Encrypted malicious traffic detection method and system based on dual adjacency graph embedding learning

Abstract

The invention belongs to the technical field of network security, and discloses an encrypted malicious traffic detection method and system based on dual adjacency graph embedding learning, and the method comprises the steps: obtaining original encrypted network traffic data, carrying out the preprocessing, and generating an initial feature matrix of a plurality of IP address nodes; processing the initial feature matrix and the static topological adjacency matrix by adopting a first graph convolutional network to obtain vector representation of static topological features; processing the initial feature matrix and the dynamic behavior adjacency matrix by adopting a second graph convolutional network to obtain vector representation of dynamic behavior features; splicing the vector representation of the static topological feature and the vector representation of the dynamic behavior feature to obtain a fused feature representation; and training a classification model based on the fusion feature representation, and performing classification detection on whether the encrypted network traffic is malicious or not by using the trained classification model. According to the method, the space structure information and the behavior time sequence information of the network traffic are effectively fused, and the capability of identifying malicious encryption threats is improved.

Description

Technical Field

[0001] This invention relates to the field of network security and artificial intelligence, and in particular to a method and system for detecting encrypted malicious traffic based on dual adjacency graph embedding learning. Background Technology

[0002] Encrypted malicious traffic detection is a core technology in the field of network security, aiming to identify malicious activities transmitted through encrypted channels such as TLS / SSL, such as botnet command and control communications and data breaches. With the widespread application of network encryption protocols, traditional detection methods based on plaintext traffic have gradually become ineffective, prompting researchers to develop various new detection schemes. These methods mainly extract patterns from traffic characteristics to distinguish between malicious and normal behavior. Existing encrypted malicious traffic detection methods can be categorized into the following types based on their technological foundation: Traditional rule-based methods include signature-based and side-channel feature-based detection techniques. Signature-based methods identify threats by matching specific patterns of known attacks, but they heavily rely on prior knowledge bases and struggle to address novel threats. Side-channel-based methods utilize unencrypted metadata for statistical analysis, but they heavily rely on manual feature engineering and have limited generalization capabilities.

[0003] Deep learning-based methods: These methods employ end-to-end feature learning to automatically extract discriminative features from raw traffic data, overcoming the limitations of manual design. However, these methods often focus on the internal features of individual traffic flows, neglecting the structural relationships between network entities and failing to fully reflect complex interactive behaviors.

[0004] Graph neural network-based methods: These methods construct network communication graphs and utilize graph neural networks to learn node embeddings to capture patterns of association between entities. Although these methods show advantages in modeling spatial structures, existing research mostly focuses on static topological features, resulting in insufficient detection performance when dealing with adaptive threats.

[0005] Overall, while existing methods offer diverse solutions for detecting encrypted malicious traffic, their development still faces fundamental limitations. Whether relying on traditional methods that depend on prior knowledge, deep learning methods that focus on the internal features of a single flow, or graph neural network algorithms that focus on static correlations, their core perspectives largely remain on characterizing network connection states or fixed behavioral patterns, failing to effectively break through the framework of static analysis. This neglect of the dynamic evolution of behavior and its interaction with static structures causes the detection performance of existing technologies to encounter bottlenecks when dealing with complex and continuously evolving encrypted threats, leaving room for improvement. Summary of the Invention

[0006] Based on this, and addressing the limitations of existing encrypted malicious traffic detection methods in static analysis when dealing with dynamic and adaptive threats, this invention proposes an encrypted malicious traffic detection method and system based on dual adjacency graph embedding learning.

[0007] In a first aspect, the present invention provides a method for detecting encrypted malicious traffic based on dual adjacency graph embedding learning, comprising the following steps: Obtain raw encrypted network traffic data, preprocess it, extract initial features from multiple IP address nodes, and obtain an initial feature matrix; Based on the initial feature matrix, static topological adjacency learning and dynamic behavioral adjacency learning are performed in parallel: Static topological adjacency learning is performed to construct a static topological adjacency matrix. The initial feature matrix and the static topological adjacency matrix are then processed using a first graph convolutional network to obtain a vector representation of the static topological features. Dynamic behavior adjacency learning is performed to construct a dynamic behavior adjacency matrix. A second graph convolutional network is then used to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features. The vector representations of the static topological features and the vector representations of the dynamic behavioral features are concatenated to obtain a fused feature representation; A classification model is trained based on the fused feature representation, and the trained classification model is used to classify and detect whether encrypted network traffic is malicious.

[0008] As an optional implementation of the first aspect of this application, the step of acquiring raw encrypted network traffic data and preprocessing it to obtain an initial feature matrix specifically includes: extracting network packets from the raw traffic file in PCAP format, and reconstructing the network packets into a network session based on the five-tuple information consisting of the source IP address, destination IP address, source port, destination port, and protocol; performing multi-level feature parsing on each network session to extract basic network layer features, traffic statistics features, and TLS / SSL specific features; aggregating the session-level features into IP-level feature representations, wherein statistical quantities including the mean, maximum value, and standard deviation are calculated for numerical features, and the term frequency-inverse document frequency (TF-IDF) method is used to process categorical features to form a basic feature matrix of IP nodes; inputting the basic feature matrix into an attention-aware feature fusion module, dynamically evaluating feature importance through the self-attention mechanism and multi-head attention mechanism of the attention-aware feature fusion module, and combining residual connections and feedforward networks to achieve deep feature interaction, and outputting the initial feature matrix.

[0009] As an optional implementation of the first aspect of this application, the step of performing static topological adjacency learning specifically includes: abstracting IP addresses in the network as graph nodes and constructing a static topological graph; wherein, when a first IP address node and a second IP address node are connected to a common destination IP address, the connection relationship between the first IP address node and the second IP address node is set as existing in the static topological adjacency matrix; normalizing the static topological adjacency matrix, including: ensuring the symmetry of the adjacency matrix through symmetry processing, and processing the symmetry-processed adjacency matrix using symmetry normalization technology; during the training phase, applying label consistency constraints to the IP address nodes in the training set and adjusting the static topological adjacency matrix: if two IP address nodes have the same malicious or normal label, their connection weights are increased; if the labels are different, their connection weights are decreased; inputting the normalized and label-consistency-constrained static topological adjacency matrix and the initial feature matrix into the first graph convolutional network, and learning the vector representation of the static topological features through multi-layer feature propagation.

[0010] As an optional implementation of the first aspect of this application, the step of performing dynamic behavioral adjacency learning specifically includes: discretizing the continuous behavioral features in the initial feature matrix to obtain binned behavioral features; based on the binned behavioral features, selecting important bins and performing Word of Evidence (WOE) quantization to construct a node behavioral feature matrix; calculating the behavioral similarity between any two IP address nodes in the behavioral feature matrix; converting the behavioral similarity into the dynamic behavioral adjacency matrix through dynamic thresholding, wherein when the behavioral similarity between two nodes is greater than a preset threshold, they are set to be connected in the dynamic behavioral adjacency matrix; and inputting the dynamic behavioral adjacency matrix and the initial feature matrix into the second graph convolutional network to learn the vector representation of the dynamic behavioral features.

[0011] As an optional implementation of the first aspect of this application, the step of discretizing the continuous behavioral features in the initial feature matrix specifically includes: filling the missing values ​​in the initial feature matrix with the mean; using the K-means clustering algorithm to bin the continuous behavioral features, wherein the number of clusters k is set to 12, and the bin boundaries are determined by the training set data; and post-processing the binning results: determining whether the number of samples in each bin is less than a preset minimum sample size threshold, and if so, merging the bin into the bin with the largest sample size.

[0012] As an optional implementation of the first aspect of this application, the step of selecting important boxes and quantifying the Weight of Evidence (WOE) specifically includes: calculating the WOE value of each box using a formula, wherein the formula is: ,in, This represents the proportion of malicious samples in this container to the total number of malicious samples. This represents the proportion of normal samples in this container to the total number of normal samples. and They are the box body The number of malicious and normal samples in China and The total number of samples is used. The WOE threshold of important boxes is automatically determined by the inflection point detection method. Specifically, the absolute WOE values ​​of all boxes are sorted, the second difference of the sorted numerical sequence is calculated, and the position corresponding to the largest second difference value is taken as the inflection point. The absolute WOE value corresponding to the inflection point is the WOE threshold. Only boxes with an absolute WOE value greater than the WOE threshold are retained as important boxes, and the behavior feature matrix of the node is constructed based on the important boxes.

[0013] As an optional implementation of the first aspect of this application, the step of training the classification model based on the fused feature representation specifically involves: using at least one classifier among logistic regression, Naive Bayes, K-nearest neighbors, decision tree, and XGBoost, with the fused feature representation as input and the corresponding traffic label as a supervision signal, to train the model and generate the dynamic behavior adjacency matrix.

[0014] Secondly, embodiments of this application provide an encrypted malicious traffic detection system based on dual adjacency graph embedding learning, comprising: The data preprocessing module is used to acquire raw encrypted network traffic data, perform preprocessing, extract initial features from multiple IP address nodes, and obtain an initial feature matrix. A static topological feature representation module is learned to construct a static topological adjacency matrix, and a first graph convolutional network is used to process the initial feature matrix and the static topological adjacency matrix to obtain a vector representation of the static topological features; A dynamic behavior feature representation module is used to construct a dynamic behavior adjacency matrix, and a second graph convolutional network is used to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features. The fusion feature generation module is used to concatenate the vector representation of the static topological features with the vector representation of the dynamic behavior features to obtain a fusion feature representation; The classification and detection module is used to train a classification model based on the fused feature representation, and to use the trained classification model to classify and detect whether encrypted network traffic is malicious.

[0015] Thirdly, embodiments of this application provide an electronic device, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the steps of the method described in the first aspect.

[0016] Fourthly, embodiments of this application provide a readable storage medium on which a program or instructions are stored, which, when executed by a processor, implement the steps of the method described in the first aspect.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. Dual Perspective Fusion: This invention innovatively constructs two parallel graph learning branches: static topological adjacency and dynamic behavioral adjacency. These branches capture the spatial structural dependence and temporal behavioral similarity of network traffic, respectively. By feature fusion, the two complementary information branches are effectively combined. Compared with existing methods that rely on only a single perspective, this invention can more comprehensively and profoundly characterize the essential features of encrypted traffic.

[0018] 2. Dynamic Behavior Adaptive Modeling: Through a series of automated processing steps, including K-means binning, WOE quantization, and inflection point detection, this method adaptively selects the most discriminative patterns from high-dimensional behavioral features and constructs a dynamic behavior graph. This mechanism reduces reliance on human experience and enhances the model's adaptability to different network environments and novel threats.

[0019] 3. Improved Detection Performance: By integrating information from both static and dynamic dimensions, the generated fused feature representation exhibits stronger discriminative power and robustness. When facing encrypted malicious traffic with covert behavior and varied patterns, this method can significantly improve detection accuracy and recall, effectively reducing false negatives and false positives, and providing more reliable technical support for network security protection. Attached Figure Description

[0020] Figure 1 This is a flowchart of an encrypted malicious traffic detection method based on dual adjacency graph embedding learning according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of an encrypted malicious traffic detection system based on dual adjacency graph embedding learning provided by an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0023] Example 1 Please see Figure 1 This is a flowchart illustrating a method for detecting encrypted malicious traffic based on dual adjacency graph embedding learning, provided by an embodiment of the present invention. The method may include the following steps: S1: Obtain raw encrypted network traffic data, preprocess it, extract initial features from multiple IP address nodes, and obtain an initial feature matrix.

[0024] Based on the analysis of encrypted traffic characteristics, this embodiment uses raw traffic files in PCAP format. The first step is session reconstruction, which aims to reassemble discrete data packets into complete network sessions based on 5-tuples. Building upon this, statistical features (such as packet size, transmission direction, and time interval) are extracted for each session, and aggregated to generate a basic feature vector for each IP address. These basic features collectively constitute an IP-level feature matrix. .in, The included static features such as SrcIP and DstIP will be used to construct the Static Topological Adjacency (STA) graph in the second stage, while its dynamic behavioral features such as packet length sequence and time interval will be used to construct the Dynamic Behavioral Adjacency (DBA) graph. (Matrix) As the final output of this step, it provides structured, high-quality input for subsequent representation learning. This preprocessing process mainly consists of the following steps: 1.1 Packet Extraction and Session Reconstruction: From raw PCAP format traffic files The process extracts network packets and reconstructs the session based on the five-tuple information (source IP address, destination IP address, source port, destination port, and protocol), reassembling discrete packets into a complete network session. For example, a series of packets with a source IP of 192.168.1.100, a destination IP of 93.184.216.34, a source port of 55001, a destination port of 443, and a TCP protocol are parsed from the PCAP file. This step aggregates these packets to form a complete TLS encrypted session stream.

[0025] 1.2 Multi-layer Feature Parsing: The Zeek network analysis tool is used to perform deep parsing of each session, extracting basic network layer features (such as IP address and port), traffic statistics features (such as byte count and session duration), and TLS / SSL specific features (such as cipher suites and SNI). For the above session, Zeek can parse the following features: session duration = 180 seconds, total uplink bytes = 150KB, total downlink bytes = 800KB, uplink packet count = 120, downlink packet count = 95, average packet size ≈ 8.2KB, and the plaintext SNI (Server Name Indicator) of the TLS handshake phase = example.com.

[0026] 1.3 Feature Aggregation and Transformation: Session-level features are aggregated into IP-level feature representations. Statistics (mean, maximum, etc.) are calculated for numerical features, and TF-IDF and other methods are used to process categorical features, forming the basic feature matrix of the IP node. For example, within a 5-minute time window, IP address 192.168.1.100 initiated 10 TLS sessions. All session features of this IP are aggregated: for numerical features, the following is the number of bytes per row, with a sum of 5MB, mean of 500KB, maximum of 1.2MB, and standard deviation of 300KB; for categorical features such as SNI, the frequency of each SNI is counted, and the TF-IDF value is calculated. Finally, the IP is represented as a feature vector containing dozens of dimensions, for example, [5MB, 500KB, 1.2MB, 300KB, ..., TF-IDF(example.com)=0.85, ...].

[0027] 1.4 Attention-Aware Feature Fusion: The basic feature matrix is ​​input into the attention-aware feature fusion module, which introduces the attention-aware feature fusion (AFF) mechanism. This module dynamically evaluates feature importance through self-attention and multi-head attention, and combines residual connections with a feedforward network to achieve deep feature interaction, generating an enhanced initial feature matrix. As input for graph learning, for example, the original aggregated feature vector of an IP node contains the aforementioned statistical features. The AFF module calculates the correlation between features through a self-attention mechanism, and may find that the standard deviation of downlink byte count and the TF-IDF value of a specific SNI are more critical for distinguishing malicious traffic, thus assigning higher attention weights to these features. The enhanced feature vector after processing by the AFF module... Its discriminative information is highlighted, for example, the weight of key features is significantly increased.

[0028] S2: Construct a static topological adjacency matrix, and use a first graph convolutional network to process the initial feature matrix and the static topological adjacency matrix to obtain a vector representation of the static topological features.

[0029] After completing the preprocessing and feature enhancement stages, we proceed to the core methodology of this embodiment, starting with Static Topological Adjacency (STA) learning. This STA learning, a crucial component of the system, is designed based on the inherent spatial structure characteristics of network communication. By constructing a communication graph model, extracting topological relationships, and learning node embedding representations, a feature representation rich in spatial structure information is ultimately generated. In network communication, traffic data exists as a unidirectional data flow from source IP address to destination IP address. To fully exploit the structural features in encrypted traffic, this embodiment constructs a static topological graph model based on communication trajectories, formally representing it as a graph structure. Through the system's graph convolutional network learning and discriminative constraint enhancement mechanism, deep extraction of network spatial topological features is achieved.

[0030] Step S2 mainly consists of the following processes: 2.1 Communication Graph Construction and Initialization: IP addresses in the network are abstracted as graph nodes, and connections are established based on actual communication records. Specifically, the graph structure is constructed. , where the set of nodes Static topology adjacency matrix for different IP addresses Element is defined as: in It is the element in the i-th row and j-th column of the static topological adjacency matrix A, with a value of 1 or 0, representing a node. and Do they share a common communication target? This represents the set of source IP-destination IP connection relationships. This represents the i-th address. Representing the j-th address, the formula is... =1 is conditional on the existence of at least one node. , making and There is a connection between them (i.e.) ),and and There are also connections between them (i.e.) This definition ensures that connections are established only between nodes that share a common communication goal, accurately reflecting the actual network topology. For example, in the preprocessing result of step S1, IP address 192.168.1.100 (denoted as node...) The system communicates with the destination IP 93.184.216.34 (i.e., the server of example.com), while another IP address, 192.168.1.101 (denoted as node), communicates with the destination IP 93.184.216.34 (i.e., the server of example.com). It has also communicated with the same destination IP 93.184.216.34. Therefore, according to the definition, and They share a common communication goal, therefore in the adjacency matrix = =1. If node If 192.168.1.102 does not communicate with 93.184.216.34, then... = =0.

[0031] 2.2 Adjacency Matrix Normalization: To improve the training stability of graph convolutional networks, the adjacency matrix is ​​normalized. The specific process is as follows: 2.2.1 First, since network communication relationships are inherently undirected, this invention ensures the symmetry of the adjacency matrix through symmetry processing: ; 2.2.2 Subsequently, symmetric normalization is used to prevent training bias caused by uneven node degree distribution: in Represents the normalized static topological adjacency matrix and degree matrix. The diagonal elements are obtained through Calculate and obtain the normalized adjacency matrix. It not only preserves the original topological structure information but also significantly improves the numerical stability of subsequent graph convolution operations. For example, the initial adjacency matrix... China only = =1, all other elements are 0. After symmetry transformation (Because it is already symmetric). Degree matrix D The diagonal element is =1, =1, =0 (Division by zero should be avoided; this is typically used to add self-joins to isolated nodes). After normalization, we get... This is used for subsequent GCN operations.

[0032] 2.3 Graph Convolutional Feature Learning: Based on the first graph convolutional network, a multi-layer feature propagation mechanism is used to learn node embedding representations. in This represents the output node embedding matrix of the (k+1)th layer graph convolutional network (GCN) during static topological adjacency (STA) learning. It is an n×d matrix, where n is the number of nodes in the graph (e.g., the number of IP addresses), and d is the dimension of the embedded features. It represents the representation learned by a node after k+1 layers of feature propagation, capturing information about the node itself and its multi-hop neighbors; when k=0, Based on the initial feature matrix The first-order embedding is calculated from the direct neighbors; when k=1, It further aggregates the features of second-order neighbors (neighbors of neighbors), and so on. The initial feature matrix generated for the attention-aware feature fusion module. For the first Layer-based trainable weight matrices. By stacking multiple layers of GCN, the model can capture multi-hop neighbor information: the first layer learns direct neighbor features, the second layer expands to second-order neighbor features, and so on. For example, the initial feature matrix... This includes the feature vector of the IP node from step S1 (e.g., the features of 192.168.1.100 are [5MB, 500KB, ...]). After passing through the first layer of GCN, the node... Features will aggregate its direct neighbors The second layer further aggregates second-order neighbor information to learn a richer topological representation.

[0033] 2.4 Enhanced Discriminative Constraints: To enhance the discriminativeness of topology learning, label consistency constraints are imposed on the training set nodes: in This represents a subset of nodes in the training set. This constraint mechanism ensures that during the training phase, strong connections are established only between nodes with the same label, thereby enhancing the model's ability to distinguish malicious traffic. For example, in the training set, nodes... (IP192.168.1.100) and If all IPs (192.168.1.101) are marked as "malicious", their connection weight is increased to 2; if one of them is not marked, the weight remains at 1; if the labels are different, the weight is reduced to 0.5.

[0034] After multi-layer graph convolution operations, the output is a vector representation of the static topological features enhanced by topology. Each row corresponds to the final feature vector of a node. These feature vectors integrate the node's own attribute information and topological structure information, forming a rich and highly discriminative feature representation, laying the foundation for subsequent fusion with dynamic behavior features. For example, for a node... (IP192.168.1.100), its output characteristics It not only includes raw traffic statistics features, but also encodes information about neighboring nodes (such as...). The association patterns are used to form a more discriminative representation, which prepares for subsequent integration with dynamic behavioral features.

[0035] S3: Construct a dynamic behavior adjacency matrix, and use a second graph convolutional network to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features.

[0036] Dynamic Behavioral Adjacency (DBA) is another important component of this system. Its core idea is to construct a relationship graph by quantifying the similarity of dynamic behavioral patterns between nodes, thereby capturing temporal behavioral characteristics in network traffic. The feature matrix obtained during the preprocessing stage is used as an example. Using this as the basic input, a relationship graph is constructed by quantifying the similarity of dynamic behavioral patterns between nodes, thereby capturing temporal behavioral features in network traffic. Unlike the Static Topological Adjacency (STA) method, which focuses on spatial connectivity, DBA focuses on the behavioral similarity between nodes, providing an important supplement of dynamic features for encrypted traffic detection.

[0037] Step S3 mainly consists of the following processes: 3.1 Data Preprocessing and Feature Binning: Using the initial feature matrix obtained in the preprocessing stage... Based on the input, a mean imputation strategy is used to handle missing values. A key step is to discretize the continuous features using a K-means clustering binning strategy (k=12), with the bin boundaries determined by the training set data. in This represents the behavioral characteristics after binning, i.e., the center value or representative vector of the i-th bin; It represents the original continuous behavioral feature vector, which is a single sample feature in the input data; Let represent the set of samples in the i-th cluster bin. This is the i-th group formed after K-means clustering (k=12), containing all samples (i.e., feature vectors) assigned to that bin. (a set of data); to avoid overfitting and noise interference, post-processing is performed on the binning results: if the sample size of a certain bin... If the sample size is 300KB, it will be merged into the bin with the largest sample size. For example, the "downlink byte count standard deviation" feature of node 192.168.1.100 is 300KB. On the training set, K-means clustering may discretize this feature into 12 bins, for example: bin 1: [0-100KB), bin 2: [100KB-250KB), ..., bin 7: [500KB-700KB). If 300KB falls into bin 3 (assuming the range is [250KB-400KB)), it will be assigned to that bin. If the sample size of bin 3 is only 8 (<10), then this bin will be merged into the bin with the largest sample size (such as bin 2).

[0038] 3.2 Selection of Important Bins and Quantification of WOE: The selection of key important bins is based on the quantification of bin discrimination ability using Weight of Evidence (WOE). in This represents the proportion of malicious samples in this container to the total number of malicious samples. This represents the proportion of normal samples in this container to the total number of normal samples. and They are the box body The number of malicious and normal samples in China and That is the total number of samples.

[0039] The WOE threshold for important bins is automatically determined using inflection point detection: for all bins in the training set... Calculate the second difference after sorting the values. The position corresponding to the largest second-order difference is taken as the inflection point: in This means that the difference is calculated again from the first difference result to obtain the second difference, which reflects the change in the rate of decrease of the WOE value. The point where the absolute value of the second difference is the largest is the "inflection point" where the rate of decrease suddenly and drastically accelerates. Indicates the WOE threshold. Used to calculate the difference between two adjacent elements in a sequence. This indicates the position or index of the element in set S that represents the maximum value.

[0040] Ultimately, only The boxes are used as important boxes for subsequent construction of the behavioral feature matrix: in This represents the constructed behavioral feature vector. and , This indicates an indicator function that returns 1 if the condition within the parentheses is true, and 0 otherwise. Let k represent the k-th feature bin. This method achieves adaptive capture of behavioral patterns by combining a dynamic binning strategy with inflection point threshold selection, and relies on WOE quantization to ensure binning discriminative power. All thresholds are calculated based on the training set to ensure unbiased evaluation. For example, bin 3 for "downlink byte standard deviation" contains... One malicious sample, One normal sample. Total number of malicious samples. Total number of normal samples .but: If the threshold is determined through inflection point detection ,because This box is retained as an important box. The feature at node 192.168.1.100 falls within box 3, and its... The corresponding feature bits It was set to 1.

[0041] 3.3 Behavior Graph Extraction: After binning the behavioral features, the system first constructs a node feature matrix. For example, if the node set contains... Each network entity (such as an IP address) has a node with If the behavioral features are dimensional, then the feature matrix can be represented as follows: When focusing on behavioral characteristics, nodes and Behavioral similarity between them is calculated using the inner product: ,in and This represents a behavioral feature vector. This calculation method effectively captures the correlation between nodes in the behavioral feature space, providing a basic similarity metric for subsequent graph construction. For example, node 192.168.1.100 ( behavioral feature vectors For [1,0, 0, 1, ...], node 192.168.1.101 ( ) eigenvectors The range is [1, 0, 1, 0, ...]. Their similarity is... It calculates the dot product of two vectors, reflecting the degree of their matching on important behavioral patterns.

[0042] 3.4 Dynamic Thresholding and Adjacency Matrix Generation: The similarity matrix is ​​converted into a sparse adjacency matrix through dynamic thresholding. Specifically, a similarity threshold is set. , similarity matrix Binarization: When hour, ;otherwise . These are elements of the adjacency matrix A, representing nodes. and Does an edge exist between them? (This is related to the dynamic adjacency matrix.) middle, =1 indicates a node and Behavioral similarity exceeds threshold That is, their behavior patterns are highly similar, so connections are established in the graph; =0 indicates insufficient similarity and no connection. Threshold The choice of threshold is crucial. This method employs a dynamic determination strategy based on data distribution characteristics, such as adaptively determining the optimal threshold by calculating similarity quantiles or cluster centers. This dynamic threshold mechanism can effectively address the differences in behavioral patterns under different network environments, ensuring that the adjacency matrix captures significant behavioral similarities while maintaining reasonable sparsity, thus obtaining a dynamic behavioral adjacency matrix. For example, if the 95th percentile of the similarity values ​​for all nodes is 0.7, then set... .like Then in the dynamic behavior adjacency matrix middle, =1 indicates a node and Their behavioral patterns are highly similar.

[0043] 3.5 Graph Embedding Learning and Feature Output: The system employs a second graph convolutional network (GCN) architecture to learn node embedding representations. This process is achieved through multi-layer feature propagation: in This represents the output embedding of the (k+1)th layer GCN during Dynamic Behavior Adjacency (DBA) learning, such as the initial layer. These are the input features, obtained after k layers of propagation. As the final output; To add a self-loop adjacency matrix, This is the corresponding degree matrix. For trainable weight matrix, The ReLU and other non-linear activation functions are used. Through multi-layer graph convolution operations, the model can aggregate information from multiple neighbors, so that the embedding representation of each node not only includes its own features but also incorporates relevant information from nodes with similar behaviors. The final system obtains a behavior-enhanced node embedding matrix: in This represents the total number of floors. For the embedding dimension, this representation matrix integrates the node's own attributes and information from nodes with similar behaviors, forming a vector representation rich in dynamic behavioral features. For example, nodes initial features It is based on its behavioral characteristics. After passing through the GCN layer, it aggregates those with similar behavior (i.e., in...). Neighboring nodes (e.g., those connected by an edge) The feature information of ). The final result It is a feature vector that integrates the dynamic patterns of itself and its neighbors with similar behaviors.

[0044] S4: The vector representation of the static topological features and the vector representation of the dynamic behavioral features are concatenated to obtain a fused feature representation.

[0045] To comprehensively utilize the complementary information of static topology and dynamic behavior, the vector representation of static topological features learned by the Static Topological Adjacency (STA) branch is used. Vector representation of dynamic behavior features learned from the Dynamic Behavior Adjacency (DBA) branch The two feature matrices are then fused using a feature concatenation strategy, merging them along their feature dimensions to generate a unified fused feature representation. : The final result It also contains the spatial structural relationships and temporal behavioral patterns of the network, providing a richer representation for downstream detection tasks. (Based on nodes) Taking the IP address 192.168.1.100 as an example, its static characteristics It is a 128-dimensional vector (encoding topological connection patterns), dynamic features. It is a 64-dimensional vector (encoding behavioral similarity), which, when concatenated, forms a new 192-dimensional feature vector. .so, It also contains spatial relationships and behavioral evolution patterns between nodes, providing a more comprehensive input for downstream classification tasks. The entire fusion process is simple and efficient, requiring no complex transformations and ensuring complete information preservation.

[0046] S5: Train a classification model based on the fused feature representation, and use the trained classification model to classify and detect whether encrypted network traffic is malicious.

[0047] Obtain fusion feature representation Next, the model training and prediction phase begins. To evaluate the generalization ability of the features learned by this method, various machine learning classifiers are used for model training and comparison, including: Logistic Regression, Naive Bayes, K-Nearest Neighbors (KNN), Decision Tree, and XGBoost. Model training is based on... The input is the traffic label, and the supervision signal is the corresponding traffic label. By comparing the performance metrics (accuracy, precision, recall, and F1 score) of each classifier on the validation set, the optimal model is selected as the final detector. For new traffic data, its fusion characteristics are obtained after the aforementioned stages. Finally, the final prediction results It is given by the following formula: This design creates an end-to-end pipeline from raw data to detection results. → → → The system systematically verified the effectiveness of the fusion of static and dynamic features.

[0048] Example 2 Please see Figure 2 The diagram shown is a schematic representation of a cryptographic malicious traffic detection system based on dual adjacency graph embedding learning, as proposed in the second embodiment of this application. The system includes the following key modules: The data preprocessing module 100 is used to acquire raw encrypted network traffic data, perform preprocessing, extract initial features of multiple IP address nodes, and obtain an initial feature matrix. The static topological feature representation module 200 is used to construct a static topological adjacency matrix, and a first graph convolutional network is used to process the initial feature matrix and the static topological adjacency matrix to obtain a vector representation of the static topological features. The learning dynamic behavior feature representation module 300 is used to construct a dynamic behavior adjacency matrix, and a second graph convolutional network is used to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features. The fusion feature generation module 400 is used to concatenate the vector representation of the static topological features with the vector representation of the dynamic behavior features to obtain a fusion feature representation; The classification and detection module 500 is used to train a classification model based on the fused feature representation, and to use the trained classification model to classify and detect whether encrypted network traffic is malicious.

[0049] The encrypted malicious traffic detection system based on dual adjacency graph embedding learning in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, in-vehicle electronic devices, wearable devices, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), etc. This application embodiment does not impose specific limitations.

[0050] The encrypted malicious traffic detection system based on dual adjacency graph embedding learning in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0051] This application provides an encrypted malicious traffic detection system based on dual adjacency graph embedding learning, which can achieve... Figure 1 The various processes implemented in the method embodiment of the encrypted malicious traffic detection method based on dual adjacency graph embedding learning will not be described again here to avoid repetition.

[0052] Optionally, embodiments of this application also provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the various processes of the above-described embodiment of an encrypted malicious traffic detection method based on dual adjacency graph embedding learning, and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0053] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described embodiment of an encrypted malicious traffic detection method based on dual adjacency graph embedding learning, and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0054] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0055] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0056] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0057] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for detecting encrypted malicious traffic based on dual adjacency graph embedding learning, characterized in that, Includes the following steps: Obtain raw encrypted network traffic data, preprocess it, extract initial features from multiple IP address nodes, and obtain an initial feature matrix; Based on the initial feature matrix, static topological adjacency learning and dynamic behavioral adjacency learning are performed in parallel: Static topological adjacency learning is performed to construct a static topological adjacency matrix. The initial feature matrix and the static topological adjacency matrix are then processed using a first graph convolutional network to obtain a vector representation of the static topological features. Dynamic behavior adjacency learning is performed to construct a dynamic behavior adjacency matrix. A second graph convolutional network is then used to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features. The vector representations of the static topological features and the vector representations of the dynamic behavioral features are concatenated to obtain a fused feature representation; A classification model is trained based on the fused feature representation, and the trained classification model is used to classify and detect whether encrypted network traffic is malicious.

2. The method according to claim 1, characterized in that, The step of acquiring raw encrypted network traffic data and preprocessing it to obtain an initial feature matrix specifically includes: Network packets are extracted from the raw traffic file in PCAP format, and the network packets are reconstructed based on the five-tuple information consisting of source IP address, destination IP address, source port, destination port and protocol to obtain the network session; Perform multi-level feature parsing on each network session to extract basic network layer features, traffic statistics features, and TLS / SSL specific features; Session-level features are aggregated into IP-level feature representations. For numerical features, statistics including mean, maximum and standard deviation are calculated. For categorical features, the term frequency-inverse document frequency (TF-IDF) method is used to process them, forming the basic feature matrix of IP nodes. The basic feature matrix is ​​input into the attention-aware feature fusion module. The importance of features is dynamically evaluated through the self-attention mechanism and multi-head attention mechanism of the attention-aware feature fusion module. Deep feature interaction is achieved by combining residual connections and feedforward networks, and the enhanced initial feature matrix is ​​output.

3. The method according to claim 1, characterized in that, The steps for performing static topological adjacency learning specifically include: IP addresses in the network are abstracted as graph nodes to construct a static topology graph; wherein, when a first IP address node and a second IP address node are connected to a common destination IP address, the connection relationship between the first IP address node and the second IP address node is set to exist in the static topology adjacency matrix; The static topological adjacency matrix is ​​normalized by: ensuring the symmetry of the adjacency matrix through symmetry processing, and processing the symmetry-normalized adjacency matrix using symmetry normalization technology. During the training phase, label consistency constraints are applied to the IP address nodes in the training set, and the static topological adjacency matrix is ​​adjusted: if two IP address nodes have the same malicious or normal label, their connection weight is increased; if the labels are different, their connection weight is decreased. The normalized and label-consistency-constrained static topological adjacency matrix and the initial feature matrix are input into the first graph convolutional network, and the vector representation of the static topological features is learned through multi-layer feature propagation.

4. The method according to claim 1, characterized in that, The steps for performing dynamic behavior adjacency learning specifically include: Discretize the continuous behavioral features in the initial feature matrix to obtain the binned behavioral features; Based on the behavioral characteristics after binning, important bins are selected and evidence weights (WOE) are quantified to construct the behavioral characteristic matrix of the nodes. Calculate the behavioral similarity between any two IP address nodes in the behavioral feature matrix; The behavioral similarity is converted into the dynamic behavioral adjacency matrix through dynamic threshold processing, wherein when the behavioral similarity between two nodes is greater than a preset threshold, they are set to be connected in the dynamic behavioral adjacency matrix. The dynamic behavior adjacency matrix and the initial feature matrix are input into the second graph convolutional network to learn the vector representation of the dynamic behavior features.

5. The method according to claim 4, characterized in that, The step of discretizing the continuous behavioral features in the initial feature matrix specifically includes: Missing values ​​in the initial feature matrix are filled with the mean. The continuous behavioral features are binned using the K-means clustering algorithm, where the number of clusters k is set to 12, and the bin boundaries are determined by the training set data. Post-processing of binning results: Determine whether the number of samples in each bin is less than the preset minimum sample size threshold. If so, merge the bin into the bin with the largest sample size.

6. The method according to claim 5, characterized in that, The steps of selecting important boxes and quantifying the weight of evidence (WOE) specifically include: The Weight of Evidence (WOE) value for each box is calculated using the following formula: in, This represents the proportion of malicious samples in this container to the total number of malicious samples. This represents the proportion of normal samples in this container to the total number of normal samples. and They are the box body The number of malicious and normal samples in China and This is the total number of samples; The WOE threshold of important boxes is automatically determined by the inflection point detection method. Specifically, the absolute WOE values ​​of all boxes are sorted, the second difference of the sorted numerical sequence is calculated, and the position corresponding to the largest second difference value is taken as the inflection point. The absolute WOE value corresponding to the inflection point is the WOE threshold. Only boxes with an absolute WOE value greater than the WOE threshold are retained as important boxes, and the behavior feature matrix of the node is constructed based on the important boxes.

7. The method according to claim 1, characterized in that, The step of training the classification model based on the fused feature representation specifically involves: using at least one classifier among logistic regression, Naive Bayes, K-nearest neighbors, decision tree, and XGBoost, with the fused feature representation as input and the corresponding traffic label as the supervision signal, to train the model.

8. A cryptographic malicious traffic detection system based on dual adjacency graph embedding learning, characterized in that, include: The data preprocessing module is used to acquire raw encrypted network traffic data, perform preprocessing, extract initial features from multiple IP address nodes, and obtain an initial feature matrix. A static topological feature representation module is learned to construct a static topological adjacency matrix, and a first graph convolutional network is used to process the initial feature matrix and the static topological adjacency matrix to obtain a vector representation of the static topological features; A dynamic behavior feature representation module is used to construct a dynamic behavior adjacency matrix, and a second graph convolutional network is used to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of the dynamic behavior features. The fusion feature generation module is used to concatenate the vector representation of the static topological features with the vector representation of the dynamic behavior features to obtain a fusion feature representation; The classification and detection module is used to train a classification model based on the fused feature representation, and to use the trained classification model to classify and detect whether encrypted network traffic is malicious.

9. An electronic device, characterized in that, The method includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the steps of the encrypted malicious traffic detection method based on dual adjacency graph embedding learning as described in any one of claims 1-7.

10. A readable storage medium, characterized in that, The program or instructions are stored on the readable storage medium, and when the program or instructions are executed by the processor, they implement the steps of the encrypted malicious traffic detection method based on dual adjacency graph embedding learning as described in any one of claims 1-7.

Images