Parallel network security protection method based on dynamic graph neural network

Abstract

The invention relates to the technical field of network security, and discloses a parallel network security protection method based on a dynamic graph neural network. The method comprises the following steps: deploying a parallel network unit to trap attack traffic; extracting flow multi-dimensional features and constructing a flow heterogeneous graph; dynamically updating the heterogeneous graph, and performing time sequence representation learning by adopting a discrete time dynamic graph neural network to obtain embedded representation of nodes or sub-graphs; on the basis of embedded representation, attack behavior detection is carried out through combination of self-supervised learning and a supervised classifier, and an abnormal score is calculated; and if the abnormal score exceeds a dynamically adjusted threshold value, safety response actions such as alarming, blocking or tracing are triggered. According to the method, a network attack behavior mode can be learned in real time, and known and unknown attacks can be effectively detected and protected under the condition of a small amount of annotated data.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a parallel network security protection method based on dynamic graph neural networks. Background Technology

[0002] With the development of mobile internet, the Internet of Things, and cloud computing, network systems are becoming increasingly complex, making it difficult to comprehensively evaluate and modify improvement plans in advance. Parallel network theory has emerged to address this challenge. By constructing parallel networks that interact with the actual network, it enables real-time information exchange and collaborative optimization. Furthermore, it abstracts control, forwarding, and application layer functions, thereby supporting software-programmable network management, real-time optimization decisions, and service adaptation to meet users' ever-changing network needs.

[0003] Meanwhile, the expansion of network scale and the frequency of security incidents have made intrusion detection systems (IDS) a critical defense tool. Current mainstream methods are based on graph neural networks (GNNs), constructing traffic data into a static graph structure and achieving intrusion detection through node or edge classification, including methods such as spatial and frequency domain graph convolution. However, existing systems have two major limitations: first, they largely rely on offline public datasets, lacking real-world application; second, they struggle to respond in real-time to constantly evolving network attack behaviors and new threats.

[0004] Therefore, there is an urgent need to develop intrusion detection methods that can be practically deployed in real network environments and support real-time detection, in order to break through the limitations of traditional static GNNs and improve the model's adaptability and responsiveness to dynamic network environments. Summary of the Invention

[0005] The purpose of this invention is to provide a parallel network security protection method based on dynamic graph neural networks, which solves the problems of existing intrusion detection technologies relying on offline static data and being unable to adapt to dynamic network changes and new attacks in real time, and achieves real-time, proactive and accurate protection against known and unknown attacks.

[0006] Therefore, this invention provides a parallel network security protection method based on dynamic graph neural networks, comprising the following steps:

[0007] Deploy parallel network units to capture and trap attack traffic;

[0008] Extract multidimensional features of the attack traffic and construct a traffic heterogeneity graph based on the multidimensional features. The nodes of the traffic heterogeneity graph represent network entities, and the edges represent the interaction relationships between network entities.

[0009] The heterogeneous flow graph is dynamically updated, and a discrete-time dynamic graph neural network model is used for temporal representation learning to obtain the embedded representation of nodes or subgraphs at different time steps.

[0010] Based on the embedded representation, attack behavior patterns are detected by combining self-supervised learning tasks with supervised classifiers, and anomaly scores are calculated.

[0011] If the anomaly score exceeds a dynamically adjusted threshold, a security response action is triggered, which includes at least one of alarm, fine-grained traffic capture, blocking, or source tracing.

[0012] The beneficial effects of this invention are:

[0013] 1. This invention proposes a security protection method based on "parallel networks", which is more convenient for practical application in real network environments and solves the problem that most current intrusion detection systems use existing public datasets and are conducted offline.

[0014] 2. This invention proposes a deep learning model based on dynamic graph neural networks, breaking away from the processing mode of traditional static graph neural networks. The graph learning task is transformed from predicting nodes, edges, and subgraphs to predicting the state of nodes or edges at the next time point, predicting missing labels, and predicting the occurrence time of the next event (change in nodes or edges). This addresses the deficiency of traditional network security protection methods in their inability to learn network attack patterns in real time.

[0015] 3. This invention proposes a network traffic modeling method based on heterogeneous graphs, realizing an efficient heterogeneous traffic feature fusion analysis method. It can depict the internal network traffic interaction relationship in real time and characterize the attack behavior features of different attack traffic from the perspectives of traffic attribute features and structural features.

[0016] 4. This invention designs an attack pattern learning method based on dynamic graph neural networks, which can learn the difference in behavioral pattern characteristics between normal traffic and attack traffic in real time and proactively with a small amount of labeled data, and can achieve effective detection and protection against unknown attacks. Attached Figure Description

[0017] Figure 1 A schematic diagram for constructing a traffic heterogeneity graph;

[0018] Figure 2 A three-stage cyclical temporal learning framework;

[0019] Figure 3 A comprehensive flowchart of safety protection methods. Detailed Implementation

[0020] The parallel network security protection method based on dynamic graph neural networks of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. The embodiments shown are only for illustrating the principles of the present invention; unless otherwise stated, the steps in this embodiment can be used individually or in combination, and should not be construed as limiting the present invention.

[0021] Example:

[0022] This embodiment provides a method for real-time security protection against known and unknown network threats in an intranet environment. This method can proactively identify attack behavior patterns even with limited labeled data. The method includes the following steps:

[0023] Step 1: Deployment of parallel network units and interception of attack traffic.

[0024] In this embodiment, a group of parallel network units is deployed in a logically isolated area outside or inside the real business network to simulate common network services in real business (such as HTTP service, SSH service, database service, etc.). The parallel network units can be composed of containers, virtual machines, high-interaction honeypots, etc. The deployment method should ensure a "parallel" relationship with the real business network in terms of network topology, meaning it will not directly affect normal communication in the real production environment; it should also have a redirection mechanism to direct suspicious or probing traffic to the parallel network units through routing policies, traffic mirroring, software-defined network controllers, or traffic redirection modules.

[0025] Step 2: Traffic capture and parsing, and feature extraction.

[0026] After the parallel network unit is operational, it begins capturing traffic that has been redirected or initiated by an active attacker. The captured traffic includes packet or session layer data. Protocol parsing and deep traffic analysis are performed on this traffic, using publicly available or common tools to parse the protocol stack and reassemble the session. Extracted features include at least the source IP, destination IP, source port, destination port, timestamp, packet length, request type, request body digest, protocol version / service version number, TCP flags, or similar configuration / status information. The extraction results form structured data, which serves as input for the next step of graph construction.

[0027] Step 3: Constructing a heterogeneous traffic graph.

[0028] Based on the structured feature data obtained in step two, a traffic heterogeneity graph is constructed. This heterogeneity graph includes various types of nodes, such as IP nodes, service nodes, port nodes, session nodes, and device fingerprint nodes; it also includes various types of edges, such as access relationships (access edges between source IP and destination IP), session inclusion relationships (subordinate edges between session nodes and packet nodes), protocol usage relationships (edges between IP and port or service nodes), and time series proximity relationships (proximity edges between nodes or sessions in adjacent time windows). The heterogeneity graph can be constructed using time windows or time slices, so that each time slice corresponds to a graph snapshot, preserving structural and attribute semantics.

[0029] Step 4: Dynamic updating of heterogeneous graphs and learning of time series representations.

[0030] In this embodiment, dynamic updates and time-series representation learning are performed on the heterogeneous graph to capture the evolutionary characteristics of attack behavior over time. The dynamic update includes the following sub-processes:

[0031] Attribute updates: As traffic and environment change, the attributes of nodes or edges in the graph (such as session duration, message frequency, protocol fields, service version, etc.) change.

[0032] Structural updates: As new accesses or connections are established, and old connections are terminated or removed, operations such as generating, deleting, or modifying edges and nodes in the graph are performed.

[0033] Message passing / neighbor aggregation: In each discrete time step or event-driven mechanism, a node receives information from its neighbors, aggregates the neighbor representations, and updates its own representation.

[0034] Representation learning can employ discrete-time dynamic graph neural network models or combine them with continuous-time dynamic graph methods. The learning model takes a graph snapshot or event sequence for each time window as input and outputs the embedding representation of each node or subgraph at each time step.

[0035] Step 5: Learning and detecting attack behavior patterns.

[0036] Based on the temporal heterogeneous graph representation obtained in step four, pattern learning and anomaly detection are performed. This embodiment employs a self-supervised learning task, such as predicting neighbor relationships or temporal evolution in graph snapshots, or reconstructing or contrastively learning graph structure or node attributes. Then, a small number of labeled samples are used to fine-tune or train a classifier based on normal behavior and known attack behaviors. The detection process includes real-time generation of node or subgraph embeddings, comparison with historical normal behavior distributions to calculate anomaly scores, and triggering alarms or further actions (e.g., fine-grained traffic capture, blocking, or source tracing) if the score exceeds a set threshold.

[0037] Regarding the security protection method for "parallel networks" based on dynamic graph neural networks, the following will elaborate on each module of the security protection method of this invention through specific examples. (Refer to...) Figure 3 , Figure 3 This is a comprehensive flowchart of safety protection methods.

[0038] Step 1: "Parallel Network" Deployment. In this step, the artificial network architecture in the parallel network adopts the method of creating virtual network containers. These containers are logically isolated from each other but can share the same underlying physical network. The underlying hardware is flexibly and on-demand allocated through the programmable control of the software platform in the centralized controller. In the artificial network, network devices are only responsible for data forwarding and can use general-purpose hardware; while the operating system, originally responsible for control, is refined into an independent network operating system, responsible for adapting to different service characteristics. Communication between the network operating system, service characteristics, and hardware devices is all implemented through programming. Through open software-defined APIs, network functions can be flexibly reconfigured, thereby improving the network's scalability and flexibility. Control applications only need to focus on their own logic, without needing to worry about underlying details. Simultaneously, the logically centralized control plane can control multiple forwarding plane devices, i.e., control the entire physical network, thereby obtaining a global network state view and optimizing the network based on this view to meet user needs. This invention utilizes publicly available and mainstream virtual machine and container technologies to deploy nodes with different network protocols and network services to form a "parallel network." The "parallel network" forms a "parallel" topology with the real business network, and is used to capture attack traffic that intrudes into the internal network, receive redirected attack traffic, and record attack behavior logs.

[0039] Step Two: Traffic Feature Extraction. Based on the attack traffic captured in Step One, features are extracted from the traffic data using publicly available traffic parsing tools. Traffic data used for intrusion detection typically includes basic features, content features, and traffic features; the data types and orders of magnitude of these features may differ. Data preprocessing is an essential step before a network intrusion detection system uses deep learning techniques for detection. This invention employs techniques such as data collection, feature transformation, and data dimensionality reduction to preprocess the traffic data. The traffic features to be extracted include, but are not limited to, source IP, source port, destination IP, destination port, timestamp, packet information, packet length, and request type. These extracted traffic features are the basic elements for constructing a traffic heterogeneity graph.

[0040] Step 3: Construction of Heterogeneous Traffic Graph. Based on the network traffic captured in Step 1 and the traffic features extracted in Step 2, graph data is constructed, such as... Figure 1 As shown. Figure 1This paper presents a schematic diagram for constructing a heterogeneous traffic graph. Heterogeneous graphs are used to model the communication interactions between source IP, destination IP, source port, destination port, and network protocols in each traffic flow. Different meta-paths and meta-graphs are designed to analyze the interactive behaviors between different traffic characteristics. The constructed traffic graph includes the extraction of the entire network topology and the feature encoding of node attributes. By constructing a network traffic graph with topological information from independent traffic flows, traffic classification can be transformed into node classification within the network traffic graph.

[0041] Step Four: Dynamic Update of the Heterogeneous Traffic Graph. Based on the heterogeneous traffic graph constructed in Step Three, the graph is dynamically updated. A dynamic graph represents a process that evolves over time. Different types of graphs evolve in different ways; some change rapidly, while others change slowly. Depending on how the time information of the dynamic graph's evolution is represented, the dynamic graph can be modeled as a Discrete-Time Dynamic Graph (DTDG) or a Continuous-Time Dynamic Graph (CTDG). For graphs where nodes or edges are frequently updated, representations based on continuous time points are more complex and computationally intensive. Therefore, this invention adopts a discrete-time dynamic graph model, which also provides more memory efficiency for storing heterogeneous graphs.

[0042] Static graph learning includes three tasks: node classification, edge classification, and graph (subgraph) classification. Dynamic graph learning differs from static graph learning; its main tasks include predicting the state of nodes or edges at the next time point, predicting missing labels, and predicting the occurrence time of the next event (change in a node or edge). Dynamic graph learning mainly consists of two major steps: first, updating the state of nodes and edges on the graph at the next timestamp; and second, setting the output function according to the target task.

[0043] For the first step, a "three-stage cyclic temporal learning framework" of dynamic graph neural networks is used to update the heterogeneous traffic graph in real time, such as... Figure 2 As shown. Figure 2 This is a three-stage recursive temporal learning framework. It updates the state of nodes and edges in a graph at the next time step. The three-stage recursive temporal learning framework describes how the algorithm learns temporal patterns. The three stages include attribute self-updating, connection processes, and message passing. Attribute self-updating refers to external factors affecting the attributes of nodes and edges in the graph; connection processes are graph-specific operations, i.e., the process of a particular dynamic graph evolving, abandoning, or modifying the edges between its nodes; message passing is a method of aggregating local neighbor information, updating node attributes by aggregating messages received from neighboring nodes and connecting edges. A temporal pattern is a recurring pattern in the evolution of a given dynamic graph, i.e., the three stages of attribute self-updating, connection processes, and message passing are repeated cyclically. This pattern can be learned and used to perform learning tasks on discrete-time dynamic graphs.

[0044] For the second step, an appropriate output function should be set based on the construction method of the traffic heterogeneous graph and the three tasks of dynamic graph learning. For example, in the construction process of the traffic heterogeneous graph, let nodes represent the "exchange attributes" and "time attributes" of a traffic flow, let edges represent the "absolute attributes" of a traffic flow, such as "service," "protocol," and "state," and let each edge in the subgraph have the exact same "absolute attributes." Then, in an intrusion detection system, the detection of "normal" and "abnormal" traffic can be transformed into the classification of nodes in the subgraph. Furthermore, if the target task is to predict the state of nodes at the next timestamp, then an appropriate and correct output function should be set according to the target task and the construction method of the traffic heterogeneous graph.

[0045] Step 5: Attack Pattern Learning. Based on the traffic heterogeneous graph constructed in Step 3 and the dynamic update of the traffic heterogeneous graph in Step 4, a low-dimensional representation vector of the graph is obtained using a dynamic graph neural network model based on geometric deep learning. This representation vector should contain as much of the original graph structure information as possible, as well as the attribute information of the nodes themselves. The obtained representation vector is further used in a dynamic heterogeneous graph learning algorithm to analyze the attribute and structural information of the traffic heterogeneous graph in order to learn the pattern characteristics of normal traffic and attack traffic. Based on the learned attack traffic pattern characteristics, malicious attack traffic existing in the internal network is detected, realizing automated detection of potential attack behaviors on the internal network, thereby achieving internal network security protection.

[0046] This invention utilizes dynamic graph neural networks and attack pattern self-learning to achieve real-time and proactive learning of the behavioral patterns of different attack traffic with a small number of labels, thereby meeting the real-time security protection needs of internal networks against known and unknown network threats.

Claims

1. A parallel network security protection method based on dynamic graph neural networks, characterized in that, Includes the following steps: Deploy parallel network units to capture and trap attack traffic; Extract multidimensional features of the attack traffic and construct a traffic heterogeneity graph based on the multidimensional features. The nodes of the traffic heterogeneity graph represent network entities, and the edges represent the interaction relationships between network entities. The heterogeneous flow graph is dynamically updated, and a discrete-time dynamic graph neural network model is used for temporal representation learning to obtain the embedded representation of nodes or subgraphs at different time steps. Based on the embedded representation, attack behavior patterns are detected by combining self-supervised learning tasks with supervised classifiers, and anomaly scores are calculated. If the anomaly score exceeds a dynamically adjusted threshold, a security response action is triggered, which includes at least one of alarm, fine-grained traffic capture, blocking, or source tracing.

2. The method according to claim 1, characterized in that, The parallel network unit is deployed in an isolated area outside the real business network or in a logically isolated area inside it, and consists of containers, virtual machines or honeypots. The parallel network unit receives suspicious traffic or probe traffic through routing policies, traffic mirroring, software-defined networking (SDN) controllers or traffic redirection modules, and forms a parallel relationship with the real business network in terms of network topology.

3. The method according to claim 1, characterized in that, The multidimensional features are extracted using protocol parsing and deep packet inspection tools, including various features such as source IP address, destination IP address, source port number, destination port number, timestamp, packet length, protocol type, TCP flags, HTTP request type, and service version number.

4. The method according to claim 1, characterized in that, The traffic heterogeneity graph is established according to a fixed-length time window sequence, and each time window corresponds to a graph snapshot that preserves the semantics of network topology and entity attributes.

5. The method according to claim 1, characterized in that, The dynamic update includes the following sub-processes: Attribute Update: Update the attribute features of nodes or edges in the graph based on changes in traffic. Structure update: Add, delete, or modify edges and nodes in the graph based on changes in network connectivity; Neighbor information aggregation: A node aggregates information about its neighboring nodes and connecting edges to update its own state representation.

6. The method according to claim 1, characterized in that, The temporal representation learning is implemented through a three-stage cyclic temporal learning framework, which includes, in sequence: Attribute self-update phase: Update the attributes of nodes and edges on the graph based on external traffic data; Structural evolution stage: Perform edge addition, deletion, or weight modification operations on the graph to reflect changes in network structure; Message passing phase: Aggregate neighborhood information through message passing mechanism and update the embedded representation of nodes.

7. The method according to claim 1, characterized in that, The attack behavior pattern detection includes: By using self-supervised learning tasks, we can predict neighbor relationships and temporal evolution paths in graph snapshots, or reconstruct and compare graph structures and node attributes to learn flow representations. Using labeled samples that account for less than 5% of the total number of samples, classifiers for normal behavior and known attack behavior are trained or fine-tuned. The anomaly score is calculated by comparing the real-time generated node or subgraph embedding with the historical normal behavior embedding distribution for similarity.

8. The method according to claim 1, characterized in that, The dynamically adjusted threshold is determined based on the statistical quantiles of the historical normal behavior embedding distribution.

9. The method according to claim 4, characterized in that, After creating graph snapshots by time window, the graph snapshots of adjacent time slices are further differentially compressed and stored, and a fast query interface based on timestamp index is established to support second-level backtracking and analysis of historical graph status during the anomaly detection phase.

10. The method according to claim 2, characterized in that, The parallel network unit records detailed logs of all received traffic, including attack behavior sequences, for subsequent threat attribution analysis.

Images