A method and system for encrypted malicious traffic detection based on dual adjacency graph embedding learning

Abstract

The application belongs to the technical field of network security, and discloses an encrypted malicious traffic detection method and system based on dual adjacency graph embedding learning, which comprises the following steps: preprocessing after obtaining original encrypted network traffic data, generating an initial feature matrix of multiple IP address nodes; processing the initial feature matrix and a static topology adjacency matrix by using a first graph convolution network to obtain a vector representation of static topology features; processing the initial feature matrix and a dynamic behavior adjacency matrix by using a second graph convolution network to obtain a vector representation of dynamic behavior features; splicing the vector representation of static topology features and the vector representation of dynamic behavior features to obtain a fusion feature representation; training a classification model based on the fusion feature representation, and using the trained classification model to classify and detect whether encrypted network traffic is malicious or not. The application effectively fuses the spatial structure information and behavior time sequence information of network traffic, and improves the recognition ability of encrypted malicious threats.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security combined with artificial intelligence, and particularly relates to an encrypted malicious traffic detection method and system based on dual adjacency graph embedding learning. BACKGROUND

[0002] Encrypted malicious traffic detection is one of the core technologies in the field of network security, aiming to identify malicious activities transmitted through encrypted channels such as TLS / SSL, such as botnet command and control communication, data leakage, etc. With the widespread application of network encryption protocols, traditional detection methods based on plaintext traffic have gradually become ineffective, prompting researchers to develop various new detection schemes. These methods mainly extract patterns from traffic features to distinguish between malicious and normal behavior. Existing encrypted malicious traffic detection methods can be divided into the following types according to the technical basis:

[0003] Traditional rule-based methods: This method includes signature-based and side-channel feature-based detection techniques. Signature-based methods identify by matching specific patterns of known attacks, but are highly dependent on prior knowledge bases and are difficult to deal with new threats. Side-channel-based methods use statistical analysis of unencrypted meta-information, but are strongly dependent on manual feature engineering and have limited generalization ability.

[0004] Deep learning-based methods: This class of methods uses end-to-end feature learning to automatically extract discriminative features from raw traffic data, breaking through the limitations of manual design. However, these methods focus more on the internal features of individual flows, ignoring the structural relationships between network entities, making it difficult to fully reflect complex interactive behaviors.

[0005] Graph neural network-based methods: This class of methods constructs network communication graphs and uses graph neural networks to learn node embeddings to capture the association patterns between entities. Although this method has advantages in modeling spatial structures, existing research has focused on static topological features, resulting in insufficient detection performance when dealing with adaptive threats.

[0006] Overall, although existing methods provide diverse solutions for encrypted malicious traffic detection, they still face fundamental limitations. Whether relying on prior knowledge, focusing on single-flow internal features, or focusing on static associations, the core perspective of these methods mostly stays in the description of network connection states or fixed behavior patterns, failing to effectively break through the framework of static analysis. This neglect of dynamic behavior evolution patterns and their interaction with static structures makes the detection performance of existing technologies encounter bottlenecks when dealing with complex and continuously evolving encrypted threats, leaving room for improvement. SUMMARY

[0007] Based on this, in view of the static analysis limitation of the existing encrypted malicious traffic detection method in processing dynamic and adaptive threats, the application provides an encrypted malicious traffic detection method and system based on double adjacency graph embedding learning.

[0008] In the first aspect, the application provides an encrypted malicious traffic detection method based on double adjacency graph embedding learning, comprising the following steps:

[0009] Obtain original encrypted network traffic data and perform preprocessing to extract initial features of multiple IP address nodes to obtain an initial feature matrix;

[0010] Based on the initial feature matrix, perform static topology adjacency learning and dynamic behavior adjacency learning in parallel:

[0011] Perform static topology adjacency learning, construct a static topology adjacency matrix, and use a first graph convolution network to process the initial feature matrix and the static topology adjacency matrix to obtain a vector representation of static topology features;

[0012] Perform dynamic behavior adjacency learning, construct a dynamic behavior adjacency matrix, and use a second graph convolution network to process the initial feature matrix and the dynamic behavior adjacency matrix to obtain a vector representation of dynamic behavior features;

[0013] Concatenate the vector representation of the static topology features and the vector representation of the dynamic behavior features to obtain a fusion feature representation;

[0014] Train a classification model based on the fusion feature representation, and use the trained classification model to classify and detect whether the encrypted network traffic is malicious or not.

[0015] As an optional implementation of the first aspect of the application, the step of obtaining original encrypted network traffic data and preprocessing to obtain an initial feature matrix specifically includes: extracting network packets from a PCAP format original traffic file, and reconstructing network sessions according to five-tuple information composed of source IP address, destination IP address, source port, destination port and protocol; performing multi-level feature analysis on each network session to extract basic network layer features, traffic statistical features and TLS / SSL specific features; aggregating session-level features into IP-level feature representation, wherein statistical quantities including mean, maximum and standard deviation are calculated for numerical value type features, and term frequency-inverse document frequency (TF-IDF) method is used to process categorical features to form a basic feature matrix of IP nodes; inputting the basic feature matrix into an attention-aware feature fusion module, dynamically evaluating feature importance through self-attention mechanism and multi-head attention mechanism of the attention-aware feature fusion module, and combining residual connection and feedforward network to realize deep feature interaction, and outputting the initial feature matrix.

[0016] As an optional implementation of the first aspect of the application, the step of performing static topology adjacency learning specifically includes: abstracting IP addresses in the network into graph nodes to construct a static topology graph; wherein when a first IP address node and a second IP address node are connected to a common destination IP address, the connection relationship between the first IP address node and the second IP address node in the static topology adjacency matrix is set as existing connection; performing normalization processing on the static topology adjacency matrix, including: ensuring the symmetry of the adjacency matrix through symmetrization processing, and processing the symmetrized adjacency matrix using symmetric normalization technology; in the training phase, applying label consistency constraint to IP address nodes in the training set, adjusting the static topology adjacency matrix: if two IP address nodes have the same malicious or normal label, the connection weight is enhanced; if the labels are different, the connection weight is weakened; inputting the normalized and label consistency constrained static topology adjacency matrix and the initial feature matrix into the first graph convolutional network to obtain the vector representation of the static topology feature through multi-layer feature propagation learning.

[0017] As an optional implementation of the first aspect of this application, the step of performing dynamic behavioral adjacency learning specifically includes: discretizing the continuous behavioral features in the initial feature matrix to obtain binned behavioral features; based on the binned behavioral features, selecting important bins and performing Word of Evidence (WOE) quantization to construct a node behavioral feature matrix; calculating the behavioral similarity between any two IP address nodes in the behavioral feature matrix; converting the behavioral similarity into the dynamic behavioral adjacency matrix through dynamic thresholding, wherein when the behavioral similarity between two nodes is greater than a preset threshold, they are set to be connected in the dynamic behavioral adjacency matrix; and inputting the dynamic behavioral adjacency matrix and the initial feature matrix into the second graph convolutional network to learn the vector representation of the dynamic behavioral features.

[0018] As an optional implementation of the first aspect of this application, the step of discretizing the continuous behavioral features in the initial feature matrix specifically includes: filling the missing values ​​in the initial feature matrix with the mean; using the K-means clustering algorithm to bin the continuous behavioral features, wherein the number of clusters k is set to 12, and the bin boundaries are determined by the training set data; and post-processing the binning results: determining whether the number of samples in each bin is less than a preset minimum sample size threshold, and if so, merging the bin into the bin with the largest sample size.

[0019] As an optional implementation of the first aspect of this application, the step of selecting important boxes and quantifying the Weight of Evidence (WOE) specifically includes: calculating the WOE value of each box using a formula, wherein the formula is: ,in, This represents the proportion of malicious samples in this container to the total number of malicious samples. This represents the proportion of normal samples in this container to the total number of normal samples. and They are the box body The number of malicious and normal samples in China and The total number of samples is used. The WOE threshold of important boxes is automatically determined by the inflection point detection method. Specifically, the absolute WOE values ​​of all boxes are sorted, the second difference of the sorted numerical sequence is calculated, and the position corresponding to the largest second difference value is taken as the inflection point. The absolute WOE value corresponding to the inflection point is the WOE threshold. Only boxes with an absolute WOE value greater than the WOE threshold are retained as important boxes, and the behavior feature matrix of the node is constructed based on the important boxes.

[0020] As an optional implementation of the first aspect of the application, the step of training a classification model based on the fusion feature representation is specifically: using at least one of a logistic regression, a naive Bayes, a K-nearest neighbor, a decision tree, and an XGBoost classifier, taking the fusion feature representation as input and taking a corresponding traffic label as a supervision signal to perform model training, so as to generate the dynamic behavior adjacency matrix.

[0021] In a second aspect, the embodiments of the application provide a system for detecting encrypted malicious traffic based on double adjacency graph embedding learning, comprising:

[0022] A data preprocessing module is configured to acquire original encrypted network traffic data, perform preprocessing, extract initial features of a plurality of IP address nodes, and obtain an initial feature matrix.

[0023] A learning static topology feature representation module is configured to construct a static topology adjacency matrix, and process the initial feature matrix and the static topology adjacency matrix by using a first graph convolution network to obtain a vector representation of a static topology feature.

[0024] A learning dynamic behavior feature representation module is configured to construct a dynamic behavior adjacency matrix, and process the initial feature matrix and the dynamic behavior adjacency matrix by using a second graph convolution network to obtain a vector representation of a dynamic behavior feature.

[0025] A fusion feature generation module is configured to splice the vector representation of the static topology feature and the vector representation of the dynamic behavior feature to obtain a fusion feature representation.

[0026] A classification detection module is configured to train a classification model based on the fusion feature representation, and perform classification detection of encrypted network traffic by using the trained classification model.

[0027] In a third aspect, the embodiments of the application provide an electronic device, which comprises a processor, a memory, and a program or instructions stored in the memory and executable on the processor, and the program or instructions are executed by the processor to implement the steps of the method according to the first aspect.

[0028] In a fourth aspect, the embodiments of the application provide a readable storage medium, which stores a program or instructions, and the program or instructions are executed by a processor to implement the steps of the method according to the first aspect.

[0029] Compared with the prior art, the application has the following beneficial effects:

[0030] 1. Dual view angle fusion: The application innovatively constructs two parallel graph learning branches of static topology adjacency and dynamic behavior adjacency, respectively capturing the spatial structure dependence and temporal behavior similarity of network traffic, and effectively combining the two complementary information through feature fusion, compared with the existing method relying on a single view, it can more comprehensively and profoundly depict the essential characteristics of encrypted traffic.

[0031] 2. Dynamic behavior adaptive modeling: Through a series of automatic processing procedures such as K-means binning, WOE quantification and inflection point detection, this method can adaptively select the most discriminant patterns from high-dimensional behavior features and construct dynamic behavior graphs. This mechanism reduces the dependence on human experience and enhances the adaptability of the model to different network environments and new threats.

[0032] 3. Improve detection performance: Since the information of static and dynamic dimensions is fused, the generated fusion feature representation has stronger discriminability and robustness. In the face of encrypted malicious traffic with hidden behavior and variable patterns, this method can significantly improve the accuracy and recall rate of detection, effectively reduce false negatives and false positives, and provide more reliable technical support for network security protection. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 is a flowchart of an encrypted malicious traffic detection method based on dual adjacency graph embedding learning according to an embodiment of the application;

[0034] Figure 2 is a structural schematic diagram of an encrypted malicious traffic detection system based on dual adjacency graph embedding learning provided by an embodiment of the application. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0036] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, not to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein. In addition, "and / or" in the specification and claims indicates at least one of the connected objects, and the character " / ", generally indicates that the front and rear associated objects are in an "or" relationship. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise explicitly specified.

[0037] Embodiment 1

[0038] Referring to Figure 1 A flowchart of an encrypted malicious traffic detection method based on dual adjacency graph embedding learning provided by an embodiment of the present application. The method can include the following steps:

[0039] S1: Obtain original encrypted network traffic data and perform preprocessing to extract initial features of multiple IP address nodes to obtain an initial feature matrix.

[0040] Based on the analysis of the characteristics of encrypted traffic, the embodiment reconstructs the sessions from the original traffic file in PCAP format . The first step is session reconstruction, which aims to recombine discrete packets into complete network sessions according to the five-tuple. On this basis, the statistical features (such as packet size, transmission direction, time interval, etc.) of each session are extracted, and a basic feature vector is generated for each IP address aggregation. These basic features together constitute the IP-level feature matrix . Among them, the static features such as SrcIP and DstIP contained will be used for the construction of the second-stage static topology adjacency (STA) graph, while the dynamic behavior features such as packet length sequence and time interval will be used for the construction of the dynamic behavior adjacency (DBA) graph. The matrix as the final output of this step provides a structured high-quality input for subsequent representation learning. This preprocessing process mainly includes the following links:

[0041] 1.1 Packet extraction and session reconstruction: Extract network packets from the original traffic file in PCAP format , and reconstruct sessions according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol) to recombine discrete packets into complete network sessions. For example, from the PCAP file, a series of packets with source IP 192.168.1.100, destination IP 93.184.216.34, source port 55001, destination port 443, and protocol TCP are parsed. This step aggregates these packets to form a complete TLS encrypted session flow.

[0042] 1.2 Multi-level feature analysis: Zeek network analysis tool is used to perform deep analysis on each session, extracting basic network layer features (such as IP address, port), traffic statistics features (such as byte count, session duration), and TLS / SSL specific features (such as encryption suite, SNI). For the above session, Zeek can analyze the features: session duration = 180 seconds, total uplink byte count = 150 KB, total downlink byte count = 800 KB, uplink packet count = 120, downlink packet count = 95, average packet size ≈ 8.2 KB, and TLS handshake phase plaintext SNI (Server Name Indication) = example.com.

[0043] 1.3 Feature aggregation and conversion: aggregate session-level features into IP-level feature representation, calculate statistics (mean, maximum, etc.) for numerical features, and use TF-IDF and other methods for categorical features to form the basic feature matrix of IP nodes. For example, within a 5-minute time window, IP address 192.168.1.100 initiates 10 TLS sessions. Then aggregate all session features of this IP: numerical features such as downlink byte count, calculate the sum = 5MB, mean = 500KB, maximum = 1.2MB, standard deviation = 300KB; for categorical features such as SNI, count the frequency of each SNI and calculate the TF-IDF value. Finally, this IP is represented as a feature vector containing dozens of dimensions, such as [5MB, 500KB, 1.2MB, 300KB,..., TF-IDF(example.com) = 0.85,...].

[0044] 1.4 Attention-aware feature fusion: input the basic feature matrix into the attention-aware feature fusion module, which introduces an attention-aware feature fusion (AFF) mechanism to dynamically evaluate feature importance through self-attention and multi-head attention, and combines residual connection and feedforward network to realize deep feature interaction, generating an enhanced initial feature matrix as input for graph learning. For example, the original aggregated feature vector of an IP node contains the above statistical features. The AFF module calculates the correlation between features through self-attention mechanism, and may find that the standard deviation of downlink byte count and the TF-IDF value of a specific SNI are more critical for distinguishing malicious traffic, thus assigning higher attention weights to these features. After processing by the AFF module, the enhanced feature vector has its discriminative information highlighted, such as the weights of key features being significantly increased.

[0045] S2: construct a static topology adjacency matrix and use a first graph convolutional network to process the initial feature matrix and the static topology adjacency matrix to obtain a vector representation of static topology features.

[0046] After the preprocessing and feature enhancement steps are completed, the core method part of the embodiment is formally entered. First, the static topology adjacency (STA) learning is introduced. The static topology adjacency learning, as an important component of the system, is designed based on the inherent spatial structure characteristics in network communication. By constructing a communication graph model, extracting the topology relationship, and learning the node embedding representation, a feature representation rich in spatial structure information is finally generated. In network communication, traffic data exists in the form of one-way data flow from the source IP address to the destination IP address. To fully exploit the structural features in encrypted traffic, the embodiment constructs a static topology graph model based on communication trajectories, which is formalized as a graph structure. Through the system's graph convolution network learning and discriminative constraint enhancement mechanism, the deep extraction of network spatial topology features is realized.

[0047] Step S2 mainly includes the following processes:

[0048] 2.1 Communication graph construction and initialization: The IP addresses in the network are abstracted as graph nodes, and the connection relationship is established based on the actual communication records. Specifically, the graph structure is constructed , where the node set corresponds to different IP addresses, and the static topology adjacency matrix is defined as:

[0049]

[0050] where is the element in the i-th row and j-th column of the static topology adjacency matrix A, and the value is 1 or 0, indicating whether the nodes and share a common communication target; represents the source IP-destination IP connection relationship set, represents the i-th address, represents the j-th address, and the formula =1 is the condition that there is at least one node such that and have a connection (i.e. ), and and also have a connection (i.e. ). This definition ensures that only nodes that share a common communication target establish a connection, accurately reflecting the actual topology structure of the network. For example, in the preprocessing result of step S1, the IP address 192.168.1.100 (denoted as node ) has communication with the destination IP 93.184.216.34 (i.e. the server of example.com), while another IP address 192.168.1.101 (denoted as node also communicated with the same purpose IP 93.184.216.34. Then according to the definition, and share the same communication target, so in the adjacency matrix = = 1. If the node (such as 192.168.1.102) does not communicate with 93.184.216.34, then = = 0.

[0051] 2.2 Adjacency matrix normalization processing: in order to improve the stability of the training of the graph convolution network, the adjacency matrix is standardized. The specific process is:

[0052] 2.2.1 First, since the network communication relationship is essentially undirected, the present application ensures the symmetry of the adjacency matrix through symmetrization processing: ;

[0053] 2.2.2 Then, the symmetric normalization technique is used to prevent training bias caused by uneven node degree distribution:

[0054]

[0055] where denotes the normalized static topology adjacency matrix, and the diagonal elements of the degree matrix are calculated by . The normalized adjacency matrix is obtained, which not only maintains the original topological structure information, but also significantly improves the numerical stability of subsequent graph convolution operations. For example, in the initial adjacency matrix only = = 1, and other elements are 0. After symmetrization (because it has been symmetrized). The diagonal elements of the degree matrix D are = 1, = 1, = 0 (zero division needs to be avoided, usually self-connection is added for isolated nodes). After normalization, we get , which is used for subsequent GCN operations.

[0056] 2.3 Graph convolution feature learning: based on the first graph convolution network, a multi-layer feature propagation mechanism is used to learn the node embedding representation:

[0057]

[0058] where denotes the output node embedding matrix of the k+1 layer graph convolution network GCN when learning static topology adjacency (STA), It is an n×d matrix, where n is the number of nodes in the graph (e.g., the number of IP addresses), and d is the dimension of the embedded features. It represents the representation learned by a node after k+1 layers of feature propagation, capturing information about the node itself and its multi-hop neighbors; when k=0, Based on the initial feature matrix The first-order embedding is calculated from the direct neighbors; when k=1, It further aggregates the features of second-order neighbors (neighbors of neighbors), and so on. The initial feature matrix generated for the attention-aware feature fusion module. For the first Layer-based trainable weight matrices. By stacking multiple layers of GCN, the model can capture multi-hop neighbor information: the first layer learns direct neighbor features, the second layer expands to second-order neighbor features, and so on. For example, the initial feature matrix... This includes the feature vector of the IP node from step S1 (e.g., the features of 192.168.1.100 are [5MB, 500KB, ...]). After passing through the first layer of GCN, the node... Features will aggregate its direct neighbors The second layer further aggregates second-order neighbor information to learn a richer topological representation.

[0059] 2.4 Enhanced Discriminative Constraints: To enhance the discriminativeness of topology learning, label consistency constraints are imposed on the training set nodes:

[0060]

[0061] in This represents a subset of nodes in the training set. This constraint mechanism ensures that during the training phase, strong connections are established only between nodes with the same label, thereby enhancing the model's ability to distinguish malicious traffic. For example, in the training set, nodes... (IP192.168.1.100) and If all IPs (192.168.1.101) are marked as "malicious", their connection weight is increased to 2; if one of them is not marked, the weight remains at 1; if the labels are different, the weight is reduced to 0.5.

[0062] After multi-layer graph convolution operations, the output is a vector representation of the static topological features enhanced by topology. Each row corresponds to the final feature vector of a node. These feature vectors integrate the node's own attribute information and topological structure information, forming a rich and highly discriminative feature representation, laying the foundation for subsequent fusion with dynamic behavior features. For example, for a node... (IP192.168.1.100), its output characteristics Not only contains the original traffic statistical features, but also encodes the association patterns with neighbor nodes (such as ), forming a more discriminative representation, preparing for the subsequent fusion with dynamic behavior features.

[0063] S3: Constructing a dynamic behavior adjacency matrix, and processing the initial feature matrix and the dynamic behavior adjacency matrix using a second graph convolution network to obtain a vector representation of the dynamic behavior features.

[0064] The dynamic behavior adjacency (DBA) method is another important part of the system, and its core idea is to construct a relationship graph by quantifying the similarity of dynamic behavior patterns between nodes, thereby capturing the timing behavior features in network traffic. Based on the feature matrix obtained in the preprocessing stage, a relationship graph is constructed by quantifying the similarity of dynamic behavior patterns between nodes, thereby capturing the timing behavior features in network traffic. Unlike the static topology adjacency (STA) method, which focuses on spatial connection relationships, DBA focuses on the similarity of behavior between nodes, providing an important dynamic feature supplement for encrypted traffic detection.

[0065] Step S3 mainly includes the following processes:

[0066] 3.1 Data preprocessing and feature binning: Based on the initial feature matrix obtained in the preprocessing stage, the missing values are processed using the mean filling strategy. The key step is to discretize the continuous features using the K-means clustering binning strategy (k=12), and the bin boundaries are determined by the training set data:

[0067]

[0068] where represents the binned behavior features, i.e. the center value or representative vector of the i-th bin; represents the original continuous behavior feature vector, which is a single sample feature in the input data; represents the sample set in the i-th clustering bin, which is the i-th grouping formed after K-means clustering (k=12) and contains all samples assigned to this bin (i.e. the set of feature vectors To avoid overfitting and noise interference, post-processing is performed on the binning results: if the sample size If so, it will be merged into the bin with the largest sample size. For example, the feature value of the node 192.168.1.100, "Downlink Byte Standard Deviation" is 300KB. On the training set, K-means clustering may discretize this feature into 12 bins, for example: Bin 1: [0-100KB), Bin 2: [100KB-250KB),..., Bin 7: [500KB-700KB). If 300KB falls into Bin 3 (assuming the range is [250KB-400KB)), it will be assigned to this bin. If the sample size of Bin 3 is only 8 (<10), this bin will be merged into the bin with the largest sample size (e.g., Bin 2).

[0069] 3.2 Important bin selection and WOE quantification: key important bin selection is based on the discriminative ability of the evidence weight (WOE) quantification of the bin:

[0070]

[0071] wherein is the proportion of malicious samples in this bin to the total number of malicious samples, is the proportion of normal samples in this bin to the total number of normal samples, and are the number of malicious and normal samples in bin respectively, and are the total number of samples.

[0072] Adopting inflection point detection to automatically determine the WOE threshold of important bins: sort the values of of all bins in the training set, and calculate the second-order difference , and the position corresponding to the maximum second-order difference value is the inflection point:

[0073]

[0074] wherein represents calculating the difference again on the first-order difference result to obtain the second-order difference, which reflects the change of the descending rate of the WOE value, and the point with the maximum absolute value of the second-order difference is the "inflection point" where the descending rate suddenly increases sharply; represents the WOE threshold, is used to calculate the difference value of adjacent two elements in a sequence, represents the position or index of the element corresponding to the maximum value in the set S.

[0075] Finally, only the bins of are retained as important bins, which are used for subsequent construction of the behavior feature matrix:

[0076]

[0077] in This represents the constructed behavioral feature vector. and , This indicates an indicator function that returns 1 if the condition within the parentheses is true, and 0 otherwise. Let k represent the k-th feature bin. This method achieves adaptive capture of behavioral patterns by combining a dynamic binning strategy with inflection point threshold selection, and relies on WOE quantization to ensure binning discriminative power. All thresholds are calculated based on the training set to ensure unbiased evaluation. For example, bin 3 for "downlink byte standard deviation" contains... One malicious sample, One normal sample. Total number of malicious samples. Total number of normal samples .but:

[0078]

[0079] If the threshold is determined through inflection point detection ,because This box is retained as an important box. The feature at node 192.168.1.100 falls within box 3, and its... The corresponding feature bits It was set to 1.

[0080] 3.3 Behavior Graph Extraction: After binning the behavioral features, the system first constructs a node feature matrix. For example, if the node set contains... Each network entity (such as an IP address) has a node with If the behavioral features are dimensional, then the feature matrix can be represented as follows: When focusing on behavioral characteristics, nodes and Behavioral similarity between them is calculated using the inner product: ,in and This represents a behavioral feature vector. This calculation method effectively captures the correlation between nodes in the behavioral feature space, providing a basic similarity metric for subsequent graph construction. For example, node 192.168.1.100 ( behavioral feature vectors For [1,0, 0, 1, ...], node 192.168.1.101 ( ) eigenvectors The range is [1, 0, 1, 0, ...]. Their similarity is... It calculates the dot product of two vectors, reflecting the degree of their matching on important behavioral patterns.

[0081] 3.4 Dynamic threshold and adjacency matrix generation: The similarity matrix is converted to a sparse adjacency matrix through dynamic thresholding. Specifically, a similarity threshold is set to binarize the similarity matrix . ; otherwise . is an element of the adjacency matrix A, indicating whether there is an edge between nodes and . In the dynamic behavior adjacency matrix , =1 indicates that the behavior similarity of nodes and exceeds the threshold , i.e., their behavior patterns are highly similar, so a connection is established in the graph; =0 indicates insufficient similarity, no connection. The choice of threshold is crucial, and this method adopts a dynamic determination strategy based on data distribution characteristics, such as adaptively determining the optimal threshold by calculating the similarity quantile or cluster center. This dynamic threshold mechanism can effectively cope with the differences in behavior patterns under different network environments, ensuring that the adjacency matrix can both capture significant behavior similarity and maintain reasonable sparsity, thus obtaining the dynamic behavior adjacency matrix . For example, if the 95% quantile of all node pair similarity values is 0.7, then set . If , then in the dynamic behavior adjacency matrix , =1, indicating that the behavior patterns of nodes and are highly similar.

[0082] 3.5 Graph embedding learning and feature output: The system uses a second graph convolutional network (GCN) architecture to learn node embedding representations. This process is achieved through multi-layer feature propagation:

[0083]

[0084] where represents the output embedding of the k+1 layer GCN during dynamic behavior adjacency (DBA) learning, such as the initial layer is the input feature, and after k layers of propagation, we get as the final output; is the adjacency matrix with self-loops, is the corresponding degree matrix, is the trainable weight matrix, is a nonlinear activation function such as ReLU. Through multi-layer graph convolution operations, the model can aggregate multiple neighbor information, so that the embedding representation of each node not only contains its own features, but also integrates the relevant information of behavior similar nodes. Finally, the system obtains a behavior-enhanced node embedding matrix:

[0085]

[0086] wherein is the total number of layers, is the embedding dimension. This representation matrix integrates the node's own attributes and the information of its behavior similar nodes, forming a vector representation rich in dynamic behavior characteristics . For example, the initial feature of node is its behavior feature. After the GCN layer, it aggregates the feature information of neighbor nodes (such as ) that are behavior similar (i.e., have edges connected in ). The final is a feature vector that integrates the dynamic patterns of itself and its behavior similar neighbors.

[0087] S4: Feature splicing the vector representation of the static topology features and the vector representation of the dynamic behavior features to obtain a fused feature representation.

[0088] To comprehensively utilize the two complementary information of static topology and dynamic behavior, the vector representation of the static topology features learned by the static topology adjacency (STA) branch is fused with the vector representation of the dynamic behavior features learned by the dynamic behavior adjacency (DBA) branch . A feature splicing (Feature Concatenation) strategy is adopted to merge the two feature matrices in the feature dimension to generate a unified fused feature representation :

[0089]

[0090] The final contains both the spatial structure relationship of the network and the temporal behavior pattern, providing a more informative representation for downstream detection tasks. Taking node (corresponding to IP address 192.168.1.100) as an example, its static feature is a 128-dimensional vector (encoding the topology connection pattern), and the dynamic feature is a 64-dimensional vector (encoding the behavior similarity). After splicing, a new 192-dimensional feature vector is formed. In this way, Meanwhile, the spatial relationship and behavior evolution mode between nodes are contained, providing more comprehensive input for downstream classification tasks. The whole fusion process is simple and efficient, without complex transformation, ensuring complete information retention.

[0091] S5: training a classification model based on the fusion feature representation, and using the trained classification model to classify and detect whether the encrypted network traffic is malicious or not.

[0092] Obtaining a fusion feature representation After that, the detection model training and prediction phase is entered. To evaluate the generalization ability of the features learned by the method, multiple machine learning classifiers are used for model training and comparison, including: Logistic Regression, Naive Bayes, KNN, Decision Tree, and XGBoost. The model training takes as input and the corresponding traffic label as the supervision signal. By comparing the performance indicators (accuracy, precision, recall, and F1 score) of each classifier on the validation set, the optimal model is selected as the final detector . For new traffic data, after the fusion feature is obtained through the preceding stages, the final prediction result is given by the following formula:

[0093]

[0094] This design forms an end-to-end pipeline from raw data to detection results → → → , which systematically verifies the effectiveness of static and dynamic feature fusion.

[0095] Embodiment 2

[0096] Please refer to Figure 2 , which shows the structure of a dual adjacency graph embedding learning-based encrypted malicious traffic detection system proposed in the second embodiment of the application. The system includes the following key modules:

[0097] The data preprocessing module 100 is used to obtain raw encrypted network traffic data and perform preprocessing to extract initial features of multiple IP address nodes and obtain an initial feature matrix.

[0098] The static topology feature representation learning module 200 is used to construct a static topology adjacency matrix and process the initial feature matrix and the static topology adjacency matrix using a first graph convolutional network to obtain a vector representation of the static topology features.

[0099] The learning dynamic behavior feature representation module 300 is configured to construct a dynamic behavior adjacency matrix, and process the initial feature matrix and the dynamic behavior adjacency matrix by using a second graph convolution network to obtain a vector representation of a dynamic behavior feature.

[0100] The fusion feature generation module 400 is configured to splice the vector representation of the static topology feature and the vector representation of the dynamic behavior feature to obtain a fusion feature representation.

[0101] The classification detection module 500 is configured to train a classification model based on the fusion feature representation, and perform classification detection on encrypted network traffic by using the trained classification model to determine whether the encrypted network traffic is malicious or not.

[0102] The encryption malicious traffic detection system based on double adjacency graph embedding learning in the embodiment of the present application can be a device, or a component, integrated circuit or chip in a terminal. The device can be a mobile electronic device, or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a notebook computer, a palm computer, a vehicle-mounted electronic device, a wearable device, an Ultra-mobile Personal Computer (UMPC), a netbook or a Personal Digital Assistant (PDA), etc., and the non-mobile electronic device can be a server, a Network Attached Storage (NAS), a Personal Computer (PC), etc., and the embodiment of the present application is not limited in this regard.

[0103] The encryption malicious traffic detection system based on double adjacency graph embedding learning in the embodiment of the present application can be a device with an operating system. The operating system can be an Android operating system, an IOS operating system or other possible operating systems, and the embodiment of the present application is not limited in this regard.

[0104] The encryption malicious traffic detection system based on double adjacency graph embedding learning provided in the embodiment of the present application can implement the method embodiment of the encryption malicious traffic detection method based on double adjacency graph embedding learning. Figure 1 The encryption malicious traffic detection system based on double adjacency graph embedding learning provided in the embodiment of the present application can implement the method embodiment of the encryption malicious traffic detection method based on double adjacency graph embedding learning.

[0105] Optionally, the embodiments of the present application further provide an electronic device, comprising a processor, a memory, a program or instructions stored in the memory and executable in the processor, which, when executed by the processor, implement each process of the above-mentioned embodiments of the method for detecting encrypted malicious traffic based on dual adjacency graph embedding learning and achieve the same technical effects. To avoid repetition, details are not described herein.

[0106] The embodiments of the present application further provide a readable storage medium having a program or instructions stored thereon, which, when executed by a processor, implement each process of the above-mentioned embodiments of the method for detecting encrypted malicious traffic based on dual adjacency graph embedding learning and achieve the same technical effects. To avoid repetition, details are not described herein.

[0107] The processor is the processor of the electronic device in the above-mentioned embodiments. The readable storage medium includes a computer readable storage medium, such as a computer readable only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc.

[0108] It should be noted that, in this document, the terms "comprising", "including", or any other variant thereof are intended to cover non-exclusive inclusions, so that processes, methods, articles, or devices including a series of elements not only include those elements, but also include other elements not explicitly listed, or include elements inherent to such processes, methods, articles, or devices. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of another identical element in the process, method, article, or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to the order of performing functions as shown or discussed, but can also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method can be performed in an order different from that described, and various steps can also be added, omitted, or combined. In addition, the features described with reference to certain examples can be combined in other examples.

[0109] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, also can be through hardware, but many cases the former is the better embodiment. Based on such understanding, the technical solutions of the present application essentially or say the part of the contribution to the prior art can be embodied in the form of software products, the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disc), including a number of instructions to make a terminal (may be a mobile phone, computer, server, air conditioner, or network equipment, etc.) executes the method described in various embodiments of the present application.

[0110] The embodiments of the present application are described above in conjunction with the drawings, but the present application is not limited to the above-mentioned specific embodiments, the above-mentioned specific embodiments are only illustrative, but not limited, those skilled in the art can make many forms without departing from the purpose of the present application and the scope of the claims under the inspiration of the present application, all belong to the protection of the present application.

Claims

1. A method for encrypted malicious traffic detection based on dual adjacency graph embedding learning, characterized in that, The method comprises the following steps: obtaining original encrypted network traffic data and performing preprocessing to extract initial features of multiple IP address nodes to obtain an initial feature matrix; based on the initial feature matrix, performing static topology adjacency learning and dynamic behavior adjacency learning in parallel: performing static topology adjacency learning, constructing a static topology adjacency matrix, and processing the initial feature matrix and the static topology adjacency matrix using a first graph convolution network to obtain a vector representation of static topology features, specifically including: abstracting IP addresses in the network as graph nodes to construct a static topology graph; wherein when a first IP address node and a second IP address node are connected to a common destination IP address, the connection relationship between the first IP address node and the second IP address node in the static topology adjacency matrix is set to exist; normalizing the static topology adjacency matrix, including: ensuring the symmetry of the adjacency matrix through symmetrization processing, and processing the symmetrized adjacency matrix using symmetric normalization technology; in the training phase, the IP address nodes in the training set are subjected to label consistency constraints, and the static topology adjacency matrix is adjusted: if two IP address nodes have the same malicious or normal label, the connection weight is enhanced; if the labels are different, the connection weight is weakened; inputting the normalized static topology adjacency matrix subjected to the label consistency constraints and the initial feature matrix into the first graph convolution network to obtain the vector representation of the static topology features through multi-layer feature propagation learning; performing dynamic behavior adjacency learning, constructing a dynamic behavior adjacency matrix, and processing the initial feature matrix and the dynamic behavior adjacency matrix using a second graph convolution network to obtain a vector representation of dynamic behavior features, specifically including: discretizing continuous behavior features in the initial feature matrix to obtain binned behavior features; based on the binned behavior features, selecting important bins and performing Weight of Evidence (WOE) quantization to construct a behavior feature matrix of nodes; calculating the behavior similarity of any two IP address nodes in the behavior feature matrix; converting the behavior similarity into the dynamic behavior adjacency matrix through dynamic threshold processing, wherein when the behavior similarity of two nodes is greater than a preset threshold, the connection is set to exist in the dynamic behavior adjacency matrix; inputting the dynamic behavior adjacency matrix and the initial feature matrix into the second graph convolution network to learn the vector representation of the dynamic behavior features; concatenating the vector representation of the static topology features and the vector representation of the dynamic behavior features to obtain a fusion feature representation; training a classification model based on the fusion feature representation, and using the trained classification model to perform malicious or non-malicious classification detection on encrypted network traffic.

2. The method of claim 1, wherein, The step of obtaining original encrypted network traffic data and performing preprocessing to obtain an initial feature matrix specifically includes: Network packets are extracted from a raw traffic file in PCAP format, and network sessions are reconstructed based on five-tuple information composed of source IP address, destination IP address, source port, destination port and protocol. Each network session is analyzed for multi-level features, extracting basic network layer features, traffic statistics features and TLS / SSL specific features. Session-level features are aggregated into IP-level feature representation, including statistical quantities such as mean, maximum and standard deviation for numerical features, and TF-IDF (Term Frequency-Inverse Document Frequency) method for categorical features to form a basic feature matrix for IP nodes. The basic feature matrix is input into an attention-aware feature fusion module, which dynamically evaluates feature importance through self-attention and multi-head attention mechanisms, and realizes deep feature interaction through residual connection and feedforward network to output an enhanced initial feature matrix.

3. The method of claim 1, wherein, The continuous behavior features in the initial feature matrix are discretized, including: Missing values in the initial feature matrix are filled with mean values. K-means clustering algorithm is used to bin the continuous behavior features, with the number of clusters k set to 12 and the bin boundaries determined by the training set data. Post-processing is performed on the binning results: determine whether the number of samples in each bin is less than the pre-set minimum sample size threshold, and if so, merge the bin into the bin with the largest sample size.

4. The method of claim 1, wherein, The steps of selecting important bins and quantifying evidence weight (WOE) include: Calculate the evidence weight (WOE) value of each bin using the formula: in, This represents the proportion of malicious samples in this container to the total number of malicious samples. This represents the proportion of normal samples in this container to the total number of normal samples. and They are the box body The number of malicious and normal samples in China and This is the total number of samples; Use the inflection point detection method to automatically determine the WOE threshold of important bins: sort the absolute values of WOE for all bins, calculate the second-order difference of the sorted numerical sequence, and take the position corresponding to the maximum second-order difference as the inflection point. The absolute value of WOE corresponding to the inflection point is the WOE threshold. Only bins with WOE absolute value greater than the WOE threshold are retained as important bins, and the behavior feature matrix of the node is constructed based on the important bins.

5. The method of claim 1, wherein, The step of training a classification model based on the fusion feature representation is to use at least one of the following classifiers: logistic regression, naive Bayes, K-nearest neighbors, decision tree, and XGBoost, with the fusion feature representation as input and the corresponding traffic label as supervision signal for model training.

6. A dual-adjacency graph embedding learning based encrypted malicious traffic detection system, characterized in that, It includes: A data preprocessing module is used to obtain raw encrypted network traffic data and perform preprocessing to extract initial features of multiple IP address nodes and obtain an initial feature matrix. The learning static topology feature representation module is configured to construct a static topology adjacency matrix and process the initial feature matrix and the static topology adjacency matrix by using a first graph convolution network to obtain a vector representation of a static topology feature. Specifically, an IP address in a network is abstracted as a graph node to construct a static topology graph. When a first IP address node and a second IP address node are connected to a common destination IP address, a connection relationship between the first IP address node and the second IP address node is set as existing in the static topology adjacency matrix. The static topology adjacency matrix is normalized, including ensuring the symmetry of the adjacency matrix by symmetric processing and processing the symmetrically processed adjacency matrix by using symmetric normalization technology. In the training phase, the IP address nodes in a training set are subjected to label consistency constraints, and the static topology adjacency matrix is adjusted. If two IP address nodes have the same malicious or normal label, the connection weight is enhanced. If the labels are different, the connection weight is weakened. The normalized static topology adjacency matrix subjected to the label consistency constraints and the initial feature matrix are input into the first graph convolution network to obtain the vector representation of the static topology feature by multi-layer feature propagation learning. The learning dynamic behavior feature representation module is configured to construct a dynamic behavior adjacency matrix and process the initial feature matrix and the dynamic behavior adjacency matrix by using a second graph convolution network to obtain a vector representation of a dynamic behavior feature. Specifically, continuous behavior features in the initial feature matrix are discretized to obtain binned behavior features. Based on the binned behavior features, important bins are selected and subjected to Weight of Evidence (WOE) quantification to construct a behavior feature matrix of nodes. The behavior similarity of any two IP address nodes in the behavior feature matrix is calculated. The behavior similarity is converted into the dynamic behavior adjacency matrix by dynamic threshold processing. When the behavior similarity of two nodes is greater than a preset threshold, the connection is set as existing in the dynamic behavior adjacency matrix. The dynamic behavior adjacency matrix and the initial feature matrix are input into the second graph convolution network to obtain the vector representation of the dynamic behavior feature. The fusion feature generation module is configured to splice the vector representation of the static topology feature and the vector representation of the dynamic behavior feature to obtain a fusion feature representation. The classification detection module is configured to train a classification model based on the fusion feature representation and perform classification detection of encrypted network traffic by using the trained classification model.

7. An electronic device, comprising: A processor, a memory, and a program or instructions stored on the memory and executable on the processor are included. When the program or instructions are executed by the processor, the steps of the method for detecting encrypted malicious traffic based on double adjacency graph embedding learning according to any one of claims 1-5 are implemented.

8. A readable storage medium, characterized by, The readable storage medium stores programs or instructions, and the programs or instructions are executed by the processor to realize the steps of the encryption malicious traffic detection method based on dual adjacency graph embedding learning according to any one of claims 1-5.

Images