Data forwarding method and device based on graph neural network

Abstract

The invention provides a data forwarding method and device based on a graph neural network, and the method and device are applied to a gateway system of a target network, and the method comprises the steps: receiving to-be-forwarded data, and recognizing a communication topological relation in the target network based on the to-be-forwarded data; constructing a session graph model; extracting features of the session graph model by using a preset graph neural network; communication topological features, statistical features and protocol content embedding vectors are obtained; analyzing and fusing feature extraction results from a flow behavior dimension, a protocol content dimension and a user behavior dimension; based on the fusion analysis result, evaluating to obtain a risk level of the to-be-forwarded data; and according to the risk level, a corresponding processing channel is matched, and then the matched processing channel is adopted to forward the to-be-forwarded data. According to the invention, the security of data forwarding can be effectively improved.

Description

Technical Field

[0001] This invention relates to the field of network communication, and more particularly to a data forwarding method and apparatus based on graph neural networks. Background Technology

[0002] As enterprise networks, data centers, and IoT environments become increasingly complex, network traffic is exhibiting characteristics such as large scale, heterogeneity, and dynamism. As critical infrastructure, network gateways not only need to achieve high-speed data forwarding but also face the significant challenge of identifying and mitigating various cybersecurity threats.

[0003] Currently, when conducting risk assessments on data to be forwarded, the input features used for the assessment are often isolated or simply pieced together, such as using only statistical features or only protocol features. This feature extraction method makes it difficult to identify threats that require the intersection of multiple feature dimensions to become apparent, resulting in insufficient security in data forwarding and posing risks to communication networks. Summary of the Invention

[0004] This invention application provides a data forwarding method and apparatus based on graph neural networks to solve the technical problem of how to improve the security of data forwarding in gateway systems.

[0005] To address the aforementioned technical problems, this invention provides a data forwarding method based on graph neural networks applied to a gateway system of a target network. The data forwarding method includes:

[0006] Receive data to be forwarded, and identify the communication topology in the target network based on the data to be forwarded;

[0007] Construct a session graph model based on the communication topology;

[0008] The features of the session graph model are extracted using a pre-defined graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors;

[0009] The feature extraction results are analyzed from the dimensions of traffic behavior, protocol content, and user behavior to obtain traffic behavior analysis results, protocol analysis results, and user behavior analysis results, respectively; and the traffic behavior analysis results, protocol analysis results, and user behavior analysis results are then fused to obtain a fused analysis result.

[0010] Based on the fusion analysis results, the risk level of the data to be forwarded is assessed; and according to the risk level, a corresponding processing channel is matched, and then the matched processing channel is used to forward the data to be forwarded.

[0011] As a preferred embodiment, the step of matching a corresponding processing channel based on the risk level, and then using the matched processing channel to forward the data to be forwarded, includes:

[0012] When the risk level is Level 1, a first processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded.

[0013] When the risk level is level two, a second processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0014] When the risk level is level three, a third processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0015] As a preferred embodiment, the data forwarding method further includes:

[0016] Real-time monitoring of the system resource status corresponding to the processing channel, including CPU utilization, hardware acceleration engine load, and cache queue depth;

[0017] Based on the risk level assessment results and the resource status, predict future load trends;

[0018] Based on the prediction results, the proportion of hardware resources allocated to the first processing channel, the second processing channel, and the third processing channel is dynamically adjusted.

[0019] As a preferred embodiment, constructing the session graph model based on the communication topology includes:

[0020] Based on the communication topology, model nodes of the session graph model are defined; wherein, the model nodes include device nodes and session nodes, the device nodes are identified by the IP address or MAC address of the device in the communication topology, and the session nodes are defined based on the communication session information from the source IP to the destination IP in the communication topology, the communication session information including IP address, port number and protocol type;

[0021] Based on the communication topology, the edges of the session graph model are defined, as well as the attributes of the edges; wherein, the edge represents the communication relationship between two nodes, and the attributes of the edge include time attribute, traffic attribute, protocol attribute, and communication frequency attribute;

[0022] The session graph model is constructed based on the defined model nodes, edges, and edge attributes.

[0023] As a preferred embodiment, the step of extracting features from the conversation graph model using a preset graph neural network to obtain feature extraction results includes:

[0024] By analyzing node centrality, key nodes in the model are identified; by using a graph clustering algorithm, the model nodes in the session graph model are divided into multiple device groups; and by performing a comprehensive analysis based on the key nodes and device groups, the communication topology features are obtained.

[0025] Based on the communication relationship, the distribution of traffic volume, number of sessions, packet rate and protocol type of the target network in each preset time window in historical communication sessions is extracted to obtain the statistical characteristics.

[0026] Based on the communication relationship, the protocol layer context information and protocol header information of the target network in historical communication sessions are identified; then, based on the protocol layer context information and protocol header information, the protocol content embedding vector is constructed.

[0027] As a preferred embodiment, before matching the corresponding processing channel according to the risk level, the method further includes:

[0028] The protocol of the data to be forwarded is identified to obtain the heterogeneous network protocol;

[0029] The heterogeneous network protocol is converted into a unified intermediate data format within the system.

[0030] As a preferred embodiment, the step of converting the heterogeneous network protocol into a unified intermediate data format within the system includes:

[0031] A reconfigurable hardware acceleration engine is used to convert the heterogeneous network protocols into a unified intermediate data format within the system.

[0032] The reconfigurable hardware acceleration engine adopts a fusion architecture of FPGA and ASIC. The FPGA part of the fusion architecture is pre-divided into a static shell area and one or more dynamic reconfiguration partitions. The static shell area has data paths and control interfaces, and the dynamic reconfiguration partitions are pre-loaded with protocol processing logic.

[0033] When converting the heterogeneous network protocol into a unified intermediate data format within the system, the dynamic reconstruction partition is used to perform protocol identification, field parsing, and structure conversion logic according to the protocol processing logic; the ASIC part in the fusion architecture performs hardware acceleration processing on preset high-frequency protocols.

[0034] Accordingly, this application also provides a data forwarding device based on a graph neural network, applied to a gateway system of a target network. The data forwarding device includes a topology identification module, a model construction module, a feature extraction module, a parsing module, and a forwarding module; wherein,

[0035] The topology identification module is used to receive data to be forwarded and identify the communication topology relationships in the target network based on the data to be forwarded.

[0036] The model building module is used to build a session graph model based on the communication topology.

[0037] The feature extraction module is used to extract features from the session graph model using a preset graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors;

[0038] The parsing module is used to parse the feature extraction results from the dimensions of traffic behavior, protocol content, and user behavior, respectively, to obtain traffic behavior parsing results, protocol parsing results, and user behavior parsing results; and to fuse the traffic behavior parsing results, protocol parsing results, and user behavior parsing results to obtain a fused parsing result.

[0039] The forwarding module is used to assess the risk level of the data to be forwarded based on the fusion parsing result; and to match the corresponding processing channel according to the risk level, and then use the matched processing channel to forward the data to be forwarded.

[0040] As a preferred embodiment, the forwarding module matches a corresponding processing channel based on the risk level, and then uses the matched processing channel to forward the data to be forwarded, including:

[0041] When the risk level is Level 1, the forwarding module matches the data to be forwarded with a first processing channel; and forwards the data to be forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded.

[0042] When the risk level is level two, the forwarding module matches the data to be forwarded with a second processing channel; and forwards the data to be forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0043] When the risk level is level three, the forwarding module matches the data to be forwarded with a third processing channel; and forwards the data to be forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0044] As a preferred embodiment, the data forwarding device further includes a dynamic adjustment module, which is used for:

[0045] Real-time monitoring of the system resource status corresponding to the processing channel, including CPU utilization, hardware acceleration engine load, and cache queue depth;

[0046] Based on the risk level assessment results and the resource status, predict future load trends;

[0047] Based on the prediction results, the proportion of hardware resources allocated to the first processing channel, the second processing channel, and the third processing channel is dynamically adjusted.

[0048] As a preferred embodiment, the model building module constructs a session graph model based on the communication topology, including:

[0049] The model building module defines the communication topology relationship and the model nodes of the session graph model. The model nodes include device nodes and session nodes. The device nodes are identified by the IP address or MAC address of the device in the communication topology relationship. The session nodes are defined based on the communication session information from the source IP to the destination IP in the communication topology relationship. The communication session information includes IP address, port number and protocol type.

[0050] Based on the communication topology, the edges of the session graph model are defined, as well as the attributes of the edges; wherein, the edge represents the communication relationship between two nodes, and the attributes of the edge include time attribute, traffic attribute, protocol attribute, and communication frequency attribute;

[0051] The session graph model is constructed based on the defined model nodes, edges, and edge attributes.

[0052] As a preferred embodiment, the feature extraction module uses a preset graph neural network to extract features from the conversation graph model, obtaining feature extraction results, including:

[0053] The feature extraction module identifies key nodes in the model nodes through node centrality analysis; it divides the model nodes in the session graph model into multiple device groups through a graph clustering algorithm; and it obtains the communication topology features by performing a comprehensive analysis based on the key nodes and device groups.

[0054] Based on the communication relationship, the distribution of traffic volume, number of sessions, packet rate and protocol type of the target network in each preset time window in historical communication sessions is extracted to obtain the statistical characteristics.

[0055] Based on the communication relationship, the protocol layer context information and protocol header information of the target network in historical communication sessions are identified; then, based on the protocol layer context information and protocol header information, the protocol content embedding vector is constructed.

[0056] As a preferred embodiment, the data forwarding device further includes a format conversion module, which is used to: identify the protocol of the data to be forwarded to obtain a heterogeneous network protocol before matching the corresponding processing channel according to the risk level; and convert the heterogeneous network protocol into a unified intermediate data format within the system.

[0057] As a preferred embodiment, the format conversion module converts the heterogeneous network protocol into a unified intermediate data format within the system, including:

[0058] The format conversion module uses a reconfigurable hardware acceleration engine to convert the heterogeneous network protocols into a unified intermediate data format within the system.

[0059] The reconfigurable hardware acceleration engine adopts a fusion architecture of FPGA and ASIC. The FPGA part of the fusion architecture is pre-divided into a static shell area and one or more dynamic reconfiguration partitions. The static shell area has data paths and control interfaces, and the dynamic reconfiguration partitions are pre-loaded with protocol processing logic.

[0060] When converting the heterogeneous network protocol into a unified intermediate data format within the system, the dynamic reconstruction partition is used to perform protocol identification, field parsing, and structure conversion logic according to the protocol processing logic; the ASIC part in the fusion architecture performs hardware acceleration processing on preset high-frequency protocols.

[0061] Compared with the prior art, this invention application has the following beneficial effects:

[0062] This invention provides a data forwarding method and apparatus based on a graph neural network, applied to a gateway system of a target network. The data forwarding method includes: receiving data to be forwarded and identifying communication topology relationships in the target network based on the data to be forwarded; constructing a session graph model based on the communication topology relationships; extracting features from the session graph model using a preset graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors; parsing the feature extraction results from traffic behavior dimensions, protocol content dimensions, and user behavior dimensions to obtain traffic behavior parsing results, protocol parsing results, and user behavior parsing results; fusing the traffic behavior parsing results, protocol parsing results, and user behavior parsing results to obtain a fused parsing result; assessing the risk level of the data to be forwarded based on the fused parsing result; and matching a corresponding processing channel according to the risk level, and then using the matched processing channel to forward the data to be forwarded. Compared to existing technical solutions that only use statistical or protocol features, this invention constructs a session graph model and uses graph neural networks to extract communication topology features, statistical features, and protocol content embedding vectors. It then analyzes these features from the dimensions of traffic behavior, protocol content, and user behavior, enabling in-depth mining of potential and hidden connections and behavioral patterns between network entities. This allows for the identification of complex cross-node and cross-session security threats that cannot be detected by single data packets or flow features alone. Furthermore, this technical solution, which uses a session graph model based on communication topology and graph neural networks for feature extraction, allows for effective risk assessment of data to be forwarded from a global perspective, thereby matching the appropriate processing channel for forwarding and fundamentally improving the security of data forwarding. Attached Figure Description

[0063] Figure 1 This is a flowchart illustrating an embodiment of the data forwarding method based on graph neural networks provided in this invention application.

[0064] Figure 2 This is a flowchart illustrating a preferred embodiment of the data forwarding method based on graph neural networks provided in this invention application.

[0065] Figure 3 This is a flowchart illustrating another preferred embodiment of the data forwarding method based on graph neural networks provided in this application.

[0066] Figure 4 : A schematic diagram of an embodiment of the data forwarding device based on a graph neural network provided in this application. Detailed Implementation

[0067] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] Example 1

[0069] Please refer to Figure 1 , Figure 1 This invention application provides a data forwarding method based on a graph neural network, applied to a gateway system of a target network. The data forwarding method includes steps S101 to S105; each step is detailed below:

[0070] Step S101: Receive the data to be forwarded and identify the communication topology in the target network based on the data to be forwarded.

[0071] In this step, the data to be forwarded is characterized by multiple sources and heterogeneity. It may come from various nodes of the target network (each node may be a device, which may be a host or a router), and when the amount of data to be forwarded reaches a certain level, it may have multiple different data formats.

[0072] This step identifies the data source (such as device ID) based on the data to be forwarded, thereby obtaining the communication topology relationship of each device in the target network for the construction of the session graph model.

[0073] Step S102: Construct a session graph model based on the communication topology.

[0074] In some preferred embodiments, such as Figure 2 As shown, step S102 includes steps S201 to S203, each of which is described in detail below:

[0075] Step S201: Define model nodes of the session graph model according to the communication topology relationship; wherein, the model nodes include device nodes and session nodes, the device nodes are identified by the IP address or MAC address of the device in the communication topology relationship, and the session nodes are defined based on the communication session information from the source IP to the target IP in the communication topology relationship, the communication session information including IP address, port number and protocol type;

[0076] Step S202: Define the edges of the session graph model and the attributes of the edges according to the communication topology; wherein the edges represent the communication relationship between two nodes, and the attributes of the edges include time attributes, traffic attributes, protocol attributes, and communication frequency attributes.

[0077] Step S203: Construct the session graph model based on the defined model nodes, edges, and edge attributes.

[0078] In this embodiment, each model node represents an important element in the network, where device nodes represent network devices such as hosts and routers in the target network, usually identified by IP or MAC addresses.

[0079] Each edge represents the communication relationship between two nodes, that is, the process of data packet transmission between the two nodes. Each edge typically includes time attributes, flow attributes, protocol attributes, and communication frequency attributes.

[0080] The time attribute refers to the transmission order of data packets, the flow attribute usually refers to the size of the data packets and the transmission rate, the protocol attribute can be the protocol type (such as TCP, UDP, etc.), and the communication frequency attribute can be the interaction frequency between nodes (such as the communication frequency between two hosts).

[0081] In this implementation, when constructing the session graph model, communication sessions can be identified using network traffic data (such as traffic capture files, PCAPs, etc.) based on information such as source IP, destination IP, and protocol type. An edge is established between each session, and the edge weight can be determined based on features such as communication frequency or data traffic volume. Furthermore, time stamps can be added during construction to record the time information of each model node and edge, facilitating feature extraction and multi-dimensional analysis in subsequent steps.

[0082] Step S103: Use a preset graph neural network to extract features from the session graph model to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors.

[0083] In this step, a pre-trained Graph Neural Network (GNN) is used to uncover the potential connections between nodes. This GNN can be pre-trained and captures the relationships and patterns between data packets through efficient learning of nodes and edges in the graph.

[0084] For example, a pre-defined graph neural network can analyze the adjacency relationships between nodes, identifying frequently communicating device pairs and node pairs that may exhibit attack or abnormal behavior. For instance, frequent connections between two devices could indicate normal communication or abnormal attack behavior (such as port scanning). On the other hand, through graph convolution and message passing mechanisms, the pre-defined graph neural network can propagate the feature information of a node to its neighboring nodes, uncovering global potential connections between nodes. For example, the behavior pattern of a node may influence the behavior of its neighboring nodes, thus allowing the capture of abnormal patterns across devices and sessions. Furthermore, introducing a self-attention mechanism into the pre-defined graph neural network can enhance attention to potential abnormal behavior by automatically selecting and assigning different weights to different edges or nodes.

[0085] In some preferred embodiments, such as Figure 3 As shown, step S103 involves extracting features from the conversation graph model using a preset graph neural network to obtain feature extraction results, including steps S301 to S303; each step is detailed below:

[0086] Step S301: Identify key nodes in the model nodes through node centrality analysis; divide the model nodes in the session graph model into multiple device groups through graph clustering algorithm; and obtain the communication topology features based on the key nodes and device groups through comprehensive analysis.

[0087] Step S302: Based on the communication relationship, extract the distribution of traffic volume, number of sessions, packet rate and protocol type of the target network in each preset time window in historical communication sessions to obtain the statistical characteristics;

[0088] Step S303: Identify the protocol layer context information and protocol header information of the target network in historical communication sessions based on the communication relationship; and then construct the protocol content embedding vector based on the protocol layer context information and protocol header information.

[0089] In this embodiment, the communication topology features are mainly used to describe the connection relationships and traffic distribution between various nodes (such as IP addresses and devices) in the network. The node centrality analysis described in this embodiment can determine which nodes occupy important positions in the network by calculating indicators such as degree centrality and betweenness centrality of nodes in the graph. Some attacks may affect the traffic of the entire network by controlling core nodes.

[0090] On the other hand, this implementation also employs graph clustering algorithms (such as the Louvain algorithm) to divide the session graph into communities (i.e., into a number of device groups), identify device groups or user groups with similar behavioral patterns, and thus identify potential attack groups or malicious traffic.

[0091] The aforementioned statistical features can be statistical features within a preset time window, primarily used to capture changes in traffic behavior over specific time periods. This embodiment can divide traffic data according to the aforementioned time window, for example, per second, per minute, or per hour. Network activity within each time period will be statistically analyzed into a set of features. For each time window, the following features can be calculated: such as traffic size (number of bytes, number of packets, etc.), number of sessions (number of communication sessions within that time window), packet rate (data packet transmission rate), and protocol type distribution, etc.

[0092] The aforementioned protocol content embedding vector can be represented by extracting the protocol layer content of data packets (such as TCP / UDP headers, HTTP messages, etc.) and mapping it into a low-dimensional embedding space.

[0093] Preset graph neural networks can extract information (such as TCP / UDP port numbers, flags, packet length, etc.) from the protocol header of each data packet and embed these information into features using convolutional neural networks (CNNs) or Transformers. Furthermore, through message passing mechanisms, the protocol content information not only depends on individual data packets but also considers the contextual information of adjacent packets, capturing potential patterns at the protocol layer. This extracted information is then mapped into low-dimensional vectors representing the traffic behavior patterns at the protocol layer, resulting in the aforementioned protocol content embedding vector.

[0094] Step S104: The feature extraction results are analyzed from the dimensions of traffic behavior, protocol content, and user behavior to obtain traffic behavior analysis results, protocol analysis results, and user behavior analysis results; and the traffic behavior analysis results, protocol analysis results, and user behavior analysis results are fused to obtain a fused analysis result.

[0095] In this step, based on the above feature extraction results, analysis can be performed from the dimensions of traffic behavior, protocol content, and user behavior. In specific implementation, the above feature extraction results can be mapped to three different analysis channels for analysis. These three analysis channels represent different traffic perspectives or data dimensions.

[0096] The traffic behavior dimension focuses on the behavioral characteristics of traffic, specifically including time-related features such as packet transmission rate, traffic patterns, and session duration. By mapping to this parsing channel, the system can capture dynamic changes in network traffic over time, such as bursts of traffic and abnormal fluctuations.

[0097] The protocol feature dimension focuses on protocol layer characteristics, such as IP protocol, port number, protocol type, and packet content. These features help the system identify whether traffic conforms to common network protocol standards, whether there is protocol abuse or other abnormal protocol behavior, and specifically, factors such as TCP / UDP ports, protocol types (e.g., HTTP, FTP, and DNS), and packet header information.

[0098] User behavior analytics (UBA) focuses on characteristics related to specific users, such as source IP, destination IP, and access patterns. By mapping corresponding resolution channels, it can effectively identify anomalies in user behavior patterns and thus discover potential malicious behavior.

[0099] After mapping the above feature extraction results to three different parsing channels, the data from the three channels can be fused, specifically through weighting, aggregation, and other methods, to form a unified fusion parsing result for traffic, which can be used to assess the risk level of the data to be forwarded.

[0100] When performing data fusion, methods such as weighted fusion, combination of time-series features, and feature standardization and normalization can be used.

[0101] For example, different resolution channels can be used with different weights, which can be handled through weighted fusion algorithms (such as weighted average, weighted summation, etc.). The weights of different protocols and behavioral features determine their influence on the final risk score. Furthermore, the features of traffic behavior and user behavior resolution channels are time-series, therefore it is necessary to model the temporal changes in traffic and use time-series models (such as LSTM, GRU, etc.) to process time-series data. Through feature standardization and normalization, different types of features can be made to have the same dimensions or distribution characteristics.

[0102] Before matching the corresponding processing channel according to the risk level in step S105, the method further includes: identifying the protocol of the data to be forwarded to obtain the heterogeneous network protocol; and converting the heterogeneous network protocol into a unified intermediate data format within the system.

[0103] In some preferred embodiments, converting the heterogeneous network protocol into a unified intermediate data format within the system includes:

[0104] A reconfigurable hardware acceleration engine is used to convert the heterogeneous network protocol into a unified intermediate data format within the system. The reconfigurable hardware acceleration engine adopts a fusion architecture of FPGA and ASIC. The FPGA part of the fusion architecture is pre-divided into a static shell area and one or more dynamic reconfiguration partitions. The static shell area has data paths and control interfaces embedded in it, and the dynamic reconfiguration partitions are pre-loaded with protocol processing logic.

[0105] When converting the heterogeneous network protocol into a unified intermediate data format within the system, the dynamic reconstruction partition is used to perform protocol identification, field parsing, and structure conversion logic according to the protocol processing logic; the ASIC part in the fusion architecture performs hardware acceleration processing on preset high-frequency protocols.

[0106] In this step, the FPGA portion is pre-divided into a Static Shell and one or more Dynamic Reconfiguration / DFX Regions, and then embedded within the Shell. It can also be configured with several control interfaces such as AXI4, AXI4-Lite, and AXI4-Stream interfaces for controlling instructions, status registers, and data flow. Furthermore, it can employ PR region management; for example, a PR controller (ICAP / PCAP) is responsible for dynamically loading and unloading the FPGA portion.

[0107] For example, the above PR region can be defined as:

[0108] Protocol Identification Module (PR1): Responsible for frame header parsing and protocol determination (e.g., Ethernet, IP, MPLS, etc.).

[0109] Field parsing module (PR2): Extracts fields from the protocol header, including variable-length field processing, offset calculation, and verification.

[0110] The structure conversion module (PR3) is responsible for mapping the parsed fields to the target protocol structure, performing byte order adjustment, session ID injection, etc.

[0111] Protocol Extension Module (PR4): Reserves an extension area to support new protocols. After dynamic loading, it can support the parsing of new protocol types or fields.

[0112] Furthermore, the aforementioned FPGA portion can also be dynamically deployed and lightweight updated (i.e., microcode and table entry updates), without requiring reconfiguration of hardware modules, resulting in fast response and suitability for scenarios with minimal protocol format changes.

[0113] Publishers can describe the protocol format, header fields, and parsing rules using a DSL. A compilation tool converts the DSL into protocol identification and parsing entries; generates entry microcode, packages it into an update package (e.g., update.bin), containing the protocol identification table, field parsing table, and state machine table; furthermore, the update package is stored on external storage media and signed to ensure its integrity and legitimacy.

[0114] The triggering and downloading of table entries are as follows: The control plane, such as the host CPU or management controller, triggers a table entry update request and sends the update package to the FPGA module through the AXI4-Lite interface; through the AXI4-Stream and AXI4-Lite interfaces, the microcode update is loaded into the FPGA's internal table entry storage (such as BRAM / URAM); the update process is verified by the FPGA's image detection mechanism (Shadow Validation) to ensure that the new table entry will not cause system anomalies.

[0115] The update takes effect immediately upon completion, with new protocol entries and parsing rules beginning to process real-time data streams. The new protocol identification and field parsing rules seamlessly replace older configurations without interrupting existing sessions. The system can verify the execution of the new entries through real-time telemetry to ensure accuracy.

[0116] In addition to the dynamic deployment mentioned above, there is also the partial reconfiguration (PR) scenario, which is suitable for scenarios that require reconfiguration of hardware logic. This involves in-depth protocol parsing, protocol function expansion, etc., and is suitable for scenarios with significant protocol changes or the need for new hardware acceleration modules.

[0117] In some preferred embodiments, the aforementioned FPGA module (or FPGA section) can be divided into multiple units such as protocol identification, field parsing, and structure conversion. The design of each unit is converted into a bitstream file using HLS / RTL compilation tools, generating corresponding PR bitstream files. The interface between each unit and other units adopts a standardized design, supporting on-demand loading. The generated PR bitstream and Manifest file may include unit version information, resource requirements, functional descriptions, compatibility declarations, signatures, etc. Furthermore, a compatibility check can be performed before deployment to ensure that the FPGA resources meet the requirements of the new module.

[0118] Furthermore, dynamic loading can be employed before deployment. Specifically, the control plane initiates a partial reconfiguration request, loading the PR bitstream into the dynamic partition of the target FPGA via the ICAP (Internal Configuration Access Port) or PCAP interface. During the loading process, the control plane ensures uninterrupted data flow through state machine management and hardware reset control, achieving zero packet loss. After loading is complete, the system reconnects to the data path via the AXI interface, ensuring that traffic smoothly enters the new protocol parsing pipeline.

[0119] In some preferred implementations, shadow instances (Shadow PRMs) can be used for rollback verification to validate the correctness of new modules without affecting normal operation. If problems are found, a quick switchback to the old version can be achieved. During any update or configuration process, if a new configuration is detected to cause system instability (such as performance issues, compatibility problems, or incorrect parsing), the system will initiate a rollback mechanism and automatically switch back to the old version of the entries or modules, restoring the previous working state and ensuring the continuity of data flow.

[0120] The ASIC portion can be used to optimize and accelerate common high-frequency protocols (such as IPSec, MPLS, and BGP) to improve throughput, reduce latency, and free up processing resources in the FPGA portion.

[0121] First, the ASIC part identifies and classifies common high-frequency protocols (such as IPSec, MPLS, BGP, etc.) and uses hardware-accelerated protocol matching mechanisms (such as hardware TCAM, hash tables, state machines, etc.).

[0122] Specifically, when a data packet arrives, the protocol type of the data packet is first determined through IP header parsing and MPLS label checking; the protocol type of each data packet will be identified, and the subsequent processing path will be determined based on the protocol type.

[0123] For the IPSec protocol, when the ASIC detects a packet as belonging to the IPSec protocol, it quickly extracts and identifies the ESP (Encapsulating Security Payload) or AH (Authentication Header) header. Using a high-speed lookup table (such as a hash table or index table), it identifies the SPI (Security Parameter Index) and SequenceNumber within the packet and determines the context of the secure session.

[0124] For encrypted data in IPSec ESP mode, the ASIC uses a hardware-accelerated AES decryption unit to decrypt the data and restore it to its original format. It also performs integrity verification on the decrypted data, such as SHA-1 or SHA-256 hash checks, to ensure the integrity and authenticity of the data during transmission.

[0125] For data transmission requiring encryption, the ASIC section uses a hardware-accelerated AES encryption unit to encrypt the data. The encrypted data is then encapsulated using IPSec, such as re-encapsulating the ESP packet, inserting the correct SPI and SequenceNumber, and preparing the data packet for transmission.

[0126] To accelerate the MPLS protocol, the ASIC part performs MPLS label parsing on received data packets, quickly matching labels within the packets using an MPLS label lookup table. Based on the label value, it determines the next-hop label (the next-layer MPLS label or the packet's target route). It supports label push, pop, and swap operations, enabling rapid manipulation of MPLS labels within data packets. A fast lookup is performed using a hardware routing table or RIB (Routing Information Base) to determine the next hop based on label information. Precise forwarding is performed based on routing information, while simultaneously updating MPLS labels to ensure efficient and seamless forwarding of data packets to their destination nodes.

[0127] For the BGP protocol, the ASIC part parses BGP routing information and processes BGP update messages, such as BGP route prefixes, AS paths, and network prefix lengths. It parses BGP advertisement messages (UPDATE, OPEN, KEEPALIVE) and maintains the BGP prefix table, supporting high-frequency BGP routing information updates and maintenance. It queries the prefixes in the BGP routing table and determines the optimal route path based on longest prefix matching (LPM) and path selection algorithms. It makes dynamic decisions on routes based on BGP attributes (such as AS paths, prefix lengths, and route priorities) for fast route switching. Furthermore, it accelerates BGP message acceleration and transmission by rapidly encapsulating BGP messages (such as OPEN and UPDATE) and transmitting them efficiently through a hardware interface, avoiding CPU intervention. High-speed synchronization is performed between BGP neighbors to ensure the timely propagation and updating of routing information.

[0128] Step S105: Based on the fusion parsing results, assess the risk level of the data to be forwarded; and according to the risk level, match the corresponding processing channel, and then use the matched processing channel to forward the data to be forwarded.

[0129] In some preferred embodiments, the accuracy of the risk level assessment results can be verified using classification metrics such as Precision / Recall / F1 (with particular attention to Recall and low false alarm scenarios) or AUC-ROC. Risk score calibration can be performed using BrierScore or ExpectedCalibrationError (ECE).

[0130] In addition, response time (average inference latency, system throughput (pps / Mbps)) and specific threat assessment performance metrics (such as the number of real attacks captured, false negative case analysis, false positive rate or false positives per thousand hours) can also be considered.

[0131] In some preferred embodiments, the step of matching a corresponding processing channel based on the risk level, and then using the matched processing channel to forward the data to be forwarded, includes:

[0132] When the risk level is Level 1, a first processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded.

[0133] When the risk level is level two, a second processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0134] When the risk level is level three, a third processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0135] Through the matching and forwarding of the above processing channels, the processing latency of the first level can be controlled within 0.5 milliseconds, and the latency of the second level can be controlled within 2 milliseconds.

[0136] Furthermore, the data forwarding method also includes:

[0137] Real-time monitoring of the system resource status corresponding to the processing channel, including CPU utilization, hardware acceleration engine load, and cache queue depth;

[0138] Based on the risk level assessment results and the resource status, predict future load trends;

[0139] Based on the prediction results, the proportion of hardware resources allocated to the first processing channel, the second processing channel, and the third processing channel is dynamically adjusted.

[0140] In some preferred approaches, deep reinforcement learning algorithms can be employed to predict the future load trends of the gateway system and dynamically adjust FPGA resource mapping, cache queue allocation, and protocol module load migration. Specifically, this can be implemented using state space and action space mechanisms.

[0141] Furthermore, the aforementioned deep learning model can also evaluate the quality of actions through a reward function, thereby training an efficient control strategy.

[0142] In one application example, such as when the gateway system serves as the edge gateway in a smart factory, different devices communicate with the central management platform using industrial protocols such as Modbus, Profinet, and OPC-UA. High-speed data forwarding, secure isolation, and protocol interoperability are required.

[0143] Industrial equipment sends data to be forwarded to the gateway system via RS485 or Ethernet. The gateway system identifies the data as Modbus / TCP protocol and automatically loads the corresponding protocol parsing logic into the FPGA; it completes the protocol conversion from Modbus / TCP to OPC-UA and synchronizes the structure mapping; it detects communication session anomalies, and if a device's communication frequency is found to be abnormally high, it is marked as medium risk; it further checks whether the traffic is a data leak or virus propagation behavior; if it is confirmed to be safe, the traffic is forwarded to the OPC-UA aggregation service; otherwise, it is blocked and an alarm is triggered; all forwarded data is written to the edge log system in real time for unified operation and maintenance analysis by the platform.

[0144] In other application instances, the cloud platform needs to monitor massive public network traffic (IPv4 / IPv6 / VXLAN) in real time at the ingress gateway and dynamically allocate resources for high-risk traffic to avoid affecting the bandwidth of core services.

[0145] For example, the gateway system can be deployed at the edge node of the data center, handling approximately 500,000 concurrent connections per second. The gateway system unpacks VXLAN encapsulated traffic and identifies the inner IPv6 transmission. The FPGA performs protocol parsing and speed acceleration, constructing a unified intermediate data format. When a source IP is detected accessing multiple ports, it is marked as high-risk. High-risk traffic enters the DPI and behavior sandbox, where dictionary attack behavior is detected. The system blocks the IP in real time, adds it to the blacklist, and dynamically releases the occupied scheduling resources. The scheduling engine schedules core services to lower-load forwarding paths to ensure their QoS. The attack detection time of this application instance is controlled within an average of less than 80 milliseconds, and it achieves automatic resource reclamation to avoid system overload, ensuring business continuity and network resilience for cloud users.

[0146] In other application examples, the data forwarding method based on graph neural networks described in any of the above implementation methods can also be used for adaptive protocol identification and intelligent forwarding on IoT platforms.

[0147] For example, in a smart city IoT platform, hundreds of sensor devices send status information to the platform via MQTT, CoAP, LwM2M, and proprietary protocols. Rapid identification, intelligent classification, and unified protocol forwarding are required.

[0148] The gateway system described in any of the above embodiments can be deployed at the edge node of the IoT platform. A portion of the access traffic uses a private protocol. Machine learning is used to dynamically guess the structure of the private protocol and construct a parsing template. Based on historical communication pattern maps, anomalies are identified: for example, if the transmission cycle of a certain type of sensor suddenly shortens, the traffic is labeled "medium risk" and enters rule matching and frequency review. If the system detects an abnormal firmware version of the device, it is determined as a potential anomaly and reported to maintenance personnel. Other normal traffic is forwarded to a unified MQTT receiver through an acceleration module. This application example achieves a new private protocol identification success rate of 88%, effectively reducing the false alarm rate of the IoT platform, reducing the burden of manual review, and enabling congestion-free processing of millions of concurrent terminal traffic.

[0149] Accordingly, please refer to Figure 4 This application also provides a data forwarding device 400 based on a graph neural network, applied to a gateway system of a target network. The data forwarding device 400 includes a topology identification module 401, a model building module 402, a feature extraction module 403, a parsing module 404, and a forwarding module 405; wherein...

[0150] The topology identification module 401 is used to receive data to be forwarded and identify the communication topology relationship in the target network based on the data to be forwarded.

[0151] The model building module 402 is used to build a session graph model based on the communication topology relationship;

[0152] The feature extraction module 403 is used to extract features from the session graph model using a preset graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors;

[0153] The parsing module 404 is used to parse the feature extraction results from the dimensions of traffic behavior, protocol content, and user behavior, respectively, to obtain traffic behavior parsing results, protocol parsing results, and user behavior parsing results; and to fuse the traffic behavior parsing results, protocol parsing results, and user behavior parsing results to obtain a fused parsing result.

[0154] The forwarding module 405 is used to assess the risk level of the data to be forwarded based on the fusion parsing result; and to match the corresponding processing channel according to the risk level, and then use the matched processing channel to forward the data to be forwarded.

[0155] As a preferred embodiment, the forwarding module 405 matches a corresponding processing channel according to the risk level, and then uses the matched processing channel to forward the data to be forwarded, including:

[0156] When the risk level is Level 1, the forwarding module 405 matches the data to be forwarded with a first processing channel; and forwards the data to be forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded.

[0157] When the risk level is the second level, the forwarding module 405 matches the data to be forwarded with the second processing channel; and forwards the data to be forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0158] When the risk level is level three, the forwarding module 405 matches the data to be forwarded with a third processing channel; and forwards the data to be forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

[0159] As a preferred embodiment, the data forwarding device 400 further includes a dynamic adjustment module, which is used for:

[0160] Real-time monitoring of the system resource status corresponding to the processing channel, including CPU utilization, hardware acceleration engine load, and cache queue depth;

[0161] Based on the risk level assessment results and the resource status, predict future load trends;

[0162] Based on the prediction results, the proportion of hardware resources allocated to the first processing channel, the second processing channel, and the third processing channel is dynamically adjusted.

[0163] As a preferred embodiment, the model building module 402 constructs a session graph model based on the communication topology, including:

[0164] The model building module 402 defines the model nodes of the session graph model based on the communication topology relationship. The model nodes include device nodes and session nodes. The device nodes are identified by the IP address or MAC address of the device in the communication topology relationship. The session nodes are defined based on the communication session information from the source IP to the destination IP in the communication topology relationship. The communication session information includes IP address, port number and protocol type.

[0165] Based on the communication topology, the edges of the session graph model are defined, as well as the attributes of the edges; wherein, the edge represents the communication relationship between two nodes, and the attributes of the edge include time attribute, traffic attribute, protocol attribute, and communication frequency attribute;

[0166] The session graph model is constructed based on the defined model nodes, edges, and edge attributes.

[0167] As a preferred embodiment, the feature extraction module 403 uses a preset graph neural network to extract features from the conversation graph model, obtaining feature extraction results, including:

[0168] The feature extraction module 403 identifies key nodes in the model nodes through node centrality analysis; it divides the model nodes in the session graph model into multiple device groups through a graph clustering algorithm; and it obtains the communication topology features by performing a comprehensive analysis based on the key nodes and device groups.

[0169] Based on the communication relationship, the distribution of traffic volume, number of sessions, packet rate and protocol type of the target network in each preset time window in historical communication sessions is extracted to obtain the statistical characteristics.

[0170] Based on the communication relationship, the protocol layer context information and protocol header information of the target network in historical communication sessions are identified; then, based on the protocol layer context information and protocol header information, the protocol content embedding vector is constructed.

[0171] As a preferred embodiment, the data forwarding device 400 further includes a format conversion module, which is used to: identify the protocol of the data to be forwarded to obtain a heterogeneous network protocol before matching the corresponding processing channel according to the risk level; and convert the heterogeneous network protocol into a unified intermediate data format within the system.

[0172] As a preferred embodiment, the format conversion module converts the heterogeneous network protocol into a unified intermediate data format within the system, including:

[0173] The format conversion module uses a reconfigurable hardware acceleration engine to convert the heterogeneous network protocols into a unified intermediate data format within the system.

[0174] The reconfigurable hardware acceleration engine adopts a fusion architecture of FPGA and ASIC. The FPGA part of the fusion architecture is pre-divided into a static shell area and one or more dynamic reconfiguration partitions. The static shell area has data paths and control interfaces, and the dynamic reconfiguration partitions are pre-loaded with protocol processing logic.

[0175] When converting the heterogeneous network protocol into a unified intermediate data format within the system, the dynamic reconstruction partition is used to perform protocol identification, field parsing, and structure conversion logic according to the protocol processing logic; the ASIC part in the fusion architecture performs hardware acceleration processing on preset high-frequency protocols.

[0176] Compared with the prior art, this invention application has the following beneficial effects:

[0177] This invention provides a data forwarding method and apparatus based on a graph neural network, applied to a gateway system of a target network. The data forwarding method includes: receiving data to be forwarded and identifying communication topology relationships in the target network based on the data to be forwarded; constructing a session graph model based on the communication topology relationships; extracting features from the session graph model using a preset graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors; parsing the feature extraction results from traffic behavior dimensions, protocol content dimensions, and user behavior dimensions to obtain traffic behavior parsing results, protocol parsing results, and user behavior parsing results; fusing the traffic behavior parsing results, protocol parsing results, and user behavior parsing results to obtain a fused parsing result; assessing the risk level of the data to be forwarded based on the fused parsing result; and matching a corresponding processing channel according to the risk level, and then using the matched processing channel to forward the data to be forwarded. Compared to existing technical solutions that only use statistical or protocol features, this invention constructs a session graph model and uses graph neural networks to extract communication topology features, statistical features, and protocol content embedding vectors. It then analyzes these features from the dimensions of traffic behavior, protocol content, and user behavior, enabling in-depth mining of potential and hidden connections and behavioral patterns between network entities. This allows for the identification of complex cross-node and cross-session security threats that cannot be detected by single data packets or flow features alone. Furthermore, this technical solution, which uses a session graph model based on communication topology and graph neural networks for feature extraction, allows for effective risk assessment of data to be forwarded from a global perspective, thereby matching the appropriate processing channel for forwarding and fundamentally improving the security of data forwarding.

[0178] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A data forwarding method based on graph neural networks, characterized in that, A gateway system applied to a target network, wherein the data forwarding method includes: Receive data to be forwarded, and identify the communication topology in the target network based on the data to be forwarded; Construct a session graph model based on the communication topology; The features of the session graph model are extracted using a pre-defined graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors; The feature extraction results are analyzed from the dimensions of traffic behavior, protocol content, and user behavior to obtain traffic behavior analysis results, protocol analysis results, and user behavior analysis results, respectively; and the traffic behavior analysis results, protocol analysis results, and user behavior analysis results are then fused to obtain a fused analysis result. Based on the fusion analysis results, the risk level of the data to be forwarded is assessed; and according to the risk level, a corresponding processing channel is matched, and then the matched processing channel is used to forward the data to be forwarded.

2. The data forwarding method based on graph neural networks as described in claim 1, characterized in that, The step of matching a corresponding processing channel based on the risk level, and then using the matched processing channel to forward the data to be forwarded, includes: When the risk level is Level 1, a first processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded. When the risk level is level two, a second processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification. When the risk level is level three, a third processing channel is matched for the data to be forwarded; and the data to be forwarded is forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

3. The data forwarding method based on graph neural networks as described in claim 2, characterized in that, The data forwarding method further includes: Real-time monitoring of the system resource status corresponding to the processing channel, including CPU utilization, hardware acceleration engine load, and cache queue depth; Based on the risk level assessment results and the resource status, predict future load trends; Based on the prediction results, the proportion of hardware resources allocated to the first processing channel, the second processing channel, and the third processing channel is dynamically adjusted.

4. The data forwarding method based on graph neural networks as described in claim 1, characterized in that, The step of constructing a session graph model based on the communication topology includes: Based on the communication topology, model nodes of the session graph model are defined; wherein, the model nodes include device nodes and session nodes, the device nodes are identified by the IP address or MAC address of the device in the communication topology, and the session nodes are defined based on the communication session information from the source IP to the destination IP in the communication topology, the communication session information including IP address, port number and protocol type; Based on the communication topology, the edges of the session graph model are defined, as well as the attributes of the edges; wherein, the edge represents the communication relationship between two nodes, and the attributes of the edge include time attribute, traffic attribute, protocol attribute, and communication frequency attribute; The session graph model is constructed based on the defined model nodes, edges, and edge attributes.

5. The data forwarding method based on a graph neural network as described in claim 4, characterized in that, The step of extracting features from the conversation graph model using a preset graph neural network to obtain feature extraction results includes: By analyzing node centrality, key nodes in the model are identified; by using a graph clustering algorithm, the model nodes in the session graph model are divided into multiple device groups; and by performing a comprehensive analysis based on the key nodes and device groups, the communication topology features are obtained. Based on the communication relationship, the distribution of traffic volume, number of sessions, packet rate and protocol type of the target network in each preset time window in historical communication sessions is extracted to obtain the statistical characteristics. Based on the communication relationship, the protocol layer context information and protocol header information of the target network in historical communication sessions are identified; then, based on the protocol layer context information and protocol header information, the protocol content embedding vector is constructed.

6. The data forwarding method based on graph neural networks as described in claim 1, characterized in that, Before matching the corresponding processing channel according to the risk level, the method further includes: The protocol of the data to be forwarded is identified to obtain the heterogeneous network protocol; The heterogeneous network protocol is converted into a unified intermediate data format within the system.

7. The data forwarding method based on graph neural networks as described in claim 6, characterized in that, The step of converting the heterogeneous network protocol into a unified intermediate data format within the system includes: A reconfigurable hardware acceleration engine is used to convert the heterogeneous network protocols into a unified intermediate data format within the system. The reconfigurable hardware acceleration engine adopts a fusion architecture of FPGA and ASIC. The FPGA part of the fusion architecture is pre-divided into a static shell area and one or more dynamic reconfiguration partitions. The static shell area has data paths and control interfaces, and the dynamic reconfiguration partitions are pre-loaded with protocol processing logic. When converting the heterogeneous network protocol into a unified intermediate data format within the system, the dynamic reconstruction partition is used to perform protocol identification, field parsing, and structure conversion logic according to the protocol processing logic; the ASIC part in the fusion architecture performs hardware acceleration processing on preset high-frequency protocols.

8. A data forwarding device based on a graph neural network, characterized in that, A gateway system applied to a target network, wherein the data forwarding device includes a topology identification module, a model construction module, a feature extraction module, a parsing module, and a forwarding module; wherein, The topology identification module is used to receive data to be forwarded and identify the communication topology relationships in the target network based on the data to be forwarded. The model building module is used to build a session graph model based on the communication topology. The feature extraction module is used to extract features from the session graph model using a preset graph neural network to obtain feature extraction results; wherein, the feature extraction results include communication topology features, statistical features, and protocol content embedding vectors; The parsing module is used to parse the feature extraction results from the dimensions of traffic behavior, protocol content, and user behavior, respectively, to obtain traffic behavior parsing results, protocol parsing results, and user behavior parsing results; and to fuse the traffic behavior parsing results, protocol parsing results, and user behavior parsing results to obtain a fused parsing result. The forwarding module is used to assess the risk level of the data to be forwarded based on the fusion parsing result; and to match the corresponding processing channel according to the risk level, and then use the matched processing channel to forward the data to be forwarded.

9. A data forwarding device based on a graph neural network as described in claim 8, characterized in that, The forwarding module matches a corresponding processing channel based on the risk level, and then uses the matched processing channel to forward the data to be forwarded, including: When the risk level is Level 1, the forwarding module matches the data to be forwarded with a first processing channel; and forwards the data to be forwarded through the first processing channel; wherein, the first processing channel uses a forwarding engine based on FPGA hardware to forward the data to be forwarded. When the risk level is level two, the forwarding module matches the data to be forwarded with a second processing channel; and forwards the data to be forwarded through the second processing channel; wherein, the second processing channel uses a regular expression matching engine to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification. When the risk level is level three, the forwarding module matches the data to be forwarded with a third processing channel; and forwards the data to be forwarded through the third processing channel; wherein, the third processing channel uses deep packet inspection, behavioral anomaly analysis and threat intelligence analysis to verify the data to be forwarded; and then forwards the data to be forwarded that has passed the verification.

10. A data forwarding device based on a graph neural network as described in claim 8, characterized in that, The model building module constructs a session graph model based on the communication topology, including: The model building module defines the communication topology relationship and the model nodes of the session graph model. The model nodes include device nodes and session nodes. The device nodes are identified by the IP address or MAC address of the device in the communication topology relationship. The session nodes are defined based on the communication session information from the source IP to the destination IP in the communication topology relationship. The communication session information includes IP address, port number and protocol type. Based on the communication topology, the edges of the session graph model are defined, as well as the attributes of the edges; wherein, the edge represents the communication relationship between two nodes, and the attributes of the edge include time attribute, traffic attribute, protocol attribute, and communication frequency attribute; The session graph model is constructed based on the defined model nodes, edges, and edge attributes.

Images