Network intrusion detection method based on IP flow graph construction and graph neural network

Abstract

The invention discloses a network intrusion detection method based on IP flow graph construction and a graph neural network, and the method comprises the steps: firstly converting original network flow data into a graph structure which can explicitly reveal a host-level behavior mode through a graph construction strategy with an IP as a center; then, a graph neural network model is provided, the model integrates neighbor-oriented multi-scale feature extraction, hierarchical attention and a context enhancement module based on a clustering prototype, and aims at capturing local anomaly and a global flow mode at the same time, and the problem of class imbalance in network intrusion detection is effectively solved.

Description

A network intrusion detection method based on IP flow graph construction and graph neural network Technical Field

[0001] This invention belongs to the field of network intrusion detection technology, specifically relating to the design of a network intrusion detection method based on IP flow graph construction and graph neural network. Background Technology

[0002] Network intrusion detection technology is crucial for protecting enterprise networks and critical information infrastructure. With the proliferation of encrypted traffic, covert tunnels, and new attack techniques, traditional detection methods based on deep packet inspection (DPI), feature matching, or serialized machine learning are struggling to cope with large-scale, highly dynamic network traffic scenarios.

[0003] In recent years, Graph Neural Networks (GNNs) have emerged as a new paradigm for intelligent network traffic analysis due to their ability to simultaneously represent the topological relationships and attribute characteristics between network flows. Existing research typically treats each network flow as a node in a graph, with node features containing statistical information about the flow (such as packet length and arrival interval). Edges are constructed based on relationships such as host communication, port co-occurrence, or protocol dependencies, thus transforming the traffic classification problem into a GNN node classification task. Although basic GNN models such as GCN, GAT, and GraphSAGE have demonstrated superior performance compared to traditional methods, they still have limitations for complex scenarios involving large-scale network traffic.

[0004] Existing GNN-based network intrusion detection methods suffer from two main shortcomings: First, their graph structure modeling is relatively simple and cannot generalize to complex network environments. Most works construct homogeneous graphs, meaning that the types of nodes and edges are limited, failing to fully capture the heterogeneity and complexity of entities (such as different IPs and ports) and relationships (such as communication and port usage) in network traffic. In particular, they fail to explicitly model fine-grained host-level communication patterns based on IP addresses. Second, their feature extraction and context awareness capabilities are insufficient. Traditional GNN models typically employ single-scale feature aggregation, making it difficult to simultaneously capture local anomalous micro-patterns and global traffic distribution changes. When dealing with common network intrusion detection issues such as class imbalance and concept drift, the lack of effective global contextual information as a reference limits their ability to detect small-scale attacks or distributed coordinated attacks.

[0005] Therefore, a graph neural network method is needed that can more precisely model the intrinsic correlations of network traffic and integrate local multi-scale information with global contextual information to improve the accuracy and practicality of network intrusion detection. Summary of the Invention

[0006] The purpose of this invention is to address the problems of existing GNN-based network intrusion detection methods being unable to generalize to complex network environments and having insufficient feature extraction and context awareness capabilities. This invention proposes a network intrusion detection method based on IP flow graph construction and graph neural networks, which can simultaneously consider multi-scale local feature information and global context information. It utilizes a graph neural network model with a hierarchical attention mechanism to perform network intrusion detection more accurately and robustly.

[0007] The technical solution of the present invention is: a network intrusion detection method based on IP flow graph construction and graph neural network, comprising the following steps: S1, extracting statistical features of each network flow from network traffic data to form a node feature matrix X, and mapping each network flow to a node in the graph to obtain a node set V.

[0008] S2. Construct an edge set E using IP-centric adjacency rules, and construct a network traffic graph G based on the node set V, edge set E, and node feature matrix X.

[0009] S3. Input the network traffic graph G into the graph neural network model. In each intermediate layer of the graph neural network model, combine the topology-aware propagation capability of the graph convolutional network and the adaptive weighting capability of the graph attention network to obtain multi-scale node feature representations.

[0010] S4. The contextual enhancement method based on clustering prototypes is used to expand the contextual information of multi-scale features and perform classification output to obtain network intrusion detection results.

[0011] Furthermore, the statistical characteristics in step S1 include the flow duration, number of forward packets, number of backward packets, packet length statistics, transmission rate, and TCP flag distribution.

[0012] Further, step S2 includes the following sub-steps: S21, connect all network flow nodes with the same source IP address to each other through undirected edges to construct the first fully connected subgraph.

[0013] S22. Connect all network flow nodes with the same destination IP address pairwise with undirected edges to construct a second fully connected subgraph.

[0014] S23. Construct an edge set E based on all edges in the first fully connected subgraph and the second fully connected subgraph.

[0015] S24. Construct a network traffic graph based on the node set V, edge set E, and node feature matrix X. .

[0016] Furthermore, the graph neural network model in step S3 includes parallel execution of adjacent scale paths and neighboring scale paths; the adjacent scale path uses a graph attention network (GAT) to aggregate the 1-hop neighbor node information of a node to generate a local latent representation; the neighboring scale path expands the receptive field to the 2-hop neighbor nodes of a node by stacking two layers of graph convolutional networks (GCN) to encode and generate a topological context representation; after embedding and concatenating the local latent representation and the topological context representation, they are jointly processed by layer normalization and exponential linear unit activation functions to obtain multi-scale node feature representations.

[0017] Furthermore, step S4 includes the following sub-steps: S41, obtaining a set of learnable context prototype vectors. , where each context prototype This represents a potential global traffic pattern or behavior template. K represents the number of context prototypes, and R represents the real number field. The feature dimension of the context prototype vector.

[0018] S42. Calculate the similarity between each node feature in the multi-scale node feature representation and all context prototypes: in Represents the feature of the i-th node With the k-th context prototype similarity, This represents the cosine similarity.

[0019] S43. Normalize the similarity between each node's features and all context prototypes to obtain soft-assigned weights: in Represents the feature of the i-th node With the k-th context prototype Soft allocation weights, Represents the feature of the i-th node Similarity with the j-th context prototype.

[0020] S44. Synthesize a personalized context vector for each node based on the soft-assigned weights: in This represents the personalized context vector of the i-th node.

[0021] S45. The personalized context vector of the node is fused with the node features in the multi-scale node feature representation through gating to generate the final node representation: in Represents the gate vector, This represents the sigmoid function. Indicates learnable parameters, This represents a vector concatenation operation. This represents element-wise multiplication. This represents the final node representation of the i-th node.

[0022] S46. Represent the final node. Input a fully connected layer and output the probability distribution of each node belonging to normal or various attack types through the softmax function to obtain the network intrusion detection results.

[0023] The beneficial effects of the present invention are: (1) The present invention can explicitly and automatically capture host-level communication behavior patterns (such as flow clusters from the same host or flow clusters sent to the same host) through the edge construction strategy centered on IP. The constructed graph structure is closer to the real internal relationship of network traffic, providing a richer and more accurate topological information foundation for subsequent GNN learning.

[0024] (2) Compared with the usual GNN, the present invention has stronger feature representation and context awareness capabilities. Through multi-scale feature extraction, it can distinguish the differences between direct and indirect neighbors when aggregating neighbor information. Context enhancement is based on clustering prototypes. Through a set of learnable prototype vectors, it dynamically assigns and integrates the most relevant global behavior patterns for each node. It can provide global context for each node in a more refined and flexible manner. It is particularly good at modeling the situation where nodes belong to multiple mixed modes (such as flows that have both normal and some abnormal features at the same time), which significantly improves the detection capability of complex and mixed attacks.

[0025] (3) The hierarchical attention of the present invention can effectively reveal the manifestation of malicious behavior at different granularities. The soft weighting provides key interpretability. By observing the weight of a node to different context prototypes, we can intuitively understand the specific reasons why the traffic is judged as abnormal by the model, and provide direct clues for threat root cause analysis. Attached Figure Description

[0026] Figure 1 shows a flowchart of a network intrusion detection method based on IP flow graph construction and graph neural network provided by an embodiment of the present invention.

[0027] Figure 2 shows a schematic diagram of the graph neural network model provided in an embodiment of the present invention.

[0028] Figure 3 shows a schematic diagram of the context enhancement method based on clustering prototypes provided in an embodiment of the present invention. Detailed Implementation

[0029] Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the drawings are merely exemplary and are intended to illustrate the principles and spirit of the invention, and are not intended to limit the scope of the invention.

[0030] This invention provides a network intrusion detection method based on IP flow graph construction and graph neural network, as shown in Figure 1, including the following steps S1~S4: S1, extracting statistical features of each network flow from network traffic data to construct a node feature matrix. Each network flow is then mapped to a node in the graph, resulting in a node set V. Here, R represents the real number field. d represents the number of nodes in the node set V, and d represents the number of original features of each network flow (node), that is, the dimension of the statistical features extracted from the network traffic data.

[0031] In this embodiment of the invention, the statistical features include stream duration, number of forward packets, number of backward packets, packet length statistics (mean, standard deviation, etc.), transmission rate, and TCP flag distribution.

[0032] S2. Construct an edge set E using IP-centric adjacency rules, and construct a network traffic graph G based on the node set V, edge set E, and node feature matrix X.

[0033] One of the key innovations of this invention compared to existing technologies lies in its edge construction strategy. To explicitly model host-level behavioral patterns, an IP-centric adjacency rule is proposed: subgraphs are constructed using source IP clusters and destination IP clusters. This strategy systematically reveals host behavioral patterns; for example, multiple related flows originating from the same host may aggregate into a densely connected subgraph. To control computational complexity while maintaining structural expressiveness, an upper limit threshold is set for the number of incident edges at each node.

[0034] Step S2 includes the following sub-steps S21 to S24: S21, Connect all network flow nodes with the same source IP address to each other through undirected edges to construct the first fully connected subgraph.

[0035] S22. Connect all network flow nodes with the same destination IP address pairwise with undirected edges to construct a second fully connected subgraph.

[0036] S23. Construct an edge set E based on all edges in the first fully connected subgraph and the second fully connected subgraph.

[0037] S24. Construct a network traffic graph based on the node set V, edge set E, and node feature matrix X. .

[0038] S3. Input the network traffic graph G into the graph neural network model. In each intermediate layer of the graph neural network model, combine the topology-aware propagation capability of the graph convolutional network and the adaptive weighting capability of the graph attention network to obtain multi-scale node feature representations.

[0039] As shown in Figure 2, in this embodiment of the invention, the graph neural network model includes parallel execution of adjacent scale paths and neighboring scale paths.

[0040] In this approach, adjacent scale paths utilize the graph attention network (GAT) to aggregate the one-hop neighbor information of nodes, generating local latent representations. The learnable attention coefficients of the graph attention network adaptively weight the influence of heterogeneous neighbor nodes, which is particularly important for flow graphs with significant differences in edge importance. The generation of the graph attention network depends on the attention coefficients of the data, reweighting neighbor contributions, amplifying salient features, and suppressing irrelevant features.

[0041] The nearest-scale path extends the receptive field to a node's two-hop neighbors by stacking two layers of a graph convolutional network (GCN), encoding a topological context representation. The GCN performs deterministic neighborhood aggregation, ensuring stability sensitivity to a fixed graph topology.

[0042] After embedding and concatenating the local latent representation and topological context representation, a multi-scale node feature representation is obtained through joint processing using layer normalization and exponential linear unit activation functions. This hierarchical design enables the model to learn node representations at different levels of abstraction: lower layers focus on local structural patterns, while higher layers capture more semantic information.

[0043] S4. The contextual enhancement method based on clustering prototypes is used to expand the contextual information of multi-scale features and perform classification output to obtain network intrusion detection results.

[0044] As shown in Figure 3, step S4 includes the following sub-steps S41~S46: S41, Obtain a set of learnable context prototype vectors , where each context prototype This indicates a potential global traffic pattern or behavior template (such as normal browsing, port scanning, DDoS attack flow, etc.). K represents the number of context prototypes, and R represents the real number field. The feature dimension represents the context prototype vector, which is the representation length of each learned global traffic pattern template (such as normal communication, port scanning, etc.) in the latent space. These context prototypes are optimized along with other parameters of the graph neural network model during training.

[0045] S42. Calculate the similarity between each node feature in the multi-scale node feature representation and all context prototypes: in Represents the feature of the i-th node With the k-th context prototype similarity, This represents the cosine similarity.

[0046] S43. Normalize the similarity between each node's features and all context prototypes to obtain soft-assigned weights: in Represents the feature of the i-th node With the k-th context prototype The soft-assigned weight represents the degree to which the i-th node belongs to the k-th context prototype pattern. Represents the feature of the i-th node Similarity with the j-th context prototype.

[0047] S44. Synthesize a personalized context vector for each node based on the soft-assigned weights: in This represents the personalized context vector of the i-th node. This vector integrates various global pattern information, and its components are determined by the matching degree between the node's own features and each context prototype.

[0048] S45. The personalized context vector of the node is fused with the node features in the multi-scale node feature representation through gating to generate the final node representation: in This represents the gate vector, used to control the fusion ratio between the original node features and the personalized context vector. This represents the sigmoid function. Indicates learnable parameters, This represents a vector concatenation operation. This represents element-wise multiplication. This represents the final node representation of the i-th node.

[0049] S46. Represent the final node. Input a fully connected layer and output the probability distribution of each node belonging to each category (normal or various attack types) through the softmax function to obtain the network intrusion detection results.

[0050] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A network intrusion detection method based on IP flow graph construction and graph neural network, characterized in that, Includes the following steps: S1. Extract statistical features of each network flow from the network traffic data to form a node feature matrix X, and map each network flow to a node in the graph to obtain a node set V; S2. Construct an edge set E using IP-centric adjacency rules, and construct a network traffic graph G based on the node set V, edge set E, and node feature matrix X; S3. Input the network traffic graph G into a graph neural network model, and combine the topology-aware propagation capability of the graph convolutional network and the adaptive weighting capability of the graph attention network in each intermediate layer of the graph neural network model to obtain a multi-scale node feature representation; S4. The contextual enhancement method based on clustering prototypes is used to expand the contextual information of multi-scale features and perform classification output to obtain network intrusion detection results.

2. The network intrusion detection method based on IP flow graph construction and graph neural network according to claim 1, characterized in that, The statistical features in step S1 include stream duration, number of forward packets, number of backward packets, packet length statistics, transmission rate, and TCP flag distribution.

3. The network intrusion detection method based on IP flow graph construction and graph neural network according to claim 1, characterized in that, Step S2 includes the following sub-steps: S21, connecting all network flow nodes with the same source IP address pairwise with undirected edges to construct a first fully connected subgraph; S22, connecting all network flow nodes with the same destination IP address pairwise with undirected edges to construct a second fully connected subgraph; S23, constructing an edge set E based on all edges in the first and second fully connected subgraphs; S24, constructing a network traffic graph based on the node set V, the edge set E, and the node feature matrix X. 。 4. The network intrusion detection method based on IP flow graph construction and graph neural network according to claim 1, characterized in that, The graph neural network model in step S3 includes parallel execution of adjacent scale paths and neighboring scale paths; the adjacent scale paths use the graph attention network GAT to aggregate the 1-hop neighbor node information of the nodes to generate local latent representations. The neighboring scale path expands the receptive field to the node's two-hop neighbor nodes by stacking two layers of graph convolutional network (GCN) and encodes the topological context representation. The local latent representation and the topological context representation are embedded and concatenated, and then jointly processed by layer normalization and exponential linear unit activation function to obtain multi-scale node feature representation.

5. The network intrusion detection method based on IP flow graph construction and graph neural network according to claim 1, characterized in that, Step S4 includes the following sub-steps: S41, obtaining a set of learnable context prototype vectors. , where each context prototype This represents a potential global traffic pattern or behavior template. K represents the number of context prototypes, and R represents the real number field. The feature dimension representing the context prototype vector; S42. Calculate the similarity between each node feature in the multi-scale node feature representation and all context prototypes: in Represents the feature of the i-th node With the k-th context prototype similarity, S43. Normalize the similarity between each node's features and all context prototypes to obtain soft-assigned weights: in Represents the feature of the i-th node With the k-th context prototype Soft allocation weights, Represents the feature of the i-th node Similarity to the j-th context prototype; S44, synthesize a personalized context vector for each node based on soft-assigned weights: in S45. The personalized context vector of the i-th node is represented by S45. The personalized context vector of the node is fused with the node features in the multi-scale node feature representation through gating to generate the final node representation. in Represents the gate vector, This represents the sigmoid function. Indicates learnable parameters, This represents a vector concatenation operation. This represents element-wise multiplication. S46. Represent the final node representation of the i-th node; Input a fully connected layer and output the probability distribution of each node belonging to normal or various attack types through the softmax function to obtain the network intrusion detection results.

Images