A Network Traffic Detection Method and System Based on Diffusion Model and Graph Comparison Learning

Abstract

This invention discloses a network traffic detection method and system based on a diffusion model and graph contrastive learning, relating to the fields of network security and artificial intelligence. The method includes: constructing network traffic as an undirected graph; extracting features from the undirected graph using a graph convolutional encoder to obtain node embedding vectors; applying a forward diffusion process to the node embedding vectors; progressively adding Gaussian noise through stochastic differential equations to generate perturbation embeddings; optimizing the scoring network parameters using a scoring matching loss; performing contrastive learning using a deep graph information maximization method; calculating the expected perturbation score for each node embedding; and obtaining the probability of the traffic sample corresponding to that node deviating from the normal distribution and exhibiting anomalies. This invention effectively integrates the generative capabilities of the diffusion model, the structural modeling capabilities of graph neural networks, and the representational learning capabilities of contrastive learning. By using the expected perturbation score as a quantitative indicator of the degree of network traffic anomalies, it improves the accuracy and robustness of abnormal network traffic detection.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence, specifically to a network traffic detection method and system based on diffusion models and graph contrastive learning. Background Technology

[0002] With the rapid development of internet technology and the increasing complexity of network infrastructure, cybersecurity threats are becoming more diversified, covert, and intelligent. Complex attack methods such as adversarial attacks, zero-day exploits, and advanced persistent threats (APTs) are emerging in large numbers, placing higher demands on cybersecurity defense systems. Traditional defense mechanisms mainly rely on rule-based intrusion detection systems and statistical feature analysis methods. However, these methods often exhibit low detection rates and high false positive rates when facing new or evolving attack patterns, and their limitations are particularly evident in complex attack scenarios.

[0003] In recent years, deep learning has achieved remarkable success in fields such as computer vision and natural language processing. Emerging technologies such as diffusion models, graph neural networks (GNNs), and contrastive learning have opened up new perspectives for abnormal traffic detection. Among them, diffusion models can effectively model the potential distribution of normal network traffic by learning the generation process of data distribution, graph neural networks can capture the complex relational structure in network traffic data, and contrastive learning uses a self-supervised mechanism to learn discriminative representations. The combination of these three technologies provides a technical possibility for overcoming the limitations of traditional detection methods.

[0004] Network traffic inherently possesses graph structure characteristics, with communication between network entities forming complex topologies. Traditional anomaly detection methods typically treat traffic records as independent samples, ignoring dependencies and contextual information between nodes, and neglecting the graph structure of network traffic. This leads to the loss of crucial structural information and limits the performance of detection models. Therefore, effectively modeling the graph structure characteristics of network traffic while leveraging the advantages of deep learning models has become a key challenge in improving anomaly detection accuracy.

[0005] The shortcomings of existing technologies mainly include: 1. Static representation learning-based methods have limited expressive power in modeling complex traffic semantic relationships and are difficult to effectively identify hidden advanced threat behaviors; 2. There is a lack of effective quantitative indicators of anomaly degree, making it difficult to accurately assess the degree to which traffic samples deviate from the normal distribution; 3. Most existing methods can only handle known threat types and are insufficient in their ability to discover unknown potential threats.

[0006] Based on this, a network traffic detection method and system based on diffusion model and graph contrastive learning are now provided, which can eliminate the drawbacks of existing technical solutions. Summary of the Invention

[0007] The purpose of this invention is to provide a network traffic detection method and system based on diffusion model and graph contrastive learning to solve the problems in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: The network traffic detection method based on diffusion models and graph contrastive learning includes the following steps: Step S1: Collect network traffic data and construct an undirected graph from the network traffic data. Step S2: Use a graph convolutional encoder to extract features from the undirected graph, update the node representation by aggregating neighbor node information, and obtain the node embedding vector; Step S3: Apply a forward diffusion process to the node embedding vector, and gradually add Gaussian noise through stochastic differential equations to generate perturbation embeddings at different noise levels; Step S4: Based on the perturbation embedding under different noise levels, train the scoring network, optimize the scoring network parameters through scoring matching loss, and capture the distribution pattern of normal traffic embedding in the diffusion process. Step S5: Using perturbation embeddings under different noise levels as input, graph contrastive learning is performed using the depth graph information maximization method. By maximizing the mutual information between the local node representation and the graph-level global representation, the parameters of the graph convolutional encoder and discriminator are jointly optimized. The perturbation embeddings are aggregated through the readout function to generate the graph-level global representation, and negative sample pairs are constructed. The discriminator is used to distinguish between the real graph-embedded pairs and the negative sample pairs. The contrastive learning loss is calculated and backpropagation is performed, thereby enhancing the stability and discriminative representation ability of the node embedding vector under diffuse noise perturbation. Step S6: Based on the trained scoring network that fuses time features and perturbation embeddings through a multilayer perceptron, sampling points are selected at multiple time steps in the diffusion process using Monte Carlo sampling. The perturbation embeddings corresponding to each sampling point are input into the scoring network to output multidimensional gradient vectors. The L2 norm of each multidimensional gradient vector is calculated, and the average of the L2 norms of multiple sampling points is taken as the expected norm to obtain the expected perturbation score of the embedding vector of each node. The degree to which the traffic sample corresponding to the node deviates from the normal traffic distribution is quantified based on the expected perturbation score, thereby determining the abnormal probability of the traffic sample.

[0009] Further, the undirected graph in step S1 is represented as follows: ,in, Represents a set of nodes, which in turn represent network entities. The edge set represents the communication relationships between network entities, with each node associated with one edge. 3D feature vector; The construction process of the undirected graph specifically includes: Treat the source IP address and destination IP address as nodes in an undirected graph; The communication relationship between IP addresses is used as an edge; if there is data packet transmission between two IP addresses, an edge connection is established. Extract the traffic features of each node and use them as a node feature vector. The traffic features include: Mean, standard deviation, maximum, and minimum data packet sizes; Distribution of TCP, UDP and ICMP transport layer protocols based on frequency statistics or one-hot coding; Frequency distribution of commonly used ports and high-order random ports; In addition, the duration of traffic, the number of connection requests per unit time, and the data packet arrival interval.

[0010] Furthermore, the graph convolutional encoder in step S2 employs a multi-layer graph convolutional network, and the calculation formula for each layer of the graph convolutional network is expressed as: ; in, For the first The node feature matrix of the layer It is a non-linear activation function. This is the original adjacency matrix. To add a self-loop adjacency matrix, This is the corresponding degree matrix. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer; The final output of the multi-layer graph convolutional network is a node embedding matrix. The node embedding matrix integrates the topological structure information of the network traffic and the node feature information. The node embedding matrix is ​​used as the initial embedding in the continuous time state and is directly input into the stochastic differential equation in step S3 for positive diffusion perturbation.

[0011] Furthermore, the forward diffusion process in step S3 is described by a stochastic differential equation, which is expressed as: ; in, Represented as over time Changing node feature vectors Represented as a continuous-time variable and satisfying , Represented as a time-dependent noise scheduling function, Represented as standard Brownian motion, the noise scheduling function is in linear form and is expressed as: ,in, and These represent the minimum and maximum noise intensities, respectively. This represents the total number of time steps in the diffusion process. Based on the analytical properties of the stochastic differential equation, the forward diffusion process realizes the embedding vector from the initial node. to any time noise embedding The analytical sampling is calculated using the following formula: ; in, Standard Gaussian noise, The signal preservation coefficient, The noise figure, the signal preservation coefficient, and the noise figure are obtained by integrating the noise scheduling function, and are expressed as follows: and An adaptive noise strategy is implemented through the linear form of the noise scheduling function. In the early stage of forward diffusion, the noise intensity is kept small to preserve the original network traffic semantic information of the node embedding. In the later stage of forward diffusion, the noise intensity is gradually increased to force the model to learn a more robust normal traffic distribution manifold.

[0012] Furthermore, the scoring network in step S4 specifically includes: The time embedding layer encodes continuous time variables through positional encoding. The embedded network first encodes time features of different frequencies using sine and cosine functions, and then performs nonlinear mapping through a two-layer perceptron. The calculation formula is expressed as follows: ; in, For time-embedded feature vectors, and The learnable weight matrix in the fully connected layer. and For the corresponding bias term, This is the scaling factor. It is a non-linear activation function; Feature fusion layer, The noise embedding generated at time With the time-embedded feature vector The data is concatenated, and feature interaction and forward propagation are performed through a multilayer perceptron. The output is the predicted log probability density gradient vector, represented as: ; in, The log probability density gradient vector predicted by the scoring network, and the noise embedding The dimensions are consistent. This represents the backbone network of a multilayer perceptron. Indicates a splicing operation; The rating matching loss layer utilizes the analytical properties of the forward diffusion process to construct a rating matching loss function based on the mean squared error between the actual and predicted ratings to optimize the rating network parameters. The functional expression of the actual rating has an analytical form, represented as follows: , Indicates noise embedding Gradient operator for partial derivatives express At any moment The probability density function, and the rating matching loss function are expressed as: ; in, For rating matching loss, This represents the mathematical expectation operation. To conform to a uniform distribution The continuous time steps of sampling For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint. Standard Gaussian noise added during the diffusion process. For continuous time variables The corresponding noise figure.

[0013] Furthermore, the contrastive learning objective function of the depth map information maximization method in step S5 is expressed as: ; in, To compare the learning objective function, Let be the total number of nodes in the undirected graph. For the discriminator function, Indicates the first Local embedding representation of each node, This indicates that the function is read out. The aggregated graph-level global representation This is a representation of a negative sample obtained by shuffling the node order.

[0014] Furthermore, the formula for calculating the expected perturbation fraction in step S6 is expressed as follows: ; in, Embedding for nodes The expected perturbation score, It is the L2 norm. For parameters The log probability density gradient vector predicted by the parameterized scoring network, These are the learnable parameters in the scoring network. Embedding for nodes At any time Noise embedding, Indicates time In the interval Uniform random sampling within the area; An approximation using Monte Carlo sampling is expressed as: ; in, For the number of samples, To obtain from a uniform distribution The randomly selected representative of the time corresponding to the disturbance is the first one. Each time step For the corresponding time step The noise embedding generated below, For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint.

[0015] Furthermore, step S6 also includes calculating the maximum mean difference distance based on the expected perturbation scores: given two sets of node embeddings and their corresponding sets of expected perturbation scores, the maximum mean difference (MMD) is used to measure the distribution difference between them, and the MMD distance is calculated using the Gaussian radial basis kernel function to quantify the quality difference between different categories of embeddings.

[0016] A network traffic detection system based on diffusion model and graph contrastive learning is used to execute a network traffic detection method based on diffusion model and graph contrastive learning. The network traffic detection system includes: The traffic graph construction module is used to collect network traffic data and construct an undirected graph of network traffic, representing network entities as nodes and the communication relationships between network entities as edges. The graph convolutional coding module is used to extract features from an undirected graph using a graph convolutional network and output node embedding vectors. The diffusion enhancement module is used to apply a forward diffusion process to the node embedding vector, which enhances the ability to model normal distributions through controllable noise perturbation. The scoring network module is used to estimate gradient information during the diffusion process and learn the distribution characteristics of normal traffic embeddings; The contrastive learning module is used for self-supervised representation learning using the method of maximizing depth map information. The anomaly detection module is used to calculate the expected disturbance score and use it as a quantitative indicator of the degree of anomaly. Based on the expected disturbance score, the probability of an anomaly in the network traffic sample is determined.

[0017] Furthermore, it also includes: The joint training module is used to alternately optimize the graph convolutional encoder, the scoring network, and the discriminator. Specifically, it first updates the parameters of the graph convolutional encoder and the discriminator synchronously based on the contrastive learning objective function, then updates the parameters of the scoring network based on the scoring matching loss function, and coordinates multiple learning objectives through the joint loss function. The MMD distance calculation module is used to calculate the maximum mean difference distance based on the expected perturbation score, quantifying the distribution difference between normal and abnormal samples.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This invention introduces the diffusion model into the field of network anomaly traffic detection, and establishes the DDGI architecture that integrates the maximization of deep graph information and the diffusion model. It effectively integrates the self-supervised representation capability of graph contrastive learning and the generative distribution modeling capability of the diffusion model, thereby enhancing the model's ability to represent normal traffic distribution. 2. This invention proposes the expected perturbation score as a quantitative indicator of the degree of network traffic anomaly. By training the scoring network to predict gradient information during the diffusion process, the expected response value under different perturbation intensities is calculated to identify abnormal patterns, thereby improving the robustness and accuracy of the anomaly detection system and realizing accurate measurement of the degree to which traffic samples deviate from the normal distribution. 3. This invention constructs network traffic data into an undirected graph structure. By modeling the graph structure, it preserves the topological information and inter-node dependencies in the network traffic, effectively overcoming the limitations of traditional methods that treat traffic records as independent samples. It can uncover hidden abnormal behaviors from the global topological relationships of network communication and has a stronger ability to identify network threats that rely on abnormal inter-node associations, such as botnets and C&C communication. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the method steps of the present invention.

[0020] Figure 2 This is a schematic diagram of the method flow of the present invention.

[0021] Figure 3 This is a schematic diagram of the EPS-DDGI framework of the present invention.

[0022] Figure 4 This is a schematic diagram of the system structure of the present invention.

[0023] Figure labeling: Flow graph construction module 10, graph convolutional coding module 20, diffusion enhancement module 30, scoring network module 40, contrastive learning module 50, anomaly detection module 60, joint training module 70, MMD distance calculation module 80. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0025] Example 1

[0026] In this embodiment, as Figures 1-3 As shown, this invention proposes a network traffic detection method based on diffusion model and graph contrastive learning, specifically including the following steps: Step S1: Collect network traffic data and construct an undirected graph from the network traffic data. Step S2: Use a graph convolutional encoder to extract features from the undirected graph, update the node representation by aggregating neighbor node information, and obtain the node embedding vector; Step S3: Apply a forward diffusion process to the node embedding vector, and gradually add Gaussian noise through stochastic differential equations to generate perturbation embeddings at different noise levels; Step S4: Based on the perturbation embedding under different noise levels, train the scoring network, optimize the scoring network parameters through scoring matching loss, and capture the distribution pattern of normal traffic embedding in the diffusion process. Step S5: Using perturbation embeddings under different noise levels as input, graph contrastive learning is performed using the depth graph information maximization method. By maximizing the mutual information between the local node representation and the graph-level global representation, the parameters of the graph convolutional encoder and discriminator are jointly optimized. The perturbation embeddings are aggregated through the readout function to generate the graph-level global representation, and negative sample pairs are constructed. The discriminator is used to distinguish between the real graph-embedded pairs and the negative sample pairs. The contrastive learning loss is calculated and backpropagation is performed, thereby enhancing the stability and discriminative representation ability of the node embedding vector under diffuse noise perturbation. Step S6: Based on the trained scoring network that fuses time features and perturbation embeddings through a multilayer perceptron, sampling points are selected at multiple time steps in the diffusion process using Monte Carlo sampling. The perturbation embeddings corresponding to each sampling point are input into the scoring network to output a multidimensional gradient vector. The L2 norm of each multidimensional gradient vector is calculated, and the average of the L2 norms of multiple sampling points is taken as the expected norm to obtain the expected perturbation score of the embedding vector of each node. The degree to which the traffic sample corresponding to the node deviates from the normal traffic distribution is quantified based on the expected perturbation score, thereby determining the abnormal probability of the traffic sample.

[0027] In this embodiment, the undirected graph in step S1 is represented as follows: ,in, Represents a set of nodes, which in turn represent network entities. The edge set represents the communication relationships between network entities, with each node associated with one edge. 3D feature vector; The construction process of an undirected graph specifically includes: Treat the source IP address and destination IP address as nodes in an undirected graph; The communication relationship between IP addresses is used as an edge; if there is data packet transmission between two IP addresses, an edge connection is established. Extract the traffic features of each node and use them as the node feature vector. The traffic features include: Mean, standard deviation, maximum, and minimum data packet sizes; Distribution of TCP, UDP and ICMP transport layer protocols based on frequency statistics or one-hot coding; Frequency distribution of commonly used ports and high-order random ports; In addition to the duration of traffic, the number of connection requests per unit time, and the data packet arrival interval; Specifically, this invention collects raw network traffic data from network devices, including packet header information, transmission protocol, source / destination IP address, source / destination port number, packet size, timestamp, etc., and then treats each unique IP address as a node in an undirected graph, forming a node set. It includes all IP addresses participating in network communication. If data packets are transmitted between two IP addresses, an edge connection is established between the corresponding nodes, and the edge set is created. Represent all communication relationships, and then extract for each node. A dimensional feature vector contains traffic features including statistical characteristics of packet size (mean, standard deviation, maximum, minimum), distribution of transport protocol types (TCP, UDP, ICMP, etc.), port number usage distribution, traffic duration, connection frequency, etc., and the node feature matrix is ​​represented as follows. ,in, This represents the total number of nodes.

[0028] like Figure 2 and Figure 3 As shown, the graph convolutional encoder in step S2 employs a multi-layer graph convolutional network, and the calculation formula for each layer of the graph convolutional network is expressed as follows: ; in, For the first The node feature matrix of the layer It is a non-linear activation function. This is the original adjacency matrix. To add a self-loop adjacency matrix, This is the corresponding degree matrix. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer; The final output of the multi-layer graph convolutional network is a node embedding matrix. The node embedding matrix integrates the topological structure information and node feature information of the network traffic. This node embedding matrix is ​​used as the initial embedding in the continuous time state and is directly input into the stochastic differential equation in step S3 for positive diffusion perturbation. Specifically, the present invention constructs an adjacency matrix of a graph. Adding self-loops yields the result; the corresponding degree matrix is ​​then calculated. The graph convolutional encoder employs a multi-layer graph convolutional network, where each layer updates the node representation by aggregating neighbor node information. The formula for calculating the layer is: ,in, The non-linear activation function, such as ReLU or PReLU, is used. After passing through multiple layers of graph convolution, the output is a node embedding matrix, where... For the embedding dimension, the embedding vector of each node. The structural and feature information of the node is encoded.

[0029] like Figure 2 and Figure 3 As shown, the forward diffusion process in step S3 is described by a stochastic differential equation, which is expressed as: ; in, Represented as over time Changing node feature vectors Represented as a continuous-time variable and satisfying , Represented as a time-dependent noise scheduling function, Represented as standard Brownian motion, the noise scheduling function is in linear form and is expressed as: ,in, and These represent the minimum and maximum noise intensities, respectively. This represents the total number of time steps in the diffusion process. Based on the analytical properties of stochastic differential equations, the forward diffusion process achieves the embedding of vectors from the initial node. to any time noise embedding The analytical sampling is calculated using the following formula: ; in, Standard Gaussian noise, The signal preservation coefficient, The noise figure, signal preservation coefficient, and noise figure are obtained by integrating the noise scheduling function, and are expressed as follows: and An adaptive noise strategy is implemented through a linear noise scheduling function. In the early stage of forward diffusion, the noise intensity is kept small to preserve the original network traffic semantic information of the node embedding. In the later stage of forward diffusion, the noise intensity is gradually increased to force the model to learn a more robust normal traffic distribution manifold. Specifically, this invention introduces a continuous-time forward diffusion process to embed clean nodes. Gradually transforming into a noisy version, the diffusion process is described by stochastic differential equations (SDEs): By solving the above stochastic differential equation (SDE), in time... Moment-time noise embedding From initial embedding Direct sampling: ,in, Standard Gaussian noise, and These are the signal preservation coefficient and the noise coefficient, respectively. The noise intensity is then adaptively adjusted based on the number of steps. Smaller noise is used in the early stages of training to preserve the embedded semantic information, while noise is gradually increased in the later stages to enhance the robustness of the model.

[0030] like Figure 2 and Figure 3 As shown, the scoring function is defined as: scoring network. Used to estimate the gradient of the log probability density function: ,in, For parameters The log probability density gradient vector predicted by the parameterized scoring network, These are the learnable parameters in the scoring network. Embedding for nodes At any time Noise embedding, For continuous time variables in the forward diffusion process, Indicates noise embedding Gradient operator for partial derivatives express At any moment The probability density function, this process provides a massive amount of training samples for the scoring network, the scoring network in step S4 specifically includes: The time embedding layer encodes continuous time variables through positional encoding. The embedded network first encodes time features of different frequencies using sine and cosine functions, and then performs nonlinear mapping through a two-layer perceptron. The calculation formula is expressed as follows: ; in, For time-embedded feature vectors, and The learnable weight matrix in the fully connected layer. and For the corresponding bias term, This is the scaling factor. It is a non-linear activation function; Feature fusion layer, The noise embedding generated at time With the time-embedded feature vector The data is concatenated, and feature interaction and forward propagation are performed through a multilayer perceptron. The output is the predicted log probability density gradient vector, represented as: ; in, The log probability density gradient vector predicted by the scoring network, and the noise embedding The dimensions are consistent. This represents the backbone network of a multilayer perceptron. Indicates a splicing operation; The rating matching loss layer utilizes the analytical properties of the forward diffusion process to construct a rating matching loss function based on the mean squared error between the actual and predicted ratings to optimize the rating network parameters. The functional expression of the actual rating has an analytical form, represented as follows: , Indicates noise embedding Gradient operator for partial derivatives express At any moment The probability density function, and the rating matching loss function are expressed as: ; in, For rating matching loss, This represents the mathematical expectation operation. To conform to a uniform distribution The continuous time steps of sampling For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint. Standard Gaussian noise added during the diffusion process. For continuous time variables The corresponding noise coefficient is optimized by minimizing the mean square error between the predicted score and the actual score, enabling the scoring network to accurately learn the gradient change pattern of normal traffic embedding in the diffusion process.

[0031] like Figure 2 and Figure 3 As shown, the method for maximizing depth map information in step S5 specifically includes: using a readout function... By aggregating all node embeddings, a graph-level representation can be obtained. ,in, This represents the graph-level global feature vector obtained after aggregation. Represents the embedding matrix of all nodes The function to read the input. The sigmoid function is used to map output features to a non-linear space. This represents the total number of nodes in an undirected graph. Indicates the first Local embedding vectors of each node, This represents the average pooling operation performed on the local embedding vectors of all nodes in the graph. By shuffling the order of the nodes in the original graph, a negative sample graph is generated. The corresponding negative sample embedding is represented as... Design a binary discriminant To distinguish between real image-embedded pairs and negative sample pairs, the discriminator employs a bilinear transformation: ,in, This represents the probability score of the discriminator for the input node and the global feature pair. The sigmoid function maps the calculation result to a probability range of 0 to 1. Indicates the first Local embedding vectors of each node, This represents the transpose matrix of the local embedding vector. The learnable weight matrix in the bilinear layer. This represents the graph-level global feature column vector obtained by aggregation through the readout function. The contrastive learning objective is to maximize the score of the true pairs while minimizing the score of the negative sample pairs. The contrastive learning objective function is expressed as: ; in, To compare the learning objective function, Let be the total number of nodes in the undirected graph. For the discriminator function, Indicates the first Local embedding representation of each node, This indicates that the function is read out. The aggregated graph-level global representation This is a representation of a negative sample obtained by shuffling the node order.

[0032] like Figure 2 and Figure 3 As shown, in step S6, the expected perturbation score is used to quantify the geometric properties and stability of the node embedding during the diffusion process. For a given node embedding... The formula for calculating the expected perturbation fraction is expressed as: ; in, Embedding for nodes The expected perturbation score, It is the L2 norm. For parameters The log probability density gradient vector predicted by the parameterized scoring network, These are the learnable parameters in the scoring network. Embedding for nodes At any time Noise embedding, Indicates time In the interval Uniform random sampling within the area; An approximation using Monte Carlo sampling is expressed as: ; in, For the number of samples, To obtain from a uniform distribution The randomly selected representative of the time corresponding to the disturbance is the first one. Each time step For the corresponding time step The noise embedding generated below, For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint; Specifically, the abnormal flow determination in step S6 includes: considering that high-quality normal embeddings should exhibit a consistent and stable scoring pattern during the diffusion process, the scoring pattern is specifically represented by the L2 norm (i.e., gradient magnitude) of the output vector of the scoring network, therefore, this invention sets up normal flow determination (lower EPS) and abnormal flow determination (higher EPS). Normal flow determination is expressed as: for flow embeddings that follow a normal distribution, the scoring network can accurately estimate the gradient that it recovers to the high-density region, and its EPS value is a low-amplitude stable value. For example, in the experimental environment, the EPS value of normal samples usually converges to the lower bound of the loss during the training phase (e.g., converges to the range of 0.5 to 0.6 in the normalized feature space), which means that the sample is located in the neighborhood of the normal data manifold. Abnormal flow determination is expressed as: for abnormal embeddings that deviate from the normal distribution, the scoring network will output a large gradient magnitude in an attempt to map them back to the normal manifold, resulting in an increase in EPS value.

[0033] like Figure 2 and Figure 3 As shown, step S6 also includes the calculation of the maximum mean difference distance based on the expected perturbation score: given two sets of node embeddings and their corresponding sets of expected perturbation scores, the maximum mean difference (MMD) is used to measure the distribution difference between them, and the MMD distance is calculated using the Gaussian radial basis kernel function to quantify the quality difference between different categories of embeddings. Specifically, to further quantify the distributional differences in quality among different node embedding sets, this invention uses the Maximum Mean Difference (MMD) based on the Expected Perturbation Score (EPS) as a metric. MMD is used to evaluate the distributional differences among different categories of embeddings. and Let represent the EPS value distributions corresponding to two different sets of node embeddings (e.g., normal traffic embedding set and traffic embedding set to be detected), respectively. The formula for calculating the square of the MMD distance is: ; in, Indicates that it follows a distribution And follow the distribution The square of the maximum mean difference between them and Let represent the probability distributions of the expected perturbation scores (EPS) for two different sets of node embeddings (e.g., the normal traffic embedding set and the traffic embedding set to be detected). and Indicates that it follows a distribution Two independent and identically distributed random variables (i.e., EPS values ​​from the first group of samples). and Indicates that it follows a distribution Two independent and identically distributed random variables (i.e., EPS values ​​from the second group of samples). The mathematical expectation operation is represented by the subscript as follows: Indicates that the pair follows a distribution Find the expectation of the variables. Indicates that the pair follows a distribution Find the expectation of the variables. Represented as following a distribution Medium sampling From the distribution Medium sampling Seeking expectations, The kernel function is represented by the Gaussian radial basis function, which is calculated using the following formula: ; in, For variables and The kernel function is represented as follows: This represents an exponential function with base e. Representing variables and The square of the Euclidean distance between them This represents the bandwidth parameter of the kernel function, which is used to control the kernel function's sensitivity to distance.

[0034] Specifically, such as Figure 3 As shown, this invention also provides a detailed schematic diagram of the EPS-DDGI framework, where EPS represents the desired perturbation score and DDGI represents the diffusion-enhanced maximization of depth map information. This diagram breaks down the five-layer implementation logic of the EPS-DDGI framework, with specific functions including: Stage 1 is the input layer, which takes the node feature matrix X and the edge matrix A as inputs, and simultaneously generates X with shuffled node features. - Shuf serves as the negative sample, providing the data foundation for contrastive learning. Stage 2 is the GCN convolutional layer, which extracts features from both positive and negative samples using two 512-dimensional graph convolutional networks, outputting positive sample embeddings H1 and negative sample embeddings H2. Stage 3 is the diffusion layer, which applies a 20-step Gaussian noise forward diffusion process to the positive and negative sample embeddings, generating perturbation embeddings with different noise levels to provide noisy samples for the scoring network training. Stage 4 is the readout function and discriminator, which generates graph-level global features through an average pooling readout function. A discriminator D is designed to distinguish between real graph-embedded pairs and negative sample pairs. BCELoss (binary cross-entropy loss) is used to optimize the discriminator, achieving contrastive learning that maximizes the information of the depth graph. Stage 5 is the output layer, which finally outputs positive samples (abnormal traffic) containing botnet activity and negative samples (normal traffic) without botnet behavior, completing the identification and classification of abnormal samples.

[0035] Specifically, the diffusion model of this invention processes the node embedding vector output by the graph convolutional encoder. This node embedding vector has fused the topological structure information and node feature information of the network traffic. It is then subjected to diffusion perturbation, which not only preserves the core features of the traffic, but also models the potential distribution of normal traffic through noise. Then, the forward diffusion process of the diffusion model is strictly defined by stochastic differential equations (SDE). By solving the stochastic differential equations of forward diffusion, analytical sampling from the initial clean embedding to the noisy embedding at any time is achieved. An adaptive noise scheduling strategy is added to the forward diffusion process. In the early stage of training, a small noise intensity is used to maintain the semantic information of the node embedding. In the later stage of training, the noise intensity is gradually increased to force the model to learn more robust normal traffic distribution features, avoid the model overfitting to low-noise samples, and improve the adaptability to complex traffic scenarios. The diffusion model is finally applied to the calculation of the desired perturbation score.

[0036] Based on the above network traffic detection method and framework, this invention also provides a supporting network traffic detection system. This system models network traffic as a graph structure, combines the generation capability of diffusion models, the structural modeling capability of graph neural networks, and the representation learning capability of contrastive learning, and proposes the expected perturbation score as a quantitative indicator of the degree of anomaly, which effectively improves the accuracy and robustness of network abnormal traffic detection. Specific embodiments are as follows.

[0037] Example 2

[0038] The difference from Example 1 is that, as in Example 1, Figure 4 As shown, the present invention also provides a network traffic detection system based on diffusion model and graph contrastive learning, used to execute the network traffic detection method based on diffusion model and graph contrastive learning as shown in Example 1. The network traffic detection system includes: The traffic graph construction module 10 is used to collect network traffic data and construct an undirected graph of network traffic. Network entities are represented as nodes, and communication relationships between network entities are represented as edges. This module is responsible for collecting network traffic data, mapping source / destination IP addresses to graph nodes, mapping communication relationships to graph edges, extracting node feature vectors, and outputting a complete network traffic graph structure. Specific examples of node feature vectors include, but are not limited to, the following statistical and behavioral features: Packet size statistics: including the mean, standard deviation, maximum and minimum packet sizes in all communications in which the node participates. These features are used to capture common abnormal packet size distributions in anomalous traffic (such as DDoS attacks or data theft). Transport protocol type distribution: The distribution of transport layer protocols used by the node in communication is represented by one-hot coding or frequency statistics, specifically including the proportion or count value of protocols such as TCP, UDP, and ICMP, which helps to identify the abuse of specific protocols (such as ICMP flooding). Port number usage distribution: Statistics on the number of port numbers involved when the node is used as a source or destination, the usage frequency of commonly used ports (such as 80, 443), and the usage of high-order random ports; Time and frequency characteristics: These include statistics on traffic duration, connection frequency (i.e., the number of connection requests per unit time), and packet arrival interval. These characteristics can effectively distinguish between normal human operation patterns and automated machine attack patterns. Graph convolutional coding module 20 is used to extract features from an undirected graph using a graph convolutional network and output node embedding vectors. This module contains multiple graph convolutional layers, which aggregate neighbor node information through a message passing mechanism, update node representations, and output high-quality node embedding vectors. The diffusion enhancement module 30 is used to apply a forward diffusion process to the node embedding vectors. It enhances the modeling ability of the normal distribution through controllable noise perturbation. This module implements the forward diffusion process and enhances the modeling ability of the normal flow distribution through controllable Gaussian noise perturbation. It generates perturbation embeddings with different noise levels for use in training the scoring network. Normal flow is defined as samples that conform to the high-dimensional distribution manifold learned by the model and occupy a dominant proportion in the training dataset (usually set to above 95%). Abnormal flow is defined as outlier samples that are statistically significantly deviated from the distribution. In terms of quantification, the expected perturbation score of normal flow usually converges to a low stable range (e.g., 0.5 to 0.6), while the EPS value of abnormal flow exceeds a preset statistical threshold (e.g., greater than 3 times the standard deviation u+3σ of the mean of normal samples, where u is the mean and σ is the standard deviation). The scoring network module 40 is used to estimate gradient information during the diffusion process and learn the distribution characteristics of normal traffic embedding. This module includes a temporal embedding layer, a feature fusion layer, and a scoring matching loss layer. It learns to estimate the log probability density gradient during the diffusion process and captures the distribution characteristics of normal traffic embedding. The contrastive learning module 50 is used for self-supervised representation learning using the Depth Graph Information Maximization (DGI) method. This module performs self-supervised representation learning by maximizing the mutual information between node representations and graph-level representations through a discriminator. The anomaly detection module 60 is used to calculate the expected perturbation score and use it as a quantitative indicator of the degree of anomaly. Based on the expected perturbation score, the module determines the probability of anomalies in network traffic samples. This module calculates the expected perturbation score (EPS value) embedded in each node based on the trained scoring network. Based on the EPS value, the module determines the degree and probability of anomalies in traffic samples. The specific determination criteria are as follows: the EPS value is converted into anomaly probability in the range of 0 to 1 using a statistical mapping function. The larger the EPS value, the farther it deviates from the Euclidean distance of the normal data manifold, and the higher the probability of it being judged as an anomaly. At the same time, the anomaly level is divided according to the statistical threshold of the EPS distribution of normal samples. EPS values ​​that exceed 3 times, 5 times, and 10 times the standard deviation of the mean are respectively judged as low, medium, and high risk levels, thereby realizing quantitative classification based on data distribution characteristics. The joint training module 70 is used to alternately optimize the graph convolutional encoder, the scoring network, and the discriminator. Specifically, it first updates the parameters of the graph convolutional encoder and the discriminator synchronously based on the contrastive learning objective function, and then updates the parameters of the scoring network based on the scoring matching loss function. By coordinating multiple learning objectives through the joint loss function, this module coordinates the joint training of the graph convolutional encoder, the scoring network, and the discriminator. It balances the contrastive learning objective and the representation stability objective through the alternating optimization strategy, thereby achieving end-to-end model optimization. The MMD distance calculation module 80 is used to calculate the maximum mean difference distance based on the expected perturbation score, quantifying the distribution difference between normal and abnormal samples.

[0039] To further demonstrate the engineering value of the methods and systems in this invention, experimental comparison data of multiple methods are provided, as shown in Tables 1 and 2 below. Table 1 - Schematic diagram of dataset attributes in the embodiment

[0040] Table 2 - Comparison of Experimental Results between the Method of the Present Invention and Existing Conventional Methods

[0041] Table 1 is a schematic table of the dataset in the embodiment of the present invention. In this embodiment, the CTU-13 dataset is selected for verification. CTU-13 is a classic dataset in the field of network anomaly detection. It mainly shows the traffic data distribution of 13 experimental scenarios. Scenario 1 contains about 2.82 million traffic records. Normal background traffic accounts for as high as 97.47%, while botnet and C&C traffic only account for about 1.44%. This significant data imbalance (the ratio of normal samples to abnormal samples is about 68:1) verifies the rationality and necessity of the technical route of the present invention, which combines diffusion model and small sample to model the distribution of large-scale normal traffic and then identify outlier abnormal traffic. Table 2 compares the experimental results of the method of this invention with existing conventional methods. On the Cora and CTU-13 datasets, the detection accuracy of the EPS-DDGI method of this invention is compared with that of various mainstream methods such as Raw features, LP, DeepWalk, DGI, and GCN. The results show that the present invention achieves a detection accuracy of 80.7% under unsupervised conditions using only node features (X) and the adjacency matrix (A), far exceeding existing conventional methods that only utilize features (42.3%). Furthermore, without requiring labeled data (Y), it surpasses supervised graph convolutional networks (GCN, 75.9%) that rely on fully labeled data. This demonstrates that the present invention can reduce the dependence on expensive labeled data while achieving higher accuracy. Furthermore, the method of this invention (EPS-DDGI) achieves a detection accuracy of 80.7% ± 0.4% on the CTU-13 dataset. Compared with the existing Depth Graph Information Maximization (DGI) method (76.8%) and Supervised Graph Convolutional Network (GCN) method (75.9%), the accuracy is improved by 3.9% and 4.8%, respectively. The data shows that the present invention has significant technical progress in reducing false alarm rate and improving detection accuracy, proving that the method has better detection accuracy and robustness when dealing with complex and unbalanced network traffic data.

[0042] In summary, this invention first constructs network traffic data into a graph structure, where network entities are nodes and communication relationships are edges. Then, it extracts node feature representations through a graph convolutional encoder. Next, it introduces a diffusion model to controllably perturb normal traffic embeddings by gradually adding Gaussian noise through a forward diffusion process. Simultaneously, it trains a scoring network to learn gradient information during the diffusion process and uses depth graph information maximization for contrastive learning to enhance representation quality. Finally, it calculates the expected perturbation score as a quantitative indicator of the degree of anomaly; a higher EPS value indicates a more significant deviation of the sample from the normal distribution. The above steps effectively integrate the generative capability of the diffusion model, the structural modeling capability of the graph neural network, and the representation learning capability of contrastive learning, improving the accuracy and robustness of network anomaly traffic detection and possessing strong practical value.

[0043] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network traffic detection method based on diffusion model and graph contrastive learning, characterized in that, Specifically, the following steps are included: Step S1: Collect network traffic data and construct an undirected graph from the network traffic data. Step S2: Use a graph convolutional encoder to extract features from the undirected graph, update the node representation by aggregating neighbor node information, and obtain the node embedding vector; Step S3: Apply a forward diffusion process to the node embedding vector, and gradually add Gaussian noise through stochastic differential equations to generate perturbation embeddings at different noise levels. Step S4: Based on the perturbation embedding under different noise levels, train the scoring network, optimize the scoring network parameters through scoring matching loss, and capture the distribution pattern of normal traffic embedding in the diffusion process. Step S5: Using perturbation embeddings under different noise levels as input, graph contrastive learning is performed using the depth graph information maximization method. By maximizing the mutual information between the local node representation and the graph-level global representation, the parameters of the graph convolutional encoder and discriminator are jointly optimized. The perturbation embeddings are aggregated through the readout function to generate the graph-level global representation, and negative sample pairs are constructed. The discriminator is used to distinguish between the real graph-embedded pairs and the negative sample pairs. The contrastive learning loss is calculated and backpropagation is performed, thereby enhancing the stability and discriminative representation ability of the node embedding vector under diffuse noise perturbation. Step S6: Based on the trained scoring network that fuses time features and perturbation embeddings through a multilayer perceptron, sampling points are selected at multiple time steps in the diffusion process using Monte Carlo sampling. The perturbation embeddings corresponding to each sampling point are input into the scoring network to output multidimensional gradient vectors. The L2 norm of each multidimensional gradient vector is calculated, and the average of the L2 norms of multiple sampling points is taken as the expected norm to obtain the expected perturbation score of the embedding vector of each node. The degree to which the traffic sample corresponding to the node deviates from the normal traffic distribution is quantified based on the expected perturbation score, thereby determining the abnormal probability of the traffic sample.

2. The network traffic detection method based on diffusion model and graph contrastive learning according to claim 1, characterized in that, The undirected graph in step S1 is represented as follows: ,in, Represents a set of nodes, which are network entities. The edge set represents the communication relationships between network entities, with each node associated with one edge. 3D feature vector; The construction process of the undirected graph specifically includes: Treat the source IP address and destination IP address as nodes in an undirected graph; The communication relationship between IP addresses is used as an edge; if there is data packet transmission between two IP addresses, an edge connection is established. Extract the traffic features of each node and use them as a node feature vector. The traffic features include: Mean, standard deviation, maximum, and minimum data packet sizes; Distribution of TCP, UDP and ICMP transport layer protocols based on frequency statistics or one-hot coding; Frequency distribution of commonly used ports and high-order random ports; In addition, the duration of traffic, the number of connection requests per unit time, and the data packet arrival interval.

3. The network traffic detection method based on diffusion model and graph contrast learning according to claim 1, characterized in that, The graph convolutional encoder in step S2 employs a multi-layer graph convolutional network, and the calculation formula for each layer of the graph convolutional network is expressed as follows: ； in, For the first The node feature matrix of the layer It is a non-linear activation function. This is the original adjacency matrix. To add a self-loop adjacency matrix, This is the corresponding degree matrix. For the first The node feature matrix of the layer For the first The learnable weight matrix of the layer; The final output of the multi-layer graph convolutional network is a node embedding matrix. The node embedding matrix integrates the topological structure information of the network traffic and the node feature information. The node embedding matrix is ​​used as the initial embedding in the continuous time state and is directly input into the stochastic differential equation in step S3 for positive diffusion perturbation.

4. The network traffic detection method based on diffusion model and graph contrast learning according to claim 1, characterized in that, The forward diffusion process in step S3 is described by a stochastic differential equation, which is expressed as: ； in, Represented as over time Changing node feature vectors Represented as a continuous-time variable and satisfying , Represented as a time-dependent noise scheduling function, Represented as standard Brownian motion, the noise scheduling function is in linear form and is expressed as: ,in, and These represent the minimum and maximum noise intensities, respectively. This represents the total number of time steps in the diffusion process. Based on the analytical properties of the stochastic differential equation, the forward diffusion process realizes the embedding vector from the initial node. to any time noise embedding The analytical sampling is calculated using the following formula: ； in, Standard Gaussian noise, The signal preservation coefficient, The noise figure, the signal preservation coefficient, and the noise figure are obtained by integrating the noise scheduling function, and are expressed as follows: and An adaptive noise strategy is implemented through the linear form of the noise scheduling function. In the early stage of forward diffusion, the noise intensity is kept small to preserve the original network traffic semantic information of the node embedding. In the later stage of forward diffusion, the noise intensity is gradually increased to force the model to learn a more robust normal traffic distribution manifold.

5. The network traffic detection method based on diffusion model and graph contrast learning according to claim 4, characterized in that, The scoring network in step S4 specifically includes: The time embedding layer encodes continuous time variables through positional encoding. The embedded network first encodes time features of different frequencies using sine and cosine functions, and then performs nonlinear mapping through a two-layer perceptron. The calculation formula is expressed as follows: ; in, For time-embedded feature vectors, and The learnable weight matrix in the fully connected layer. and For the corresponding bias term, This is the scaling factor. It is a non-linear activation function; Feature fusion layer, The noise embedding generated at time With the time-embedded feature vector The data is concatenated, and feature interaction and forward propagation are performed through a multilayer perceptron. The output is the predicted log probability density gradient vector, represented as: ; in, The log probability density gradient vector predicted by the scoring network, and the noise embedding The dimensions are consistent. This represents the backbone network of a multilayer perceptron. Indicates a splicing operation; The rating matching loss layer utilizes the analytical properties of the forward diffusion process to construct a rating matching loss function based on the mean squared error between the actual and predicted ratings to optimize the rating network parameters. The functional expression of the actual rating has an analytical form, represented as follows: , Indicates noise embedding Gradient operator for partial derivatives express At any moment The probability density function, and the rating matching loss function are expressed as: ； in, For rating matching loss, This represents the mathematical expectation operation. To conform to a uniform distribution The continuous time steps of sampling For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint. Standard Gaussian noise added during the diffusion process. For continuous time variables The corresponding noise figure.

6. The network traffic detection method based on diffusion model and graph contrast learning according to claim 5, characterized in that, The contrastive learning objective function of the depth map information maximization method in step S5 is expressed as: ； in, To compare the learning objective function, Let be the total number of nodes in the undirected graph. For the discriminator function, Indicates the first Local embedding representation of each node, This indicates that the function is read out. The aggregated graph-level global representation This is a representation of a negative sample obtained by shuffling the node order.

7. The network traffic detection method based on diffusion model and graph contrast learning according to claim 1, characterized in that, The formula for calculating the expected perturbation fraction in step S6 is expressed as follows: ； in, Embedding for nodes The expected perturbation score, It is the L2 norm. For parameters The log probability density gradient vector predicted by the parameterized scoring network, These are the learnable parameters in the scoring network. Embedding for nodes At any time Noise embedding, Indicates time In the interval Uniform random sampling within the area; An approximation using Monte Carlo sampling is expressed as: ； in, For the number of samples, To obtain from a uniform distribution The randomly selected representative of the time corresponding to the disturbance is the first one. Each time step For the corresponding time step The noise embedding generated below, For continuous time steps of random sampling, This represents a continuous uniform distribution function, indicating that in Throughout the entire integration interval, the probability of any time step being sampled is equal. This represents the maximum number of time steps set for the forward diffusion process, i.e., the time boundary of the diffusion endpoint.

8. The network traffic detection method based on diffusion model and graph contrast learning according to claim 1, characterized in that, Step S6 further includes calculating the maximum mean difference distance based on the expected perturbation score: given two sets of node embeddings and their corresponding sets of expected perturbation scores, the maximum mean difference (MMD) is used to measure the distribution difference between them, and the MMD distance is calculated using the Gaussian radial basis kernel function to quantify the quality difference between different categories of embeddings.

9. A network traffic detection system based on diffusion model and graph contrastive learning, used to execute the network traffic detection method based on diffusion model and graph contrastive learning according to any one of claims 1-8, characterized in that, The network traffic detection system includes: The traffic graph construction module (10) is used to collect network traffic data and construct an undirected graph of network traffic, representing network entities as nodes and the communication relationships between network entities as edges; The graph convolutional coding module (20) is used to extract features from an undirected graph using a graph convolutional network and output node embedding vectors. The diffusion enhancement module (30) is used to apply a forward diffusion process to the node embedding vector, thereby enhancing the normal distribution modeling capability through controllable noise perturbation. The scoring network module (40) is used to estimate gradient information during the diffusion process and learn the distribution characteristics of normal traffic embedding; The contrastive learning module (50) is used for self-supervised representation learning using the depth map information maximization method; An anomaly detection module (60) is used to calculate the expected disturbance score and use it as a quantitative indicator of the degree of anomaly. Based on the expected disturbance score, the probability of an anomaly in the network traffic sample is determined.

10. The network traffic detection system based on diffusion model and graph contrastive learning according to claim 9, characterized in that, Also includes: The joint training module (70) is used to alternately optimize the graph convolutional encoder, the scoring network and the discriminator. Specifically, the parameters of the graph convolutional encoder and the discriminator are updated synchronously based on the contrastive learning objective function, and the parameters of the scoring network are updated based on the scoring matching loss function. Multiple learning objectives are coordinated through the joint loss function. The MMD distance calculation module (80) is used to calculate the maximum mean difference distance based on the expected perturbation score, quantifying the distribution difference between normal and abnormal samples.

Images