adjusted according to defense requirements and network characteristics. For example, it can be set to [specific value] for scenarios focusing on large-scale coordinated attacks. For scenarios where the focus is on single-point intrusion, settings can be configured. .

[0093] This unified residual vector As a key metric for structural anomaly detection, it serves as an input feature in subsequent time-series modeling and decision-making processes, participating in training and evaluation. Through this multi-level residual fusion mechanism, the system can effectively improve its sensitivity and response accuracy to weak structural disturbances, low-frequency attacks, and stealthy behaviors, while simultaneously meeting the dual requirements of local anomaly identification and global situational awareness.

[0094] S300: Inputs a unified residual vector sequence as a temporal feature into the Transformer network and outputs node-level anomaly scores and graph-level attack prediction probability distributions in parallel.

[0095] Furthermore, the parallel output step includes:

[0096] After adding positional encoding to the unified residual vector sequence, it is passed sequentially through a multi-head self-attention layer and a feedforward neural network layer to output the node representation sequence.

[0097] Each node representation is mapped through a linear layer and then activated by a Sigmoid activation function to obtain a node-level anomaly score.

[0098] The graph-level representation is obtained by average pooling the node representation sequence. The graph-level representation is then mapped through a linear layer and passed through the Softmax function to obtain the graph-level attack prediction probability distribution.

[0099] Specifically, to further capture the evolution trend of structural residual vectors in the time dimension, this invention constructs a Transformer-based temporal discrimination model. Through step S200, the system obtains a unified residual vector sequence over consecutive time steps. This sequence comprehensively reflects the changes in local node behavior and global topology deviations in the network structure.

[0100] Before inputting the residual sequence into the Transformer network, position encoding is first added to the residual vector at each time step. To preserve temporal positional information, positional encoding employs a combination of sine and cosine functions, enabling the model to distinguish inputs at different time steps. The positionally encoded sequences then utilize a multi-head attention mechanism to extract dependencies between sequences.

[0101] ;

[0102] Among them, the multi-head attention mechanism can capture the correlation between any two time steps in the sequence and learn various temporal dependency patterns such as short-term mutations and medium-term trends from different representation subspaces. The Transformer outputs a set of node representation sequences: Each of them Represents a node In time The structure is dynamically represented, integrating the node's historical behavior patterns, current state, and association information with other nodes.

[0103] Based on the node representation sequence output by the Transformer, the system performs both node-level and graph-level detection tasks in parallel. For node-level anomaly detection, for each node... The nodes are represented by a single-layer linear mapping. Convert to a scalar, then compress to the [0, 1] interval using the Sigmoid activation function, and calculate its anomaly probability:

[0104] ;

[0105] in and The weight and bias parameters of the linear layer are learned through training data. The Sigmoid activation function outputs the value. Represents a node The probability of an anomaly at the current moment. The closer the score is to 1, the more likely the node is to exhibit abnormal behavior; the closer it is to 0, the more normal the node's behavior.

[0106] This mechanism can accurately identify hosts, ports, or connections exhibiting abnormal behavior within the network, enabling host-level or connection-level threat localization. For example, when a host suddenly initiates connections to a large number of different targets or its communication protocol usage patterns change abnormally, its node-level anomaly score will significantly increase.

[0107] For graph-level attack prediction tasks, the system first performs average pooling on the node representation sequence, aggregating all node information into a single graph-level representation vector:

[0108] ;

[0109] in The graph-level representation, representing the overall network state within the current time window, captures the semantic features of the global topology. This graph-level representation is then mapped to the attack category space through a linear layer and normalized using the Softmax function to obtain the attack type prediction probability distribution.

[0110] ;

[0111] in , The weight and bias parameters for the graph classification module; output This represents the predicted probability distribution within the C-type attack label space. Specifically, ,in This indicates that the current network state belongs to the [number]th [level]. The probability of a certain type of attack is equal to the sum of all probabilities, which is 1.

[0112] The attack type determination is a multi-classification task, and the number of categories C can be defined according to actual defense needs. For example, it may include various types such as normal traffic, denial-of-service (DoS) attacks, port scanning, and brute-force attacks. The model's ability to achieve this relies on supervised learning using training data containing such finely labeled data. This module can quickly classify the overall traffic graph status within the current time window, assisting the mimicry system in attack type identification and response level determination.

[0113] By combining structural residuals and temporal dependencies in Transformer sequence modeling, node-level anomaly scoring and graph-level attack prediction are simultaneously performed on a unified structural embedding output, realizing a linked detection mechanism from fine-grained anomaly identification to global attack judgment. This mechanism not only improves the accuracy and coverage of anomaly detection but also enhances the system's adaptability to multi-source heterogeneous attacks, becoming a core intelligent decision-making module in mimicry defense.

[0114] S400: Combines node-level anomaly scoring with graph-level attack prediction probability distribution to calculate anomaly intensity index, and sets dual thresholds to classify traffic into normal traffic, uncertain anomaly traffic, and high-risk traffic;

[0115] Furthermore, the step of calculating the anomaly intensity index includes: calculating the average value of the node-level anomaly scores of all nodes, extracting the maximum probability value from the graph-level attack prediction probability distribution, and weighting and summing the average value of the node-level anomaly scores and the maximum probability value according to a set weight coefficient to obtain the anomaly intensity index.

[0116] Specifically, after the structural residual comparison mechanism and the Transformer module complete the initial anomaly identification, a mimicry judgment and conflict mitigation mechanism is further established to address the lack of linkage and buffer space between "detection results" and "defense execution" in traditional intrusion detection. During the detection phase, the system has obtained two key indicators: one is the node-level anomaly score. , indicating the first Each node at time... The abnormal probability; secondly, the graph-level attack prediction results. ,in This represents the predicted probability distribution of the attack label.

[0117] In actual defense scheduling, the system calculates the global anomaly intensity index based on a fusion strategy. The specific steps are as follows:

[0118] First, calculate the average node-level anomaly score for all nodes:

[0119] ;

[0120] in It reflects the average level of node anomalies in the overall network.

[0121] Secondly, predict the probability distribution of graph-level attacks. Extract the maximum probability value from:

[0122] ;

[0123] in This represents the confidence level of the strongest attack type at the graph level.

[0124] Finally, the average and maximum probability values ​​of the node-level anomaly scores are compared using the set balancing weight hyperparameters. Weighted summation yields the anomaly intensity index:

[0125] ;

[0126] in The weighting of the control node-level anomaly score and attack type confidence level is balanced. This anomaly strength index... By combining information from both local node anomalies and global attack patterns, a more comprehensive picture of the current network security status can be drawn.

[0127] Furthermore, the dual thresholds include a safety threshold and a danger threshold. When the abnormal intensity index is lower than the safety threshold, it is determined to be normal flow. When the abnormal intensity index is higher than the danger threshold, it is determined to be high-risk flow. When the abnormal intensity index is between the safety threshold and the danger threshold, it is determined to be uncertain abnormal flow.

[0128] Specifically, the system uses a dual-threshold strategy to classify traffic into three risk levels. Specifically, it sets security thresholds. and danger threshold ,in Used to determine the level of abnormality:

[0129] Normal traffic determination: If The system considers the current traffic to be of low risk and classifies it as normal traffic, directly entering the normal execution path without needing to activate the mimicry defense mechanism.

[0130] High-risk traffic determination: If The system identifies highly suspicious behavior, classifies it as high-risk traffic, and immediately triggers the mimicry defense mechanism.

[0131] Uncertainty-based abnormal traffic determination: If The system enters a buffer judgment phase, also known as "conservative mimicry execution mode," and classifies the traffic as uncertain and abnormal. Within the conflict zone, the system recognizes that although the discrimination module has not reached a strong attack consensus, there are still weak abnormal signals such as structural disturbances and node deviations.

[0132] For uncertain and abnormal traffic, the system adopts a buffering strategy: redirecting requests to a mimic execution pool, where virtual nodes (configured in a heterogeneous environment) provide non-core responses, while recording the response path and feature vectors for subsequent verification and relearning.

[0133] This buffering mechanism effectively avoids two common risks of false alarms: localized node anomalies without graph-level anomaly prediction, such as short-term communication pattern deviations in individual hosts that haven't yet formed an attack pattern; and high graph-level attack prediction probability with scattered node anomaly scores, such as spoofed scans or low-frequency poisoning behavior. Through a dual-threshold mechanism, the system effectively reduces the false alarm rate while maintaining detection sensitivity, improving the robustness and controllability of defense decisions. In practical applications, the threshold... and It can be dynamically adjusted according to historical traffic statistics and security policy requirements. The initial threshold can be determined by the statistical distribution of historical normal traffic abnormal intensity indicators to adapt to the defense needs of different network environments.

[0134] S500: For uncertain abnormal traffic, it identifies abnormal nodes based on node-level anomaly scores and redirects the traffic to standard mimicry executors. For high-risk traffic, it redirects it to heterogeneous inducement executors and adjusts the response strategy according to the attack type.

[0135] The system passes the abnormal intensity index After determining that the traffic poses a potential threat, the mimicry response process begins. To improve the system's responsiveness, controllability, and countermeasure effectiveness, this invention not only relies on anomaly intensity indicators... Risk classification is performed, and node-level anomaly scoring is further integrated. Achieve precise traffic redirection, combined with graph-level attack prediction results. Fine-tuning the response strategy enables intelligent adaptive defense.

[0136] Furthermore, the step of identifying abnormal nodes includes: setting a node abnormality threshold based on the statistical distribution of historical node-level abnormality scores; comparing the node-level abnormality score of each node with the node abnormality threshold; marking nodes with abnormality scores higher than the node abnormality threshold as abnormal nodes; guiding the traffic corresponding to the abnormal nodes to the standard mimicry executor; and allowing the traffic corresponding to non-abnormal nodes to pass through to the real system.

[0137] When the discrimination index is satisfied When this occurs, the system determines it to be an uncertain abnormal traffic flow and enters the standard mimicry strategy process.

[0138] The system uses node-level anomaly scoring vectors Implement refined traffic scheduling. The specific steps are as follows:

[0139] First, set the node anomaly threshold based on the statistical distribution of historical node-level anomaly scores. This threshold can be dynamically determined by analyzing the mean and standard deviation of abnormal scores for all nodes within a historical time window, for example, by setting it to the historical mean plus 1.5 times the standard deviation.

[0140] Secondly, the node-level anomaly score for each node is compared with the node anomaly threshold. For any node... ,like If so, then mark the node as an abnormal node; if If it is, then it is marked as a non-abnormal node.

[0141] Finally, traffic corresponding to abnormal nodes is redirected to the standard mimic execution entity for processing, while traffic corresponding to non-abnormal nodes is allowed to pass directly to the real system. This selective traffic redirection mechanism ensures both defense and response to suspicious traffic and avoids excessive interference with normal business operations, thereby improving the overall efficiency of the system.

[0142] Furthermore, the standard mimicry actuator is superimposed with a random delay perturbation that follows a normal distribution on the baseline response time.

[0143] Standard mimicry executions are deployed in logically isolated environments and typically use lightweight virtualized containers to host services. They can simulate normal business processes but do not involve real data or core resources.

[0144] To further disrupt the attacker's detection of the system's response patterns, this invention employs a perturbation mechanism. Specifically, the standard mimicry actuator is superimposed with a normally distributed random delay perturbation on the baseline response time:

[0145] ;

[0146] in As the baseline response time, The final response time of the system. Let be the disturbance quantity, which follows the mean . variance is The system follows a normal distribution. By introducing random delays, the system can effectively obscure an attacker's speculation about the system's logic and timing response patterns, making it impossible for the attacker to accurately predict the system's response time, thereby interfering with their judgment of the system's structure and behavioral logic.

[0147] Furthermore, the heterogeneous induction executor adopts an operating system version, kernel configuration, or instruction set architecture that is different from the production system.

[0148] Specifically, when When the system determines that the traffic is high-risk, it enters the enhanced mimicry response mechanism to guide all traffic to the heterogeneous induction executor.

[0149] Heterogeneous deception executors operate in deeply heterogeneous environments, employing different operating system versions, kernel configurations, or instruction set architectures than the production system. For example, if the production system runs a Linux 5.x kernel, the heterogeneous executor can be configured as a FreeBSD system or use a different version of the Linux kernel; if the production system is based on an x86 architecture, the heterogeneous executor can be deployed in an ARM architecture environment. This deep heterogeneity makes it difficult for attackers to determine whether their attack has hit the real target. Even if attackers obtain some information about the executor through fingerprinting or behavioral probing, this information differs significantly from the real production system, thus achieving the system's deception protection objective and greatly increasing the difficulty and cost for attackers to carry out precise attacks.

[0150] Furthermore, the step of adjusting the response strategy includes: determining the attack type with the highest probability from the graph-level attack prediction probability distribution, and adjusting the response parameters of the standard mimicry actuator or the heterogeneous induced actuator according to the attack type.

[0151] The system further predicts graph-level attacks based on the results. Fine-tune the response strategy to achieve precise countermeasures based on attack characteristics. The specific steps are as follows:

[0152] First, predict the probability distribution of graph-level attacks. The attack type with the highest probability of being identified:

[0153] ;

[0154] in This indicates the most likely type of attack.

[0155] Subsequently, the response parameters of the standard mimicry actuator or the heterogeneous induced actuator are adjusted according to the attack type. Specific type-based fine-tuning strategies include:

[0156] like To counter probe-type attacks, the system injects deceptive information in a targeted manner. For example, it returns TCP RST packets for closed ports and forged banner information for open ports to mislead attackers into drawing incorrect network maps. By providing false service version information or system fingerprints, the system causes attackers to develop subsequent attack strategies based on erroneous information, thus rendering them ineffective.

[0157] like To address brute-force attacks, the system employs an incremental delay response mechanism. As the number of authentication failures from the same source IP increases, the response delay increases significantly, drastically reducing the attacker's efficiency. For example, the first failure results in a 1-second delay, the second in a 2-second delay, the third in a 4-second delay, and so on, making brute-force attacks impractical in terms of time cost.

[0158] like In response to a DoS flood attack, the system automatically tightens its rate limiting policy and prioritizes resource allocation to drop connections from suspected attack sources, while simultaneously protecting the resources of the mimicking execution entity itself from being exhausted. Specific measures include: setting a rate cap on connection requests from a single source IP, dropping requests exceeding the limit; and temporarily blocking abnormally high-frequency connection requests.

[0159] By combining a general perturbation mechanism with a typed fine-tuning strategy, this mechanism can effectively obscure attackers' speculations about the system's logic and timing response patterns, improve the system's adaptability and robustness in uncertain and complex attack scenarios, effectively reduce the risk of misjudgment, and slow down the attacker's breakthrough speed.

[0160] Example 2: In November 2024, a university campus network suffered multiple DDoS attacks, affecting the normal use of its online teaching platform. Attackers used infected IoT devices (smart lights, cameras, etc.) on campus to form a botnet and launch a distributed attack on the academic affairs server. Traditional traffic scrubbing equipment can only perform global rate limiting after the attack traffic reaches a threshold, and cannot accurately identify the controlled botnet devices, thus affecting normal access for teachers and students as well. In March 2025, the university's network center adopted a solution such as... Figure 3The invention shown is a mimicry traffic defense system based on dynamic graph residual comparison, deployed at the access layer of core services such as the academic affairs system, specifically including:

[0161] The dynamic graph construction module is used to collect network traffic logs and construct a dynamic graph sequence according to time steps. In the graph, the nodes are host IPs, the edges represent communication connections between hosts, and the edge weights are obtained by transforming the connection features through a mapping function.

[0162] The residual comparison module is used to encode the dynamic graph sequence through the temporal graph attention network to obtain the node embedding matrix, calculate the difference between the current node embedding and the historical baseline embedding to obtain the node-level residual, calculate the difference between the current graph embedding and the historical graph embedding to obtain the graph-level residual, and weightedly fuse the node-level residual and the graph-level residual to construct a unified residual vector.

[0163] The temporal discrimination module is used to input the unified residual vector sequence as temporal feature into the Transformer network and output node-level anomaly scores and graph-level attack prediction probability distributions in parallel.

[0164] The risk classification module is used to integrate node-level anomaly scoring with graph-level attack prediction probability distribution to calculate anomaly intensity index, and set dual thresholds to classify traffic into normal traffic, uncertain anomaly traffic, and high-risk traffic.

[0165] The mimicry response module is used to identify abnormal nodes based on node-level anomaly scores for uncertain and abnormal traffic and guide the traffic to standard mimicry executors. For high-risk traffic, it guides it to heterogeneous inducement executors and adjusts the response strategy according to the attack type.

[0166] On a morning in April 2025 at 10:00 AM, during peak course selection time, the system detected 23 IP addresses within the campus network simultaneously accessing the academic affairs server at a high frequency. The residual comparison module identified a sharp increase in node-level residuals and a deviation of graph-level residuals from the normal fluctuation range; the time-series discrimination module output an attack probability of 0.91, and the risk grading module calculated the anomaly intensity to exceed the danger threshold. The system immediately redirected the relevant traffic to the heterogeneous induction execution entity through the mimicry response module, and superimposed random latency and rate limiting at the response level, reducing the attack intensity by 95%, while maintaining stable access for normal faculty and students. The system did not generate false alarms, and this invention completed identification and response within 3 minutes of the attack initiation.

[0167] In May 2025, a student computer in a laboratory was infected with a worm virus that used low-frequency scanning (5 targets every 10 minutes) to evade traditional detection. The residual comparison module, through dynamic graph sequences, discovered that this node accessed port 445 of 180 different IPs within 6 consecutive time windows. Although the traffic at individual moments was normal, the node-level residuals remained consistently high. The timing discrimination module outputs a scan attack probability of 0.73. The risk grading module classifies it as an uncertain anomaly (…). The system redirects traffic from this host to a standard mimicry executable, returning a forged service banner. The attacker's subsequent exploit code based on the error message fails, and the system-generated anomaly path graph helps administrators quickly locate and isolate the infected host.

[0168] In June 2025, the system detected an external IP address continuously attempting brute-force attacks on the campus SSH service. Each attempt was spaced 30 seconds apart to circumvent rate limits. The system's graph analysis revealed an abnormal connection pattern between this IP address and 12 servers on campus. Although the connection frequency was low, the authentication failure rate was 100%. Node-level anomaly scoring was performed. The timing discrimination module predicts and identifies the attack as a brute-force attack (probability 0.79). The mimicry response module dynamically adjusts response parameters based on the attack type and activates an incremental delay mechanism, reducing attack efficiency by over 90%. Throughout the process, the risk grading module and the mimicry response module work together to ensure that defensive actions always match the threat level.

[0169] Three months after deployment, a total of 67 attack attempts were detected, with a botnet attack interception rate of 91.7%. The average detection response time was reduced from 25 minutes with traditional equipment to 4 minutes, the false alarm rate dropped to 6.5%, and the normal traffic passage rate reached 98.3%. Through a unified residual comparison-driven dynamic discrimination and mimicry response closed loop, the system significantly improved the overall defense efficiency and stability of the campus network.

[0170] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A mimicry-based traffic defense method based on dynamic graph residual comparison, characterized in that, include: S100: Collect network traffic logs and construct a dynamic graph sequence according to time steps. In the graph, nodes are host IPs, edges represent communication connections between hosts, and edge weights are obtained by transforming the connection features through a mapping function. S200: The node embedding matrix is ​​obtained by encoding the dynamic graph sequence through the temporal graph attention network. The difference between the current node embedding and the historical baseline embedding is calculated to obtain the node-level residual. The difference between the current graph embedding and the historical graph embedding is calculated to obtain the graph-level residual. The node-level residual and the graph-level residual are weighted and fused to construct a unified residual vector. S300: Inputs a unified residual vector sequence as a temporal feature into the Transformer network and outputs node-level anomaly scores and graph-level attack prediction probability distributions in parallel. S400: Combines node-level anomaly scoring with graph-level attack prediction probability distribution to calculate anomaly intensity index, and sets dual thresholds to classify traffic into normal traffic, uncertain anomaly traffic, and high-risk traffic; S500: For uncertain abnormal traffic, it identifies abnormal nodes based on node-level abnormality scores and guides the traffic to standard mimicry executors. For high-risk traffic, it guides it to heterogeneous inducement executors and adjusts the response strategy according to the attack type. The steps for constructing the unified residual vector include: Set the historical time window length, obtain the node embedding matrix of several time steps before the current time step and calculate the average to obtain the historical baseline embedding, calculate the difference vector between the current node embedding and the historical baseline embedding and calculate the L2 norm to obtain the node anomaly metric. Average pooling is performed on the node embedding matrix at each time step to obtain the graph embedding at each time step. The graph embedding within the historical time window is averaged to obtain the historical graph embedding. The difference vector between the current graph embedding and the historical graph embedding is calculated and the L2 norm is obtained to obtain the graph anomaly metric. The average of the node anomaly metrics for all nodes is calculated, and the average of the node anomaly metrics is weighted and summed with the graph anomaly metrics according to the set weight coefficients to obtain a unified residual vector.

2. The mimicry traffic defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The parallel output steps include: After adding positional encoding to the unified residual vector sequence, it is passed sequentially through a multi-head self-attention layer and a feedforward neural network layer to output the node representation sequence. Each node representation is mapped through a linear layer and then activated by a Sigmoid activation function to obtain a node-level anomaly score. The graph-level representation is obtained by average pooling the node representation sequence. The graph-level representation is then mapped through a linear layer and passed through the Softmax function to obtain the graph-level attack prediction probability distribution.

3. The mimicry-flow defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The steps for calculating the anomaly intensity index include: calculating the average node-level anomaly score of all nodes, extracting the maximum probability value from the graph-level attack prediction probability distribution, and weighting the average node-level anomaly score and the maximum probability value by a set weighting coefficient to obtain the anomaly intensity index.

4. The mimicry traffic defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The dual thresholds include a safety threshold and a danger threshold. When the abnormal intensity index is lower than the safety threshold, it is determined to be normal flow. When the abnormal intensity index is higher than the danger threshold, it is determined to be high-risk flow. When the abnormal intensity index is between the safety threshold and the danger threshold, it is determined to be uncertain abnormal flow.

5. The mimicry-flow defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The steps for identifying abnormal nodes include: setting a node abnormality threshold based on the statistical distribution of historical node-level abnormality scores; comparing the node-level abnormality scores of each node with the node abnormality threshold; marking nodes with abnormality scores higher than the node abnormality threshold as abnormal nodes; directing the traffic corresponding to the abnormal nodes to the standard mimicry executor; and allowing the traffic corresponding to non-abnormal nodes to pass through to the real system.

6. The mimicry traffic defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The standard mimic actuator is superimposed with a random delay perturbation that follows a normal distribution on the baseline response time.

7. The mimicry-flow defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The heterogeneous induction executor uses an operating system version, kernel configuration, or instruction set architecture that is different from the production system.

8. The mimicry traffic defense method based on dynamic graph residual comparison according to claim 1, characterized in that, The steps for adjusting the response strategy include: determining the attack type with the highest probability from the graph-level attack prediction probability distribution, and adjusting the response parameters of the standard mimicry actuator or the heterogeneous induced actuator according to the attack type.

9. A mimicry-based traffic defense system based on dynamic graph residual comparison, characterized in that, include: The dynamic graph construction module is used to collect network traffic logs and construct a dynamic graph sequence according to time steps. In the graph, the nodes are host IPs, the edges represent communication connections between hosts, and the edge weights are obtained by transforming the connection features through a mapping function. The residual comparison module is used to encode the dynamic graph sequence through the temporal graph attention network to obtain the node embedding matrix, calculate the difference between the current node embedding and the historical baseline embedding to obtain the node-level residual, calculate the difference between the current graph embedding and the historical graph embedding to obtain the graph-level residual, and weightedly fuse the node-level residual and the graph-level residual to construct a unified residual vector. The temporal discrimination module is used to input the unified residual vector sequence as temporal feature into the Transformer network and output node-level anomaly scores and graph-level attack prediction probability distributions in parallel. The risk classification module is used to integrate node-level anomaly scoring with graph-level attack prediction probability distribution to calculate anomaly intensity index, and set dual thresholds to classify traffic into normal traffic, uncertain anomaly traffic, and high-risk traffic. The mimicry response module is used to identify abnormal nodes based on node-level anomaly scores for uncertain and abnormal traffic and guide the traffic to standard mimicry executors. For high-risk traffic, it guides it to heterogeneous inducement executors and adjusts the response strategy according to the attack type. The construction of the unified residual vector includes: Set the historical time window length, obtain the node embedding matrix of several time steps before the current time step and calculate the average to obtain the historical baseline embedding, calculate the difference vector between the current node embedding and the historical baseline embedding and calculate the L2 norm to obtain the node anomaly metric. Average pooling is performed on the node embedding matrix at each time step to obtain the graph embedding at each time step. The graph embedding within the historical time window is averaged to obtain the historical graph embedding. The difference vector between the current graph embedding and the historical graph embedding is calculated and the L2 norm is obtained to obtain the graph anomaly metric. The average of the node anomaly metrics for all nodes is calculated, and the average of the node anomaly metrics is weighted and summed with the graph anomaly metrics according to the set weight coefficients to obtain a unified residual vector.

Images