Abnormal network node detection method based on GraphSAGE and side attention mechanism

Abstract

The invention belongs to the technical field of network behavior anomaly detection and analysis, and discloses an abnormal network node detection method based on GraphSAGE and a side attention mechanism. Aiming at the problems that a traditional network flow analysis method is limited in detection effect in a complex structure network attack scene, and an existing graph neural network model is insufficient in mining of edge information in a graph and is limited in node communication behavior modeling capability, the invention realizes a dual-view graph node feature extraction method fusing IP graph and IP port graph information. And an abnormal network node detection model based on a GraphSAGE and a side attention mechanism is constructed. According to the model, weighted aggregation is carried out on side traffic features of nodes through a side attention mechanism, a GraphSAGE layer is improved to aggregate neighborhood node embedding and traffic side features, graph topology information and side traffic information are fused at the same time in the finally generated node embedding, and finally abnormal node detection is completed by utilizing a shallow classifier. The method has good generalization ability and high detection accuracy.

Description

Technical Field

[0001] This invention belongs to the field of network behavior anomaly detection and analysis technology, and in particular relates to an anomaly network node detection method based on GraphSAGE and edge attention mechanism. Background Technology

[0002] With the widespread application of information technology, network systems have become critical infrastructure in various fields such as the global economy, industrial control, and social management. Network applications are becoming increasingly diverse, network structures are becoming more complex, and the attack methods they suffer are constantly evolving. Network attack methods have shifted from eavesdropping and tampering to increasingly covert and distributed attack forms. The December 2024 Cybersecurity Situation Report indicated that over 41.392 billion web application attacks and approximately 253,308 Distributed Denial of Service (DDoS) attacks were detected in China in November. QratorLabs' "DDoS Attack Statistics and Observations" report stated that QratorLabs discovered a large-scale DDoS botnet containing 1.33 million devices in the first quarter of 2025, a significant increase compared to the large-scale botnet with 227,000 devices discovered in 2024. DDoS attacks, Denial of Service (DoS) attacks, botnets, web application attacks, brute-force attacks, and Advanced Persistent Threats (APTs) can cause system paralysis, data breaches, and the theft of confidential information if successful, severely impacting the normal and stable operation of society. Therefore, accurately detecting cyberattacks and taking timely defensive measures to reduce the losses caused by cyberattacks are essential for ensuring network security and stability. From the perspective of the attack chain model, common methods in the exploitation phase of attacks such as web application attacks and brute-force attacks aim to gain control of the host. Subsequently, by implanting malware on the victim host, the attacker completes the installation and control phase, forming a botnet. In the subsequent stages of the attack chain, these botnets are often used to carry out DDoS, distributed port scanning, and other DoS attacks. Network traffic analysis technology, as a key technical means to ensure the continuous security of cyberspace, can detect and block such threats, protecting critical infrastructure, data, and networks.

[0003] Current network traffic analysis techniques are primarily based on machine learning and deep learning methods. While these methods possess some capability to detect complex attacks, they typically only consider the characteristics of the traffic data itself in isolation, modeling normal behavior and detecting anomalies, without taking into account the device interaction relationships and network topology information contained within the traffic. As network attack methods become increasingly complex, these methods exhibit limited effectiveness in detecting complex network attacks such as botnet attacks and distributed port scans. Since the transmission of data packets in a network not only possesses statistical characteristics in terms of time and content but also reflects the spatial relationships between network entities, researchers often use graphs to model network communication. Nodes can represent hosts or devices, and edges can represent communication between nodes. This modeling approach provides a structural foundation for researchers to utilize graph neural networks for graph representation learning tasks. Therefore, graph representation learning based on graph neural networks has gradually become an important research direction in the field of traffic analysis. However, existing node classification studies mostly focus on the structural information of the graph, failing to fully integrate the node's own topological characteristics and edge traffic characteristics, thus limiting the model's ability to model node communication behavior patterns.

[0004] Based on the above analysis, the problems and shortcomings of the existing technology are as follows: (1) Existing network traffic analysis techniques based on machine learning and deep learning typically only consider the characteristics of the traffic data itself in isolation, without taking into account network topology information. As network attack methods become more complex, these methods will have limited detection effectiveness when detecting abnormal nodes that launch complex network attacks such as botnet attacks and distributed port scans.

[0005] (2) Existing graph representation-based learning models for detecting abnormal nodes often only focus on nodes, topological features, or edge information, and do not fully mine information on the graph, which limits the model's ability to model node communication behavior patterns. Summary of the Invention

[0006] To address the problems existing in the prior art, this invention provides an abnormal network node detection method based on GraphSAGE and edge attention mechanism.

[0007] This invention is implemented as follows: an abnormal network node detection method based on GraphSAGE and edge attention mechanism includes: Step 1: Perform data preprocessing on the traffic dataset to obtain a subset of the traffic dataset; Step 2: Divide the dataset into multiple time slices based on the time window, and create two different perspectives of traffic graphs in each time slice: one with IP address as the node and the other with IP port as the node. Step 3: Tag the nodes in the IP port graph according to the corresponding traffic data tags within the time slice; Step 4: Initialize node vectors, calculate and align the node topology features of the nodes in the two viewpoint graphs respectively; Step 5: Establish the EA-NAGE model, perform graph representation learning on multiple IP port graphs, and effectively fuse edge traffic information and neighborhood node information using the edge attention mechanism and the improved GraphSAGE layer to generate node embeddings and detect abnormal nodes. Step 6: Adjust model parameters and train the model; Step 7: Evaluate the EA-NAGE model using accuracy, precision, recall, and F1-score, and use the EA-NAGE model to detect anomalous network nodes.

[0008] Furthermore, in step one, data preprocessing requires cleaning, sampling, and standardizing the original dataset: (1) Data cleaning: handle outliers and label errors in the original dataset; for example, NaN outliers and Inf outliers, normal traffic from normal devices is incorrectly labeled as an attack on the traffic record; for traffic records where all features are outliers, delete all records where all features are outliers; for traffic records where individual features are outliers, calculate the average value of the feature column and replace the outlier; for traffic data label errors in the dataset, correct the erroneous traffic labels based on the attack time and abnormal host IP provided by the dataset benchmark truth. (2) Dataset sampling: A random undersampling strategy was adopted to sample normal traffic and abnormal traffic separately, merge normal traffic samples and abnormal traffic samples to generate traffic subsets, and sort the traffic subsets in chronological order; while ensuring that valuable information is not lost, sample balance is achieved to solve the problem of model performance degradation caused by extreme imbalance of the number of nodes in the network communication graph. (3) Data standardization: Data standardization uses Z-score to standardize traffic features, ensuring the distribution of feature values ​​while eliminating differences in feature dimensions, and preventing large fluctuations in the model during training, which could lead to poor training results.

[0009] Furthermore, in step two, the preprocessed traffic data is divided into fixed time windows, with the time window length set to [value missing]. Minutes, timestamp of traffic data is The duration of the flow is , No. The start time of each time window and the The end time of each time window Definition:

[0010] in, The timestamp of the earliest traffic within all time windows of the current dataset; The time window to which a traffic record belongs is determined as follows:

[0011] Graph construction requires building IP graphs and IP port graphs based on time windows to extract node topology features from different perspectives. Considering the directionality of network traffic and the possibility of multiple flow records between two nodes, these two types of graphs are constructed using directed multigraphs. The time window sequence is set as follows: The graph set constructed after dividing the time window is as follows: ; in the Within each time window, the representation of each constructed IP diagram and IP port diagram is uniformly denoted as: ; in, It includes two types of diagrams: IP diagrams and IP port diagrams. For each node in the IP graph, the node topology features are calculated through node initialization. , This is a set of nodes in an IP port graph. Each node's topology characteristics are calculated through node initialization. For example, if the four-tuple information (source IP, destination IP, source port, destination port) corresponding to a traffic record is (192.168.10.50, 34851, 172.16.0.1, 49633), then the node identifiers in the IP port diagram are (192.168.10.50:34851) and (172.16.0.1:49633), and the node identifiers in the IP diagram are (192.168.10.50) and (172.16.0.1). A set of directed edges containing IP graphs and IP port graphs, and a set of edge features. The edge features of the IP graph and IP port graph are traffic features.

[0012] Furthermore, in step three, since the training of the graph neural network depends on node label information, labels should be defined for the nodes of the IP port graph based on the traffic data labels in the corresponding time window; in the... IP port graph within a time window The directed edges are constructed from flow records, and each edge All have binary labels ,in, This indicates that the traffic is abnormal. Based on this, the label determination rules for nodes are defined as follows: (1) Definition of abnormal nodes: If a node outgoing edge set There is at least one edge in the middle. If the traffic is abnormal, then this node in the current window will be marked as an abnormal node. (2) Normal node definition: If a node If all outgoing edges of a node are normal traffic, or if the node has no outgoing edges within the current window, then the node is marked as a normal node in the current window. Therefore, the node label definition formula is as follows:

[0013] Furthermore, in step four, the initial vector calculation of graph nodes aims to obtain node topological features from both the IP graph and the IP port graph perspectives. Specifically, it extracts seven types of topological features from these two graphs, including: out-degree, in-degree, degree centrality, betweenness centrality, compact centrality, eigenvector centrality, and PageRank. (1) Out-degree, the formula is as follows:

[0014] in, Represents a set of nodes. Indicates whether there is a slave node. To the node The edge; (2) In-degree, the formula is as follows:

[0015] in, Represents a set of nodes. Indicates whether there is a slave node. To the node The edge; (3) Degree centrality, the formula is as follows:

[0016] in, For nodes The sum of out-degree and in-degree, This represents the number of nodes in the graph; (4) Betweenness centrality, the formula is as follows:

[0017] in, Represents a set of nodes. Represents a node With nodes The total number of shortest paths between them. This indicates that these shortest paths pass through the nodes. Quantity; (5) Tight centrality, the formula is as follows:

[0018] in, Represents a node With nodes The shortest path length between them; (6) Eigenvector centrality, the formula is as follows:

[0019] in, It is a constant used for normalization during the calculation process, ensuring that the centrality vector satisfies the characteristic equation. It is a node The set of neighboring nodes For nodes eigenvector centrality value; (7) PageRank, the formula is as follows:

[0020] in, This is the damping coefficient, which represents the probability of a jump. Pointing to a node The set of neighboring nodes, For nodes The degree of departure; Aligning IP graph node features with IP port graph node features enhances the model's ability to represent node communication behavior by integrating node topology information; for each time window, the nodes of the IP port graph... Parse its IP prefix to obtain For example, a node identified as (192.168.1.10:443) will have its IP address resolved. Nodes in the IP port graph are identified by their IP prefix. Find the characteristics of nodes with the same IP in the IP graph. After feature alignment, the two sets of node features are fused using the following formula to construct enhanced features for the IP port graph nodes. Finally, the initialized feature vector contains 14 dimensions, corresponding to the out-degree, in-degree, degree centrality, betweenness centrality, compact centrality, eigenvector centrality, and PageRank of the IP graph and IP port graph, respectively.

[0021] Furthermore, in step five, the EA-NAGE model includes a graph neural network consisting of stacked Edge-Attention and Neighbor-Aggregation layers, as well as a shallow neural network detector. The Edge-Attention layer introduces an edge attention mechanism. The attention coefficient is calculated from the outgoing edge features of the center node and the target node of the outgoing edge, aiming to highlight the key information of the outgoing edge flow of the center node. The formula is as follows:

[0022] in, Indicates the first In a time window graph, the central node outward edge The corresponding edge features, This indicates the node that the outgoing edge of the center node points to. Features; and Let represent the linear transformation matrices used for node features and edge features, respectively, to map different types of input features to a unified feature space. as well as These are the learnable parameters. It is a non-linear activation function, and this part uses Perform a non-linear transformation on the attention value.

[0023] use The function normalizes the attention values ​​to obtain the final edge attention score:

[0024] in, It is the central node The target node from which the edge is formed; The central node calculates the messages passed from its neighbors; it then calculates the attention scores based on the outgoing edges. The edge flow characteristics are aggregated to obtain the central node. News :

[0025] The central node updates the message; the central node... Node features With aggregated information The nodes are concatenated and updated using a linear mapping to obtain the first-level node embeddings. :

[0026] The Neighbor-Aggregation layer, based on GraphSAGE, aims to capture the behavior of neighboring nodes and highlight the outgoing edge traffic patterns of the central node. Unlike GraphSAGE's sampling mechanism, this layer employs a full-neighbor aggregation strategy, aggregating all outgoing edge traffic features and their corresponding neighboring node embeddings. This strategy avoids information loss, thus fully preserving the local neighborhood structure and behavioral characteristics of nodes. The Neighbor-Aggregation layer's message passing method directly passes the central node... The outbound flow characteristics are added to and averaged with the corresponding neighbor node characteristics, as shown in the following formula:

[0027] in, and It is a trainable matrix for the message passing part of the Neighbor-Aggregation layer. It is the embedding of the neighboring nodes corresponding to the outgoing edges of the central node; The Neighbor-Aggregation layer concatenates the current message. Embedding with Edge-Attention layer nodes The node embeddings are updated through a simple linear transformation to obtain the final node embeddings of the IP port graph in the t-th time slice.

[0028] The shallow neural network detector uses a fully connected layer to classify abnormal and normal nodes. Specifically, it embeds the IP port graph nodes within the t-th time window. The input is fed into this fully connected layer, and the argmax function is used to determine the node category:

[0029] in, For the number of node categories, It represents a fully connected layer.

[0030] Another objective of this invention is to provide an abnormal network node detection system based on GraphSAGE and edge attention mechanisms, comprising: The data preprocessing module is used to preprocess the traffic dataset to obtain a subset of the traffic dataset; The partitioning module is used to divide the dataset into multiple time slices based on a time window, and create two different perspectives of traffic graphs in each time slice: one with IP address as the node and the other with IP port as the node. The tagging module is used to tag nodes in the IP port graph based on the corresponding traffic data tags within the time slice; The initialization module is used to initialize node vectors, calculate and align the topological features of nodes in the two viewpoint graphs respectively; The model building module is used to build the EA-NAGE model, perform graph representation learning on multiple IP port graphs, and detect abnormal nodes. The adjustment module is used to adjust model parameters and train the model; The detection module is used to evaluate the EA-NAGE model using accuracy, precision, recall, and F1-score, and to detect anomalous network nodes using the EA-NAGE model.

[0031] Another objective of this invention is to provide an abnormal network node detection method based on multi-view communication graph feature alignment and edge attention-enhanced graph representation learning, comprising the following steps: A first communication perspective diagram and a second communication perspective diagram are constructed based on the same time window. The first communication perspective diagram uses communication entities as nodes, and the second communication perspective diagram uses a combination of communication entities and port identifiers as nodes. Extract the structural topology features of the nodes from the first and second communication perspective maps respectively; Based on the communication entity identifier, the node features of the first communication view graph are aligned and mapped to the corresponding nodes in the second communication view graph to form enhanced node features; Based on enhanced node features and communication behavior features, a graph neural network model with edge attention mechanism and neighborhood full aggregation mechanism is constructed to learn the representation of nodes; The determination of whether a communication node is an abnormal node is based on the node representation. Among them, the multi-view feature alignment mechanism is used to fuse structural information from different communication abstraction levels, the edge attention mechanism is used to highlight abnormal communication behavior, and the neighborhood full aggregation mechanism is used to completely preserve local communication patterns. The three constitute a collaborative anomaly detection mechanism.

[0032] Furthermore, the nodes in the first communication perspective diagram represent communication entity identifiers, and the nodes in the second communication perspective diagram represent identifiers formed by combining communication entity identifiers and port numbers.

[0033] Furthermore, the feature alignment method involves parsing the communication entity identifier in the node identifier of the second communication perspective map, and then splicing and merging the corresponding node features in the first communication perspective map.

[0034] Furthermore, the enhanced node features simultaneously include structural topology features from both the first and second communication viewpoints.

[0035] Furthermore, the criteria for determining abnormal nodes are the category results output by the classification network that the node represents.

[0036] Another object of the present invention is to provide a computer device including a memory and a processor, the memory storing a computer program, which, when executed by the processor, causes the processor to perform the steps of the abnormal network node detection method based on GraphSAGE and edge attention mechanism.

[0037] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the abnormal network node detection method based on GraphSAGE and edge attention mechanism.

[0038] Another objective of this invention is to provide an information data processing terminal for implementing the aforementioned abnormal network node detection system based on GraphSAGE and edge attention mechanism.

[0039] Based on the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solution to be protected by this invention are as follows: During the detection process, the model fully explores the potential relationships in the graph structure, thereby improving its detection performance for attack nodes in complex network structures; the model has a high detection effect and is suitable for practical engineering.

[0040] This invention addresses the limitations of traditional network traffic analysis techniques in detecting attacks on complex network structures, and the insufficient information mining capabilities of graph neural network-based anomaly node detection models, which restrict their ability to model node communication behavior patterns. It proposes an anomaly network node detection method based on GraphSAGE and edge attention mechanisms. This method extracts graph node topological features from two perspectives and constructs a corresponding anomaly network node detection model. The edge attention mechanism weights and aggregates the outgoing edge features of nodes, and the GraphSAGE layer is improved to aggregate outgoing edge features and corresponding neighboring node embeddings. The final node embedding integrates both graph topology information and graph edge traffic information. This method is suitable for detecting network nodes exhibiting abnormal behaviors such as DDoS attacks, DoS attacks, botnet attacks, and web application attacks, demonstrating good generalization and high accuracy.

[0041] The final node embedding generated by this invention integrates graph topology information and edge flow information, achieving a detection accuracy of 99.89%, precision of 99.87%, recall of 99.56%, and F1-score of 99.71%.

[0042] This invention co-designs an importance characterization mechanism for outbound communication behavior with a full neighborhood aggregation mechanism, transforming node anomaly detection from traditional reliance on single statistical features or fixed neighborhood aggregation methods to joint modeling of the contribution of communication behavior and local communication structure patterns. On one hand, by weighting the importance of node outbound communication behavior, the impact of abnormal traffic on node representation is significantly amplified, thus avoiding the dilution of abnormal communication by a large amount of normal communication. On the other hand, by aggregating all neighborhood information of a node without sampling and filtering, the local communication structure of the node is fully preserved, preventing the omission of key anomaly patterns at the structural level. The synergy of these two approaches enables the model to accurately identify the behavioral characteristics of abnormal communication and understand the position and role of abnormal behavior in the network structure, thereby achieving more stable and accurate identification of anomaly nodes. Compared with detection methods based solely on traffic statistical thresholds or solely on structural features, this scheme exhibits stronger robustness and generalization ability in complex, variable, and noisy real-world network environments, significantly reducing the risk of false positives and false negatives, demonstrating significant progress in anomaly characterization accuracy and detection stability.

[0043] By introducing a multidimensional structural centrality index as a node structural feature, this scheme allows node representation to move beyond simple connection counts and reflect the multi-layered roles and influence of nodes within the overall communication network. This design enables the accurate characterization of anomalous nodes not only in their communication behavior but also in their structural location; for example, relay-type, control-type, and edge-type anomalous nodes can all be distinguished. Compared to methods using only degree or traffic volume, this scheme significantly improves the ability to identify concealed anomalous nodes and reduces the probability of misjudgment due to changes in traffic volume, resulting in more stable and reliable detection results and demonstrating a significant advancement in structural representation capabilities.

[0044] By employing an importance weighting mechanism that jointly models outgoing edge behavior and target node features, anomalous communication is no longer simply treated as equally weighted inputs. Instead, its influence intensity is dynamically adjusted based on its behavioral characteristics and interacting objects. This mechanism highlights communication relationships with anomalous patterns, such as high-frequency anomalous connections or clustered connections of anomalous objects, thereby improving the separability of anomalous behavior in node representations. Compared to fixed weights or simple summation methods, this scheme significantly enhances the model's sensitivity and discriminative ability to anomalous patterns, making the detection results more discriminative and demonstrating significant progress in anomalous saliency modeling.

[0045] By weighted aggregation of outgoing edge behaviors, this scheme amplifies the impact of anomalous communication in the node representation, creating a clearer distinction between anomalous and normal nodes in the embedding space. This design reduces the problem of anomalous signals being masked by a large amount of normal communication, making it particularly suitable for scenarios with a low attack ratio or sparse anomalous behavior. Compared to traditional average aggregation methods, this scheme has significant advantages in anomaly separability and detection sensitivity, thereby significantly improving detection performance in low signal-to-noise ratio scenarios.

[0046] By employing a full neighborhood aggregation strategy, this approach avoids the information loss problem inherent in sampling mechanisms, preserving the complete local structural patterns of nodes. This is significant for anomalies that rely on local topological morphology for judgment; for example, star-shaped attack structures or chain-like diffusion structures can be fully represented. Compared to sampling-based methods, this approach offers significant advantages in structural fidelity and pattern completeness, thereby enhancing the detection capability for complex attack structures.

[0047] By constructing a multi-view communication graph and performing feature alignment, this approach integrates communication information at different levels of abstraction into a unified node representation, enabling the model to simultaneously understand the entity-level structure and port-level behavioral patterns. This integration enhances the expressive power of the node representation, allowing anomalous nodes to exhibit anomalous features simultaneously across multiple semantic spaces, significantly improving the reliability and generalization of detection, and demonstrating remarkable progress in cross-view information fusion.

[0048] By decoupling the construction of node representations from the anomaly detection mechanism, this approach improves the system's flexibility and scalability, allowing different classification models to be freely replaced without altering the representation mechanism. This modular design enhances the system's adaptability, facilitating deployment in various network environments and attack scenarios, demonstrating a significant advancement in system architectural flexibility.

[0049] By fusing structural and behavioral features into a unified representation, this approach enables the model to simultaneously understand communication patterns and network roles, thereby improving its coverage of multiple anomalies. Compared to methods using only a single type of feature, this approach has significant advantages in anomaly type adaptability and detection stability.

[0050] By adopting a simple mapping classification method, this scheme reduces model complexity and the risk of overfitting, making the detection results more stable and reliable. It is particularly suitable for environments with limited sample size or frequent distribution changes, demonstrating significant progress in practicality and stability.

[0051] By defining anomalies based on differences in communication patterns, this approach eliminates the reliance on fixed attack templates or rules, enabling the system to adapt to unknown attacks and novel anomaly scenarios. This significantly improves the foresight and long-term applicability of the detection system, demonstrating remarkable progress in adaptability to unknown anomalies.

[0052] This invention fills a technological gap in the industry both domestically and internationally: Existing network traffic analysis methods struggle to identify complex or multi-stage network attacks, and while existing graph neural network-based anomaly node detection models are prevalent, there is a lack of a method in publicly available literature that can simultaneously and organically combine graph node features with edge traffic features to improve attack detection effectiveness. This invention constructs a node initialization module that enhances node behavior features from two perspectives, and for the first time integrates an edge attention mechanism with an improved GraphSAGE layer, enabling the generated node embeddings to simultaneously express both topological structure and edge traffic behavior. This technical approach is currently lacking in research both domestically and internationally; therefore, this invention fills a significant technological gap in network behavior anomaly detection. Attached Figure Description

[0053] Figure 1 This is a flowchart of an abnormal network node detection method based on GraphSAGE and edge attention mechanism provided in an embodiment of the present invention.

[0054] Figure 2 This is a framework diagram of the IP graph and IP port graph constructed based on a time window, provided in an embodiment of the present invention.

[0055] Figure 3 This is a diagram of the EA-NAGE model detection framework provided in this embodiment of the invention.

[0056] Figure 4 This is a diagram of the Edge-Attention graph neural network layer framework based on the edge attention mechanism provided in this embodiment of the invention.

[0057] Figure 5 This is a diagram showing the impact of window size changes on model performance, as provided in an embodiment of the present invention.

[0058] Figure 6 This is a graph showing the performance evaluation results of the EA-NAGE model and the comparison model provided in this embodiment of the invention on the CIC-IDS-2017 dataset.

[0059] Figure 7 This is a graph showing the performance evaluation results of the EA-NAGE model and the comparison model provided in this embodiment of the invention on the CIC-UNSW-NB15 dataset.

[0060] Figure 8This is a block diagram of an abnormal network node detection system based on GraphSAGE and edge attention mechanism provided in an embodiment of the present invention. Detailed Implementation

[0061] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0062] like Figure 1 As shown, an abnormal network node detection method based on GraphSAGE and edge attention mechanism provided by this embodiment of the invention includes the following steps: S101, perform data preprocessing on the traffic dataset to obtain a subset of the traffic dataset; S102, the dataset is divided into multiple time slices based on the time window, and two different perspectives of traffic graphs are created in each time slice, one with IP as the node and the other with IP port as the node; S103, Tag the nodes in the IP port graph according to the corresponding traffic data labels within the time slice; S104, Initialize node vectors, calculate and align the topological features of nodes in the two viewpoint graphs respectively; S105, EA-NAGE model is established, graph representation learning is performed on multiple IP port graphs, and edge attention mechanism and improved GraphSAGE layer are used to effectively fuse edge traffic information and neighborhood node information to generate node embeddings, thereby detecting abnormal nodes; S106, Adjust model parameters and train the model; S107 evaluates the EA-NAGE model using accuracy, precision, recall, and F1-score, and uses the EA-NAGE model to detect anomalous network nodes.

[0063] The abnormal network node detection method based on GraphSAGE and edge attention mechanism provided in this invention is based on the core idea of ​​abstracting network traffic behavior into a time-series graph structure. It realizes a dual-view graph node feature extraction method that integrates IP graph and IP port graph information. On this basis, by introducing an improved GraphSAGE layer and edge attention mechanism, the graph neural network's ability to express node communication behavior is enhanced, thereby achieving accurate detection of abnormal network nodes.

[0064] First, the raw network traffic data is cleaned, normalized, and feature-filtered to remove invalid fields and outliers, forming a subset of the traffic dataset for modeling. Then, the traffic data is segmented based on a preset time window, dividing continuous traffic into multiple time slices to characterize the evolution of network behavior over time. Within each time slice, a traffic graph is constructed using both IP addresses and IP ports as nodes. These two graph structures describe network communication relationships from different perspectives, with edges between nodes representing communication connections and corresponding traffic attributes.

[0065] Based on this, according to the traffic label information within the time slice, corresponding behavior labels are assigned to graph nodes from the IP port perspective for subsequent model supervised training. Subsequently, the node vectors in the graphs from both perspectives are initialized, and their topological features are calculated separately. Through a feature alignment mechanism, the correspondence between node representations under different perspectives is established, thereby achieving the collaborative fusion of multi-perspective information.

[0066] Furthermore, an abnormal network node detection model based on GraphSAGE and edge attention mechanisms, namely the EA-NAGE model, is constructed. This model aggregates neighborhood node features and edge features based on GraphSAGE and edge attention mechanisms to generate node embeddings. Specifically, the Edge-Attention layer dynamically adjusts the influence of each communication connection on the node representation through the edge attention mechanism, enabling the model to highlight key edge information corresponding to abnormal communication behaviors. The Neighbor-Aggregation layer based on GraphSAGE aggregates both the outgoing edge traffic features from the central node and the low-dimensional embeddings of the corresponding destination nodes. The aim is to learn the low-dimensional embeddings of neighborhood nodes, which contain both structure and behavior, while further strengthening the edge traffic features from the central node. The final generated node embeddings integrate graph topology information and edge traffic information, and a shallow classifier is used to complete the abnormal node detection.

[0067] Finally, by adjusting the model parameters and iteratively training, the EA-NAGE model gradually converges, and its performance is evaluated using metrics such as accuracy, precision, recall, and F1-score. The trained EA-NAGE model can be used to detect anomalous network nodes, effectively identifying network attack behaviors.

[0068] In step S101 provided in this embodiment of the invention, data preprocessing requires cleaning, sampling, and standardizing the original dataset: Data cleaning: This involves handling outliers and incorrect labeling in the original dataset. For example, NaN and Inf outliers, or normal traffic from legitimate devices being incorrectly labeled as an attack. If all traffic records contain outliers, all records with all outliers are deleted. If only a few traffic records contain outliers, the average of that feature column is calculated and used to replace the outlier. For incorrect traffic labeling in the dataset, the erroneous traffic labels are corrected based on the attack time and abnormal host IPs provided by the dataset's baseline.

[0069] Dataset Sampling: A random undersampling strategy was employed, sampling normal and abnormal traffic separately. Normal and abnormal traffic samples were merged to generate a traffic subset, which was then sorted chronologically. This approach achieves sample balance while ensuring no valuable information is lost, addressing the performance degradation caused by extreme imbalances in the number of nodes in the network communication graph.

[0070] Data standardization: Data standardization uses Z-score to standardize traffic features, eliminating differences in feature dimensions while ensuring the distribution of feature values, and preventing large fluctuations in the model during training, which could lead to poor training results.

[0071] In S102 of this embodiment of the invention, the preprocessed traffic data is divided into fixed time windows, and the length of the time window is set to be... Minutes, timestamp of traffic data is The duration of the flow is , No. The start time of each time window and the The end time of each time window Definition:

[0072] in, This is the timestamp of the earliest traffic within all time windows of the current dataset.

[0073] The time window to which a traffic record belongs is determined as follows:

[0074] Graph construction requires building IP graphs and IP port graphs based on time windows to extract node topology features from different perspectives. Considering the directionality of network traffic and the possibility of multiple flow records between two nodes, these two types of graphs are constructed using directed multigraphs. The time window sequence is set as follows: The graph set constructed after dividing the time window is as follows: ; in the Within each time window, the representation of each constructed IP diagram and IP port diagram is uniformly denoted as: ; in, It includes two types of diagrams: IP diagrams and IP port diagrams. For each node in the IP graph, the node topology features are calculated through node initialization. , This is a set of nodes in an IP port graph. Each node's topology characteristics are calculated through node initialization. For example, if the four-tuple information (source IP, destination IP, source port, destination port) corresponding to a traffic record is (192.168.10.50, 34851, 172.16.0.1, 49633), then the node identifiers in the IP port diagram are (192.168.10.50:34851) and (172.16.0.1:49633), and the node identifiers in the IP diagram are (192.168.10.50) and (172.16.0.1). A set of directed edges containing IP graphs and IP port graphs, and a set of edge features. The edge features of the IP graph and IP port graph are traffic features.

[0075] like Figure 2 As shown. In this embodiment, after dividing the traffic dataset according to time windows, an IP graph and an IP port graph are constructed based on the data in each time slice. This reduces the size of the input graph of the model and allows for more granular node communication behavior. It also provides basic graph data for the initial vector calculation of graph nodes in step four.

[0076] In S103 provided in this embodiment of the invention, since the training of the graph neural network depends on node label information, labels should be defined for the nodes of the IP port graph according to the traffic data labels in the corresponding time window; in the... IP port graph within a time window The directed edges are constructed from flow records, and each edge All have binary labels ,in, This indicates that the traffic is abnormal. Based on this, the label determination rules for nodes are defined as follows: (1) Definition of abnormal nodes: If a node outgoing edge set There is at least one edge in the middle. If the traffic is abnormal, then this node in the current window will be marked as an abnormal node. (2) Normal node definition: If a node If all outgoing edges of a node are normal traffic, or if the node has no outgoing edges within the current window, then the node is marked as a normal node in the current window. Therefore, the node label definition formula is as follows:

[0077] In S104 of this embodiment, further, in step four, the initial vector calculation of graph nodes aims to obtain node topological features from two perspectives: IP graph and IP port graph. Specifically, seven types of topological features are extracted from the two types of graphs, including: out-degree, in-degree, degree centrality, betweenness centrality, compact centrality, eigenvector centrality, and PageRank. (1) Out-degree, the formula is as follows:

[0078] in, Represents a set of nodes. Indicates whether there is a slave node. To the node The edge.

[0079] (2) In-degree, the formula is as follows:

[0080] in, Represents a set of nodes. Indicates whether there is a slave node. To the node The edge.

[0081] (3) Degree centrality, the formula is as follows:

[0082] in, For nodes The sum of out-degree and in-degree, This represents the number of nodes in the graph.

[0083] (4) Betweenness centrality, the formula is as follows:

[0084] in, Represents a set of nodes. Represents a node With nodes The total number of shortest paths between them. This indicates that these shortest paths pass through the nodes. The quantity.

[0085] (5) Tight centrality, the formula is as follows:

[0086] in, Represents a node With nodes The shortest path length between them.

[0087] (6) Eigenvector centrality, the formula is as follows:

[0088] in, It is a constant used for normalization during the calculation process, ensuring that the centrality vector satisfies the characteristic equation. , It is a node The set of neighboring nodes For nodes The eigenvector centrality value.

[0089] (7) PageRank, the formula is as follows:

[0090] in, This is the damping coefficient, which represents the probability of a jump. Pointing to a node The set of neighboring nodes, For nodes The degree of departure.

[0091] Aligning IP graph node features with IP port graph node features integrates node topology information, enhancing the model's ability to represent node communication behavior. For each window of the IP port graph nodes... Parse its IP prefix to obtain For example, a node identified as (192.168.1.10:443) will have its IP address resolved. Nodes in the IP port graph are identified by their IP prefix. Find the characteristics of nodes with the same IP in the IP graph. After feature alignment, the following formula is used to align the two types of node features to construct enhanced features for the IP port graph nodes. Finally, the initialized feature vector contains 14 dimensions, corresponding to the out-degree, in-degree, degree centrality, betweenness centrality, compact centrality, eigenvector centrality, and PageRank of the IP graph and IP port graph, respectively.

[0092]

[0093] In S105 provided in this embodiment of the invention, the EA-NAGE model includes a graph neural network consisting of stacked Edge-Attention layers and Neighbor-Aggregation layers, as well as a shallow neural network detector.

[0094] like Figure 3 As shown, in this embodiment, firstly, the IP port graph divided based on the time window is input into the Edge-Attention layer. The central node uses the edge attention mechanism to calculate weights based on the features of outgoing edges and their connected neighboring nodes, and aggregates the traffic behavior features of outgoing edges accordingly. Subsequently, the aggregated traffic information is fused with the initial features of the central node itself to obtain a low-dimensional embedding that represents the current node behavior model. Then, the graph data enters the Neighbor-Aggregation layer. Unlike the Edge-Attention layer, this layer is based on an improved GraphSAGE architecture and adopts a full neighborhood aggregation strategy. On the one hand, it aggregates the neighboring node embeddings generated by the previous layer to capture the local graph structure information of the neighborhood; on the other hand, it again fuses the outgoing edge traffic features of the central node to further enhance the model's representation of communication behavior patterns. By stacking GNN layers in the above manner, a final node embedding that simultaneously possesses local graph structure and node neighborhood communication features can be obtained. To accelerate model training convergence and improve training stability, the model introduces layer normalization and non-linear activation functions after the Edge-Attention layer and the Neighbor-Aggregation layer. At the same time, to alleviate overfitting during training, a Dropout layer is added after the Edge-Attention layer.

[0095] The Edge-Attention layer introduces an edge attention mechanism. The attention coefficient is calculated from the outgoing edge features of the center node and the target node of the outgoing edge, aiming to highlight the key information of the outgoing edge flow of the center node. The formula is as follows:

[0096] in, Indicates the first The central node in the time window graph outward edge The corresponding edge features, This indicates the node that the outgoing edge of the center node points to. Its characteristics.

[0097] and Let represent the linear transformation matrices used for node features and edge features, respectively, to map different types of input features to a unified feature space. as well as These are the learnable parameters. It is a non-linear activation function, and this part uses Perform a non-linear transformation on the attention value.

[0098] use The function normalizes the attention values ​​to obtain the final edge attention score:

[0099] in, It is the central node The target node from which the edge is formed.

[0100] The central node calculates the messages passed from its neighbors. This is based on the attention scores from the outgoing edges. The edge flow characteristics are aggregated to obtain the central node. News :

[0101] The central node updates the message. The central node... Node features With aggregated information The nodes are concatenated and updated using a linear mapping to obtain the first-level node embeddings. :

[0102] The Neighbor-Aggregation layer, based on GraphSAGE, aims to capture the behavior of neighboring nodes and highlight the outgoing edge traffic patterns of the central node. Unlike GraphSAGE's sampling mechanism, this layer employs a full-neighbor aggregation strategy, aggregating all outgoing edge traffic features and their corresponding neighboring node embeddings. This strategy avoids information loss, thus fully preserving the local neighborhood structure and behavioral characteristics of nodes. The Neighbor-Aggregation layer's message passing method directly passes the central node... The neighbor node features and outgoing edge features are added together and averaged, as shown in the following formula:

[0103] in, and It is a trainable matrix for the message passing part of the Neighbor-Aggregation layer. It is the embedding of the neighboring nodes corresponding to the outgoing edges of the central node.

[0104] The Neighbor-Aggregation layer concatenates the current message. Embedding with Edge-Attention layer nodes The node embedding is updated through a simple linear transformation to obtain the nth node. The final node embedding of the IP port graph in each time slice.

[0105]

[0106] The shallow neural network detector uses a fully connected layer to classify abnormal and normal nodes. Specifically, the first... IP port graph node embedding within a time window The input is fed into this fully connected layer, and the argmax function is used to determine the node category:

[0107] in, For the number of node categories, It represents a fully connected layer.

[0108] In S107 of this embodiment of the invention, the EA-NAGE model is evaluated using accuracy, precision, recall and F1-score, and the EA-NAGE model is used to detect abnormal network nodes.

[0109] like Figure 6 Another objective of this invention is to provide an abnormal network node detection system based on GraphSAGE and edge attention mechanisms, comprising: The data preprocessing module is used to preprocess the traffic dataset to obtain a subset of the traffic dataset; The partitioning module is used to divide the dataset into multiple time slices based on a time window, and create two different perspectives of traffic graphs in each time slice: one with IP address as the node and the other with IP port as the node. The tagging module is used to tag nodes in the IP port graph based on the corresponding traffic data tags within the time slice; The initialization module is used to initialize node vectors, calculate and align the topological features of nodes in the two viewpoint graphs respectively; The model building module is used to build the EA-NAGE model, perform graph representation learning on multiple IP port graphs, and detect abnormal nodes. The adjustment module is used to adjust model parameters and train the model; The detection module is used to evaluate the EA-NAGE model using accuracy, precision, recall, and F1-score, and to detect anomalous network nodes using the EA-NAGE model.

[0110] The anomaly detection system based on GraphSAGE and edge attention mechanism proposed in this invention is not a simple superposition or replacement of existing graph neural network models, but rather a holistic and collaborative anomaly detection mechanism built around the inherent coupling characteristics of network traffic data in the time dimension, structural dimension and interaction semantic dimension.

[0111] First, the data preprocessing module does not merely perform routine cleaning. Instead, it standardizes and aligns the raw traffic data, constrained by temporal continuity and communication integrity, to form a subset of traffic data capable of supporting multi-perspective graph construction. This provides a consistent data foundation for subsequent time slicing and graph structure construction. The preprocessing result directly affects the stability of the graph structure and the comparability of node representations, and is a prerequisite for the overall system performance.

[0112] Subsequently, the partitioning module performs time-series segmentation of traffic data based on a sliding time window, and simultaneously constructs two traffic graph structures with different semantic perspectives within each time slice: on the one hand, it uses IP addresses as nodes to depict the macroscopic communication topology between hosts; on the other hand, it uses IP ports as nodes to depict specific service interactions and behavioral patterns. The two perspectives are generated in parallel within the same time slice, but their node sets, edge meanings, and structural densities are all different, forming a complementary but irreplaceable graph structure representation.

[0113] Based on this, the label module does not assign values ​​to nodes in isolation. Instead, it uses the correspondence between traffic labels within the time slice and port-level communication behavior to accurately map abnormal semantics to IP port graph nodes. This allows for the introduction of fine-grained abnormal supervision signals while maintaining host-level topology integrity, providing semantic anchors for the model to distinguish between normal and abnormal behavior.

[0114] The initialization module extracts topological features from nodes in both perspective graphs and aligns these features, enabling the IP graph and IP port graph to be fusionable and comparable in their representation spaces. This process is not a simple feature concatenation, but rather a unification of dimensions and scale, allowing node representations from different structural perspectives to be modeled by the same model, laying the foundation for cross-graph learning.

[0115] The EA-NAGE model built in the model building module uses GraphSAGE's neighborhood aggregation mechanism as its backbone. By introducing attention weights at the edge level, the model can dynamically adjust the information propagation intensity according to the importance of different communication relationships, thereby achieving time-consistent graph representation learning across multiple IP port graphs. The combination of the edge attention mechanism and GraphSAGE enables the model to not only focus on the node's own attributes but also distinguish the degree of contribution of different communication behaviors to anomaly detection, resulting in a representation that combines structure and semantics.

[0116] The adjustment module jointly adjusts the number of aggregation layers, attention parameters, and time slice weights during model training, enabling the model to maintain stable discrimination ability across different time slices and avoiding interference from abnormal fluctuations in a single time window on the overall detection results.

[0117] Finally, the detection module validates the model performance based on a multi-index evaluation system, and uses the trained EA-NAGE model to detect abnormal nodes in unknown network traffic, thereby achieving accurate identification of abnormal network nodes.

[0118] Therefore, this invention constructs a holistic, collaborative, and mutually constraining anomaly detection mechanism through time slicing, multi-view graph construction, feature alignment, and edge attention-guided graph representation learning. Its technical effectiveness cannot be achieved by simply combining existing technologies, demonstrating significant systematicity and innovation. Addressing the limitations of traditional network traffic analysis techniques in detecting complex network attacks, and the insufficient information mining capabilities of graph neural network-based anomaly node detection models, which restrict their ability to model node communication behavior patterns, this invention designs an anomaly network node detection method based on GraphSAGE and edge attention mechanisms. This method achieves graph node topology feature extraction from two perspectives and constructs a corresponding anomaly network node detection model based on this. By introducing an edge attention mechanism to weighted aggregate node edge features and improving the GraphSAGE layer to aggregate edge features and corresponding neighbor node embeddings, the final generated node embedding integrates graph topology information and edge traffic information. This method is suitable for detecting network nodes engaging in DDoS attacks, DoS attacks, botnet attacks, web application attacks, and other abnormal behaviors, exhibiting good generalization and high accuracy.

[0119] This invention is applicable to the technical fields of network behavior anomaly detection and analysis, network security threat identification, and communication behavior modeling. It can be deployed in carrier networks, data centers, cloud computing platforms, enterprise intranet security systems, and government network environments. This invention can be used as a standalone abnormal network node detection product, or embedded in security products such as Intrusion Detection Systems (IDS), Security Information and Event Management Systems (SIEM), Network Traffic Analysis Platforms (NTA), Next-Generation Firewalls (NGFW), and Zero Trust Access Control Systems to identify various network threats, including DDoS attacks, DoS attacks, botnet attacks, and web attacks.

[0120] The present invention has been tested in this embodiment, and the following is the experimental section: The performance evaluation of this invention uses two mainstream intrusion detection datasets: one is the CIC-IDS-2017 intrusion detection evaluation dataset jointly constructed by the University of Brunswick and the Canadian Cyber ​​Security Institute in 2017; the other is the CIC-UNSW-NB15 dataset constructed by the Canadian Cyber ​​Security Institute based on the original Pcap network traffic files of the UNSW-NB15 dataset released by the Australian Cyber ​​Security Centre, using CICFlowMeter to extract features from the captured network traffic. To reduce the dataset size and alleviate the class imbalance problem between normal and abnormal traffic, random undersampling was used on both datasets in the experiment. After undersampling, the CIC-IDS-2017 dataset contains 836,460 normal traffic entries and 557,644 abnormal traffic entries; the CIC-UNSW-NB15 dataset contains 89,583 normal traffic entries and 89,583 abnormal traffic entries. Subsequently, the datasets were divided into training and test sets in a 7:3 ratio.

[0121] The impact of window size variation on model performance, such as Figure 5 As shown in the figure, the detection F1-score of the EA-NAGE model varies with the size of the time window. The detection performance of the EA-NAGE model changes accordingly with the size of the time window. On the CIC-IDS-2017 dataset, the model maintains high detection performance across different time windows, with the F1-score consistently above 99%, showing a gradual upward trend as the time window increases, reaching its maximum value in a 60-minute window, after which the F1-score slightly decreases. A similar trend was observed on the CIC-UNSW-NB15 dataset, where the model achieves its maximum F1-score within a 60-minute time window. Therefore, a time window size of 60 minutes was set for both datasets.

[0122] Since GraphSAGE, GAT, XG-BoT, GCN, ANN, and SVM cannot directly learn the features of flow edges, it is necessary to convert the flow edge features into node features in the comparative experiments. Specifically, the flow features of all outgoing edges are summed and concatenated with the initialized graph node features to serve as the final input features for the nodes.

[0123] The performance evaluation results of the EA-NAGE model and the comparison model on the CIC-IDS-2017 dataset are shown in the figure. Figure 6As shown, the EA-NAGE model achieved an accuracy of 99.89%, a precision of 99.87%, a recall of 99.56%, and an F1 score of 99.71%. Compared to the RE-GCN model, which can also aggregate node and edge features, the EA-NAGE model improved recall by 5.71% and F1 score by 5.52%. Compared to the GraphSAGE model, which can aggregate two-hop neighborhood features, the EA-NAGE model improved recall by 0.73%. Compared to the traditional machine learning model SVM, the EA-NAGE model improved recall by 42.47%.

[0124] Performance evaluation results of the EA-NAGE model and its comparison model on the CIC-UNSW-NB15 dataset are shown in the figure. Figure 7 As shown, the EA-NAGE model achieved an accuracy of 99.38%, a precision of 98.47%, a recall of 99.80%, and an F1 score of 99.13%. Compared to the RE-GCN model, which can also aggregate node and edge features, the EA-NAGE model improved recall by 1.83% and F1 score by 1.20%. Compared to the GraphSAGE model, which can aggregate two-hop neighborhood features, the EA-NAGE model improved recall by 0.33%. Compared to the traditional machine learning model SVM, the EA-NAGE model improved recall by 11.46%.

[0125] Table 1 presents the experimental results of feature ablation, used to verify the effectiveness of the proposed graph node augmentation features. Here, EA-NAGE-without-NF indicates that the EA-NAGE model does not use graph node augmentation features and only utilizes flow edge features for anomaly node detection; EA-NAGE indicates that the model uses both graph node augmentation features and flow edge features. The experimental results show that on the CIC-IDS-2017 dataset, introducing graph node augmentation features improved recall by 3.87% and F1-score by 2.16%, indicating that the proposed features have a significant effect on improving the ability to identify anomaly nodes. On the CIC-UNSW-NB15 dataset, introducing graph node augmentation features improved precision by 0.63% and F1-score by 0.36%. The experimental results further verify that graph node augmentation features can effectively supplement topological structure information, thereby improving the overall detection performance and robustness of the model.

[0126] Table 1. Experimental results of characteristic ablation

[0127] It should be noted that embodiments of the present invention can be implemented in hardware, software, or a combination of both. The hardware portion can be implemented using dedicated logic; the software portion can be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or dedicated-design hardware. Those skilled in the art will understand that the above-described devices and methods can be implemented using computer-executable instructions and / or included in processor control code, for example, such code provided on a carrier medium such as a disk, CD, or DVD-ROM, a programmable memory such as read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuitry such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field-programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of the above-described hardware circuitry and software, such as firmware.

[0128] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions, and improvements made by those skilled in the art within the scope of the technology disclosed in the present invention, and within the spirit and principles of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An abnormal network node detection method based on GraphSAGE and edge attention mechanism, characterized in that, Includes the following steps: Based on network traffic data within the same time window, a first communication perspective graph and a second communication perspective graph are constructed respectively. The first communication perspective graph uses communication entities as nodes, while the second communication perspective graph uses a combination of communication entities and port identifiers as nodes. Both perspective graphs use network traffic as directed edges. The structural topological features of nodes in the first and second communication view maps are extracted respectively, and the node features of the first communication view map are aligned and mapped to the corresponding nodes in the second communication view map to generate an enhanced node feature vector containing dual-view communication structural features. The edge attention weights are calculated based on the outgoing edge behavior of nodes and the characteristics of the corresponding target nodes, which are used to characterize the degree of contribution of different communication behaviors to node anomalies. The outgoing edge communication behavior of nodes is weighted and aggregated based on edge attention weights to obtain the communication behavior representation of nodes in the first stage. The behavior representations of neighboring nodes of a node are aggregated with the corresponding communication behavior features, and then full neighborhood aggregation is performed to obtain the second-stage node representation of the node. Based on the node representation in the second stage, a shallow classifier is used to determine whether a node is an abnormal node. The dual-view feature alignment mechanism is used to fuse structural information from different communication abstraction levels, the edge attention computing mechanism is used to highlight the key communication relationships corresponding to abnormal node behavior, and the full neighborhood aggregation is used to completely preserve the local communication structure pattern of the node. The three constitute a collaborative anomaly detection mechanism.

2. The method as described in claim 1, characterized in that, The node identifiers in the first communication perspective graph are IP addresses, while the node identifiers in the second communication perspective graph are combinations of IP addresses and port numbers.

3. The method as described in claim 1, characterized in that, The node feature vectors from both perspectives include at least the node's out-degree, in-degree, degree centrality, betweenness centrality, tight centrality, eigenvector centrality, and PageRank value.

4. The method as described in claim 1, characterized in that, The feature alignment method involves parsing the communication entity identifier in the node identifier of the second communication perspective map, and then splicing and merging the corresponding node features in the first communication perspective map.

5. The method as described in claim 1, characterized in that, The edge attention weights are obtained by linear mapping and nonlinear transformation of the outgoing edge communication features of the central node and the outgoing edge target node features, and then normalized to obtain the relative weight relationship between each outgoing edge.

6. The method as described in claim 1, characterized in that, The node behavior representation in the first stage is obtained by weighted summation of the communication behavior features of all outgoing edges of the node according to the corresponding attention weights.

7. The method as described in claim 1, characterized in that, The full neighborhood aggregation mechanism fuses the first-stage node behavior representation and communication behavior features corresponding to all outgoing edges of a node, without sampling and filtering the neighborhood, and applies an aggregation function to gather all neighborhood information to update the embedded representation of the central node.

8. The method as described in claim 1, characterized in that, The criteria for determining abnormal nodes are the category results output by the classification network that the node represents.

Images