A data transmission security method based on graph neural detection

Abstract

This invention discloses a data transmission security method based on graph neural network detection, comprising the following steps: collecting data from the physical layer, network layer, and application layer and synchronously normalizing it to generate a multi-layer time series set; constructing a dynamic graph and inputting it into a graph attention network to obtain node embeddings, edge embeddings, and graph-level risks; calculating homogeneity bias based on the embeddings and detecting it using CUSUM; performing a random walk on the dynamic graph to obtain an entropy sequence and detecting it using CUSUM; aggregating homogeneity and diffusion results by cross-layer mapping to establish a cross-layer coupled CUSUM; selecting candidate subgraphs based on graph-level risks, establishing a memory cache, and performing historical enhancement; fusing the cross-layer and memory enhancement results to output the range and type of abnormal nodes, abnormal edges, and abnormal subgraphs. This invention improves the accuracy and timeliness of anomaly identification through cross-layer modeling and memory enhancement.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to a data transmission security method based on graph neural network detection. Background Technology

[0002] With the continuous development of internet infrastructure, the scale of data transmission is constantly expanding, network communication structures are becoming increasingly complex, and data traffic is exhibiting characteristics of being cross-layered, multimodal, and highly dynamic. Traditional data transmission security detection methods mostly rely on feature matching and rule setting, identifying intrusion behaviors and abnormal traffic through predefined patterns. These methods are effective in dealing with known attack samples, but they struggle to adapt to the ever-evolving attack methods, especially in handling encrypted traffic, multi-layered protocol interactions, and complex topology environments, where the accuracy and real-time performance of detection are often insufficient. In recent years, with the application of machine learning and deep learning methods, detection mechanisms based on statistical features and model training have gradually become a research hotspot. However, most models remain at the level of single-dimensional traffic feature modeling, lacking a comprehensive characterization of the interaction relationships between different layers in data transmission, resulting in limited ability to identify cross-layer attacks, covert penetration, and long-term latent anomalies.

[0003] In existing research, graph neural networks (GNNs) are beginning to be introduced into cybersecurity scenarios to characterize the complex relationships between communication nodes and data flows using graph structure information. While GNNs have shown potential in capturing structured features and temporal dependencies, they still face two main challenges. First, most existing methods focus only on the overall accuracy of graph representation learning, lacking specific detection mechanisms for abrupt changes during transmission and easily overlooking anomalous shifts in data distribution over short periods. Second, GNN outputs are mostly concentrated at the classification or clustering level, lacking the ability to be combined with statistical detection methods, making it difficult to provide timely alerts in real-time detection.

[0004] On the other hand, statistical change point detection models such as CUSUM have a theoretical advantage in capturing time series abrupt changes, and can monitor abnormal fluctuations in sequences through cumulative deviation. However, using CUSUM alone often requires manual feature extraction for specific sequences, and cannot directly model complex cross-layer transmission data, thus limiting its applicability and robustness. When faced with multi-layer protocol interactions, changes in structural homogeneity, and abrupt changes in diffusion patterns, traditional CUSUM methods lack effective input structures, resulting in unsatisfactory detection performance.

[0005] Based on the shortcomings of existing technologies, several deficiencies in current data transmission security detection urgently need to be addressed. First, there is a lack of a unified multi-layer data fusion mechanism; the security status of the physical, network, and application layers is often modeled separately, making it difficult to comprehensively analyze cross-layer threats. Second, there is a lack of a mechanism combining graph neural networks and statistical detection, failing to establish a close link between structural modeling and temporal mutation detection. This results in detection models either emphasizing structural representation or temporal monitoring, failing to consider both simultaneously. Third, there is a lack of memory enhancement mechanisms; existing models mostly rely on short-term signals to determine abnormal behavior, making it difficult to capture the historical characteristics of latent attacks and persistent threats. Finally, existing fusion methods generally employ simple splicing or averaging, without setting reasonable weight allocation and mapping relationships for cross-layer abnormal signals, resulting in a lack of refinement and differentiation in detection results.

[0006] Therefore, how to provide a secure data transmission method based on graph neural network detection is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] One objective of this invention is to propose a data transmission security method based on graph neural network detection. This invention comprehensively utilizes graph neural network modeling and CUSUM change point detection technology. By constructing node embedding and edge embedding on a dynamic graph structure, and combining homogeneity anomaly detection, diffusion anomaly detection, cross-layer coupling detection, and memory enhancement detection, it can identify abnormal nodes, abnormal edges, abnormal subgraph ranges, and anomaly types during data transmission. Furthermore, it describes in detail the entire process of joint modeling at the physical layer, network layer, and application layer, proposes an anomaly result aggregation method based on cross-layer mapping relationships, and introduces a memory caching mechanism within the candidate subgraph range to enhance the ability to capture historical anomaly signals. Finally, by fusing cross-layer anomaly results and memory-enhanced anomaly results, it outputs accurate anomaly detection results, possessing the advantages of strong cross-layer fusion, sensitive mutation identification, complete historical memory, and high detection accuracy.

[0008] A data transmission security method based on graph neural network detection according to an embodiment of the present invention includes the following steps:

[0009] Collect physical layer signals, network layer traffic and application layer session data during data transmission, complete time synchronization and feature normalization, and form a multi-layer time series dataset;

[0010] A dynamic graph structure is constructed based on a multi-layer time-series dataset. Node attributes and edge attributes are input into a graph attention network to obtain node embeddings, edge embeddings, and graph-level risk scores.

[0011] Homogeneity index is calculated based on node embedding and neighbor embedding to form a homogeneity deviation sequence. CUSUM detection is performed on the homogeneity deviation sequence to output homogeneity anomaly results.

[0012] Perform a random walk on the dynamic graph structure to obtain the node visit distribution sequence, calculate the walk entropy sequence, perform CUSUM detection on the walk entropy sequence, and output the diffusion anomaly result.

[0013] Based on the cross-layer mapping relationship, the homogeneous anomaly results and the diffusion anomaly results are aggregated at the physical layer, network layer and application layer to establish a cross-layer coupled CUSUM detection model and output cross-layer anomaly results;

[0014] Candidate subgraphs are located based on graph-level risk scores. A memory cache is established within the candidate subgraphs to store the historical sequence of cross-level anomaly results and perform historical enhancement processing to output memory-enhanced anomaly results.

[0015] The cross-layer anomaly results and memory-enhanced anomaly results are fused to form the final anomaly detection result, which outputs the anomaly node, anomaly edge, anomaly subgraph range and anomaly type.

[0016] Optionally, the process of collecting physical layer signals, network layer traffic, and application layer session data during data transmission specifically includes:

[0017] Acquire physical layer signals, including received signal strength, signal-to-noise ratio, and carrier frequency;

[0018] Collect network layer traffic, which includes source address, destination address, transmission rate, and data packet length;

[0019] Collect application layer session data, which includes session identifier, request timestamp, response timestamp, and session duration;

[0020] The physical layer signals, network layer traffic, and application layer session data are synchronized in time to establish a unified time series.

[0021] Normalization is performed on the time-synchronized data to form a multi-layer time-series dataset.

[0022] Optionally, the process of constructing the dynamic graph structure and inputting node and edge attributes into the graph attention network specifically includes:

[0023] The physical layer signals in the multi-layer time series dataset are mapped to node attribute fields, the network layer traffic is mapped to edge attribute fields, and the application layer session data is mapped to session association fields to determine the node set and edge set.

[0024] The node set and edge set are organized into a time slice graph according to a unified time series, and the node attributes and edge attributes of each time slice are recorded.

[0025] The existence status of nodes, edge connections, and attribute values ​​are updated based on time slices to form a dynamic graph structure that changes over time.

[0026] Configure the input layer, attention aggregation layer, and output layer of the graph attention network;

[0027] The neighborhood attention weights are calculated using the target node, neighboring nodes, and corresponding edge attributes as inputs within the attention aggregation layer.

[0028] The neighborhood attention weights are normalized, and the neighbor node attributes and edge attributes are weighted and aggregated according to the normalized weights to obtain the updated node representation.

[0029] In the graph attention network, a multi-head attention mechanism is set up, and attention weights are calculated in parallel according to a preset number of heads. The aggregation results of each head are spliced ​​together, and node embeddings are obtained through nonlinear transformation and normalization.

[0030] Edge embeddings are generated by combining node embeddings of connected nodes with edge attributes and mapping them together.

[0031] Perform readout operations on node embeddings and edge embeddings to obtain graph-level risk scores.

[0032] Optionally, the generation of the homogeneity anomaly results specifically includes:

[0033] Determine the time slices in the unified time series, and for each time slice, obtain the neighbor set of the node, the corresponding edge attributes, and the graph attention weights;

[0034] The similarity between a node and its neighboring nodes is calculated, using the cosine of the included angle as the similarity measure, and the graph attention weight is used as the weighting coefficient to weight the neighborhood similarity, forming a sequence of node homogeneity indicators.

[0035] The homogeneity baseline sequence is calculated within a sliding time window, and the homogeneity deviation sequence is formed based on the difference between the homogeneity index sequence and the baseline sequence.

[0036] Establish a two-sided CUSUM recursive relationship on homogeneous biased sequences, and update the upper and lower offset statistics respectively:

[0037] ;

[0038] ;

[0039] in, Indicates time slice The upper offset statistic, Indicates time slice The lower offset statistic, Indicates time slice Homogeneity deviation value, This represents the upper offset drift parameter. Indicates the lower offset drift parameter;

[0040] Set the upper offset threshold With lower offset threshold When the upper offset statistic exceeds The time marker is marked as an anomaly in the upper offset homogeneity, and the current offset statistic exceeds The time marker is marked as a lower offset homogeneity anomaly;

[0041] The homogeneity anomaly markers of each node are summarized to form a homogeneity anomaly result.

[0042] Optionally, the generation of the diffusion anomaly result specifically includes:

[0043] In each time slice of the unified time series, the dynamic graph structure is used as input. Starting from a node, a random walk is performed on the dynamic graph structure according to the adjacency relationship and edge attribute. The access probability of each node in the time slice is recorded to form a node access distribution sequence.

[0044] The wandering entropy is calculated based on the node access distribution sequence to form a wandering entropy sequence. The wandering entropy within a time slice is obtained by multiplying the access probability of each node by the logarithm of that access probability, summing the results, and taking the negative value.

[0045] The wandering entropy sequence is compared with the baseline mean, and the entropy deviation at each time slice is calculated to form an entropy deviation sequence.

[0046] Establish a CUSUM recursive relationship on the entropy deviation sequence:

[0047] ;

[0048] Where S(k) represents the CUSUM statistic at time slice k, ΔH(k) represents the entropy deviation at time slice k, and μ represents the drift parameter;

[0049] Set a threshold, and output the diffusion anomaly result when the statistic S(k) exceeds the threshold.

[0050] Optionally, the generation of the cross-layer anomaly results specifically includes:

[0051] In each time slice of the unified time series, homogeneous anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer homogeneous anomaly sequence.

[0052] In each time slice of the unified time series, the diffusion anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer diffusion anomaly sequence.

[0053] The cross-layer homogeneous anomaly sequences and cross-layer diffusion anomaly sequences are weighted and aggregated to form a cross-layer anomaly indicator sequence. The weight parameters are determined based on the preset hierarchical importance coefficient.

[0054] Perform CUSUM detection on cross-layer anomaly indicator sequences, compare statistics with set thresholds, identify abrupt changes in time series and output cross-layer anomaly results.

[0055] Optionally, the abnormal results of memory enhancement specifically include:

[0056] Based on the graph-level risk score and the preset threshold, connected subgraphs are selected from the dynamic graph structure. When the score reaches the threshold, the current connected subgraph is determined as a candidate subgraph.

[0057] A memory cache is established within the candidate subgraph range. The memory cache includes time index, cross-level anomaly result values, source level labels and subgraph identifiers, and an independent storage area is set up for each candidate subgraph.

[0058] In each time slice of the unified time series, cross-layer anomaly results are written to the memory cache of the corresponding candidate subgraph according to the time index. When the number of records exceeds the preset window length, the earliest record is deleted.

[0059] Perform data cleanup on cross-level outlier results in the memory cache, including missing value imputation, extreme value truncation, and time-aligned interpolation, to ensure the continuity of the time index;

[0060] Within a fixed-length historical window, weights are set in descending order of time (from most recent to oldest). Cross-layer anomaly results within the window are weighted and aggregated to generate a memory enhancement index sequence for the corresponding time slice.

[0061] Align the memory enhancement index sequence with cross-layer anomaly results, and make judgments based on preset thresholds and preset durations. When the memory enhancement index continuously meets the judgment conditions, a memory enhancement anomaly result is generated.

[0062] Optionally, the generation of the final anomaly detection result specifically includes:

[0063] In each time slice of the unified time series, cross-layer anomalies and memory-enhanced anomalies are collected and aligned according to time index and subgraph identifier;

[0064] In the aligned result set, the labeling information of abnormal nodes, abnormal edges, and subgraph ranges is extracted to establish a fusion input table;

[0065] In the fusion input table, preset weights are assigned to cross-layer abnormal results and memory-enhanced abnormal results, and a fusion score is generated according to the weighted calculation rules.

[0066] Set a classification threshold for the fusion score. When the fusion score reaches the classification threshold, output the final anomaly label for the corresponding time slice.

[0067] The final anomaly marker is combined with the anomaly node, anomaly edge, subgraph range, and anomaly type to generate the final anomaly detection result.

[0068] The beneficial effects of this invention are:

[0069] This invention establishes a unified data fusion mechanism across the physical, network, and application layers, enabling cross-layer data to be represented and modeled within the same dynamic graph structure. Unlike traditional detection methods that rely on single-layer features, this invention can simultaneously capture data interaction relationships across different layers, providing a complete input structure for subsequent anomaly detection and avoiding the feature loss problem caused by single-layer modeling.

[0070] This invention introduces homogeneity deviation CUSUM detection and wandering entropy CUSUM detection into the dynamic graph structure. These two detection methods correspond to different anomaly patterns, enabling the differentiation and independent identification of structural consistency mutations and diffusion pattern mutations. Through cross-layer mapping relationships, homogeneity anomaly results and diffusion anomaly results are aligned and aggregated at the physical, network, and application layers. A weighted mechanism is used to form a cross-layer anomaly indication sequence, allowing for a unified expression of cross-layer anomaly signals and ensuring detection continuity and accuracy in complex scenarios.

[0071] This invention establishes a memory cache within the candidate subgraph range and performs weighted aggregation of cross-layer anomaly results based on a historical window to generate a memory-enhanced index sequence. This introduces historical dependence into the detection process, enabling the identification of latent attacks and persistent threats. By fusing cross-layer anomaly results with memory-enhanced anomaly results in the final stage, anomaly nodes, anomaly edges, and anomaly subgraph ranges are clearly marked. The detection results possess complete time indexes and hierarchical labels, ensuring the full traceability of anomaly events. Attached Figure Description

[0072] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0073] Figure 1 This is a flowchart of a data transmission security method based on graph neural network detection proposed in this invention;

[0074] Figure 2This is a schematic diagram of the dynamic graph structure construction for a data transmission security method based on graph neural network detection proposed in this invention;

[0075] Figure 3 This is a schematic diagram of the memory caching mechanism of a data transmission security method based on graph neural network detection proposed in this invention. Detailed Implementation

[0076] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0077] refer to Figure 1-3 A data transmission security method based on graph neural network detection includes the following steps:

[0078] Collect physical layer signals, network layer traffic and application layer session data during data transmission, complete time synchronization and feature normalization, and form a multi-layer time series dataset;

[0079] A dynamic graph structure is constructed based on a multi-layer time-series dataset. Node attributes and edge attributes are input into a graph attention network to obtain node embeddings, edge embeddings, and graph-level risk scores.

[0080] Homogeneity index is calculated based on node embedding and neighbor embedding to form a homogeneity deviation sequence. CUSUM detection is performed on the homogeneity deviation sequence to output homogeneity anomaly results.

[0081] Perform a random walk on the dynamic graph structure to obtain the node visit distribution sequence, calculate the walk entropy sequence, perform CUSUM detection on the walk entropy sequence, and output the diffusion anomaly result.

[0082] Based on the cross-layer mapping relationship, the homogeneous anomaly results and the diffusion anomaly results are aggregated at the physical layer, network layer and application layer to establish a cross-layer coupled CUSUM detection model and output cross-layer anomaly results;

[0083] Candidate subgraphs are located based on graph-level risk scores. A memory cache is established within the candidate subgraphs to store the historical sequence of cross-level anomaly results and perform historical enhancement processing to output memory-enhanced anomaly results.

[0084] The cross-layer anomaly results and memory-enhanced anomaly results are fused to form the final anomaly detection result, which outputs the anomaly node, anomaly edge, anomaly subgraph range and anomaly type.

[0085] This invention constructs a multi-layer time-series dataset by collecting signal, traffic, and session data at the physical, network, and application layers, and synchronizing and normalizing them under a unified time series model. This enables integrated modeling of cross-layer information. In traditional methods, data from different layers are typically processed independently, lacking a unified time and feature alignment mechanism, which easily leads to temporal inconsistencies and contextual fragmentation during anomaly detection. This invention, by establishing a multi-layer time-series dataset, fuses signal strength and noise characteristics from the physical layer, traffic and transmission characteristics from the network layer, and request-response characteristics from the application layer. This ensures global consistency and completeness of the anomaly detection input, thereby significantly improving the performance of subsequent detection models in complex environments.

[0086] In this embodiment, the process of collecting physical layer signals, network layer traffic, and application layer session data during data transmission specifically includes:

[0087] Acquire physical layer signals, including received signal strength, signal-to-noise ratio, and carrier frequency;

[0088] Collect network layer traffic, which includes source address, destination address, transmission rate, and data packet length;

[0089] Collect application layer session data, which includes session identifier, request timestamp, response timestamp, and session duration;

[0090] The physical layer signals, network layer traffic, and application layer session data are synchronized in time to establish a unified time series.

[0091] Normalization is performed on the time-synchronized data to form a multi-layer time-series dataset.

[0092] This invention constructs a dynamic graph structure based on a multi-layer time-series dataset and inputs node and edge attributes into a graph attention network to generate node embeddings, edge embeddings, and graph-level risk scores, achieving a structured representation of cross-layer data. Traditional graph modeling methods are mostly based on static structures, which cannot reflect the dynamic changes in data transmission, leading to detection lags or omissions. The dynamic graph structure of this invention updates node states and edge relationships with time slices, enabling timely capture of structural evolution features. Simultaneously, by calculating neighborhood weights through a graph attention network, it highlights key communication relationships, enhances the representational capabilities of nodes and edges, and provides more accurate input features for subsequent anomaly detection.

[0093] In this embodiment, the process of constructing the dynamic graph structure and inputting node attributes and edge attributes into the graph attention network specifically includes:

[0094] The physical layer signals in the multi-layer time series dataset are mapped to node attribute fields, the network layer traffic is mapped to edge attribute fields, and the application layer session data is mapped to session association fields to determine the node set and edge set.

[0095] The node set and edge set are organized into a time slice graph according to a unified time series, and the node attributes and edge attributes of each time slice are recorded.

[0096] The existence status of nodes, edge connections, and attribute values ​​are updated based on time slices to form a dynamic graph structure that changes over time.

[0097] Configure the input layer, attention aggregation layer, and output layer of the graph attention network;

[0098] The neighborhood attention weights are calculated using the target node, neighboring nodes, and corresponding edge attributes as inputs within the attention aggregation layer.

[0099] The neighborhood attention weights are normalized, and the neighbor node attributes and edge attributes are weighted and aggregated according to the normalized weights to obtain the updated node representation.

[0100] In the graph attention network, a multi-head attention mechanism is set up, and attention weights are calculated in parallel according to a preset number of heads. The aggregation results of each head are spliced ​​together, and node embeddings are obtained through nonlinear transformation and normalization.

[0101] Edge embeddings are generated by combining node embeddings of connected nodes with edge attributes and mapping them together.

[0102] Perform readout operations on node embeddings and edge embeddings to obtain graph-level risk scores.

[0103] This invention utilizes the similarity relationship between node embeddings and neighbor embeddings to form a homogeneity deviation sequence, and introduces a CUSUM detection mechanism into the sequence to effectively identify situations where structural consistency changes abruptly. Traditional detection methods based on means or thresholds can only identify significant anomalies and easily overlook hidden mean shifts. This invention establishes a two-sided CUSUM recursive relationship between the homogeneity index and the baseline, enabling real-time accumulation and amplification of subtle shifts, preventing abrupt changes from being masked by long-term smoothing effects, thereby timely detecting potential attack behaviors and abnormal nodes, and improving the sensitivity and robustness of detection.

[0104] In this embodiment, the generation of the homogeneity anomaly result specifically includes:

[0105] Determine the time slices in the unified time series, and for each time slice, obtain the neighbor set of the node, the corresponding edge attributes, and the graph attention weights;

[0106] The similarity between a node and its neighboring nodes is calculated, using the cosine of the included angle as the similarity measure, and the graph attention weight is used as the weighting coefficient to weight the neighborhood similarity, forming a sequence of node homogeneity indicators.

[0107] The homogeneity baseline sequence is calculated within a sliding time window, and the homogeneity deviation sequence is formed based on the difference between the homogeneity index sequence and the baseline sequence.

[0108] Establish a two-sided CUSUM recursive relationship on homogeneous biased sequences, and update the upper and lower offset statistics respectively:

[0109] ;

[0110] ;

[0111] in, Indicates time slice The upper offset statistic, Indicates time slice The lower offset statistic, Indicates time slice Homogeneity deviation value, This represents the upper offset drift parameter. Indicates the lower offset drift parameter;

[0112] Set the upper offset threshold With lower offset threshold When the upper offset statistic exceeds The time marker is marked as an anomaly in the upper offset homogeneity, and the current offset statistic exceeds The time marker is marked as a lower offset homogeneity anomaly;

[0113] The homogeneity anomaly markers of each node are summarized to form a homogeneity anomaly result.

[0114] This invention performs random walks on a dynamic graph structure to obtain a node access distribution sequence, calculates the walk entropy sequence based on the access probability, and then uses CUSUM to detect and identify abnormal diffusion patterns, achieving accurate monitoring of complex propagation behaviors. Traditional methods based on total traffic or frequency thresholds struggle to characterize the dynamic diffusion characteristics of propagation paths, easily missing cross-path penetration behaviors. This invention measures the uncertainty of access distribution through entropy values, enabling it to keenly capture changes in diffusion rates and propagation patterns. When abnormal signals spread through the network, abrupt changes in walk entropy can be amplified and output as detection results, thereby enhancing the ability to identify diffusion-type attacks.

[0115] In this embodiment, the generation of the diffusion anomaly result specifically includes:

[0116] In each time slice of the unified time series, the dynamic graph structure is used as input. Starting from a node, a random walk is performed on the dynamic graph structure according to the adjacency relationship and edge attribute. The access probability of each node in the time slice is recorded to form a node access distribution sequence.

[0117] The wandering entropy is calculated based on the node access distribution sequence to form a wandering entropy sequence. The wandering entropy within a time slice is obtained by multiplying the access probability of each node by the logarithm of that access probability, summing the results, and taking the negative value.

[0118] The wandering entropy sequence is compared with the baseline mean, and the entropy deviation at each time slice is calculated to form an entropy deviation sequence.

[0119] Establish a CUSUM recursive relationship on the entropy deviation sequence:

[0120] ;

[0121] Where S(k) represents the CUSUM statistic at time slice k, ΔH(k) represents the entropy deviation at time slice k, and μ represents the drift parameter;

[0122] Set a threshold, and output the diffusion anomaly result when the statistic S(k) exceeds the threshold.

[0123] This invention aggregates homogeneous and diffused anomaly results at the physical, network, and application layers, and establishes a cross-layer coupled CUSUM detection model through a weighted mechanism, effectively achieving joint judgment of cross-layer information. Existing methods often rely on only single-layer data for detection, making it difficult to fully capture cross-layer attacks. This invention ensures the alignment of anomaly results in time and hierarchy through cross-layer mapping relationships, and further assigns importance to different levels through weight parameters, enabling the cross-layer anomaly indication sequence to comprehensively reflect the global state, further improving the reliability and accuracy of detection in complex multi-layer environments.

[0124] In this embodiment, the generation of the cross-layer anomaly result specifically includes:

[0125] In each time slice of the unified time series, homogeneous anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer homogeneous anomaly sequence.

[0126] In each time slice of the unified time series, the diffusion anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer diffusion anomaly sequence.

[0127] The cross-layer homogeneous anomaly sequences and cross-layer diffusion anomaly sequences are weighted and aggregated to form a cross-layer anomaly indicator sequence. The weight parameters are determined based on the preset hierarchical importance coefficient.

[0128] Perform CUSUM detection on cross-layer anomaly indicator sequences, compare statistics with set thresholds, identify abrupt changes in time series and output cross-layer anomaly results.

[0129] This invention locates candidate subgraphs based on graph-level risk scoring, establishes a memory cache within the candidate range to store cross-layer anomaly results, and performs historical enhancement processing, effectively improving the ability to identify latent attacks and long-term anomalies. Traditional detection methods are mostly based on short-term windows, unable to accumulate and utilize long-term historical information, leading to the neglect of latent attacks. This invention maintains historical sequences through fixed-length windows and uses a decreasing weighting method to enhance the influence of recent anomalies while retaining long-term signals. This allows detection to not only rely on immediate mutations but also integrate long-term trends, thereby significantly improving the system's ability to perceive and determine persistent threats.

[0130] In this embodiment, the memory enhancement abnormality result specifically includes:

[0131] Based on the graph-level risk score and the preset threshold, connected subgraphs are selected from the dynamic graph structure. When the score reaches the threshold, the current connected subgraph is determined as a candidate subgraph.

[0132] A memory cache is established within the candidate subgraph range. The memory cache includes time index, cross-level anomaly result values, source level labels and subgraph identifiers, and an independent storage area is set up for each candidate subgraph.

[0133] In each time slice of the unified time series, cross-layer anomaly results are written to the memory cache of the corresponding candidate subgraph according to the time index. When the number of records exceeds the preset window length, the earliest record is deleted.

[0134] Perform data cleanup on cross-level outlier results in the memory cache, including missing value imputation, extreme value truncation, and time-aligned interpolation, to ensure the continuity of the time index;

[0135] Within a fixed-length historical window, weights are set in descending order of time (from most recent to oldest). Cross-layer anomaly results within the window are weighted and aggregated to generate a memory enhancement index sequence for the corresponding time slice.

[0136] Align the memory enhancement index sequence with cross-layer anomaly results, and make judgments based on preset thresholds and preset durations. When the memory enhancement index continuously meets the judgment conditions, a memory enhancement anomaly result is generated.

[0137] This invention cleans and weights historical cross-layer anomaly results in the memory cache of candidate subgraphs to form a memory-enhanced index sequence. It then outputs memory-enhanced anomaly results by combining threshold and duration rules, achieving synergistic utilization of historical and real-time information. Existing methods often suffer from insufficient utilization of historical data and are prone to oversensitivity to occasional fluctuations. This invention ensures data continuity by performing missing data imputation, time alignment, and extreme value truncation on the anomaly sequence. Furthermore, it balances new and old anomaly signals through a decreasing weight mechanism, thereby avoiding interference from short-term fluctuations and improving the stability and accuracy of anomaly detection.

[0138] In this embodiment, the generation of the final anomaly detection result specifically includes:

[0139] In each time slice of the unified time series, cross-layer anomalies and memory-enhanced anomalies are collected and aligned according to time index and subgraph identifier;

[0140] In the aligned result set, the labeling information of abnormal nodes, abnormal edges, and subgraph ranges is extracted to establish a fusion input table;

[0141] In the fusion input table, preset weights are assigned to cross-layer abnormal results and memory-enhanced abnormal results, and a fusion score is generated according to the weighted calculation rules.

[0142] Set a classification threshold for the fusion score. When the fusion score reaches the classification threshold, output the final anomaly label for the corresponding time slice.

[0143] The final anomaly marker is combined with the anomaly node, anomaly edge, subgraph range, and anomaly type to generate the final anomaly detection result.

[0144] This invention weightedly fuses cross-layer anomaly results with memory-enhanced anomaly results, establishing a fusion input table and outputting anomaly nodes, anomaly edges, anomaly subgraph ranges, and anomaly types, achieving a complete representation of the final detection result. Traditional methods often limit their output to single anomaly alarms, lacking hierarchical and range information, making it difficult to meet the needs of source tracing and subsequent processing. This invention, by introducing weight calculation and classification thresholds in the fusion stage, rationally integrates detection results from different sources, maintaining the real-time nature of cross-layer anomalies while leveraging the stability of memory enhancement, thereby outputting a comprehensive result containing structural range and anomaly type, ensuring the integrity and traceability of detection information.

[0145] Example 1:

[0146] To verify the feasibility of this invention in practice, it was applied to a security monitoring scenario of a large-scale data transmission network. This scenario covers the physical layer, network layer, and application layer. The physical layer includes link signal strength, signal-to-noise ratio, and frequency parameters; the network layer includes traffic characteristics between nodes; and the application layer includes service request and response data. Traditional rule matching methods often rely on manual rule bases in this environment and cannot identify complex attack patterns. Although single machine learning methods can discover some features, they lack the ability to model across layers as a whole, and are prone to misjudgment and missed detection when facing latent attacks and highly dynamic traffic anomalies.

[0147] During the experimental deployment, this invention first collects data at different levels. The physical layer obtains the received signal strength, signal-to-noise ratio, and carrier frequency. The network layer records the source address, destination address, transmission rate, and data packet length. The application layer extracts the session identifier, request timestamp, response timestamp, and session duration. All data undergoes time synchronization and normalization processing and is input into a dynamic graph structure. Node embedding, edge embedding, and graph-level risk scoring are generated through a graph attention network to achieve unified modeling of cross-layer data.

[0148] During the detection process, the system calculates the homogeneity deviation sequence by comparing the similarity between node embedding and neighbor embedding, identifies mutation points using the CUSUM method, and outputs homogeneity anomaly results. Simultaneously, it performs random walks on the dynamic graph structure to obtain the access distribution under time slices and calculates the entropy value, forming a walk entropy sequence. Then, it obtains diffusion anomaly results through CUSUM detection. Subsequently, it performs time alignment and weighted aggregation of the homogeneity anomaly results from the physical layer, network layer, and application layer with the diffusion anomaly results to form a cross-layer anomaly indication sequence, and performs CUSUM detection to obtain cross-layer anomaly results.

[0149] Based on cross-layer anomaly detection, this invention establishes a memory cache within the subgraph range with a high graph-level risk score. The cache stores the historical sequence of cross-layer anomaly results, maintains a fixed-length window and performs data cleaning, and uses decreasing weights to calculate and generate a memory-enhanced index sequence. When the index meets the judgment conditions within a continuous time slice, the memory-enhanced anomaly result is output. Finally, the cross-layer anomaly results and the memory-enhanced anomaly results are merged to output the final detection result containing anomaly nodes, anomaly edges, anomaly subgraph ranges, and anomaly types.

[0150] In the experimental data, the network topology contained 1,000 nodes and 3,000 edges, with 200,000 physical layer samples, 500,000 network layer traffic entries, and 300,000 application layer sessions. A total of 52 attack events occurred throughout the period, including 20 sudden attacks and 32 latent attacks. The experiments compared the rule-matching method, the single graph neural network method, and the method of this invention. The results are shown in Table 1.

[0151] Table 1 Comparison results of different detection methods

[0152]

[0153] As shown in Table 1, the accuracy of the rule matching method is only 82.3%, the false alarm rate is 11.5%, the detection latency is 4.8 seconds, and the latent attack detection rate is only 56.2%. The accuracy of the single graph neural network method is improved to 89.7%, the false alarm rate is reduced to 8.4%, the detection latency is shortened to 3.6 seconds, and the latent attack detection rate reaches 71.4%. The method of this invention is significantly better than the comparative methods in all four indicators, with an accuracy of 95.6%, a false alarm rate reduced to 5.1%, a detection latency shortened to 2.2 seconds, and a latent attack detection rate increased to 90.3%, which can effectively identify abnormal behavior in complex environments.

[0154] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A data transmission security method based on graph neural network detection, characterized in that, Includes the following steps: Collect physical layer signals, network layer traffic and application layer session data during data transmission, complete time synchronization and feature normalization, and form a multi-layer time series dataset; A dynamic graph structure is constructed based on a multi-layer time-series dataset. Node attributes and edge attributes are input into a graph attention network to obtain node embeddings, edge embeddings, and graph-level risk scores. Homogeneity index is calculated based on node embedding and neighbor embedding to form a homogeneity deviation sequence. CUSUM detection is performed on the homogeneity deviation sequence to output homogeneity anomaly results. Perform a random walk on the dynamic graph structure to obtain the node visit distribution sequence, calculate the walk entropy sequence, perform CUSUM detection on the walk entropy sequence, and output the diffusion anomaly result. Based on the cross-layer mapping relationship, the homogeneous anomaly results and the diffusion anomaly results are aggregated at the physical layer, network layer and application layer to establish a cross-layer coupled CUSUM detection model and output cross-layer anomaly results; Based on the graph-level risk score and the preset threshold, connected subgraphs are selected from the dynamic graph structure. When the score reaches the threshold, the current connected subgraph is determined as a candidate subgraph. A memory cache is established within the candidate subgraph range. The memory cache includes time index, cross-level anomaly result values, source level labels and subgraph identifiers, and an independent storage area is set up for each candidate subgraph. In each time slice of the unified time series, cross-layer anomaly results are written to the memory cache of the corresponding candidate subgraph according to the time index. When the number of records exceeds the preset window length, the earliest record is deleted. Perform data cleanup on cross-level outlier results in the memory cache, including missing value imputation, extreme value truncation, and time-aligned interpolation, to ensure the continuity of the time index; Within a fixed-length historical window, weights are set in descending order of time (from most recent to oldest). Cross-layer anomaly results within the window are weighted and aggregated to generate a memory enhancement index sequence for the corresponding time slice. Align the memory enhancement index sequence with cross-layer abnormal results, and make judgments based on preset thresholds and preset durations. When the memory enhancement index continuously meets the judgment conditions, generate a memory enhancement abnormal result. The cross-layer anomaly results and memory-enhanced anomaly results are fused to form the final anomaly detection result, which outputs the anomaly node, anomaly edge, anomaly subgraph range and anomaly type.

2. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The process of collecting physical layer signals, network layer traffic, and application layer session data during data transmission specifically includes: Acquire physical layer signals, including received signal strength, signal-to-noise ratio, and carrier frequency; Collect network layer traffic, which includes source address, destination address, transmission rate, and data packet length; Collect application layer session data, which includes session identifier, request timestamp, response timestamp, and session duration; The physical layer signals, network layer traffic, and application layer session data are synchronized in time to establish a unified time series. Normalization is performed on the time-synchronized data to form a multi-layer time-series dataset.

3. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The process of constructing a dynamic graph structure and inputting node and edge attributes into the graph attention network specifically includes: The physical layer signals in the multi-layer time series dataset are mapped to node attribute fields, the network layer traffic is mapped to edge attribute fields, and the application layer session data is mapped to session association fields to determine the node set and edge set. The node set and edge set are organized into a time slice graph according to a unified time series, and the node attributes and edge attributes of each time slice are recorded. The existence status of nodes, edge connections, and attribute values ​​are updated based on time slices to form a dynamic graph structure that changes over time. Configure the input layer, attention aggregation layer, and output layer of the graph attention network; The neighborhood attention weights are calculated using the target node, neighboring nodes, and corresponding edge attributes as inputs within the attention aggregation layer. The neighborhood attention weights are normalized, and the neighbor node attributes and edge attributes are weighted and aggregated according to the normalized weights to obtain the updated node representation. In the graph attention network, a multi-head attention mechanism is set up, and attention weights are calculated in parallel according to a preset number of heads. The aggregation results of each head are spliced ​​together, and node embeddings are obtained through nonlinear transformation and normalization. Edge embeddings are generated by combining node embeddings of connected nodes with edge attributes and mapping them together. Perform readout operations on node embeddings and edge embeddings to obtain graph-level risk scores.

4. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The generation of the homogeneity anomaly results specifically includes: Determine the time slices in the unified time series, and for each time slice, obtain the neighbor set of the node, the corresponding edge attributes, and the graph attention weights; The similarity between a node and its neighboring nodes is calculated, using the cosine of the included angle as the similarity measure, and the graph attention weight is used as the weighting coefficient to weight the neighborhood similarity, forming a sequence of node homogeneity indicators. The homogeneity baseline sequence is calculated within a sliding time window, and the homogeneity deviation sequence is formed based on the difference between the homogeneity index sequence and the baseline sequence. Establish a two-sided CUSUM recursive relationship on the homogeneous biased sequence, and update the upper and lower offset statistics respectively; Set an upper offset threshold and a lower offset threshold. When the upper offset statistic exceeds the upper offset threshold, it is marked as an upper offset homogeneity anomaly. When the lower offset statistic exceeds the lower offset threshold, it is marked as a lower offset homogeneity anomaly. The homogeneity anomaly markers of each node are summarized to form a homogeneity anomaly result.

5. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The generation of the diffusion anomaly results specifically includes: In each time slice of the unified time series, the dynamic graph structure is used as input. Starting from a node, a random walk is performed on the dynamic graph structure according to the adjacency relationship and edge attribute. The access probability of each node in the time slice is recorded to form a node access distribution sequence. The wandering entropy is calculated based on the node access distribution sequence to form a wandering entropy sequence. The wandering entropy within a time slice is obtained by multiplying the access probability of each node by the logarithm of that access probability, summing the results, and taking the negative value. The wandering entropy sequence is compared with the baseline mean, and the entropy deviation at each time slice is calculated to form an entropy deviation sequence. Establish a CUSUM recursive relation on the entropy deviation sequence, where S(k) represents the CUSUM statistic at time slice k; Set a threshold, and output the diffusion anomaly result when the statistic S(k) exceeds the threshold.

6. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The generation of the cross-layer anomaly results specifically includes: In each time slice of the unified time series, homogeneous anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer homogeneous anomaly sequence. In each time slice of the unified time series, the diffusion anomaly results of the physical layer, the network layer, and the application layer are extracted. The three types of results are aligned and aggregated according to the time index to form a cross-layer diffusion anomaly sequence. The cross-layer homogeneous anomaly sequences and cross-layer diffusion anomaly sequences are weighted and aggregated to form a cross-layer anomaly indicator sequence. The weight parameters are determined based on the preset hierarchical importance coefficient. Perform CUSUM detection on cross-layer anomaly indicator sequences, compare statistics with set thresholds, identify abrupt changes in time series and output cross-layer anomaly results.

7. The data transmission security method based on graph neural network detection according to claim 1, characterized in that, The generation of the final anomaly detection result specifically includes: In each time slice of the unified time series, cross-layer anomalies and memory-enhanced anomalies are collected and aligned according to time index and subgraph identifier; In the aligned result set, the labeling information of abnormal nodes, abnormal edges, and subgraph ranges is extracted to establish a fusion input table; In the fusion input table, preset weights are assigned to cross-layer abnormal results and memory-enhanced abnormal results, and a fusion score is generated according to the weighted calculation rules. Set a classification threshold for the fusion score. When the fusion score reaches the classification threshold, output the final anomaly label for the corresponding time slice. The final anomaly marker is combined with the anomaly node, anomaly edge, subgraph range, and anomaly type to generate the final anomaly detection result.

Images