Network attack detection method, apparatus, computer device, and program product

Abstract

The application is suitable for the network security technical field, and provides a network attack detection method, device, computer equipment and program product, the method comprises the following steps: obtaining network flow data to be detected; inputting the network flow data into a preset gating network to generate a routing weight value for selecting from multiple expert models; processing the network flow data by using one or more of the multiple expert models to generate an expert model processing result; wherein the multiple expert models are arranged in parallel and at least include: a first expert model configured to analyze time sequence characteristics of the network flow data; a second expert model configured to analyze space-time correlation characteristics of the network flow data; and fusing the expert model processing result based on the routing weight value to generate a network attack detection result. Thus, diversified network attacks can be efficiently and accurately identified.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and in particular relates to a network attack detection method, device, computer equipment and program product. Background Technology

[0002] With the rapid development of network information technology, network attack methods are becoming increasingly diversified and intelligent. For example, new types of attacks such as distributed denial-of-service attacks and advanced persistent threats pose a serious threat to network security. Existing network attack detection methods are usually intrusion detection methods based on fixed rules or single machine learning models. When dealing with complex and ever-changing attacks, they are prone to problems such as missed detections, high false positive rates, and weak generalization ability, making it difficult to meet the needs of dynamic defense. Summary of the Invention

[0003] This application provides a network attack detection method, apparatus, computer equipment, and program product, which can solve the technical problems of existing network attack detection methods, such as high false alarm rate, weak generalization ability, and difficulty in meeting the needs of dynamic defense when dealing with complex and ever-changing attacks.

[0004] In a first aspect, embodiments of this application provide a network attack detection method, including:

[0005] Acquire network traffic data to be detected;

[0006] The network traffic data is input into a preset gated network to generate routing weight values ​​for selection from multiple expert models;

[0007] The network traffic data is processed using one or more of the plurality of expert models to generate expert model processing results; wherein the plurality of expert models are set in parallel and include at least:

[0008] A first expert model is configured to analyze the time-series characteristics of the network traffic data.

[0009] A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data.

[0010] Based on the routing weight values, the processing results of the expert model are fused to generate network attack detection results.

[0011] In one possible implementation of the first aspect, the gating network is an attention-based gating network;

[0012] The step of inputting the network traffic data into a preset gated network to generate routing weight values ​​for selection from multiple expert models includes:

[0013] Feature extraction is performed on the network traffic data input to the gating network to obtain multidimensional semantic features;

[0014] The importance weights of the multidimensional semantic features to the multiple expert models are calculated based on the attention mechanism.

[0015] The routing weight value of each expert model is obtained based on the importance weights of the multiple expert models.

[0016] In one possible implementation of the first aspect, the expert model processing result includes a temporal feature detection result; the first expert model includes a TCN module, a BiGRU module, and a Transformer module connected in sequence.

[0017] The step of processing the network traffic data using one or more of the multiple expert models to generate expert model processing results includes:

[0018] The network traffic data is input into the TCN module to capture multi-scale local temporal patterns in the network traffic data and output the first temporal feature;

[0019] The first time series feature is input into the BiGRU module to capture the bidirectional time dependency in the first time series feature and output the second time series feature;

[0020] The second time series feature is input into the Transformer module to capture the global long-term dependencies in the second time series feature and output the third time series feature;

[0021] The third temporal feature is pooled and fully connected to obtain the temporal feature detection result.

[0022] In one possible implementation of the first aspect, the expert model processing result includes spatiotemporal feature detection results; the second expert model includes an Informer module and a GNN module;

[0023] The step of processing the network traffic data using one or more of the multiple expert models to generate expert model processing results includes:

[0024] An interaction graph is constructed based on the communication relationships of the network traffic data; wherein, the nodes of the interaction graph are network entities;

[0025] The network traffic data is input into the Informer module to obtain the long-term time-series characteristics of each node;

[0026] The long-period temporal features are used as the temporal attribute features of the nodes in the interaction graph, and are input into the GNN module along with the adjacency matrix of the interaction graph.

[0027] The GNN module performs multi-layer graph convolution operations on the interaction graph carrying temporal attribute features, iteratively aggregating the temporal attribute features of each node with the association features of neighboring nodes, and mining the spatiotemporal topological associations and cooperative behavior features between nodes.

[0028] Pooling and full connection are performed on all node features output by the GNN module to obtain the spatiotemporal feature detection results.

[0029] In one possible implementation of the first aspect, the step of fusing the expert model processing results based on the routing weight values ​​to generate network attack detection results includes:

[0030] The temporal feature detection results and the spatiotemporal feature detection results are multiplied element-wise with their corresponding routing weight values ​​through a broadcast mechanism to obtain the temporal feature detection weighted result and the spatiotemporal feature detection weighted result;

[0031] The weighted results of temporal feature detection and the weighted results of spatiotemporal feature detection are concatenated along the feature dimension to generate an intermediate fusion tensor.

[0032] The fully connected layer is invoked to perform feature mapping and dimensionality compression on the intermediate fusion tensor to generate fusion features;

[0033] The network attack detection result is obtained based on the fusion features.

[0034] In one possible implementation of the first aspect, the method further includes a model training step, the model training step comprising:

[0035] Based on the network attack detection results and the true labels of the samples, calculate the classification loss;

[0036] Based on the distribution of routing weight values ​​generated by the gating network in the training batch, the load balancing loss is calculated.

[0037] The total loss is obtained by weighted summing the classification loss and the load balancing loss.

[0038] Based on the total loss, the network parameters of the gated network and all expert models are updated using the backpropagation algorithm.

[0039] In one possible implementation of the first aspect, calculating the load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch includes:

[0040] For all samples in a training batch, compute the expert model. activation frequency for:

[0041] ;in, This represents the number of samples in this training batch. It is an exponential function. For the first The index of expert models whose samples are selected by the gating network;

[0042] Calculate load balancing loss using the following formula. :

[0043] ;in, For hyperparameters, For expert models The routing weight value.

[0044] Secondly, embodiments of this application provide a network attack detection device, comprising:

[0045] The acquisition module is used to acquire network traffic data to be detected;

[0046] The routing weight value generation module is used to input the network traffic data into a preset gated network to generate routing weight values ​​for selection from multiple expert models.

[0047] An expert model processing result generation module is used to process the network traffic data using one or more of the plurality of expert models to generate expert model processing results; wherein the plurality of expert models are set in parallel and include at least:

[0048] A first expert model is configured to analyze the time-series characteristics of the network traffic data.

[0049] A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data.

[0050] The network attack detection result generation module is used to fuse the expert model processing results based on the routing weight value to generate network attack detection results.

[0051] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the network attack detection method described in any one of the first aspects above.

[0052] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the network attack detection method described in any one of the first aspects.

[0053] Fifthly, embodiments of this application provide a computer program product that, when run on a computer device, causes the computer device to execute the network attack detection method described in any one of the first aspects.

[0054] The beneficial effects of the embodiments in this application compared with the prior art are:

[0055] By introducing gating networks for dynamic routing decisions, analysis tasks can be adaptively scheduled to the most suitable expert model based on the inherent characteristics of the input network traffic data. By setting up complementary first expert models (time series analysis) and second expert models (spatiotemporal correlation analysis) in parallel, it is possible to simultaneously perform in-depth modeling of attacks with significant temporal patterns and attacks with complex spatial coordination characteristics. This solves the performance limitations of single models or statically fused models when facing diverse attacks, significantly improving the model's generalization ability and detection range.

[0056] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a schematic flowchart illustrating a network attack detection method provided in an embodiment of this application;

[0059] Figure 2 This is a schematic diagram of the structure of a first expert model provided in an embodiment of this application;

[0060] Figure 3 This is a schematic diagram of the structure of a second expert model provided in an embodiment of this application;

[0061] Figure 4 This is a diagram of the overall architecture for network security attack detection provided in an embodiment of this application;

[0062] Figure 5 This is a schematic diagram of a cross-expert collaborative reasoning mechanism provided in an embodiment of this application;

[0063] Figure 6 This is a schematic diagram of the network attack detection device provided in the embodiments of this application;

[0064] Figure 7 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0065] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0066] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0067] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0068] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0069] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0070] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0071] Figure 1 A schematic flowchart of a network attack detection method provided in this application is shown.

[0072] S101, Obtain network traffic data to be detected.

[0073] This involves capturing or receiving network traffic data to be detected from the network environment. The network traffic data can be either raw network packets or pre-processed network flow records. Network traffic data includes, but is not limited to, source IP address, destination IP address, source port, destination port, protocol type (TCP / UDP / ICMP), packet length, timestamp, flags (SYN, ACK, FIN, etc.), traffic duration, number of session packets, number of bytes, and TTL value. The data collection and acquisition process covers different types of services (such as HTTP, FTP, SSH, etc.) and network conditions (normal communication, abnormal access attempts, denial-of-service attacks, etc.) to ensure the timeliness, spatial integrity, and temporal span of the data. Simultaneously, the data undergoes standardization processing (such as converting IP addresses to numerical identifiers and encoding protocol types) and labeling to distinguish between normal and malicious traffic.

[0074] Optionally, after obtaining the network traffic data to be detected, it is also necessary to preprocess the network traffic data to generate network traffic data (also known as network traffic feature vectors) suitable for subsequent hybrid expert models. ).

[0075] Specifically, the preprocessing operations may include: data cleaning to remove duplicate or malformed records; missing value imputation, for example, using the mean, median, or time series interpolation to fill missing feature values; feature engineering to extract or construct more representative features from the raw data, such as statistical features of packet size, connection duration, etc.; and data normalization, for example, using min-max normalization to scale all numerical features to the [0, 1] interval to eliminate the influence of different feature units and accelerate model convergence.

[0076] Optionally, data construction may also be required. The data construction steps are as follows:

[0077] Time series sample construction: The sliding window method is used to select traffic characteristics within a fixed time window (e.g., 30 seconds) to form a sequence matrix of consistent length;

[0078] Multidimensional feature set construction: Extract high-order statistical features, including IP distribution entropy, packet length variance, connection frequency change rate, skewness, kurtosis, etc., and combine them with time features, spatial features, and protocol features to form a multidimensional feature vector;

[0079] Data augmentation: Introduce small time delays or random noise into time series samples, adjust the starting point of the time window, change the order of data packets to generate new samples; for long-cycle dependent attack patterns, combine the graph structure information of several time slices before and after to form a complete spatiotemporal context;

[0080] Graph structure data construction: An interaction graph is generated based on communication logs, and node feature matrices and adjacency matrices are extracted for input to the second expert model.

[0081] S102, the network traffic data is input into a preset gating network to generate routing weight values ​​for selection from multiple expert models.

[0082] In this process, the preprocessed network traffic data can be input in parallel into a pre-defined gating network and multiple expert models.

[0083] In one embodiment of this application, the gating network employs an attention-based network, such as a multi-head self-attention network, to analyze the intrinsic characteristics of the input data and dynamically generate a set of routing weight values.

[0084] Specifically, let the network traffic feature vector input to the gating network be... , ,in, To represent the dimension of this feature vector, it is linearly transformed using a learnable projection matrix to generate the query vector, key vector, and value vector required by the attention mechanism:

[0085] ;

[0086] ;

[0087] ;

[0088] in, (Query the projection matrix to...) Linear transformation to query vector Q) (Key projection matrix, used to project...) Linear transformation to key vector K) (Value projection matrix, used to...) The linear transformation is a value vector V. Output dimension 2 corresponds to the two expert models in this application (first expert module and second expert module).

[0089] To improve computational efficiency and focus on key features, a ProbSparse self-attention mechanism is introduced to calculate sparsity metrics. Only the top u key vectors with the highest relevance to the query vector are retained (e.g., u=3), where u is a hyperparameter used to control sparsity.

[0090] ;

[0091] in, The square root of the key vector dimension (used to scale the dot product result and avoid gradient vanishing). The probability distribution of the key vectors (obtained by normalizing K using the Softmax function); This means selecting the key vector indices corresponding to the first u maximum values ​​to obtain a subset of key vectors. (The set of key vectors used for subsequent calculations after filtering).

[0092] Then, h attention heads are computed in parallel (h=2 in this embodiment, where h is the number of attention heads used for multi-scale feature extraction), each attention head based on the filtered key vector. Calculate the attention weights and weight them over the value vector V:

[0093] For the m-th attention head, ( , representing the m-th attention head), have:

[0094] ;

[0095] in, , , The sub-projection matrix for the m-th attention head (used to project Q, (V is split into different attention heads). Defined as the attention calculation function, specifically:

[0096] ;

[0097] After concatenating the outputs of all attention heads, the output transformation matrix is ​​used. (Used to integrate multi-head attention output) Integration yields multi-head attention output:

[0098] ;in, This indicates a vector concatenation operation (concatenating the outputs of multiple attention heads into a single vector).

[0099] Then, the multi-head attention output is superimposed with the results of a regular fully connected layer to obtain the unnormalized expert selection logits vector. (z represents the unnormalized weight scores of the two expert models):

[0100] ;in, The weight matrix of the fully connected layer (used for weighting) Perform linear transformations. This is the bias vector (used for bias adjustment in fully connected layers).

[0101] Next, the logits vector z is transformed into a probability distribution using the Softmax function, which is the final routing weight value assigned to the two expert models. p is the normalized route weight vector:

[0102] ;

[0103] in, The weights assigned to the first expert module, The weights assigned to the second expert module satisfy the following conditions: and The sum of is 1, and and All values ​​are greater than or equal to 0. Understandably, if the input data exhibits strong periodicity or suddenness, the gating network, after training, should be able to learn to assign it a higher gating value. A higher value should be assigned if the data exhibits complex collaborative behavior among multiple nodes. value. This is the normalization function (which converts z into a probability distribution).

[0104] The above formula uses two expert models as an example. If there are N expert models, then:

[0105] In the formula, It is the routing weight value assigned to the k-th expert model, and satisfies... The sum of these is 1.

[0106] S103, use one or more of the multiple expert models to process the network traffic data and generate expert model processing results.

[0107] The multiple expert models are configured in parallel and include at least the following:

[0108] A first expert model is configured to analyze the time-series characteristics of the network traffic data.

[0109] A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data.

[0110] Optionally, the expert model processing result includes a temporal feature detection result; the first expert model includes a TCN module, a BiGRU module, and a Transformer module connected in sequence; the step of processing the network traffic data using one or more of the plurality of expert models to generate the expert model processing result includes: inputting the network traffic data into the TCN module to capture multi-scale local temporal patterns in the network traffic data and outputting a first temporal feature; inputting the first temporal feature into the BiGRU module to capture bidirectional time dependencies in the first temporal feature and outputting a second temporal feature; inputting the second temporal feature into the Transformer module to capture global long-term dependencies in the second temporal feature and outputting a third temporal feature; and performing pooling and full connection on the third temporal feature to obtain the temporal feature detection result.

[0111] The first expert model focuses on analyzing the time-series characteristics of network traffic data. This model aims to capture the dynamic evolution of network behavior from a time dimension, such as the burstiness, periodicity, and trends of traffic. This is crucial for identifying attacks with significant time dependencies (including but not limited to distributed denial-of-service attacks and port scanning).

[0112] refer to Figure 2 The document illustrates the detailed structure of the first expert model. In one embodiment of this application, the model employs a composite structure combining a temporal convolutional network, a bidirectional gated recurrent unit, and a transformer, namely the TCN-BiGRU-Transformer. The network traffic feature vector input to this model... First, the TCN module processes the data. This TCN module, by stacking multiple layers of causal convolutions and dilated convolutions, can effectively expand the receptive field without acquiring future information, thereby capturing local temporal patterns of network traffic at different time scales. Its dilated convolution operation can be defined as:

[0113] ;in, It is the value of the input sequence at time t. This is the convolution output, where B is the kernel size. It is the coefficient of thermal expansion. These are convolutional weights. It should be noted that the TCN module also integrates residual connections to prevent the vanishing gradient problem when the network has deep layers. The output of its residual block can be expressed as:

[0114] In the formula, It is the input of the residual block. , This is a learnable weight matrix.

[0115] The output of the TCN module is the first temporal feature capturing the local temporal pattern. This first temporal feature is then input into the BiGRU module. The BiGRU module consists of a forward-gated recurrent unit and a backward-gated recurrent unit, capable of processing sequence data from both forward and backward dimensions, thereby capturing long-range bidirectional temporal dependencies in the sequence. Its hidden state is calculated as follows:

[0116]

[0117]

[0118]

[0119] in, It is the input of time t. , These are the forward and backward hidden states, respectively. This is the concatenated bidirectional hidden state. The output of the BiGRU module is the second temporal feature capturing the bidirectional dependency. This second temporal feature is then fed into the Transformer module. This Transformer module utilizes its core self-attention mechanism to calculate the correlation strength between any two time steps in the sequence, thereby capturing global long-term dependencies and compensating for the gradient problem that may exist in recurrent neural networks when processing extremely long sequences. Its self-attention calculation formula is:

[0120] The query matrix Q, key matrix K, and value matrix V are all obtained from the input sequence through linear transformation. Using a multi-head attention mechanism, the model can learn relevant information from different representation subspaces. Finally, the first expert model performs pooling and fully connected operations on the third temporal features output by the Transformer module to generate temporal feature detection results. The mapping function of the entire first expert model can be expressed as:

[0121] .

[0122] Optionally, the TCN module contains multiple stacked temporal convolutional blocks, each employing causal convolution and dilated convolution with a kernel size of 3 and dilation coefficients increasing progressively (1, 2, 4, ...), combined with residual connections, batch normalization, and the ReLU activation function; the BiGRU module consists of forward GRU units and backward GRU units, with a hidden layer dimension that can be set to 128, outputting bidirectional hidden states and concatenating them; the Transformer module contains 8 attention heads, with a feedforward neural network hidden layer dimension of 512, introducing residual connections and layer normalization after each layer, and finally aggregating temporal features through a global average pooling layer.

[0123] Optionally, the expert model processing result includes spatiotemporal feature detection results; the second expert model includes an Informer module and a GNN module; the step of processing the network traffic data using one or more of the plurality of expert models to generate expert model processing results includes:

[0124] An interaction graph is constructed based on the communication relationships of the network traffic data; wherein the nodes of the interaction graph are network entities; the network traffic data is input to the Informer module to obtain the long-term temporal features of each node; the long-term temporal features are used as the temporal attribute features of the nodes in the interaction graph, and are input to the GNN module along with the adjacency matrix of the interaction graph; the GNN module performs multi-layer graph convolution operation on the interaction graph carrying the temporal attribute features, iteratively aggregating the temporal attribute features of each node and the association features of neighboring nodes, and mining the spatiotemporal topological associations and cooperative behavior features between nodes; pooling and fully connected operations are performed on all node features output by the GNN module to obtain the spatiotemporal feature detection results.

[0125] The second expert model is configured to analyze the spatiotemporal correlation characteristics of network traffic data. For example, when hosts in a botnet launch a coordinated attack, their communication behavior forms a specific structure in the network topology (such as a star or mesh topology), and lateral movement in advanced persistent threats also leaves traces in the host interaction graph; these all fall under the category of spatiotemporal correlation characteristics. (Reference) Figure 3 This illustrates the detailed structure of the second expert model. In this embodiment, the model employs a composite structure combining the Informer model and a graph neural network, namely Informer-GNN. Specifically, the network traffic feature vector... The data is input into the Informer module. The Informer module is a model designed for efficient long-sequence prediction, focusing on key anomaly time points and uncovering cross-node propagation paths. Furthermore, the Informer module employs distillation, progressively reducing sequence length between layers to extract dominant long-term temporal features. The output of the Informer module is the long-term temporal feature for each node. These long-term temporal features are then used as the initial temporal attribute features of the corresponding nodes in the interaction graph, and input into the GNN module along with the adjacency matrix of the interaction graph. It is understood that in this embodiment, the GNN module can be a graph convolutional network. This GNN module performs message passing and feature aggregation on the graph structure by executing multiple layers of graph convolution operations. Each layer of graph convolution aggregates the neighboring node information of a node, thus fusing the node representation with the structural and feature information of its neighborhood. Its single-layer graph convolution operation can be represented as:

[0126] In the formula, Let i be the feature representation of node i in the l-th layer. It is the set of neighbors of node i. This is the learnable weight matrix of the l-th layer. By stacking multiple layers, the GNN module can capture complex, multi-hop cooperative behavior patterns and attack propagation paths among network entities, thereby uncovering deep-seated spatiotemporal topological correlation features. For example, discovering a group of previously unrelated IP addresses suddenly starting to access the same target IP, which manifests as a highly clustered subgraph structure in the topology graph, is a typical feature of cooperative attacks. Finally, the second expert model outputs detection results that reflect the complex cooperative relationships among network entities. Finally, the second expert model performs pooling and fully connected operations on all node features output by the GNN module to obtain spatiotemporal feature detection results. The mapping function of the entire second expert model can be expressed as: .

[0127] S104, Based on the routing weight value, the processing results of the expert model are fused to generate network attack detection results.

[0128] In the embodiments of this application, see Figure 4 The diagram shows the overall architecture for network security attack detection, logically constructed as data input - data preprocessing - gating network - expert model - fusion output. Data input includes network layer metrics, transport layer metrics, application layer metrics, behavioral features, and statistical features (i.e., network traffic data). Data preprocessing includes data cleaning, normalization, noise reduction, gap filling, and data construction, optimizing the input network traffic data to provide suitable data for subsequent model analysis. The attention-based gating network generates routing weight values ​​(P1, P2). The expert model includes a first expert model (TCN-BiGRU-Transformer) and a second expert model (Informer-GNN). The first expert model analyzes the time-series characteristics of network traffic data, while the second expert model analyzes the spatiotemporal correlation characteristics. The fusion output stage fuses the expert model processing results through a fully connected layer (DENSE), ultimately outputting network attack detection results such as normal traffic (Benign), denial-of-service (DoS) attacks, port scanning (PortScan), botnets, and brute-force attacks.

[0129] Optionally, after the first and second expert models complete their calculations in parallel, their respective outputs (i.e., temporal feature detection results and spatiotemporal feature detection results) are sent to the fusion module along with the routing weight vector generated by the gating network. The fusion module performs weighted fusion of the processing results of each expert model based on the routing weight values. Specifically: the temporal feature detection results and the spatiotemporal feature detection results are multiplied element-wise with their corresponding routing weight values ​​through a broadcast mechanism to obtain the weighted temporal feature detection results and the weighted spatiotemporal feature detection results; the weighted temporal feature detection results and the weighted spatiotemporal feature detection results are concatenated along the feature dimension to generate an intermediate fusion tensor; a fully connected layer is called to perform feature mapping and dimensionality compression on the intermediate fusion tensor to generate fusion features; and the network attack detection results are obtained based on the fusion features.

[0130] The broadcast mechanism is an operational rule that automatically expands the dimension of a feature tensor. When element-wise operations are performed on tensors of different dimensions, the lower-dimensional tensor is automatically expanded to match the dimension of the higher-dimensional tensor, ensuring that the operation is executable (e.g., expanding a scalar routing weight value to the same dimension as the corresponding feature). Element-wise multiplication refers to multiplying the feature tensor and the corresponding routing weight value element-wise at the same positions.

[0131] In this embodiment of the application, firstly, the temporal feature detection results (such as feature vectors with shape [1, 128]), the spatiotemporal feature detection results (such as feature vectors with shape [1, 128]), and the corresponding routing weight values ​​(such as β, γ, β+γ=1) are obtained.

[0132] Subsequently, the routing weight values ​​are expanded in dimension using a broadcast mechanism: the scalar β is expanded into a tensor with the same dimension as the temporal feature detection result (e.g., [1, 128]), and similarly, γ is expanded into a tensor with the same dimension as the spatiotemporal feature detection result.

[0133] Next, perform element-wise multiplication: 1) Multiply the temporal feature detection result with the expanded β tensor element-wise to obtain the temporal feature detection weighted result; 2) Multiply the spatiotemporal feature detection result with the expanded γ tensor element-wise to obtain the spatiotemporal feature detection weighted result.

[0134] Then, the weighted results of temporal feature detection and spatiotemporal feature detection are concatenated along the feature dimension to generate an intermediate fusion tensor.

[0135] The dimension of a feature refers to the dimension in the feature tensor that represents the feature attributes. For example, if each weighted feature is a 128-dimensional vector, then the feature dimension is 128. The concatenation operation will integrate the attribute information of different features along this dimension.

[0136] Among them, the splicing operation refers to the operation of connecting multiple feature tensors along the feature dimension, preserving the original information of each tensor and integrating them into a higher-dimensional tensor, thereby achieving the initial fusion of multiple types of features.

[0137] Among them, the intermediate fusion tensor refers to the tensor generated after the splicing operation of the weighted results of temporal feature detection and the weighted results of spatiotemporal feature detection, which contains all the information of the two types of weighted features.

[0138] Finally, the intermediate fusion tensor is passed to the next step for feature transformation and deep integration through a fully connected layer, generating more compact and representative fused features.

[0139] The fusion feature, serving as an internal intermediate state, carries rich abstract feature information and its dimensions are configurable. The fusion feature integrates the strengths of two expert models, highlighting the contribution of expert features with high matching degree to the current input while retaining auxiliary information from other expert features.

[0140] In this embodiment, during the mapping process, the fully connected layer automatically mines deep correlations between different types of features using learned weight parameters. Simultaneously, the fully connected layer applies a non-linear activation function to process the transformed features, enhancing the model's ability to express complex non-linear relationships and filtering out invalid information. Finally, through dimensionality compression and feature optimization, a unified dimensional (e.g., 128-dimensional) fused feature is generated.

[0141] Optionally, the method further includes a model training step, which includes: calculating a classification loss based on the network attack detection results and the true labels of the samples; calculating a load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch; weighting and summing the classification loss and the load balancing loss to obtain a total loss; and updating the network parameters of the gating network and all expert models using a backpropagation algorithm based on the total loss.

[0142] Optionally, for all samples in a training batch, compute the expert model. activation frequency for:

[0143] ;in, This represents the number of samples in this training batch. It is an exponential function. For the first The index of expert models whose samples are selected by the gating network;

[0144] Calculate load balancing loss using the following formula. :

[0145] ;in, For hyperparameters, For expert models The routing weight value.

[0146] During the training phase, to ensure that all expert models are adequately trained, the fusion module can employ a weighted fusion approach. Specifically, the output of the first expert model is fused... With route weight Multiply and combine the outputs of the second expert model. With route weight Multiply the two weighted results, then add them together to obtain the final prediction output. : .in, This represents the output of the k-th expert model to the input (such as anomaly score or classification probability).

[0147] As an optional fusion method, the weighted result can also be... and The features are concatenated along the feature dimension and then deeply fused through one or more fully connected layers to finally generate the prediction output.

[0148] During iterative optimization of model parameters, the training objective of the model includes not only minimizing the classification loss (e.g., cross-entropy loss) between the predicted result (i.e., network attack detection result) and the true label. It also introduces a load balancing loss. This loss function aims to penalize the gating network for allocating the vast majority of tasks to a small number of expert models, thereby promoting a more balanced distribution of routing weights. First, the activation percentage of expert model k in a training batch is defined. and average route probability : , Where B is the batch size. It is the first Each sample is assigned the expert index with the highest weight. It is an indicator function. It is a gating network for the first Each sample is assigned a weight to the expert model k. Correspondingly, the load balancing loss... Then it is defined as: ,in, This is a hyperparameter used to control the strength of load balancing. Ultimately, the total training loss function is a weighted sum of the classification loss and the load balancing loss: ,in, It's the balancing factor. The optimizer will use this total loss... The backpropagation algorithm is used to update all learnable parameters in the gated network, the first expert model, and the second expert model. During training, a validation set is used for evaluation, and the change in the validation set loss determines whether to terminate training early or save the optimal model parameters until all iterations are completed. Finally, a final evaluation is performed on the test set.

[0149] In one optional embodiment, a sparse activation strategy is employed during the model inference phase to maximize efficiency and conserve computational resources. After acquiring the network traffic data to be detected, the gating network first generates route weight values. Subsequently, not all expert models are used; instead, the expert model with the highest route weight is selectively activated (i.e., a Top-1 strategy). That is, if... If so, only the first expert model will be activated to perform feature analysis on the data.

[0150] Alternatively, the expert models with higher routing weights can be activated (the top n expert models with higher weights can be activated, where n can be set according to the actual situation), while the remaining expert models remain dormant, thereby significantly reducing computational overhead.

[0151] In the inference phase, a sparse activation strategy can be used, while in the training phase, soft routing is used, which means that the outputs of all expert models are calculated simultaneously and weighted by p to ensure gradient differentiability.

[0152] In one optional embodiment, the preprocessed network traffic data (also known as network traffic feature vectors) is processed... This data can be structured into various different forms to suit subsequent expert models. This application provides two examples: one is time-series data, used as input to the first expert model. This structure slices network traffic data according to fixed time windows (e.g., every 30 seconds), forming a series of feature vector sequences with chronological order. The other is dynamic interaction graph data, used as input to the second expert model. This structure constructs an interaction graph based on communication relationships (such as the interaction between source and destination IPs) in the network traffic data. Nodes in the interaction graph can represent network entities (such as IP addresses), and edges can represent communication behaviors between entities. Each node can carry its own temporal features, while the adjacency matrix of the interaction graph describes the connections between nodes.

[0153] Next, the network traffic data is input into a preset gating network to generate routing weight values ​​for selection from multiple expert models. Then, one or more of the expert models are used to process the network traffic data to generate expert model processing results. Specifically, the preprocessed network traffic data (also known as network traffic feature vectors) is... The input is fed into the gating network, the feature vector sequence is fed into the first expert model, and the interaction graph is fed into the second expert model.

[0154] In this embodiment, a first expert model, comprising a TCN module, a BiGRU module, and a Transformer module connected in sequence, can accurately identify time-dependent attacks such as DoS and port scanning. A second expert model, comprising an Informer module and a GNN module, effectively detects spatially spreading threats such as APTs and lateral movement within intranets, overcoming the bottleneck of traditional models' inability to handle multi-dimensional features and improving the detection accuracy for complex attacks. Furthermore, the TCN module captures fine-grained temporal patterns, the BiGRU module enhances bidirectional dependency awareness, the Transformer module strengthens long-range context understanding, and the Informer and GNN modules focus on key abnormal time points and cross-node propagation paths, improving the model's robustness in scenarios with noise interference and encrypted traffic. Through a sparse activation strategy, the computational overhead during the inference phase is reduced, and a load balancing mechanism ensures balanced use of expert models, avoiding overload of a single model and adapting to edge devices and high-throughput real-time detection scenarios.

[0155] This embodiment, based on the above embodiments, introduces a cross-expert collaborative reasoning mechanism. In existing hybrid expert models, experts typically work independently with a lack of information exchange, limiting the model's depth of understanding of complex attacks. This embodiment aims to achieve information exchange and collaborative processing among expert models.

[0156] This embodiment adds a collaborative reasoning module between the first expert model and the second expert model. For detailed operating principles, please refer to [link / reference needed]. Figure 5 The specific process is as follows: First, following the method described in the above embodiments, data acquisition, preprocessing, and generation of routing weight values ​​through a gating network are completed. Then, the method enters the collaborative reasoning stage, executing cross-expert collaborative reasoning. The core idea of ​​this step is: each expert first performs a preliminary analysis of the data and assesses the confidence level of their own judgment. Then, based on this confidence level, they selectively share the key information (i.e., intermediate features) they extract with other experts. An expert with a higher confidence level in their judgment is more likely to extract valuable knowledge, and should influence other experts more; conversely, an expert with a lower confidence level may have features containing noise, and their interference with other experts should be reduced.

[0157] The cross-expert collaborative reasoning process can be broken down into the following sub-steps. Please refer to the following: Figure 5 To understand:

[0158] 1) Generating intermediate features and preliminary probabilities: The first and second expert models process the input data in parallel, and generate intermediate feature representations, denoted as intermediate feature Ht and intermediate feature Hg, respectively, in the intermediate layers of their respective models (e.g., node representations after the first layer of graph convolution in a graph neural network). Simultaneously, these two intermediate features are passed through a lightweight classification head (e.g., a simple fully connected layer with Softmax) to obtain preliminary attack class probability distributions, denoted as preliminary probability Probt and preliminary probability Probg.

[0159] 2) Calculate the knowledge certainty factor: For each expert's initial probability distribution Prob (a vector containing probabilities of C categories, where C is the total number of categories), calculate its information entropy, also known as knowledge entropy (the formula for calculating knowledge entropy is the existing formula). Information entropy is an indicator of uncertainty. If an expert's output probability distribution is highly concentrated (e.g., the probability for a certain category is close to 1), its information entropy is low, indicating that the expert has a very high degree of confidence in their judgment. Conversely, if the output probability distribution is very uniform, the information entropy will be high, indicating that the expert has high uncertainty.

[0160] Subsequently, based on the calculated knowledge entropy E(Et and Eg), the knowledge determinism factor is calculated using a nonlinear mapping function. The formulas for calculating the knowledge determinism factors KCFt and KCFg are as follows: This formula non-linearly maps the entropy value E (ranging from [0, log(C)]) to the interval (0, 1]. When the entropy E approaches 0 (extreme certainty), KCF approaches 1; when the entropy E increases (uncertainty increases), KCF decays smoothly and non-linearly. This design ensures that only highly deterministic knowledge can play a strong guiding role in subsequent fusion.

[0161] 3) Performing entropy-controlled knowledge fusion: The intermediate features of one expert will be updated based on the knowledge certainty factors of another expert. Taking the updating of the intermediate features of the first expert model as an example, the update process can be represented by the following formula: Accordingly, the formula for updating the intermediate features of the second expert model is: .

[0162] In the first formula, Ht is the original intermediate feature of the first expert model; Hg is the knowledge source from the second expert model. It is a learnable linear transformation matrix 511, which maps the dimension and semantic space of the intermediate feature Hg of the second expert to a space compatible with the first expert. The hyperbolic tangent activation function is used to perform nonlinear processing on the transformed features; while KCFg is the knowledge certainty factor 510 from the second expert, which acts like a gating mechanism. If the second expert's initial judgment is very certain (KCFg is close to 1), then its feature Hg will be fused into H't with a large weight; conversely, if the second expert's uncertainty is high (KCFg is close to 0), then the influence of Hg on H't will be negligible. Furthermore, the formula uses a residual connection form ( This ensures that the model retains its original feature information, which helps stabilize the training process. In this way, each expert has the opportunity to refer to the high-confidence findings of other experts and use them to correct or enhance their own feature representations.

[0163] Subsequently, based on the updated features, multiple expert model processing results are generated. After the updated features H't and H'g are calculated in the collaborative reasoning module, they are fed back to the subsequent processing layers of their respective expert models. For example, H't is input into the first expert model, replacing the original input; similarly, H'g is input into the second expert model. After absorbing knowledge from other experts, the expert models continue to complete the remaining calculations, ultimately generating more reliable expert model processing results that have undergone knowledge fusion.

[0164] Finally, the process returns to S104, which is the same as in the above embodiment. Based on the routing weight value of the gated network, the two expert processing results enhanced by collaborative reasoning are weighted and fused to generate the final network attack detection result.

[0165] The beneficial effects of this embodiment can be illustrated through the following application scenario: Suppose an advanced persistent threat is occurring. In the early stages of an attack, the attacker may only conduct small-scale, low-frequency scans, which manifest as weak anomalies in the time series. At this time, the first expert model may not be able to determine that it is an attack with high confidence, resulting in a scattered initial probability distribution (Probt), high knowledge entropy (Et), and low knowledge certainty factor (KCFt). However, although these scanning behaviors are weak, they may already exhibit unusual chain or star-shaped propagation patterns on the topology graph of host interactions. The second expert model (graph expert) can keenly capture this spatial structure anomaly and determine it as malicious behavior with high confidence. Therefore, its Probg distribution is concentrated, Eg is low, and KCFg is high. In the entropy-controlled knowledge fusion step, because KCFg is high, the intermediate feature Hg of the second expert is added to the intermediate feature Ht of the first expert with a larger weight after transformation matrix Wgt. This is equivalent to the second expert model providing the first expert model with key information about spatial coherence. Upon receiving this information, the updated feature H't will contain this spatial collaboration information, enabling the subsequent transformer module of the first expert model to more accurately identify the malicious nature of these temporal events. Ultimately, both experts will report the attack with higher confidence, thus achieving a comprehensive effect superior to the detection performance of individual experts.

[0166] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0167] Corresponding to the network attack detection method described in the above embodiments, Figure 6 A structural block diagram of the network attack detection device provided in the embodiments of this application is shown. For ease of explanation, only the parts related to the embodiments of this application are shown.

[0168] Reference Figure 6 The network attack detection device includes:

[0169] The acquisition module is used to acquire network traffic data to be detected;

[0170] The routing weight value generation module is used to input the network traffic data into a preset gated network to generate routing weight values ​​for selection from multiple expert models.

[0171] An expert model processing result generation module is used to process the network traffic data using one or more of the plurality of expert models to generate expert model processing results; wherein the plurality of expert models are set in parallel and include at least:

[0172] A first expert model is configured to analyze the time-series characteristics of the network traffic data.

[0173] A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data.

[0174] The network attack detection result generation module is used to fuse the expert model processing results based on the routing weight value to generate network attack detection results.

[0175] In one possible implementation, the gated network is an attention-based gated network; the route weight generation module is used for:

[0176] Feature extraction is performed on the network traffic data input to the gating network to obtain multidimensional semantic features;

[0177] The importance weights of the multidimensional semantic features to the multiple expert models are calculated based on the attention mechanism.

[0178] The routing weight value of each expert model is obtained based on the importance weights of the multiple expert models.

[0179] In one possible implementation, the expert model processing result includes temporal feature detection results; the first expert model includes a TCN module, a BiGRU module, and a Transformer module connected in sequence; the expert model processing result generation module is used for:

[0180] The network traffic data is input into the TCN module to capture multi-scale local temporal patterns in the network traffic data and output the first temporal feature;

[0181] The first time series feature is input into the BiGRU module to capture the bidirectional time dependency in the first time series feature and output the second time series feature;

[0182] The second time series feature is input into the Transformer module to capture the global long-term dependencies in the second time series feature and output the third time series feature;

[0183] The third temporal feature is pooled and fully connected to obtain the temporal feature detection result.

[0184] In one possible implementation, the expert model processing result includes spatiotemporal feature detection results; the second expert model includes an Informer module and a GNN module; the expert model processing result generation module is used for:

[0185] An interaction graph is constructed based on the communication relationships of the network traffic data; wherein, the nodes of the interaction graph are network entities;

[0186] The network traffic data is input into the Informer module to obtain the long-term time-series characteristics of each node;

[0187] The long-period temporal features are used as the temporal attribute features of the nodes in the interaction graph, and are input into the GNN module along with the adjacency matrix of the interaction graph.

[0188] The GNN module performs multi-layer graph convolution operations on the interaction graph carrying temporal attribute features, iteratively aggregating the temporal attribute features of each node with the association features of neighboring nodes, and mining the spatiotemporal topological associations and cooperative behavior features between nodes.

[0189] Pooling and full connection are performed on all node features output by the GNN module to obtain the spatiotemporal feature detection results.

[0190] In one possible implementation, the network attack detection result generation module is used for:

[0191] The temporal feature detection results and the spatiotemporal feature detection results are multiplied element-wise with their corresponding routing weight values ​​through a broadcast mechanism to obtain the temporal feature detection weighted result and the spatiotemporal feature detection weighted result;

[0192] The weighted results of temporal feature detection and the weighted results of spatiotemporal feature detection are concatenated along the feature dimension to generate an intermediate fusion tensor.

[0193] The fully connected layer is invoked to perform feature mapping and dimensionality compression on the intermediate fusion tensor to generate fusion features;

[0194] The network attack detection result is obtained based on the fusion features.

[0195] In one possible implementation, the network attack detection device further includes a training module for:

[0196] Based on the network attack detection results and the true labels of the samples, calculate the classification loss;

[0197] Based on the distribution of routing weight values ​​generated by the gating network in the training batch, the load balancing loss is calculated.

[0198] The total loss is obtained by weighted summing the classification loss and the load balancing loss.

[0199] Based on the total loss, the network parameters of the gated network and all expert models are updated using the backpropagation algorithm.

[0200] In one possible implementation, the training module is used for:

[0201] For all samples in a training batch, compute the expert model. activation frequency for:

[0202] ;in, This represents the number of samples in this training batch. It is an exponential function. For the first The index of expert models whose samples are selected by the gating network;

[0203] Calculate load balancing loss using the following formula. :

[0204] ;in, For hyperparameters, For expert models The routing weight value.

[0205] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0206] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0207] This application also provides a computer device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor executes the computer program to implement the steps in any of the above method embodiments.

[0208] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0209] This application provides a computer program product that, when run on a computer device, enables the computer device to perform the steps described in the above-described method embodiments.

[0210] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Figure 7 As shown, the computer device of this embodiment includes: at least one processor 60 ( Figure 7 (Only one is shown in the diagram), memory 61, and computer program 62 stored in said memory 61 and executable on said at least one processor 60, wherein the processor 60 executes said computer program 62 to implement the steps in any of the above embodiments of network attack detection methods.

[0211] The computer device may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will understand that... Figure 7 The examples of computer devices are merely examples and do not constitute a limitation on computer devices. They may include more or fewer components than shown in the illustration, or combinations of certain components, or different components. For example, they may also include input / output devices, network access devices, etc.

[0212] The processor 60 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0213] In some embodiments, the memory 61 may be an internal storage unit of the computer device, such as a hard drive or memory. In other embodiments, the memory 61 may be an external storage device of the computer device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, the memory 61 may include both internal and external storage units of the computer device. The memory 61 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 61 can also be used to temporarily store data that has been output or will be output.

[0214] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a device / computer equipment, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0215] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0216] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0217] In the embodiments provided in this application, it should be understood that the disclosed apparatus / computer devices and methods can be implemented in other ways. For example, the apparatus / computer device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0218] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0219] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting network attacks, characterized in that, include: Acquire network traffic data to be detected; The network traffic data is input in parallel into a preset gated network and multiple expert models; Based on the gated network, route weight values ​​are generated for selection from multiple expert models; A sparse activation strategy is employed, utilizing one or more of the multiple expert models to process the network traffic data, generating expert model processing results; wherein the multiple expert models are configured in parallel, and at least include: A first expert model is configured to analyze the time-series characteristics of the network traffic data. A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data. Based on the routing weight values, the processing results of the expert model are fused to generate network attack detection results; The expert model training steps include: calculating classification loss based on the network attack detection results and the true labels of the samples; calculating load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch; weighting and summing the classification loss and the load balancing loss to obtain the total loss; and updating the network parameters of the gating network and all expert models using the backpropagation algorithm based on the total loss. The calculation of load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch includes: For all samples in a training batch, compute the expert model. activation frequency for: ;in, This represents the number of samples in this training batch. It is an exponential function. For the first The index of expert models whose samples are selected by the gating network; Calculate load balancing loss using the following formula. : ;in, For hyperparameters, For expert models The routing weight value.

2. The network attack detection method as described in claim 1, characterized in that, The gating network is an attention-based gating network; The step of inputting the network traffic data into a preset gated network to generate routing weight values ​​for selection from multiple expert models includes: Feature extraction is performed on the network traffic data input to the gating network to obtain multidimensional semantic features; The importance weights of the multidimensional semantic features to the multiple expert models are calculated based on the attention mechanism. The routing weight value of each expert model is obtained based on the importance weights of the multiple expert models.

3. The network attack detection method as described in claim 1, characterized in that, The expert model processing results include temporal feature detection results; the first expert model includes a TCN module, a BiGRU module, and a Transformer module connected in sequence. The step of processing the network traffic data using one or more of the multiple expert models to generate expert model processing results includes: The network traffic data is input into the TCN module to capture multi-scale local temporal patterns in the network traffic data and output the first temporal feature; The first time series feature is input into the BiGRU module to capture the bidirectional time dependency in the first time series feature and output the second time series feature; The second time series feature is input into the Transformer module to capture the global long-term dependencies in the second time series feature and output the third time series feature; The third temporal feature is pooled and fully connected to obtain the temporal feature detection result.

4. The network attack detection method as described in claim 3, characterized in that, The expert model processing results include spatiotemporal feature detection results; the second expert model includes an Informer module and a GNN module; The step of processing the network traffic data using one or more of the multiple expert models to generate expert model processing results includes: An interaction graph is constructed based on the communication relationships of the network traffic data; wherein, the nodes of the interaction graph are network entities; The network traffic data is input into the Informer module to obtain the long-term time-series characteristics of each node; The long-period temporal features are used as the temporal attribute features of the nodes in the interaction graph, and are input into the GNN module along with the adjacency matrix of the interaction graph. The GNN module performs multi-layer graph convolution operations on the interaction graph carrying temporal attribute features, iteratively aggregating the temporal attribute features of each node with the association features of neighboring nodes, and mining the spatiotemporal topological associations and cooperative behavior features between nodes. Pooling and full connection are performed on all node features output by the GNN module to obtain the spatiotemporal feature detection results.

5. The network attack detection method as described in claim 4, characterized in that, The step of fusing the expert model processing results based on the routing weight values ​​to generate network attack detection results includes: The temporal feature detection results and the spatiotemporal feature detection results are multiplied element-wise with their corresponding routing weight values ​​through a broadcast mechanism to obtain the temporal feature detection weighted result and the spatiotemporal feature detection weighted result; The weighted results of temporal feature detection and the weighted results of spatiotemporal feature detection are concatenated along the feature dimension to generate an intermediate fusion tensor. The fully connected layer is invoked to perform feature mapping and dimensionality compression on the intermediate fusion tensor to generate fusion features; The network attack detection result is obtained based on the fusion features.

6. The network attack detection method as described in claim 1, characterized in that, The method further includes: The percentage of activations of expert model k in a training batch for: ; The average routing probability of expert model k in a training batch for: Where B is the batch size. It is the first Each sample is assigned the expert index with the highest weight. It is an indicator function. It is a gating network for the first Each sample is assigned a weight to the expert model k; Load balancing losses The calculation formula is: ;in, These are preset hyperparameters; The formula for calculating the total loss is: ;in, It is a balancing factor, which the optimizer uses based on the total loss. The backpropagation algorithm is used to update all learnable parameters in the gated network, the first expert model, and the second expert model.

7. The network attack detection method as described in claim 6, characterized in that, The method further includes: When the network traffic data is input to the first expert model and the second expert model in parallel, the network traffic data is processed by the first expert model, and a first intermediate feature Ht is extracted and output in a preset intermediate layer. At the same time, the network traffic data is processed by the second expert model, and a second intermediate feature Hg is extracted and output in a preset intermediate layer. A first preliminary probability distribution Probt is generated based on the first intermediate feature Ht, and a second preliminary probability distribution Probg is generated based on the second intermediate feature Hg. The first knowledge certainty factor KCFt is calculated based on the first preliminary probability distribution Probt, and the second knowledge certainty factor KCFg is calculated based on the second preliminary probability distribution Probg; wherein, the first knowledge certainty factor KCFt and the second knowledge certainty factor KCFg represent the confidence level of the corresponding expert model in judging the current input network traffic data. The first intermediate feature Ht is weighted and fused using the second knowledge certainty factor KCFg to obtain the knowledge-enhanced first intermediate feature. The second intermediate feature Hg is then weighted and fused using the first knowledge certainty factor KCFt to obtain the knowledge-enhanced second intermediate feature. ; The first intermediate feature after knowledge enhancement The input is fed into the network layer of the first expert model for processing to obtain the first final feature; the knowledge-enhanced second intermediate feature is then processed. The input is fed into the network layer of the second expert model for processing to obtain the second final feature; Based on the first final feature and the second final feature, a network attack detection result is generated.

8. A network attack detection device, characterized in that, include: The acquisition module is used to acquire network traffic data to be detected; The input module is used to input the network traffic data in parallel into a preset gated network and multiple expert models; A route weight value generation module is used to generate route weight values ​​based on the gated network for selection from multiple expert models; The expert model processing result generation module employs a sparse activation strategy to process the network traffic data using one or more of the multiple expert models, generating expert model processing results; wherein the multiple expert models are configured in parallel and include at least: A first expert model is configured to analyze the time-series characteristics of the network traffic data. A second expert model is configured to analyze the spatiotemporal correlation features of the network traffic data. The network attack detection result generation module is used to fuse the expert model processing results based on the routing weight value to generate network attack detection results. The expert model training steps include: calculating classification loss based on the network attack detection results and the true labels of the samples; calculating load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch; weighting and summing the classification loss and the load balancing loss to obtain the total loss; and updating the network parameters of the gating network and all expert models using the backpropagation algorithm based on the total loss. The calculation of load balancing loss based on the distribution of routing weight values ​​generated by the gating network in the training batch includes: For all samples in a training batch, compute the expert model. activation frequency for: ;in, This represents the number of samples in this training batch. It is an exponential function. For the first The index of expert models whose samples are selected by the gating network; Calculate load balancing loss using the following formula. : ;in, For hyperparameters, For expert models The routing weight value.

9. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as claimed in any one of claims 1 to 7.

10. A computer program product, characterized in that, When the computer program product is run on a computer device, it causes the computer device to perform the method as described in any one of claims 1 to 7.

Images