A method and system for real-time monitoring and early warning of unauthorized external connections based on deep learning

Abstract

This invention discloses a method and system for real-time monitoring and early warning of unauthorized external connections based on deep learning, comprising the following modules: a data acquisition and dynamic graph construction module for real-time acquisition of external connection behavior data and generation of a dynamic graph structure; an event monitoring and local subgraph identification module for monitoring node and edge changes and identifying relevant local subgraphs; an incremental dynamic graph neural network training module for parameter updates and feature propagation within the local subgraph; a group attention feature aggregation module for feature aggregation under a multi-granularity attention mechanism; a graph attention decision classification module for classification and risk determination based on anomaly information entropy; and a global asynchronous aggregation and early warning output module for aggregating and outputting early warning information across the entire network. This invention can efficiently integrate multi-source network behavior and contextual features to achieve accurate real-time monitoring and intelligent early warning of unauthorized external connections in complex network environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information security and intelligent network management, and in particular to a method and system for real-time monitoring and early warning of illegal external connection behavior based on deep learning. BACKGROUND

[0002] With the continuous improvement of informatization level, the internal network structure is increasingly complex, and the connection behavior of hosts, user accounts and application processes to external networks is increasingly frequent. External connection behavior, while supporting business development, has also become the main entry point for network security threats such as data leakage, sensitive information theft, and malicious code implantation. In actual operation and maintenance, unauthorized external access, illegal data transmission, and gang coordination behavior are increasing, which seriously threatens network security and data compliance.

[0003] Traditional external connection monitoring methods are mostly based on rule matching, black and white lists or static threshold judgment, and are difficult to cope with the dynamic changes of nodes and behaviors in large-scale network environments, and even more difficult to discover complex illegal external connection behaviors with features such as concealment, collaboration and variability. At the same time, existing anomaly detection methods based on single-point features have limited recognition ability when dealing with gang-type and collaborative external connection threats, and cannot achieve unified protection of real-time and scalability.

[0004] In recent years, with the development of deep learning and graph neural network technology, some research has attempted to apply intelligent detection models to the field of network security, but most of them are still limited to static graph structures or offline processing of full data, lacking efficient incremental modeling and real-time inference mechanisms for dynamic changes in network nodes and edges, making it difficult to adapt to the real-world needs of high concurrency and massive heterogeneous data. Therefore, there is an urgent need for an intelligent illegal external connection behavior monitoring and early warning system that can dynamically adapt to network structure changes, take into account single-point anomalies and group collaboration risks, and have high real-time performance and large-scale scalability.

[0005] Therefore, how to provide a method and system for real-time monitoring and early warning of illegal external connection behavior based on deep learning is a problem that needs to be solved by those skilled in the art. SUMMARY

[0006] The present application realizes real-time monitoring and efficient early warning of external connection behavior in large-scale networks through incremental dynamic graph neural networks, group attention feature aggregation and graph attention decision classification modules, can fuse multi-source behavior and context features, dynamically highlight high-risk nodes and collaborative gang anomalies, and improve the detection accuracy and early warning intelligence of illegal external connection behavior in complex environments, effectively supporting security protection and automated response in the entire network.

[0007] According to the real-time monitoring and early warning system for illegal external connection behavior based on deep learning, the following modules are included:

[0008] a data collection and dynamic graph construction module for collecting external connection behavior data in real time and constructing a dynamic graph structure with hosts, accounts, and processes as nodes and external connection relationships as edges;

[0009] a dynamic graph event monitoring and local subgraph identification module for monitoring addition, deletion, and attribute update events of nodes and edges in the dynamic graph structure and identifying k-order neighborhood subgraphs centered on changed nodes or edges as local subgraphs;

[0010] an incremental dynamic graph neural network training module for performing local training and feature propagation in the affected local subgraph and updating only relevant nodes and neighborhood nodes;

[0011] a group attention feature aggregation module for aggregating behavior features of nodes and external connection relationships through a multi-head and multi-granularity context-aware attention mechanism to generate group-level node features;

[0012] a graph attention decision classification module for classifying group-level node features in combination with group-level node features and graph structure information based on a decision tree with abnormal information entropy as a classification criterion, dynamically adjusting a classification threshold according to an attention weight, and outputting violation risk determination and early warning information;

[0013] a global asynchronous summary and early warning output module for summarizing violation risk determination and early warning information of each local subgraph and dynamically aggregating the information into real-time monitoring and early warning output in the target network range.

[0014] A violation external connection behavior real-time monitoring and early warning method based on deep learning according to an embodiment of the application includes the following steps:

[0015] Real-time collection of external connection behavior data of each host, user account, and application process in a target network and dynamic construction of a dynamic graph structure with hosts, accounts, and processes as nodes and external connection relationships as edges;

[0016] Monitoring of addition, deletion, and attribute update events of nodes and edges in the dynamic graph structure, automatic identification of local subgraphs related to changes for each dynamic change event of nodes or edges, and the local subgraph being a k-order neighborhood subgraph centered on a changed node or edge;

[0017] In the local subgraph, local training and feature propagation are performed based on an incremental dynamic graph neural network model, and only affected nodes and neighborhood nodes are updated to obtain an incrementally updated local subgraph;

[0018] In the incrementally updated local subgraph, behavior features of nodes and external connection relationships are aggregated through a multi-head and multi-granularity context-aware attention mechanism;

[0019] The aggregated node features are input into a graph attention decision classification module, based on the node features and graph structure information, a decision tree with abnormal information entropy as the splitting criterion is used for classification, the classification threshold is dynamically adjusted, and the single node and group cooperative behavior violation risk judgment and early warning information are output;

[0020] The violation risk judgment and early warning information of each local subgraph are asynchronously aggregated to form a comprehensive real-time monitoring and early warning output for the target network violation external connection behavior.

[0021] Further, the external connection behavior data includes network connection logs of hosts, external communication records of user accounts, external data access logs of application processes, port scanning information, protocol types, target addresses, access timestamps, and packet element information.

[0022] Further, the dynamic graph structure, wherein each host, user account and application process is respectively taken as a different type of graph node, the external connection behavior between nodes is marked as a directed edge, and an attribute vector is assigned to each node and edge, in the attribute vector of the node and edge, the node attribute includes the basic behavior features, historical risk label, external connection target category feature and time sequence feature of the host, account and application process, and the edge attribute includes the protocol type, target address, access time, communication frequency of the external connection behavior, and the historical risk label feature related to the external connection behavior.

[0023] Further, the step of monitoring the addition, deletion and attribute update events of nodes and edges in the dynamic graph structure comprises detecting the state changes of host, user account and application process nodes, the establishment and disconnection of external connection relationship between nodes, the numerical changes of node attributes and edge attributes, and for each node or edge change, using a k-order neighborhood expansion method centered on the changed node or edge, taking the changed node or edge as the starting point, the system automatically traverses and identifies all nodes and edges with a path length not exceeding k from the node or edge, and determines the affected local subgraph area.

[0024] Further, the incremental dynamic graph neural network model comprises a network main body stacked by multiple layers of graph neural network units, each layer containing a node feature transformation unit, an edge feature fusion unit and a message aggregation function, the node feature transformation unit performs linear transformation processing on the original input feature vector or the embedded vector of the last layer of each node, the edge feature fusion unit transforms the attribute vector of each edge, and splices the edge attribute and the adjacent node feature during message passing;

[0025] The message aggregation function in each layer of graph neural network unit synthesizes the features and messages of all neighbor nodes of a certain node to generate the aggregated features of the node in the current layer, and the aggregation method is weighted summation;

[0026] The system maintains an embedding feature vector for each node, which is obtained by converting the basic attribute features, external connection behavior features, time sequence features, external connection target category features, and historical risk label features into high-dimensional features through a neural network embedding layer or a feature encoder;

[0027] The node embedding features are used to represent the attributes, behaviors, and security risk states of the nodes in the current dynamic graph structure. The edge embedding features are obtained by processing the protocol type, target address, access time, communication frequency, and historical risk label of the external connection behavior between nodes through an embedding layer or feature aggregation.

[0028] The system maintains an external connection behavior feature vector for each edge, which reflects the attributes, frequency, and risk score of the external connection behavior. The overall incremental dynamic graph neural network model parameters include attention weight matrices, edge weight matrices, message aggregation parameters, and bias terms and activation function parameters of each layer of the network.

[0029] The system allocates a historical state buffer area for each node and edge to save the last feature embedding, local aggregation result, and message passing state to support incremental calculation. It also has an incremental dynamic graph neural network model and a parameter synchronization module between local subgraphs.

[0030] Further, the local training and feature propagation steps are as follows:

[0031] After detecting the addition, deletion, or attribute change of a node or edge, the k-order neighborhood nodes and edges centered on the changed node or edge are automatically determined to form the current affected local subgraph.

[0032] Based on the current parameter set of the incremental dynamic graph neural network model, an incremental dynamic graph neural network model copy is generated for the local subgraph region, and the initial parameters are synchronized globally.

[0033] Only the nodes and edges within the local subgraph perform gradient calculation and parameter update, and the unaffected parts remain unchanged.

[0034] The local training uses the gradient descent algorithm to iteratively adjust the attention weights, edge weights, and aggregation parameters based on the local loss function.

[0035] The gradient calculation and attention weight, edge weight, and aggregation parameter update process are limited within the local subgraph.

[0036] According to the recursive expansion of the number of graph neural network layers, the features of the affected nodes or edges are aggregated, fused, and propagated to all nodes within the k-order neighborhood, dynamically updating the embedding representations of each node and edge.

[0037] After the local training and feature propagation are completed, the updated parameters and state vectors are written back to the incremental dynamic graph neural network model, and consistency verification is performed on the global parameter set.

[0038] Further, the multi-head multi-granularity context-aware attention mechanism specifically comprises:

[0039] Within the locally updated subgraph, all node embedding features and corresponding external connection relationship edge features are combined with time sequence features, external connection target category features and historical risk label features to form a multi-granularity context feature vector;

[0040] A multi-head attention structure is used to calculate attention weights for node-neighbor pairs in different subspaces, and each head of attention focuses on different types of context feature vectors;

[0041] The weight of each attention head is determined by a parameterized correlation function, which is specifically:

[0042] After the embedding features, edge features, time sequence features, target category features and historical risk label features of the node-neighbor pairs are spliced, the corresponding weight matrix and bias term of the attention head are input, and the correlation score is obtained after linear transformation and nonlinear activation function processing, and the attention weight is obtained after Softmax normalization;

[0043] The weighted outputs of all heads of attention are fused in a set manner to obtain the final group-level node aggregation feature.

[0044] Further, the graph attention decision-making classification module specifically comprises:

[0045] The group-level node aggregation feature is used as an input feature vector to initialize the root node of the decision tree;

[0046] The average attention weight of each node is calculated, which is equal to the average value of the attention weights of all neighbors of the node, and the attention weight is used as a sample weight in the subsequent decision tree training process;

[0047] In the decision tree construction process, the root node is first initialized, and for each split node, the anomaly information entropy of the current node sample set is calculated, and the optimal split feature is selected from all candidate features based on the principle of maximum weighted information gain;

[0048] The calculation of the weighted information gain introduces the attention weight of each candidate feature corresponding to the subset as a weight factor into the split criterion of the information gain;

[0049] For each candidate feature, the leaf node classification threshold is dynamically adjusted according to the sample anomaly probability distribution and the attention weight during the splitting process, wherein the high-risk node, i.e., the attention weight exceeding the set threshold, automatically lowers the classification threshold of the branch to enhance the sensitivity of the high-risk node, and the normal node remains unchanged with the default threshold;

[0050] The decision tree splitting process is recursively performed until the preset maximum tree depth is reached or the number of leaf node samples is lower than a set proportion. A post-pruning strategy is then adopted to remove branch nodes that have limited overall accuracy improvement after branch pruning.

[0051] When outputting anomaly probability scores for each node, the node decision tree output probability is fused with attention weights. The final anomaly score of high-weight nodes is increased accordingly. The anomaly score of high-weight nodes is amplified according to the attention weights, so that under the same judgment, high-risk nodes get higher anomaly probability outputs.

[0052] The beneficial effects of this invention are:

[0053] This invention introduces an incremental dynamic graph neural network and a multi-head, multi-granularity attention mechanism to efficiently process external behavioral data in large-scale dynamic networks, enabling real-time anomaly detection and behavior change tracking for various object types such as nodes, accounts, and processes. Based on efficient parameter updates and multi-source feature aggregation within local subgraphs, the system significantly improves detection efficiency and response speed in complex network structures, making it particularly suitable for high-concurrency, dynamically evolving enterprise-level or cloud platform scenarios.

[0054] The graph attention decision classification module designed in this invention, through a weighted information gain splitting mechanism involving attention weights and a dynamic threshold adjustment mechanism, can highlight high-risk nodes and group collaborative behaviors, achieving unified risk assessment and early warning output for both single-node anomalies and group anomalies. The system supports global asynchronous aggregation and automated linkage, effectively reducing the risk of missed reports and false positives, and providing users with structured, real-time monitoring of unauthorized external connections and intelligent security assurance. Attached Figure Description

[0055] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0056] Figure 1 This is a schematic diagram of the structure of a real-time monitoring and early warning system for unauthorized external connections based on deep learning proposed in this invention;

[0057] Figure 2 This is a flowchart of a method for real-time monitoring and early warning of unauthorized external connections based on deep learning, as proposed in this invention. Detailed Implementation

[0058] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0059] refer toFigure 1 A real-time monitoring and early warning system for unauthorized external connections based on deep learning, comprising the following modules:

[0060] The data acquisition and dynamic graph construction module is used to collect external behavior data in real time and construct a dynamic graph structure with hosts, accounts, and processes as nodes and external relationships as edges.

[0061] The dynamic graph event listening and local subgraph identification module is used to listen for the addition, deletion and attribute update events of nodes and edges in the dynamic graph structure, and to identify the k-order neighborhood subgraph centered on the changed node or edge as a local subgraph.

[0062] The incremental dynamic graph neural network training module is used to perform local training and feature propagation within the affected local subgraph, updating only the relevant nodes and neighboring nodes;

[0063] The group attention feature aggregation module aggregates the behavioral features of nodes and external relationships through a multi-head, multi-granularity context-aware attention mechanism to generate group-level node features;

[0064] The graph attention decision classification module is used for group-level node features. It combines group-level node features and graph structure information to classify based on a decision tree with anomaly information entropy as the classification criterion. It dynamically adjusts the classification threshold according to the attention weight and outputs violation risk judgment and early warning information.

[0065] The global asynchronous aggregation and early warning output module is used to aggregate the violation risk judgment and early warning information of each local subgraph and dynamically aggregate them into real-time monitoring and early warning output for the target network scope.

[0066] This invention, through modular system design and deep learning algorithms, can collect and model the external behavior of various types of objects, such as hosts, accounts, and processes, in real time in large-scale dynamic network environments, accurately tracking changes in nodes and relationships. The system employs an incremental dynamic graph neural network to achieve efficient local updates, combined with a multi-head, multi-granularity attention mechanism and a graph decision classification module. This allows for the fusion of multi-dimensional behavioral and structural features, dynamically highlighting the violation risks of high-risk nodes and collaborative behaviors. This enables precise monitoring and early warning of complex external behaviors, effectively improving the real-time performance, accuracy, and intelligence of anomaly detection, providing strong technical support for network security protection and automated operation and maintenance.

[0067] refer to Figure 2 A method for real-time monitoring and early warning of unauthorized external connections based on deep learning, comprising the following steps:

[0068] Real-time collection of external behavior data of each host, user account, and application process in the target network, and dynamic construction of a dynamic graph structure with hosts, accounts, and processes as nodes and external relationships as edges;

[0069] Listen to the addition, deletion and attribute update events of nodes and edges in the dynamic graph structure. For each dynamic change event of a node or edge, automatically identify the local subgraph related to the change. The local subgraph is a k-order neighborhood subgraph centered on the changed node or edge.

[0070] Within the local subgraph, local training and feature propagation are performed based on an incremental dynamic graph neural network model, updating only the affected nodes and their neighboring nodes to obtain the incrementally updated local subgraph.

[0071] Within the incrementally updated local subgraph, the behavioral features of nodes and external relationships are aggregated through a multi-head, multi-granularity context-aware attention mechanism.

[0072] The aggregated node features are input into the graph attention decision classification module. Based on the node features and graph structure information, a decision tree with anomaly information entropy as the splitting criterion is used for classification. The classification threshold is dynamically adjusted, and the violation risk judgment and early warning information of single node and group collaborative behavior are output.

[0073] The violation risk assessment and early warning information of each local subgraph are asynchronously aggregated to form a comprehensive real-time monitoring and early warning output for the target network's illegal external connection behavior.

[0074] This invention's method, through multi-level data acquisition, dynamic graph modeling, event monitoring, and local identification, combined with incremental dynamic graph neural networks and multi-head, multi-granularity attention mechanisms, enables dynamic and accurate analysis of nodes and their external connections in large-scale networks. It supports real-time identification of local structural changes, rapid local training, and feature propagation, and inputs group-level node features into the graph attention decision classification module to achieve adaptive discrimination and early warning based on anomaly information entropy. Through global asynchronous aggregation, the method can dynamically output highly sensitive and accurate monitoring and intelligent early warning of illegal external connections across the entire network, effectively improving the intelligence and responsiveness of network security operations and maintenance.

[0075] In this embodiment, the external connection behavior data includes the host's network connection logs, user account's external communication records, application process's external data access logs, port scan information, protocol type, target address, access timestamp, and data packet metadata.

[0076] In this embodiment, the dynamic graph structure is used to represent different types of graph nodes, including hosts, user accounts, and application processes. External connections between nodes are marked as directed edges. Attribute vectors are assigned to each node and edge. The attribute vectors of nodes and edges include the following: node attributes include basic behavioral characteristics, historical risk labels, external target category characteristics, and time sequence characteristics of the host, account, and application process; edge attributes include the protocol type, target address, access time, communication frequency, and historical risk label characteristics related to the external connection behavior.

[0077] In this embodiment, the steps of monitoring the addition, deletion, and attribute update events of nodes and edges in the dynamic graph structure specifically involve detecting changes in the state of host, user account, and application process nodes, the establishment and disconnection of external connections between nodes, and changes in the values ​​of node and edge attributes. For each change of a node or edge, a k-order neighborhood expansion method centered on the changed node or edge is adopted. Starting from the changed node or edge, the system automatically uses breadth-first search to traverse and identify all nodes and edges whose path length to the node or edge does not exceed k, and determines them as the affected local subgraph regions.

[0078] In this embodiment, the incremental dynamic graph neural network model includes a network body composed of multiple layers of graph neural network units stacked sequentially. Each layer contains a node feature transformation unit, an edge feature fusion unit, and a message aggregation function. The node feature transformation unit performs linear transformation processing on the original input feature vector of each node or the embedding vector of the previous layer. The edge feature fusion unit transforms the attribute vector of each edge and concatenates the edge attributes with the features of adjacent nodes during message transmission.

[0079] The node feature transformation unit, for each node, first performs a weighted summation and bias adjustment on its input feature vector. This involves assigning a learnable weight parameter to each input feature and adding a bias constant to the weighted result of all features. The result is then processed by a linear rectifier unit to obtain the new feature representation of that node in the current layer. This approach ensures that each layer of the network can parameterize and optimize the original information of the nodes, giving them richer representational capabilities.

[0080] In the edge feature fusion unit, the attribute vector of each edge also undergoes a similar linear transformation. The system sets trainable weight parameters for each dimension of the edge attribute, performs a weighted summation of the edge attributes, adds a bias, and then processes the result through an activation function to obtain the transformed edge feature vector. This process can automatically adjust and optimize the behavior representation ability of edges in the network.

[0081] During message passing, the system concatenates the transformed feature vector of an edge with the feature vectors of its neighboring nodes. This concatenation operation involves first converting both the node and edge feature vectors to the same dimension, then linking the two sets of vectors end-to-end to form a new, longer feature vector. In this way, each node receives messages from each of its neighboring nodes containing both the neighboring node's own features and the behavioral information of the edges connecting those two nodes. This facilitates a more comprehensive analysis of the network structure and outbound behavior by subsequent aggregation functions.

[0082] The message aggregation function combines the features and messages of all neighboring nodes of a node in each layer of the graph neural network unit to generate the aggregated features of the node in this layer. The aggregation method is weighted summation.

[0083] During message aggregation, the system performs a weighted summation of the concatenated feature vectors passed from all neighboring nodes, according to specified weights. These weights can be dynamically generated through presets, node attributes, edge attributes, or attention mechanisms. Ultimately, the new feature representation of a node is the sum of all weighted neighboring messages. In this way, nodes can integrate multi-dimensional information from themselves and their neighborhood, achieving efficient representation and recursive optimization of behavior, attributes, and security states in a dynamic graph structure.

[0084] The system maintains an embedded feature vector for each node, which is a vector representation obtained by performing high-dimensional feature transformation on basic attribute features, external behavior features, temporal features, external target category features and historical risk label features through a neural network embedding layer or feature encoder.

[0085] The system first organizes the original attribute characteristics (such as protocol type, target address, access time, communication frequency, historical risk labels, etc.) of nodes (such as hosts, accounts, processes) or edges (external behavior) into a fixed-length vector according to a predefined order;

[0086] Subsequently, this original feature vector is input into the embedding layer. The embedding layer is essentially a fully connected neural network layer that assigns a set of independent trainable weight parameters to each input feature and performs a linear transformation through matrix multiplication and bias terms. After the linear transformation, ReLU is applied or a non-linear mapping is performed on the result. In this way, the original input features are mapped to a higher-dimensional feature space.

[0087] This process can not only automatically learn the complex relationships between various features, but also extract and fuse the structural, semantic, and behavioral information implicit in the original features, improving the ability of subsequent neural network layers to discriminate and express node or edge states. For categorical features (such as protocol type, risk level, etc.), the system can first convert them into continuous numerical vectors through one-hot encoding, label encoding, or embedding lookup tables, and then input them into the embedding layer for further mapping;

[0088] Node embedding features are used to characterize the attributes, behaviors, and security risk status of nodes in the current dynamic graph structure. Edge embedding features are obtained by processing the protocol type, target address, access time, communication frequency, and historical risk labels of the external connection behavior between nodes through an embedding layer or feature aggregation.

[0089] The system maintains an outbound behavior feature vector for each edge, reflecting the attributes, frequency, and risk score of the outbound behavior. The overall incremental dynamic graph neural network model parameters include the attention weight matrix, edge weight matrix, message aggregation parameters, and bias terms and activation function parameters for each layer of the network.

[0090] The system allocates a historical state cache for each node and edge to save the previous feature embedding, local aggregation results and message passing state to support incremental computation, and has an incremental dynamic graph neural network model and a parameter synchronization module between local subgraphs.

[0091] In this embodiment, the specific steps of local training and feature propagation are as follows:

[0092] After detecting the addition, deletion, or attribute change of a node or edge, the system automatically determines the k-order neighboring nodes and edges centered on the changed node or edge, forming the currently affected local subgraph.

[0093] Based on the current parameter set of the incremental dynamic graph neural network model, an incremental dynamic graph neural network model copy is generated for the local subgraph region, with the initial parameters synchronized with the global model.

[0094] Gradient calculation and parameter updates are performed only on nodes and edges within a local subgraph, while unaffected parts retain their original values.

[0095] Local training employs the gradient descent algorithm, iteratively adjusting the attention weights, edge weights, and aggregation parameters based on the local loss function;

[0096] Gradient calculation and the update process of attention weights, edge weights, and aggregation parameters are limited to the local subgraph.

[0097] Following the recursive expansion of the graph neural network layers, the features of the affected nodes or edges are aggregated, fused, and propagated to all nodes in the k-order neighborhood layer by layer, dynamically updating the embedding representations of each node and edge.

[0098] After local training and feature propagation are completed, the updated parameters and state vectors are written back to the incremental dynamic graph neural network model, and the consistency of the global parameter set is checked.

[0099] Specifically, when the system recognizes that a certain region (i.e., a local subgraph) in the network needs to be updated due to changes in nodes or edges, the system only trains and optimizes the nodes and edges within the local subgraph, without having to recalculate the entire global graph model.

[0100] The system organizes the current features, historical embeddings, and state information of all nodes and edges within a local subgraph as training inputs, and sets a local loss function based on the actual monitoring target. For example, the loss function can be the cross-entropy loss for node risk discrimination, or the mean squared error between the node output and the true risk label. The local loss function only depends on the predicted outputs and labels of nodes and edges within that subgraph and does not involve other parts of the entire graph.

[0101] The system performs gradient calculations on model parameters such as attention weights, edge weights, and message aggregation parameters in the local subgraph. Specifically, based on the forward inference results with the current parameters, the partial derivatives of the loss function with respect to these parameters are calculated to obtain the gradient for each parameter. The system updates the parameter values ​​in the opposite direction of the gradients according to the set learning rate. After each iteration, the attention weights, edge weights, and aggregation parameters are adjusted in the direction that reduces the loss function, thereby improving the model's discriminative performance in the local subgraph.

[0102] All gradient calculations and parameter updates are strictly confined to the currently affected local subgraph; model parameters outside the local subgraph remain unchanged. In this way, the system achieves dynamic adaptation of the network structure and efficient incremental training, significantly reducing computational resource consumption and training time, while maintaining the model's sensitivity and efficiency to dynamic network changes. After completing the local parameter update, the system synchronizes the optimized parameters and state back to the global model and performs consistency checks to ensure the synchronization and correctness of the global and local model states.

[0103] In this embodiment, the multi-head, multi-granularity context-aware attention mechanism specifically includes:

[0104] Within the incrementally updated local subgraph, embedding features of all nodes and edge features of corresponding external relationships, combined with temporal features, external target category features, and historical risk label features, form a multi-granularity context feature vector.

[0105] A multi-head attention structure is adopted, and attention weights are calculated for node-neighbor pairs in different subspaces. Each head attention focuses on different types of context feature vectors.

[0106] The weights of each attention head are determined by a parameterized correlation function, which is specifically defined as follows:

[0107] After concatenating the embedding features, edge features, temporal features, target category features, and historical risk label features of the node-neighbor pairs, the weight matrix and bias term of the corresponding attention head are input, and the relevance score is obtained after linear transformation and nonlinear activation function processing, and then normalized to attention weight by Softmax.

[0108] The attention-weighted outputs of all heads are fused according to a set method to obtain the final group-level node aggregation feature.

[0109] In this embodiment, the preferred setting method is to concatenate the node feature vectors output by each attention head to form a higher-dimensional comprehensive feature vector; alternatively, the outputs of each head can be weighted and summed according to set weights, or the average can be directly taken for fusion. For high-order representation scenarios, a linear transformation layer can be introduced after concatenation to further extract joint information between features through trainable weights. The system can flexibly select any of the above fusion methods according to different scenarios, which not only ensures the diverse expression of features from each head but also improves the accuracy of downstream classification and discrimination tasks.

[0110] In this embodiment, the graph attention decision classification module specifically includes:

[0111] The cluster-level node aggregation features are used as the input feature vector to initialize the root node of the decision tree;

[0112] For each node, the mean attention weight is calculated. The mean attention weight is equal to the average of the attention weights of all the nodes’ neighbors. The attention weights are used as sample weights in the subsequent decision tree training process.

[0113] In the process of building a decision tree, the root node is first initialized. For each split node, the abnormal information entropy of the current node's sample set is calculated, and the optimal split feature is selected from all candidate features based on the principle of maximizing the weighted information gain.

[0114] The calculation of the weighted information gain incorporates the attention weight of the subset corresponding to each candidate feature as a weighting factor into the information gain splitting criterion.

[0115] For each candidate feature, during the splitting process, the classification threshold of the leaf node is dynamically adjusted according to the sample anomaly probability distribution and attention weight. For high-risk nodes, i.e. when the attention weight exceeds the set threshold, the classification threshold of the branch is automatically lowered to enhance the sensitivity of the high-risk node, while the default threshold remains unchanged for normal nodes.

[0116] The decision tree splitting process is recursively performed until the preset maximum tree depth is reached or the number of leaf node samples is lower than a set proportion. A post-pruning strategy is then adopted to remove branch nodes that have limited overall accuracy improvement after branch pruning.

[0117] When outputting anomaly probability scores for each node, the node decision tree output probability is fused with attention weights. The final anomaly score of high-weight nodes is increased accordingly. The anomaly score of high-weight nodes is amplified according to the attention weights, so that under the same judgment, high-risk nodes get higher anomaly probability outputs.

[0118] In this implementation, the attention weight of each node is automatically calculated by the graph attention network through traversing neighborhood relationships during the group attention feature aggregation stage. Specifically, when processing each node, the system focuses on the connection relationships between that node and all its direct neighbors. For each pair of center nodes and neighbor nodes, the system concatenates or jointly encodes their feature vectors (including node features, edge features, and context features), and then inputs them into a trainable weight function.

[0119] The weighting function typically includes a set of learnable parameters and a non-linear activation function. Its output represents the importance of the neighboring node to the central node, i.e., the degree of contribution of the neighboring node in message passing and feature aggregation. Next, the system normalizes the attention scores of all neighbors (e.g., using a softmax function) to ensure that the sum of the attention weights of all neighbors is 1. Finally, the system records the attention weights of each node corresponding to all its neighbors.

[0120] When calculating the importance weight of a node, the system averages the attention weights of all its neighbors to obtain the node's mean attention weight. This mean not only reflects the node's "activity" or "influence" within its neighborhood but also its comprehensive connection to network structure and behavioral characteristics. Subsequently, during training and classification in the graph attention decision-making module, the system uses this mean attention weight as the node's importance weight for operations such as sample weighting and threshold adjustment, thereby enhancing the sensitivity and role of high-risk and key nodes in overall risk assessment.

[0121] Furthermore, to measure the uncertainty of a node sample set in the anomaly detection task, the system calculates the anomaly information entropy of that node sample set. Specifically, the system first counts the number of each category (e.g., "abnormal" and "normal") in the current sample set and calculates the probability distribution of each category in the sample set. Next, it multiplies the probability of each category by its logarithm and sums the results, finally taking the negative of the sum to obtain the anomaly information entropy value of the node sample set. A higher information entropy value indicates a more even distribution of abnormal and normal categories in the current node set, resulting in greater classification uncertainty; a lower information entropy indicates a clearer judgment. During the decision tree splitting process, the system aims to reduce anomaly information entropy, prioritizing splitting based on features that maximize the reduction of information entropy, thereby continuously improving the accuracy of anomaly detection at classification nodes and the overall risk identification capability.

[0122] Example 1:

[0123] In this embodiment, the traffic logs of the enterprise's intranet for the entire day of April 3, 2024, were selected. These logs include fields such as host ID, account ID, process name, target IP address, protocol type, packet size, access time, and risk tags, totaling approximately 8,500 records. The system stores the raw data as a structured CSV file, with some entries manually marked as high-risk external connections (e.g., abnormal port access, suspected group external connections).

[0124] The experiment used data acquisition nodes deployed next to the core switch to read logs in batches every 5 minutes. Python scripts were used to map entities such as hosts, accounts, and processes to nodes, and external events were constructed as directed edges. A total of 256 nodes and 1860 edges were formed in one day.

[0125] Whenever a new node is added or an edge attribute changes (such as a port change or a change in the target IP), the local subgraph identification process is triggered. For example, at 09:20:13 on 2024-04-03, when a new HTTP connection to 192.168.**.201 is detected on host PC2005, the system automatically uses PC2005 as the center, sets k=2, and performs a breadth-first search to obtain a local subgraph consisting of 5 relevant nodes and 12 edges.

[0126] The node and edge features of the local subgraph are input into the neural network, using the Adam optimizer with a learning rate of 0.001 and a maximum local iteration of 20 epochs. The initial features of nodes and edges are converted into 64-dimensional vectors through an embedding layer, and the model loss function is cross-entropy. After each iteration, the parameters are updated to cover only the local subgraph; unaffected attention weights remain unchanged.

[0127] For each node, the system employs a 4-head attention mechanism, with each head focusing on different feature groups (such as protocol / time series / account / historical risk), and outputting weighted aggregated features. The aggregated node features have a length of 256 dimensions.

[0128] The aggregated features are input into the decision tree classifier, with a maximum tree depth of 8. Splitting features are selected based on the maximum decrease in the entropy of the anomaly information in the sample set. For each node, the average attention weight of all its neighbors is calculated and used as the sample weight for splitting. Nodes with weights higher than 0.7 have their classification threshold automatically lowered by 10%. The system ultimately outputs the anomaly probability and corresponding warning level for each node.

[0129] A total of 17 high-risk, unauthorized external connections were detected that day, including 3 group collaboration incidents and 5 single high-risk accounts making external connections. The system automatically wrote the risk nodes, traffic details, time, and IP address into the alert log and automatically blocked them by calling the enterprise security platform interface via API.

[0130] Serial number Host ID Account ID Process Target IP Protocol Time Abnormal probability Warning level 1 PC2005 user_KT cmd.exe 192.168.**.201 HTTP 2024-04-0309:20 0.93 High 2 PC1021 admin_AZ svchost 203.82.54.**.17 TCP 2024-04-0312:34 0.87 High 3 PC1157 guest python 8.8.8.8 DNS 2024-04-0314:28 0.74 Medium

[0131] As shown in the table above, the system accurately identified multiple high-risk external connections on April 3, 2024. Among them, the PC2005 node and its neighborhood were aggregated and analyzed as having collaborative anomalies, with an anomaly probability as high as 0.93, triggering a high-level alert. PC1021 was a single high-risk account external connection, which was also accurately detected and isolated. Although the PC1157 host had frequent DNS external connections, it was judged to be under a medium-level alert after aggregation of historical risks and time sequence characteristics, and no false blocking occurred.

[0132] This embodiment demonstrates that the system process is data reproducible and engineering implementable, capable of quickly locating and accurately judging various types of unauthorized external connection events, and realizing dynamic security protection and intelligent response of the enterprise intranet.

[0133] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A real-time monitoring and early warning system for unauthorized external connections based on deep learning, characterized in that, Includes the following modules: The data acquisition and dynamic graph construction module is used to collect external behavior data in real time and construct a dynamic graph structure with hosts, accounts, and processes as nodes and external relationships as edges. The dynamic graph event listening and local subgraph identification module is used to listen for the addition, deletion and attribute update events of nodes and edges in the dynamic graph structure, and to identify the k-order neighborhood subgraph centered on the changed node or edge as a local subgraph. The incremental dynamic graph neural network training module is used to perform local training and feature propagation within the affected local subgraph, updating only the relevant nodes and neighboring nodes; The group attention feature aggregation module aggregates the behavioral features of nodes and external relationships through a multi-head, multi-granularity context-aware attention mechanism to generate group-level node features; The graph attention decision classification module is used for group-level node features. It combines group-level node features and graph structure information to classify based on a decision tree with anomaly information entropy as the splitting criterion. It dynamically adjusts the classification threshold according to the attention weight and outputs violation risk judgment and early warning information. The global asynchronous aggregation and early warning output module is used to aggregate the violation risk judgment and early warning information of each local subgraph and dynamically aggregate them into real-time monitoring and early warning output for the target network scope.

2. A method for real-time monitoring and early warning of unauthorized external connections based on deep learning, used to implement the real-time monitoring and early warning system for unauthorized external connections based on deep learning as described in claim 1, characterized in that, Includes the following steps: Real-time collection of external behavior data of each host, user account, and application process in the target network, and dynamic construction of a dynamic graph structure with hosts, accounts, and processes as nodes and external relationships as edges; Listen to the addition, deletion and attribute update events of nodes and edges in the dynamic graph structure. For each dynamic change event of a node or edge, automatically identify the local subgraph related to the change. The local subgraph is a k-order neighborhood subgraph centered on the changed node or edge. Within the local subgraph, local training and feature propagation are performed based on an incremental dynamic graph neural network model, updating only the affected nodes and their neighboring nodes to obtain the incrementally updated local subgraph. Within the incrementally updated local subgraph, the behavioral features of nodes and external relationships are aggregated through a multi-head, multi-granularity context-aware attention mechanism. The aggregated node features are input into the graph attention decision classification module. Based on the node features and graph structure information, a decision tree with anomaly information entropy as the splitting criterion is used for classification. The classification threshold is dynamically adjusted, and the violation risk judgment and early warning information of single node and group collaborative behavior are output. The violation risk assessment and early warning information of each local subgraph are asynchronously aggregated to form a comprehensive real-time monitoring and early warning output for the target network's illegal external connection behavior.

3. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The external connection behavior data includes the host's network connection logs, user account external communication records, application process external data access logs, port scan information, protocol type, target address, access timestamp, and data packet metadata.

4. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The dynamic graph structure is described in which each host, user account, and application process is treated as a different type of graph node. Outbound behaviors between nodes are marked as directed edges. Attribute vectors are assigned to each node and edge. The attribute vectors of the nodes and edges include the following: node attributes include basic behavioral characteristics, historical risk labels, outbound target category characteristics, and time sequence characteristics of the host, account, and application process; edge attributes include the protocol type, target address, access time, communication frequency, and historical risk label characteristics related to the outbound behavior.

5. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The steps for monitoring the addition, deletion, and attribute update events of nodes and edges in the dynamic graph structure are as follows: Detecting state changes of host, user account, and application process nodes; establishment and disconnection of external connections between nodes; and numerical changes of node and edge attributes. For each change of a node or edge, a k-order neighborhood expansion method centered on the changed node or edge is adopted. Starting from the changed node or edge, the system automatically uses breadth-first search to traverse and identify all nodes and edges whose path length to the node or edge does not exceed k, thus determining the affected local subgraph region.

6. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The incremental dynamic graph neural network model includes a network body composed of multiple layers of graph neural network units stacked sequentially. Each layer contains a node feature transformation unit, an edge feature fusion unit, and a message aggregation function. The node feature transformation unit performs linear transformation on the original input feature vector of each node or the embedding vector of the previous layer. The edge feature fusion unit transforms the attribute vector of each edge and concatenates the edge attributes with the features of adjacent nodes during message transmission. The message aggregation function combines the features and messages of all neighboring nodes of a node in each layer of the graph neural network unit to generate the aggregated features of the node in this layer. The aggregation method is weighted summation. The system maintains an embedded feature vector for each node, which is a vector representation obtained by performing high-dimensional feature transformation on basic attribute features, external behavior features, temporal features, external target category features and historical risk label features through a neural network embedding layer or feature encoder. Node embedding features are used to characterize the attributes, behaviors, and security risk status of nodes in the current dynamic graph structure. Edge embedding features are obtained by processing the protocol type, target address, access time, communication frequency, and historical risk labels of the external connection behavior between nodes through an embedding layer or feature aggregation. The system maintains an outbound behavior feature vector for each edge, reflecting the attributes, frequency, and risk score of the outbound behavior. The overall incremental dynamic graph neural network model parameters include the attention weight matrix, edge weight matrix, message aggregation parameters, and bias terms and activation function parameters for each layer of the network. The system allocates a historical state cache for each node and edge to save the previous feature embedding, local aggregation results and message passing state to support incremental computation, and has an incremental dynamic graph neural network model and a parameter synchronization module between local subgraphs.

7. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The specific steps of local training and feature propagation are as follows: After detecting the addition, deletion, or attribute change of a node or edge, the system automatically determines the k-order neighboring nodes and edges centered on the changed node or edge, forming the currently affected local subgraph. Based on the current parameter set of the incremental dynamic graph neural network model, an incremental dynamic graph neural network model copy is generated for the local subgraph region, with the initial parameters synchronized with the global model. Gradient calculation and parameter updates are performed only on nodes and edges within a local subgraph, while unaffected parts retain their original values. Local training employs the gradient descent algorithm, iteratively adjusting the attention weights, edge weights, and aggregation parameters based on the local loss function; Gradient calculation and the update process of attention weights, edge weights, and aggregation parameters are limited to the local subgraph. Following the recursive expansion of the graph neural network layers, the features of the affected nodes or edges are aggregated, fused, and propagated to all nodes in the k-order neighborhood layer by layer, dynamically updating the embedding representations of each node and edge. After local training and feature propagation are completed, the updated parameters and state vectors are written back to the incremental dynamic graph neural network model, and the consistency of the global parameter set is checked.

8. The method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The multi-head, multi-granularity context-aware attention mechanism specifically includes: Within the incrementally updated local subgraph, embedding features of all nodes and edge features of corresponding external relationships, combined with temporal features, external target category features, and historical risk label features, form a multi-granularity context feature vector. A multi-head attention structure is adopted, and attention weights are calculated for node-neighbor pairs in different subspaces. Each head attention focuses on different types of context feature vectors. The weights of each attention head are determined by a parameterized correlation function, which is specifically defined as follows: After concatenating the embedding features, edge features, temporal features, target category features, and historical risk label features of the node-neighbor pairs, the weight matrix and bias term of the corresponding attention head are input, and the relevance score is obtained after linear transformation and nonlinear activation function processing, and then normalized to attention weight by Softmax. The attention-weighted outputs of all heads are fused according to a set method to obtain the final group-level node aggregation feature.

9. A method for real-time monitoring and early warning of unauthorized external connections based on deep learning according to claim 2, characterized in that, The graph attention decision classification module specifically includes: The cluster-level node aggregation features are used as the input feature vector to initialize the root node of the decision tree; For each node, the mean attention weight is calculated. The mean attention weight is equal to the average of the attention weights of all the nodes’ neighbors. The attention weights are used as sample weights in the subsequent decision tree training process. In the process of building a decision tree, the root node is first initialized. For each split node, the abnormal information entropy of the current node's sample set is calculated, and the optimal split feature is selected from all candidate features based on the principle of maximizing the weighted information gain. The calculation of the weighted information gain incorporates the attention weight of the subset corresponding to each candidate feature as a weighting factor into the information gain splitting criterion. For each candidate feature, during the splitting process, the classification threshold of the leaf node is dynamically adjusted according to the sample anomaly probability distribution and attention weight. For high-risk nodes, i.e. when the attention weight exceeds the set threshold, the classification threshold of the branch is automatically lowered to enhance the sensitivity of the high-risk node, while the default threshold remains unchanged for normal nodes. The decision tree splitting process is recursively performed until the preset maximum tree depth is reached or the number of leaf node samples is lower than a set proportion. A post-pruning strategy is then adopted to remove branch nodes that have limited overall accuracy improvement after branch pruning. When outputting anomaly probability scores for each node, the node decision tree output probability is fused with attention weights. The final anomaly score of high-weight nodes is increased accordingly. The anomaly score of high-weight nodes is amplified according to the attention weights, so that under the same judgment, high-risk nodes get higher anomaly probability outputs.

Images