Port resource dynamic management method and system based on graph neural network and real-time big data, storage medium and program product

Abstract

The invention provides a port resource dynamic management method and system based on a graph neural network and real-time big data, a storage medium and a program product, and relates to the technical field of deep learning, a flow time slice is generated by using a sliding window to adapt to a real-time requirement, a packet length sequence and a time interval are extracted to construct an initial flow feature vector, and the initial flow feature vector is subjected to dynamic management. And basic description of port behaviors is completed. A topological adjacency matrix is utilized to construct a graph structure, aggregation operation is carried out through a graph neural network, and topology is utilized as path constraint to force each port node to refer to the characteristics of neighbor nodes of the port node. The feature representation of the port is no longer isolated, and the global connection relationship is fused. Even if an attacker enables the microscopic statistical characteristics of the malicious port to tend to the normal service in numerical value through traffic shaping, the abnormal neighbor connection mode still corrects the characteristic vector through graph aggregation, so that the misjudgment of characteristic assimilation is broken, and the recognition precision of the abnormal behavior of the high-concealment dynamic port is improved.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, and in particular to a method, system, storage medium, and program product for dynamic governance of port resources based on graph neural networks and real-time big data. Background Technology

[0002] With the rapid development of the Internet and the Internet of Things, the interaction between services and devices in the network is becoming more and more frequent. In the current highly dynamic environment, the port number of legitimate business is no longer fixed and often changes in real time as the service is started, stopped or migrated.

[0003] To address the issue of static rules failing due to the dynamic and random changes in ports, related technologies continue to process traffic through encrypted traffic identification technology based on spatiotemporal sequence characteristics. This involves treating communication behavior on a port as a sequence of signals arranged in time and performing pattern matching. Thus, without decrypting message content or relying on fixed port numbers, the specific application type carried on the dynamic port can be inferred by analyzing traffic behavior. This solves to some extent the problem that simply relying on port numbers cannot identify dynamically migrating services and non-standard port applications.

[0004] However, related technologies can make the packet length distribution and time interval characteristics of illegal control flows statistically similar to those of normal business flows by randomly filling data packets or introducing controlled delay jitter. Therefore, the accuracy of identifying highly concealed abnormal behavior of dynamic ports is low. Summary of the Invention

[0005] This application provides a method, system, storage medium, and program product for dynamic governance of port resources based on graph neural networks and real-time big data, which can be used to improve recognition accuracy.

[0006] Firstly, this application provides a method for dynamic governance of port resources based on graph neural networks and real-time big data. This includes: Use a sliding window to capture communication data and generate a traffic time slice containing all data packets in the current window; The header information of all data packets in the traffic time slice is parsed with a preset length, wherein: the combination of IP address and port number is defined as a port node, and the connection between port nodes with session interaction relationship is mapped as a communication edge; The initial flow feature vector is obtained by extracting the packet length sequence and packet arrival time interval statistics associated with each port node from the flow time slice; A topological adjacency matrix is ​​constructed based on port nodes and communication edges; and the initial flow feature vectors of the port nodes are added in sequence to form a node feature matrix. The topological adjacency matrix and the node feature matrix are input into a pre-set graph neural network model for aggregation operation. The topological adjacency matrix is ​​used as a path constraint for feature propagation, enabling each port node to fuse features with its neighbor nodes and output a topologically enhanced feature vector. The business semantic label corresponding to each port node is obtained by decoding and mapping based on the topology-enhanced feature vector. Based on the business semantic tags, a preset security baseline is matched to generate access control policies for port nodes. The access control policies include blocking or allowing.

[0007] By employing the aforementioned technical solution, a sliding window is used to generate traffic time slices to adapt to real-time requirements, and packet length sequences and time intervals are extracted to construct initial flow feature vectors, thus completing a basic characterization of port behavior. A graph structure is constructed using a topological adjacency matrix, and aggregation operations are performed through a graph neural network. The topology is used as a path constraint to force each port node to reference the features of its neighboring nodes. This mechanism ensures that the feature representation of a port is no longer isolated but incorporates global connectivity relationships. Even if an attacker uses traffic shaping (such as introducing controlled latency) to make the micro-statistical characteristics of a malicious port numerically similar to normal business operations, its abnormal neighbor connection patterns will still correct its feature vectors through graph aggregation, thereby breaking the misjudgment caused by feature assimilation and improving the accuracy of identifying highly concealed dynamic port anomalies.

[0008] In conjunction with some embodiments of the first aspect, in some embodiments, the steps of inputting the topological adjacency matrix and the node feature matrix into a preset graph neural network model for aggregation operation, using the topological adjacency matrix as a path constraint for feature propagation, enabling each port node to fuse features with its neighbor nodes, and outputting a topologically enhanced feature vector, specifically include: Traverse the node feature matrix, compare the initial flow feature vectors of the target port node with those of its neighboring nodes, and determine the maximum feature dimension; the target port node can be any port node. The feature computation space is constructed using the maximum feature dimension as the benchmark; Based on the positional distribution of non-zero elements in the topological adjacency matrix, the neighboring nodes are located, and the initial flow feature vectors of the neighboring nodes are accumulated in the feature operation space onto the initial flow feature vector of the target port node to obtain the accumulated feature vector. The accumulated feature vectors are filtered to obtain the topology-enhanced feature vectors.

[0009] By employing the aforementioned technical solution, during the aggregation phase of the graph neural network, the maximum feature dimension in the target and neighbor vectors is determined through traversal comparison, and a feature computation space is constructed accordingly. This allows the preservation of the complete dimension of variable-length traffic data. Subsequently, an accumulation operation is performed within a unified maximum-dimensional space. Because the computational benchmark is aligned and maximized, the subtle jitter fingerprints at the ends of long sequences (often containing key features) that might have been lost during low-dimensional compression or truncation are fully preserved during the aggregation process. The final output topology-enhanced feature vector not only integrates neighbor information but also minimizes the loss of detail caused by feature dimension truncation, enhancing the model's ability to capture port behaviors that utilize long-sequence traffic for covert attacks.

[0010] In conjunction with some embodiments of the first aspect, in some embodiments, before the step of locking neighboring nodes based on the positional distribution of non-zero elements in the topological adjacency matrix, and accumulating the initial flow feature vectors of the neighboring nodes onto the initial flow feature vectors of the target port node in the feature operation space to obtain the accumulated feature vector, the method further includes: In the topological adjacency matrix, a self-loop channel pointing to the target port node is added to each communication edge connecting to the target port node, resulting in a self-loop topological adjacency matrix. The steps of identifying neighboring nodes based on the positional distribution of non-zero elements in the topological adjacency matrix, and accumulating the initial flow feature vectors of the neighboring nodes onto the initial flow feature vector of the target port node in the feature operation space to obtain the accumulated feature vector include: Count the total number of communication edges and self-loop channels of the target port node in the self-loop topology adjacency matrix; The normalization coefficient is determined based on the total quantity, where the normalization coefficient is negatively correlated with the total quantity; Based on the positional distribution of non-zero elements in the self-loop topological adjacency matrix, neighboring nodes are located. The initial flow feature vectors of the neighboring nodes and the target port node are weighted using normalization coefficients and then accumulated in the feature operation space onto the initial flow feature vector of the target port node to obtain the accumulated feature vector.

[0011] By adopting the above technical solution and adding a self-loop channel, the model is logically forced to include the characteristics of the target port node itself when aggregating neighbor information, effectively preventing the "oversmoothing" phenomenon where the original characteristics are completely submerged by the neighbor characteristics after multi-layer propagation. Furthermore, the total number of connections is counted, and a normalization coefficient negatively correlated with it is introduced to weight the aggregation process. This processing is equivalent to imposing a weight penalty on "supernodes" with a huge number of connections in the network, avoiding the explosion of feature values ​​or dominance of local feature distribution caused by too many connections to a single node. This achieves sensitive capture of weak abnormal signals at the network edge and effective suppression of supernode noise, ensuring the numerical stability and accuracy of feature propagation.

[0012] In conjunction with some embodiments of the first aspect, in some embodiments, the step of adding the initial flow feature vectors of the port nodes in sequence to form a node feature matrix specifically includes: Length interval determination is performed on each initial flow feature vector using a standard dimension threshold. For the initial flow feature vector whose length exceeds the standard dimension threshold, a segmentation process is performed to obtain several overflow feature fragments whose dimension length is lower than the standard dimension threshold; In the node feature matrix, a corresponding number of virtual logical nodes are added to the port nodes that generate overflow feature fragments; The unsegmented initial flow feature vector and the overflow feature fragment are added sequentially to form the node feature matrix, where the overflow feature fragment serves as the feature vector of the virtual logical node.

[0013] By adopting the above technical solution, and by adding virtual logical nodes and using the overflow fragments as their feature vectors, the problem of "vectors being too long to fit into a matrix" is transformed into the problem of "increasing the number of nodes in a graph structure." This allows long-tail traffic data that originally could not fit into a fixed-dimensional matrix to be fully incorporated into the computation process in the form of virtual nodes. It achieves full feature retention for ultra-long heterogeneous traffic, ensuring that key attack fingerprints hidden deep within the traffic sequence (i.e., the overflow portion) are not missed due to dimensional limitations, thus improving the completeness of detecting complex, long-cycle attacks.

[0014] In conjunction with some embodiments of the first aspect, in some embodiments, after the step of adding a corresponding number of virtual logical nodes to the port nodes that generate overflow feature fragments in the node feature matrix, the method further includes: Establish bidirectional, interconnected, and same-originating edges between virtual logical nodes, their parent port nodes, and the nodes belonging to the same port node. The topological adjacency matrix is ​​expanded based on the same-origin related edges, and the multiple split virtual logical nodes are added as new vertices and incorporated into the topological adjacency matrix.

[0015] By adopting the above technical solution, bidirectional interconnected edges with the same origin are established and the topological adjacency matrix is ​​expanded, thus reconstructing the logical connections for the feature fragments that were physically fragmented in the previous step. During graph neural network operations, these edges with the same origin act as high-speed information channels, enabling overflowing feature fragments scattered in various virtual nodes to flow back to the physical port nodes or interact between virtual nodes.

[0016] In conjunction with some embodiments of the first aspect, in some embodiments, the step of extracting the packet length sequence and packet arrival time interval statistics associated with each port node from the traffic time slice to obtain the initial flow feature vector specifically includes: Iterate through the traffic time slices, read the IP header length field and header arrival timestamp of each data packet, and generate the original physical attribute sequence; The arrival timestamps of adjacent data packets in the original physical attribute sequence are differentially analyzed to obtain the packet arrival time interval sequence. The variance and standard deviation of the packet length values ​​in the original physical attribute sequence are calculated to obtain the load jitter factor; The packet length values, packet arrival time interval sequences, and payload jitter factors are concatenated and normalized to obtain the initial flow feature vector.

[0017] By employing the above technical solution, in extracting initial features, not only is the basic packet length sequence obtained, but time intervals are also extracted through differential operations, and the payload jitter factor is extracted by calculating variance and standard deviation. These three steps comprehensively characterize port behavior from spatial (size distribution), temporal (transmission rhythm), and statistical (fluctuation stability) dimensions, respectively. Finally, these multimodal features are concatenated and normalized to generate an initial flow feature vector containing rich information.

[0018] In conjunction with some embodiments of the first aspect, in some embodiments, the step of decoding and mapping based on topology-enhanced feature vectors to obtain the service semantic label corresponding to each port node specifically includes: Retrieve the pre-built business standard fingerprint library stored in system memory; Using the topology-enhanced feature vector of the port node to be identified as the source point and all standard center vectors in the business standard fingerprint database as target points, the spatial distance calculation logic is executed one by one to calculate the Euclidean distance value or cosine similarity value between the source point and each target point, and a fingerprint distance list containing all distance calculation results is generated. Traverse the fingerprint distance list, filter out the distance items with the best values ​​according to the principle of minimizing distance or maximizing similarity, and mark the corresponding standard business types as candidate business types; Determine whether the distance item with the optimal value falls within the preset effective judgment radius of the candidate service type. If it does, the match is successful, and the name of the candidate service type is confirmed as the service semantic label of the port node.

[0019] By employing the above technical solution, spatial metrics (such as distance or similarity) between the features of the port to be identified and the center vectors in the standard library are calculated, transforming abstract features into measurable similarity values. Furthermore, by selecting the optimal option and performing secondary verification in conjunction with the effective judgment radius, a dual judgment logic is constructed: requiring both "most similar" and "within the effective range".

[0020] Secondly, this application provides a dynamic port resource management system based on graph neural networks and real-time big data. The dynamic port resource management system based on graph neural networks and real-time big data includes: one or more processors and a memory; the memory is coupled to one or more processors, and the memory is used to store computer program code, which includes computer instructions. One or more processors call the computer instructions to cause the dynamic port resource management system based on graph neural networks and real-time big data to perform the method described in the first aspect and any possible implementation of the first aspect.

[0021] Thirdly, this application provides a computer program product containing instructions that, when the computer program product is run on a port resource dynamic management system based on graph neural networks and real-time big data, causes the port resource dynamic management system based on graph neural networks and real-time big data to execute the method described in the first aspect and any possible implementation thereof.

[0022] Fourthly, this application provides a computer-readable storage medium including instructions that, when executed on a port resource dynamic management system based on graph neural networks and real-time big data, cause the port resource dynamic management system based on graph neural networks and real-time big data to perform the method described in the first aspect and any possible implementation thereof.

[0023] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. By utilizing a sliding window to generate traffic time slices to adapt to real-time requirements, and extracting packet length sequences and time intervals to construct initial flow feature vectors, a basic characterization of port behavior is achieved. A graph structure is constructed using a topological adjacency matrix, and aggregation operations are performed through a graph neural network. Topology is used as a path constraint to force each port node to reference the features of its neighboring nodes. This mechanism ensures that the port's feature representation is no longer isolated but incorporates global connectivity relationships. Even if attackers use traffic shaping (such as introducing controlled latency) to make the micro-statistical characteristics of malicious ports numerically similar to normal business operations, their abnormal neighbor connection patterns will still correct their feature vectors through graph aggregation, thereby breaking the misjudgment caused by feature assimilation and improving the accuracy of identifying highly concealed dynamic port anomalies.

[0024] 2. In the aggregation phase of the graph neural network, the maximum feature dimension in the target and neighbor vectors is determined by traversing and comparing them, and a feature computation space is constructed accordingly. This allows the preservation of the complete dimension of variable-length traffic data. Subsequently, an accumulation operation is performed within a unified maximum-dimensional space. Because the computational benchmark is aligned and maximized, the subtle jitter fingerprints at the ends of long sequences (often containing key features) that might have been lost during low-dimensional compression or truncation are fully preserved during the aggregation process. The final output topology-enhanced feature vector not only integrates neighbor information but also minimizes the loss of detail caused by feature dimension truncation, enhancing the model's ability to capture port behaviors that utilize long-sequence traffic for covert attacks.

[0025] 3. Adding a self-loop channel logically forces the model to include the target port node's own features when aggregating neighbor information, effectively preventing the "oversmoothing" phenomenon where the original features are completely submerged by neighbor features after multi-layer propagation. Furthermore, the total number of connections is counted, and a normalization coefficient negatively correlated with it is introduced to weight the aggregation process. This process is equivalent to imposing a weight penalty on "supernodes" with a huge number of connections in the network, avoiding the explosion of feature values ​​or dominance of local feature distribution due to excessive connections from a single node. This enables the sensitive capture of weak anomalous signals at the network edge and effective suppression of supernode noise, ensuring the numerical stability and accuracy of feature propagation. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating a dynamic port resource management method based on graph neural networks and real-time big data in an embodiment of this application. Figure 2 This is a flowchart illustrating step S105 in an embodiment of this application; Figure 3 This is an exemplary hardware structure diagram of a port resource dynamic management system based on graph neural networks and real-time big data in this application embodiment. Detailed Implementation

[0027] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items.

[0028] Hereinafter, the terms "first" and "second" are for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the quantity of the indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more of such features. In the description of the embodiments of the present application, unless otherwise specified, the meaning of "plurality" is two or more.

[0029] Please refer to Figure 1 , Figure 1 which is a schematic flowchart of a port resource dynamic governance method based on a graph neural network and real-time big data in an embodiment of the present application; S101. Use a sliding window to intercept communication data and generate a traffic time slice containing all data packets within the current window; Among them, the communication data represents the original binary data packet stream flowing through a network interface card or a virtual switch port, including but not limited to protocol packets such as TCP, UDP, and ICMP.

[0030] S102. Analyze the information of the preset length of the headers of all data packets in the traffic time slice, where: the combination of the IP address and the port number is defined as a port node, and the connection between port nodes with a session interaction relationship is mapped as a communication link; Among them, the preset length of the header refers to a fixed byte sequence at the starting position of the data packet, usually covering the protocol headers of the link layer, network layer, and transport layer; a port node refers to a vertex (Vertex) representing a network entity pair in a graph structure, usually uniquely identified by a <IP address, port number> binary tuple; a communication link refers to an edge (Edge) connecting two vertices in a graph structure, used to represent a substantial data exchange behavior between two network entities.

[0031] Specifically, the system traverses each data packet in the time slice, reads its IP header and TCP / UDP header information, extracts the source IP, destination IP, source port, destination port, and transport layer protocol type (five-tuple information). Subsequently, the system performs deduplication and aggregation processing on these five-tuples, and identifies each unique "IP:Port" as a graph node. At the same time, if it is detected that there is data packet transmission (regardless of the direction) between node A and node B, an undirected or directed connection edge is established between A and B, thereby converting the flat traffic log into graph data with a topological structure.

[0032] S103. Extract the packet length sequence and the statistical value of the packet arrival time interval associated with each port node from the traffic time slice to obtain an initial flow feature vector; Among them, the packet length sequence refers to a set of data packet payload values ​​arranged in chronological order; the packet arrival time interval statistics refer to the statistical characteristics (such as mean and variance) of the difference in arrival times between two adjacent data packets; the initial flow feature vector refers to a one-dimensional numerical array used to digitally describe the port behavior pattern, which is the input data for the subsequent graph neural network.

[0033] Specifically, the system traces back all data packets that the node participated in within the current time slice. It sorts the packets by timestamp, extracts the length (bytes) of the first N packets, forming a sequence. Next, it calculates the timestamp difference (DeltaTime) between adjacent packets and uses these differences to calculate statistics such as the mean, standard deviation, maximum, and minimum values. Finally, it may combine information such as the stream duration and protocol type encoding to concatenate and normalize all the above values, forming a fixed- or variable-length vector, i.e., the initial stream feature vector.

[0034] In some specific embodiments, step S103 specifically includes: S1031. Traverse the traffic time slices, read the IP header length field and header arrival timestamp of each data packet, and generate the original physical attribute sequence; The original physical attribute sequence refers to a time-sorted list consisting of (length, timestamp) tuples.

[0035] Specifically, the system scans the data packets in the slice in processing order. For each packet belonging to the target port, its length and timestamp are copied directly from memory. These raw values ​​are then appended to the list sequentially, without any statistical compression, preserving the most original physical layer information.

[0036] S1032. Perform a difference operation on the arrival timestamps of adjacent data packets in the original physical attribute sequence to obtain a packet arrival time interval sequence; Specifically, this step extracts dynamic features along the time dimension. For the original timestamp sequence [t1, t2, ..., t...] n The system calculates iat1 = t2 - t1, iat2 = t3 - t2, ..., iat n-1 =t n -t n-1 This sequence eliminates the influence of absolute time.

[0037] S1033. Calculate the variance and standard deviation of the packet length values ​​in the original physical attribute sequence to obtain the load jitter factor. Among them, the load jitter factor is a statistical indicator that describes the degree of fluctuation in packet size.

[0038] Specifically, this step extracts statistical features of the payload dimension. The system obtains the packet length sequence [l_1, l_2, ..., l_...]. n Calculate the mean. ,variance Standard deviation These values ​​quantify whether the port traffic is "constantly large" (such as a full MTU packet for video streaming or file downloads, with small variance) or "fluctuating" (such as interactive web browsing, with large variance).

[0039] S1034. The packet length value, packet arrival time interval sequence and load jitter factor are concatenated and normalized to obtain the initial flow feature vector.

[0040] Among them, concatenation refers to splicing different types of numerical values ​​into a long vector; normalization refers to mapping numerical values ​​of different physical dimensions (bytes, microseconds, dimensionless ratios) to the same interval (such as [0, 1]).

[0041] As can be seen, in extracting initial features, not only is the basic packet length sequence obtained, but time intervals are also extracted through differencing, and the payload jitter factor is extracted by calculating variance and standard deviation. These three steps comprehensively characterize port behavior from the spatial dimension (size distribution), the temporal dimension (transmission rhythm), and the statistical dimension (fluctuation stability), respectively. Finally, these multimodal features are concatenated and normalized to generate an initial flow feature vector containing rich information.

[0042] S104. Construct a topological adjacency matrix based on port nodes and communication edges; and add the initial flow feature vectors of the port nodes in order to form a node feature matrix; Among them, the topological adjacency matrix refers to a two-dimensional array or sparse matrix object, whose rows and columns correspond to nodes in the graph, and the element values ​​indicate whether there is a connection between nodes; the node feature matrix refers to a large matrix formed by stacking the feature vectors of all nodes row by row, with each row corresponding to the attribute information of a node.

[0043] Specifically, this step transforms the previously extracted graph elements and feature elements into the mathematical form required for linear algebra operations. The system assigns unique index IDs starting from 0 to all port nodes. An N×N adjacency matrix A is constructed (N is the total number of nodes). If there is a communication edge between node i and node j, then A is set... ij =1 (or edge weight value), otherwise 0. Simultaneously, an N×F feature matrix X (F being the dimension of the feature vectors) is constructed, and the initial flow feature vector of the port node with ID i is filled into the i-th row of the matrix. This establishes a one-to-one correspondence between the node's position in the matrix and the topology.

[0044] S105. Input the topological adjacency matrix and the node feature matrix into the preset graph neural network model for aggregation operation. Use the topological adjacency matrix as the path constraint for feature propagation to enable each port node to fuse features with its neighbor nodes and output a topological enhancement feature vector. Among them, the pre-set graph neural network model refers to a pre-trained deep learning algorithm model with graph convolution or graph attention mechanisms; the path constraint of feature propagation means that feature data can only flow along the edges defined in the adjacency matrix and cannot cross non-connected nodes; feature fusion refers to performing mathematical operations such as weighted summation or concatenation of its own features with the received neighbor features.

[0045] Specifically, the constructed adjacency matrix A and feature matrix X are input into the graph neural network model. Matrix multiplication (such as AXW) is performed within the model layers, causing each node to aggregate the feature information of its first-order neighbors. In a multi-layer GNN, information from second-order and third-order neighbors is further aggregated. Through this aggregation, the originally isolated port feature vector absorbs the behavioral patterns of its communicating counterpart, generating a new vector containing contextual topological semantics—the topology-enhanced feature vector. This vector no longer merely describes how the port sends packets but also implicitly contains structural information about "who the port is communicating with."

[0046] Specifically, this step allows isolated port features to "flow" within the network topology through a multi-layered information transmission and aggregation mechanism. The graph neural network model first receives the topological adjacency matrix (this "network") and the node feature matrix (the data of these "points") as input. In each computational layer of the model, the system performs the following logical operations: In some specific embodiments, for each port node in the network (as the target node), the system searches for and locks all "neighbor nodes" directly connected to it based on the topological adjacency matrix.

[0047] The feature vectors of these locked neighbor nodes are collected. Since different neighbors may have different importance (e.g., neighbors that communicate frequently are more important), the model uses learnable weight parameters or edge weights to perform a weighted sum or average of the feature vectors of these neighbors, summing them into a single "neighborhood context vector".

[0048] The aggregated "neighborhood context vector" is concatenated or added to the target port node's "original feature vector." Then, a non-linear activation function is used to transform the fused data, generating a new feature representation for the port node at this layer. After one or more layers of such processing, the final output topology-enhanced feature vector no longer simply describes the port's own behavior but incorporates behavioral patterns related to other nodes, reflecting its role and positioning within the overall network structure.

[0049] In some optional embodiments, the model uses a learnable weight matrix to perform a linear transformation (dimensionality increase or decrease) on the entire node feature matrix to extract higher-order relationships within the features; secondly, it directly uses the topological adjacency matrix to left-multiply the transformed feature matrix, and through the mathematical properties of matrix multiplication, it accumulates the feature values ​​of all neighbors onto the target node in one step; finally, the resulting matrix is ​​filtered through the ReLU activation function, and the enhanced features of all nodes in the entire network are directly output in parallel by hardware.

[0050] In some alternative embodiments, for each target port node to be processed, instead of using all neighbors in the graph, a fixed number (e.g., 10) of neighboring nodes are randomly sampled. Next, the feature vectors of these 10 neighbors are averaged to obtain neighborhood information. Finally, this average is concatenated with the target node's own features and input into a fully connected layer for fusion transformation, outputting the enhanced features of the node. No limitations are imposed here.

[0051] S106. Decode and map the topology-enhanced feature vectors to obtain the business semantic labels corresponding to each port node; Decoding mapping refers to the process of converting high-dimensional floating-point feature vectors into specific category probabilities or category indices; business semantic labels refer to business type names that are understandable to humans.

[0052] Specifically, the system inputs the topology-enhanced feature vector corresponding to each port into a classifier (usually a Softmax layer or a fully connected layer). The classifier projects the vector onto a class space and calculates the probability value of the port belonging to each predefined service category. The category with the highest probability is selected as the prediction result, and the category ID is converted into a specific text label by looking up a table. This label reveals the actual service nature carried by the port at the current moment.

[0053] In some specific embodiments, step S106 specifically includes: S1061. Retrieve the pre-built business standard fingerprint database stored in system memory; Among them, the business standard fingerprint database refers to a key-value pair database or vector index database that stores the mapping between "business name (Key)" and "standard center vector (Value)". The standard center vector refers to the baseline vector obtained by clustering and averaging the traffic characteristics of a large number of known and clean certain businesses (such as normal SSH, normal HTTP, and normal DNS).

[0054] S1062. Using the topology enhancement feature vector of the port node to be identified as the source point and all standard center vectors in the business standard fingerprint database as target points, execute the spatial distance calculation logic one by one, calculate the Euclidean distance value or cosine similarity value between the source point and each target point, and generate a fingerprint distance list containing all distance calculation results. Here, the source point is the vector output by the current GNN; the target point is the baseline vector in the library; and the spatial distance calculation logic refers to the mathematical formula for calculating the similarity between two vectors.

[0055] Specifically, this step quantifies similarity. Let the source point be V, and the database contain K target points C_1...C_k. The system iteratively calculates the Euclidean distance (i.e., the length of the line connecting the two points) or cosine similarity (i.e., the cosine of the angle between two vectors) between the source point and each target point. Then, it generates a list containing "business type" and "corresponding distance / similarity value".

[0056] S1063. Traverse the fingerprint distance list, filter out the distance item with the best value according to the principle of minimizing distance or maximizing similarity, and mark the corresponding standard business type as the candidate business type. The candidate business type refers to the most likely category, but it has not yet been finalized.

[0057] Specifically, this step performs preliminary filtering. It iterates through the list to find the item with the smallest distance value (Min) or the item with the largest similarity value (Max). For example, if (HTTP, 0.2) is found to be the smallest distance, then the candidate type is marked as "HTTP".

[0058] S1064. Determine whether the distance item with the optimal value falls within the preset effective judgment radius of the candidate service type. If it does, the match is successful, and the name of the candidate service type is confirmed as the service semantic label of the port node.

[0059] The effective judgment radius refers to the range of fluctuation (hypersphere radius R) allowed for each business category in the feature space.

[0060] S107. Generate access control policies for port nodes based on the preset security baseline matched with the business semantic tags. The access control policies include blocking or allowing.

[0061] As can be seen, calculating the spatial metric (such as distance or similarity) between the features of the port to be identified and the center vector in the standard library transforms the abstract features into measurable similarity values. Furthermore, by selecting the optimal option and combining it with the effective judgment radius for secondary verification, a dual judgment logic is constructed: requiring both "most similar" and "within the effective range".

[0062] Among them, the security baseline refers to the set of whitelist rules that are predefined within the organization for legitimate business ports, IP ranges and communication behaviors; the access control policy refers to the instructions that can be executed by firewalls, routers or SDN controllers to intervene in network traffic.

[0063] Specifically, after obtaining the dynamic semantic label of the port, the system immediately queries the security baseline configuration pre-loaded in memory. The logical judgment is as follows: if the label is "legitimate business" (such as web services) and the port behavior conforms to the baseline (such as only being open during working hours), a "allow" policy is generated; if the label is "malicious application" (such as mining) or "illegal business" (such as unauthorized VPN), a "block" policy is generated. This policy contains specific five-tuple matching fields and action instructions, and is sent to the network edge device for execution.

[0064] As can be seen, by using a sliding window to generate traffic time slices to adapt to real-time requirements and extracting packet length sequences and time intervals to construct initial flow feature vectors, a basic characterization of port behavior is achieved. A graph structure is constructed using a topological adjacency matrix, and aggregation operations are performed through a graph neural network. The topology is used as a path constraint to force each port node to reference the features of its neighboring nodes. This mechanism ensures that the port's feature representation is no longer isolated but incorporates global connectivity relationships. Even if attackers use traffic shaping (such as introducing controlled latency) to make the micro-statistical characteristics of malicious ports numerically similar to normal business operations, their abnormal neighbor connection patterns will still correct their feature vectors through graph aggregation, thereby breaking the misjudgment caused by feature assimilation and improving the accuracy of identifying highly concealed dynamic port anomalies.

[0065] Please see Figure 2 , Figure 2 This is a flowchart illustrating step S105 in an embodiment of this application; In some embodiments, step S105 specifically includes: S1051. Traverse the node feature matrix, compare the dimension length of the initial flow feature vector of the target port node with that of its neighboring nodes, and determine the maximum feature dimension; the target port node can be any port node. Here, the target port node refers to the central node that is currently performing graph convolution operations and is preparing to update its own state; the maximum feature dimension refers to the value of the feature vector length that is the largest among the target node and all its first-order neighbor nodes.

[0066] Specifically, this step differs from conventional GNN processing of fixed-length vectors; it deals with heterogeneous variable-length features. Before the aggregation operation begins, for each row in the matrix (i.e., each target port node), the system retrieves the column indices of all non-zero elements in the adjacency matrix (i.e., neighboring nodes). The system reads the actual length attributes of its own and all neighboring nodes' feature vectors, finds the length of the vector with the richest information and longest sequence among this group of locally related nodes, and defines it as the baseline dimension for this local aggregation operation. This means that each local aggregation cluster may have a different maximum dimension, or the global maximum dimension may be used.

[0067] In some embodiments, when constructing the node feature matrix, the lengths of all port feature vectors in the entire network are scanned; secondly, the global maximum value is directly taken; finally, the global maximum value is set as the unified maximum feature dimension for all aggregation operations.

[0068] S1052. Construct the feature operation space based on the maximum feature dimension; S1053. Based on the position distribution of non-zero elements in the topological adjacency matrix, lock the neighboring nodes, and accumulate the initial flow feature vector of the neighboring nodes onto the initial flow feature vector of the target port node in the feature operation space to obtain the accumulated feature vector. The positional distribution of non-zero elements refers to the coordinates (i, j) of the adjacency matrix where the value is 1 (or the weight value), indicating that node j is a neighbor of node i; accumulation refers to the addition operation of the corresponding dimension values ​​of the vector.

[0069] Specifically, the system scans the i-th row of the adjacency matrix to find all non-zero columns j1, j2, ..., j k Then, the system extracts the feature vector v of node i itself from the feature matrix. i and the feature vectors v of all neighbors j1 v j2 These vectors are aligned and placed into the feature operation space constructed by S1052 (short vectors are padded with 0s for alignment), and then bitwise addition is performed.

[0070] In some embodiments, each neighboring node sends its own feature vector as a "message" to the target node; secondly, the target node receives all messages; and finally, vector addition is performed in its local computing space.

[0071] S1054. Filter the accumulated feature vector to obtain the topology-enhanced feature vector.

[0072] Among them, filtering refers to the operation of filtering and transforming data using non-linear activation functions, which usually includes denoising and feature extraction.

[0073] Specifically, the accumulated vector may contain negative values ​​(if some transformation was applied) or have an unnormalized numerical range. The system inputs the accumulated vector into a non-linear activation function (such as ReLU, LeakyReLU, or Sigmoid). All negative values ​​are set to 0, eliminating inhibitory signals that are not helpful for discrimination, and only retaining the activated positive features. The final output vector is the topology-enhanced feature vector, which integrates its own and its neighbors' features and has undergone a non-linear transformation, giving it stronger expressive power.

[0074] As can be seen, in the aggregation stage of the graph neural network, the maximum feature dimension in the target and neighbor vectors is determined by traversing and comparing them, and a feature computation space is constructed accordingly. This allows the full dimension of variable-length traffic data to be preserved. Subsequently, an accumulation operation is performed within a unified maximum-dimensional space. Because the computational benchmark is aligned and maximized, the subtle jitter fingerprints at the ends of long sequences (often containing key features) that might have been lost in low-dimensional compression or truncation are fully preserved during the aggregation process. The final output topology-enhanced feature vector not only integrates neighbor information but also minimizes the loss of detail caused by feature dimension truncation, enhancing the model's ability to capture port behaviors that utilize long-sequence traffic for covert attacks.

[0075] In practical applications, the above embodiments focus on simply incorporating the contextual information of neighboring nodes. Under multi-layer propagation or strong neighborhood interactions, the initial flow feature vector unique to the target port node (i.e., the microscopic fingerprint reflecting its true behavior, such as a specific attack packet sequence) is easily covered and diluted by a large number of neighboring features. This leads to an "over-smoothing" phenomenon in the model. Simultaneously, real network communication topologies exhibit typical scale-free characteristics, with "supernodes" containing tens of thousands of connections. These supernodes aggregate massive amounts of neighboring features, causing the aggregated feature values ​​to expand exponentially (numerical explosion). This huge numerical difference dominates the gradient update direction of the entire network, producing a severe "signal masking effect."

[0076] Therefore, in some embodiments, before step S1054, the method further includes: S201. Add a self-loop channel pointing to the target port node to each communication connection edge in the topological adjacency matrix to obtain the self-loop topological adjacency matrix. In graph theory, a self-loop path is an edge (Loop) that starts from a node and returns directly to that node; a self-loop topological adjacency matrix is ​​a new matrix created by adding non-zero values ​​to the diagonal positions of the original adjacency matrix.

[0077] Specifically, the system copies the original topological adjacency matrix A. Then, it constructs an identity matrix I with the same dimensions as A (all 1s on the main diagonal and 0s elsewhere). Matrix addition is then performed: A = A + I. Logically, this is equivalent to forcibly defining each port node as its own "neighbor." This way, when aggregating neighbor information later, the algorithm automatically includes the node's own characteristics.

[0078] It should be noted that for each communication edge connecting to the target port node (i.e., each source of external information input), logically, it is mandatory to separate or confirm a corresponding self-loop channel pointing to that node itself (or to strengthen the self-loop). The purpose is to establish a universal adversarial balance rule: regardless of the number of communication edges a port node has, it ensures that the "self-focus" mechanism always exists and is adapted to the scale of external connections. In this way, the same set of topology description standards can be applied to all port nodes of any order of magnitude of connections in the entire network.

[0079] S202. Count the total number of communication edges and self-loop channels of the target port node in the self-loop topology adjacency matrix; The total number refers to the "degree" in graph theory, which is the total number of edges connected to the node (including the self-loops mentioned earlier).

[0080] S203. Determine the normalization coefficient based on the total quantity, where the normalization coefficient is negatively correlated with the total quantity; The normalization coefficient is a multiplier factor used to scale feature values ​​and balance the contributions of different nodes; negative correlation indicates that the larger the total number, the smaller the coefficient.

[0081] S204. Based on the position distribution of non-zero elements in the self-loop topological adjacency matrix, the neighboring nodes are locked. The initial flow feature vectors of the neighboring nodes and the target port node are weighted using normalization coefficients and then accumulated in the feature operation space onto the initial flow feature vector of the target port node to obtain the accumulated feature vector.

[0082] Here, "weighted" means multiplying each element value of the feature vector by a normalization coefficient.

[0083] Specifically, the system first identifies all source nodes associated with the target port node based on the self-loop topology. This includes both external neighbor nodes connected via communication edges and the target port node itself connected via the self-loop channel. Then, the system multiplies the initial flow feature vector of each source node with its corresponding normalization coefficient, generating a set of weighted feature vectors that have undergone proportional compression. Finally, the system superimposes these weighted feature vectors component-by-component within the feature computation space. The essential effect of this series of operations is to achieve a kind of "numerical peak smoothing and valley filling": it forcibly reduces the numerical intensity of single information transmitted by high-connectivity nodes (supernodes), thus ensuring that regardless of the number of neighbors connected to the target port node, the final aggregated feature vector is always constrained within a relatively stable and reasonable numerical range.

[0084] As can be seen, adding a self-loop channel logically forces the model to include the characteristics of the target port node itself when aggregating neighbor information, effectively preventing the "oversmoothing" phenomenon where the original features are completely submerged by the neighbor features after multi-layer propagation. Furthermore, the aggregation process is weighted by counting the total number of connections and introducing a normalization coefficient negatively correlated with it. This process is equivalent to imposing a weight penalty on "supernodes" with a huge number of connections in the network, avoiding the explosion of feature values ​​or dominance of local feature distribution due to excessive connections from a single node. This achieves sensitive capture of weak anomalous signals at the network edge and effective suppression of supernode noise, ensuring the numerical stability and accuracy of feature propagation.

[0085] In practical applications, initial flow feature vectors (such as packet length sequences) are extracted. In real networks, an HTTP flow may contain thousands of packets, while a UDP heartbeat may only contain 3 packets. The aforementioned embodiment "adds the initial flow feature vectors sequentially to form a node feature matrix." However, when constructing the matrix for GNN operations, mathematical alignment of dimensions is required. An implicit, conventional approach is to "set a fixed length" (e.g., the first 100 packets), forcibly truncating long sequences and padding short sequences with zeros. This results in the direct discarding of crucial attack fingerprints hidden in the long flow (feature dimension truncation loss), leading to detection failure.

[0086] After step S104, the method further includes: S301, performing length interval determination on each initial flow feature vector using a standard dimension threshold; The standard dimension threshold refers to the maximum length of the feature vector that the input layer of the graph neural network can accept or that is specified to maintain computational efficiency (e.g., 1024 dimensions or 256 dimensions); the length interval determination refers to the logical operation of comparing the actual dimension of each vector with the threshold to determine whether it overflows.

[0087] S302. Perform segmentation processing on the initial flow feature vector whose length exceeds the standard dimension threshold to obtain several overflow feature fragments whose dimension length is lower than the standard dimension threshold. Among them, segmentation refers to the operation of physically dividing a long vector into multiple short vectors; overflow feature fragments refer to a continuous segment of feature data that has been cut off. In essence, it is still a feature vector, but it represents a part of the original data stream.

[0088] Specifically, the first continuous data segment of the vector's header is taken as the first feature segment; subsequently, subsequent data segments are taken as intermediate feature segments until the remaining data at the end of the vector is processed. For portions at the end that are insufficient for the step length, zero-padding is used for alignment. Through this processing, the original single long vector is decomposed into a set of ordered sub-vector sequences. Each overflow feature segment independently carries the behavioral fingerprint information of that port at a specific time stage, corresponding to the micro-statistical characteristics of the connection establishment stage, the continuous data transmission stage, and the connection termination stage in the traffic lifecycle. This ensures that the entire process information of long-cycle traffic is completely discretized and preserved without omission.

[0089] S303. In the node feature matrix, add a corresponding number of virtual logical nodes for the port nodes that generate overflow feature fragments. Virtual logical nodes refer to node entities (IDs) added to the graph structure that do not directly correspond to physical network interface card ports but participate in graph operations. They carry additional data features that have been segmented.

[0090] S304. Establish bidirectional, interconnected, and same-originating association edges between virtual logical nodes, their parent port nodes, and the same port node. Among them, the same-origin associated edge refers to a special type of edge that does not represent network communication, but rather the logical relationship of "belonging to the same physical port"; bidirectional communication means that information can flow freely in both directions between physical nodes and virtual nodes.

[0091] Specifically, for each physical port node and its derived virtual logical nodes, the system performs the following two modes of edge construction operations in the topology network: First, a star-shaped convergence connection structure is constructed, that is, direct origin-related edges are established between the physical port node and each virtual logical node. This structure establishes the physical node as the main body of information convergence center, enabling it to directly obtain information feedback from all feature fragments. Second, a chain-like temporal connection structure is constructed, that is, according to the temporal order of feature fragments in the original traffic, origin-related edges are sequentially established between adjacent virtual logical nodes. This structure reconstructs the linear temporal relationship of the original data in the graph topology, ensuring that the segmented feature fragments can still perceive the evolution logic of the context. By establishing the above composite connections, the system logically reorganizes the feature units that were originally discretely distributed due to segmentation into a structured whole with strong internal correlations.

[0092] S305. Expand the topological adjacency matrix based on the same-origin related edges, and add the multiple split virtual logical nodes as new vertices into the topological adjacency matrix.

[0093] Among them, matrix expansion refers to increasing the number of rows and columns of a matrix; adding a new vertex refers to a virtual node occupying a new row and column index in the adjacency matrix.

[0094] Specifically, this step updates the global topology. The original adjacency matrix A is N×N. Assume M new virtual nodes are added. The system expands the matrix to (N+M)×(N+M). The newly added M rows / columns correspond to the virtual nodes. The system fills the newly added regions of this expanded matrix with the same-origin association edges established in S301 (filling in 1 or weight). At the same time, virtual nodes usually do not inherit external communication edges from physical nodes (i.e., virtual nodes usually do not directly connect to the neighbors of other physical nodes, unless for specific higher-order hop connections), maintaining the clarity of the topology.

[0095] It is evident that establishing bidirectional interconnected edges and expanding the topological adjacency matrix reconstructs the logical connections between the physically fragmented feature segments from the previous step. During graph neural network operations, these edges act as high-speed information channels, enabling overflowing feature segments scattered across various virtual nodes to flow back to the physical port nodes or interact between virtual nodes.

[0096] S306. Add the unsegmented initial flow feature vector and overflow feature fragments in sequence to form a node feature matrix, wherein the overflow feature fragments serve as the feature vectors of the virtual logical nodes.

[0097] In this context, adding in sequence means filling the vector into the corresponding row of the matrix according to the index order of the node IDs (including physical and virtual ones).

[0098] Specifically, the system initializes a large matrix with the number of rows equal to (the number of physical nodes + the number of virtual nodes) and the number of columns equal to the standard dimension threshold. For unsegmented short-flow ports, their feature vectors are directly filled into the row corresponding to their IDs, padding with zeros if necessary. For segmented long-flow ports, the first segment of their features is filled into the row corresponding to the physical node IDs, and the remaining overflow feature fragments are sequentially filled into the rows corresponding to the assigned virtual node IDs. Thus, regardless of the original traffic length, it is normalized into an aligned matrix, satisfying the mathematical requirements for batch processing in GNNs.

[0099] As can be seen, by adding virtual logical nodes and using the overflow fragments as their feature vectors, the problem of "vectors being too long to fit into a matrix" is transformed into the problem of "increasing the number of nodes in the graph structure." This allows long-tail traffic data that originally could not fit into a fixed-dimensional matrix to be fully incorporated into the computation process in the form of virtual nodes. It achieves full feature preservation of ultra-long heterogeneous traffic, ensuring that key attack fingerprints hidden deep within the traffic sequence (i.e., the overflow portion) are not missed due to dimensional limitations, thus improving the completeness of detecting complex, long-cycle attacks.

[0100] The following describes an exemplary port resource dynamic management system 300 based on graph neural networks and real-time big data provided in the embodiments of this application. Figure 3 This is an exemplary hardware structure diagram of a port resource dynamic management system 300 based on graph neural networks and real-time big data provided in this application embodiment.

[0101] In some embodiments, the port resource dynamic management system 300 based on graph neural networks and real-time big data is a computer device or includes a computer device. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores data. The network interface of the computer device is used to communicate with other external terminals or servers via a network connection. In some embodiments, the network interface can be a wired network interface; in some embodiments, the network interface can also be a wireless network interface. When the computer program is executed by the processor, it implements the methods in the embodiments of this application.

[0102] Those skilled in the art will understand that Figure 3The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0103] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

[0104] As used in the above embodiments, depending on the context, the term "when..." can be interpreted as meaning "if...", "after...", "in response to determining...", or "in response to detecting...". Similarly, depending on the context, the phrase "when determining..." or "if (the stated condition or event) is interpreted as meaning "if determining...", "in response to determining...", "when (the stated condition or event) is detected", or "in response to detecting (the stated condition or event)".

[0105] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive), etc.

[0106] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The aforementioned storage medium includes various media capable of storing program code, such as ROM or random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A dynamic governance method for port resources based on graph neural networks and real-time big data, characterized in that, include: Use a sliding window to capture communication data and generate a traffic time slice containing all data packets in the current window; The header information of all data packets in the traffic time slice with a preset length is parsed, wherein: the combination of IP address and port number is defined as a port node, and the connection between port nodes with session interaction relationship is mapped as a communication edge; An initial flow feature vector is obtained by extracting the packet length sequence and packet arrival time interval statistics associated with each port node from the flow time slice; A topological adjacency matrix is ​​constructed based on the port nodes and the communication edges; and the initial flow feature vectors of the port nodes are added in sequence to form a node feature matrix; The topological adjacency matrix and the node feature matrix are input into a preset graph neural network model for aggregation operation. The topological adjacency matrix is ​​used as a path constraint for feature propagation, so that each port node and its neighbor nodes perform feature fusion and output a topological enhancement feature vector. Based on the topology-enhanced feature vector, the business semantic label corresponding to each port node is obtained by decoding and mapping. Based on the business semantic tags, a preset security baseline is matched to generate an access control policy for the port node, which includes blocking or allowing access.

2. The method according to claim 1, characterized in that, The step of inputting the topological adjacency matrix and the node feature matrix into a preset graph neural network model for aggregation operation, and using the topological adjacency matrix as a path constraint for feature propagation to enable feature fusion between each port node and its neighbor nodes, and outputting a topology-enhanced feature vector, specifically includes: Traverse the node feature matrix, compare the dimension length of the initial flow feature vector of the target port node with that of its neighboring nodes, and determine the maximum feature dimension; the target port node can be any port node. The feature computation space is constructed using the maximum feature dimension as the benchmark; Based on the positional distribution of non-zero elements in the topological adjacency matrix, neighboring nodes are located. The initial flow feature vectors of the neighboring nodes are accumulated in the feature operation space and added to the initial flow feature vector of the target port node to obtain the accumulated feature vector. The accumulated feature vector is filtered to obtain the topology-enhanced feature vector.

3. The method according to claim 2, characterized in that, Before the step of locking neighbor nodes based on the position distribution of non-zero elements in the topological adjacency matrix, and accumulating the initial flow feature vectors of the neighbor nodes onto the initial flow feature vectors of the target port node in the feature operation space to obtain the accumulated feature vector, the method further includes: In the topological adjacency matrix, a self-loop channel pointing to the target port node is added to each communication link connecting to the target port node to obtain a self-loop topological adjacency matrix. The step of locking neighboring nodes based on the positional distribution of non-zero elements in the topological adjacency matrix, and accumulating the initial flow feature vectors of the neighboring nodes onto the initial flow feature vector of the target port node in the feature operation space to obtain the accumulated feature vector, specifically includes: Count the total number of communication edges and self-loop channels of the target port node in the self-loop topology adjacency matrix; A normalization coefficient is determined based on the total quantity, wherein the normalization coefficient is negatively correlated with the total quantity; Based on the positional distribution of non-zero elements in the self-loop topological adjacency matrix, the neighboring nodes are locked. The initial flow feature vectors of the neighboring nodes and the target port node are weighted using the normalization coefficient and then accumulated onto the initial flow feature vector of the target port node in the feature operation space to obtain the accumulated feature vector.

4. The method according to claim 1, characterized in that, The step of adding the initial flow feature vectors of the port nodes in sequence to form a node feature matrix specifically includes: Length interval determination is performed on each of the initial flow feature vectors using a standard dimension threshold. For the initial flow feature vector whose length exceeds the standard dimension threshold, a segmentation process is performed to obtain several overflow feature fragments whose dimension length is lower than the standard dimension threshold; In the node feature matrix, a corresponding number of virtual logical nodes are added to the port node that generates the overflow feature fragment; The unsegmented initial flow feature vector and the overflow feature fragment are added sequentially to form the node feature matrix, wherein the overflow feature fragment serves as the feature vector of the virtual logical node.

5. The method according to claim 4, characterized in that, After the step of adding a corresponding number of virtual logical nodes to the port node that generates the overflow feature fragment in the node feature matrix, the method further includes: A bidirectional, interconnected, and same-origin association edge is established between the virtual logical node, the port node to which it belongs, and the port node to which it belongs. The topological adjacency matrix is ​​expanded based on the shared edges, and the multiple virtual logical nodes that are split off are added as new vertices and incorporated into the topological adjacency matrix.

6. The method according to claim 1, characterized in that, The step of extracting the packet length sequence and packet arrival time interval statistics associated with each port node from the traffic time slice to obtain the initial flow feature vector specifically includes: Traverse the traffic time slices, read the IP header length field and header arrival timestamp of each data packet, and generate the original physical attribute sequence; The arrival timestamps of adjacent data packets in the original physical attribute sequence are differentially analyzed to obtain the packet arrival time interval sequence. The variance and standard deviation of the packet length values ​​in the original physical attribute sequence are calculated to obtain the load jitter factor. The packet length value, the packet arrival time interval sequence, and the payload jitter factor are concatenated and normalized to obtain the initial flow feature vector.

7. The method according to claim 1, characterized in that, The step of decoding and mapping based on the topology-enhanced feature vector to obtain the business semantic label corresponding to each port node specifically includes: Retrieve the pre-built business standard fingerprint library stored in system memory; Using the topology-enhanced feature vector of the port node to be identified as the source point and all the standard center vectors in the business standard fingerprint database as the target points, the spatial distance calculation logic is executed one by one to calculate the Euclidean distance value or cosine similarity value between the source point and each target point, and a fingerprint distance list containing all distance calculation results is generated. Traverse the fingerprint distance list, filter out the distance items with the best values ​​according to the principle of minimizing distance or maximizing similarity, and mark the corresponding standard business types as candidate business types; Determine whether the optimal distance value falls within the preset effective judgment radius of the candidate service type. If it does, the match is successful, and the name of the candidate service type is confirmed as the service semantic label of the port node.

8. A dynamic port resource management system based on graph neural networks and real-time big data, characterized in that, The port resource dynamic management system based on graph neural networks and real-time big data includes: one or more processors and a memory; the memory is coupled to the one or more processors, the memory is used to store computer program code, the computer program code includes computer instructions, and the one or more processors call the computer instructions to cause the port resource dynamic management system based on graph neural networks and real-time big data to perform the method as described in any one of claims 1-7.

9. A computer program product containing instructions, characterized in that, When the computer program product is run on the port resource dynamic management system based on graph neural networks and real-time big data, the port resource dynamic management system based on graph neural networks and real-time big data performs the method as described in any one of claims 1-7.

10. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is executed on the port resource dynamic management system based on graph neural networks and real-time big data, the port resource dynamic management system based on graph neural networks and real-time big data performs the method as described in any one of claims 1-7.

Images