A knowledge graph-based network traffic anomaly detection method, device and medium

Abstract

The application discloses a network traffic anomaly detection method and device based on a knowledge graph, and a medium, and relates to the technical field of network security, and comprises the following steps: calling a normal communication template layer in a network traffic knowledge graph, offsetting and resolving a current detection traffic communication relationship proportion sequence, retaining a communication relationship which is not resolved, generating a current detection traffic residual error deformation subgraph, and calculating a current detection traffic average residual error intensity; according to an attack semantic layer in the network traffic knowledge graph, performing semantic closed loop judgment on the current detection traffic residual error deformation subgraph, combining the current detection traffic average residual error intensity to calculate a current detection traffic anomaly judgment value, statistically analyzing historical normal traffic anomaly judgment values, obtaining an anomaly judgment threshold, and completing anomaly judgment. The application organizes communication relationship rules in the normal communication template layer and the attack semantic layer by constructing the network traffic knowledge graph, and realizes unified semantic expression of the communication relationship and historical behavior correlation representation.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, device and medium for detecting network traffic anomalies based on knowledge graphs. Background Technology

[0002] In the field of network security technology, network traffic anomaly detection typically revolves around traffic behavior modeling, communication relationship organization, and anomaly identification. Conventional methods often extract traffic features, construct knowledge graphs or relationship graph structures, and combine similarity calculations, relationship reasoning, or graph retrieval to identify abnormal connections, abnormal access, and abnormal interaction patterns. As network services continue to become more complex, knowledge graphs, due to their ability to express relationships, organize semantics, and establish structural associations, have gradually become an important technical approach for network traffic anomaly detection.

[0003] However, existing methods still have two limitations: First, conventional discrimination focuses on the direct matching or local correlation between current traffic and historical traffic, and lacks a continuous interpretation of communication relationship offsets that combine the normal distribution center and fluctuation range, making it difficult to distinguish between resolvable offsets and offsets that should be retained; Second, existing graph discrimination mostly stays at the level of relationship co-occurrence or path association, and pays insufficient attention to whether multiple types of residual communication relationships form a closed support structure, and there is still room for improvement in the stability of judgment under complex and abnormal scenarios. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a network traffic anomaly detection method based on knowledge graphs, which solves the problems of lack of continuous interpretation of communication relationship offsets and insufficient discrimination of closed support for multiple types of residual communication relationships.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a network traffic anomaly detection method based on a knowledge graph, comprising: collecting current detected traffic, historical normal traffic, and historical confirmed anomaly traffic; performing session segmentation and protocol phase identification on the network traffic; statistically analyzing and calculating the proportions of the identified communication relationships to obtain a communication relationship proportion sequence for current detected traffic, a communication relationship proportion sequence for historical normal traffic, and a communication relationship proportion sequence for historical confirmed anomaly traffic; constructing a network traffic knowledge graph based on the communication relationship proportion sequences for historical normal traffic and historical confirmed anomaly traffic; and statistically analyzing the distribution of historical normal traffic communication relationships to form a normal communication model. The system employs a layered approach: First, it statistically analyzes the co-occurrence of confirmed abnormal traffic communication relationships in the past to form an attack semantic layer. Then, it calls upon the normal communication template layer from the network traffic knowledge graph to offset and resolve the current detected traffic communication relationship proportion sequence, retaining unresolved relationships to generate a residual deformation subgraph of the current detected traffic and calculating the average residual intensity. Based on the attack semantic layer in the network traffic knowledge graph, it performs semantic loop closure judgment on the residual deformation subgraph of the current detected traffic, calculates the current detected traffic anomaly judgment value by combining it with the average residual intensity, and statistically analyzes the anomaly judgment values ​​of historical normal traffic to obtain the anomaly judgment threshold, thus completing the anomaly judgment process.

[0007] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the method for segmenting network traffic into sessions includes: collecting current detected traffic, historical normal traffic, and historical confirmed abnormal traffic; extracting packet arrival time, source address, destination address, source port, destination port, and protocol type; and using a batch of packet records formed by each continuous collection as a statistical window to form current detected traffic packet records, historical normal traffic packet records, and historical confirmed abnormal traffic packet records, respectively; and performing session segmentation based on the current detected traffic packet records, historical normal traffic packet records, and historical confirmed abnormal traffic packet records. The process involves dividing the data into three parts: source address, destination address, source port, destination port, and protocol type, which are then used as a communication quintuple. Message records with the same communication quintuple are arranged in order of arrival time. The time difference between adjacent message records is calculated to form a message interval sequence. The sum of the median of the message interval sequence and the interquartile range of the message interval sequence is taken as the continuous communication interval. Based on whether the time difference between adjacent message records is not greater than the continuous communication interval, message records with unchanged communication quintuples and continuous time are grouped into the same communication session, forming the current detected traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set, respectively.

[0008] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the protocol phase identification, which involves statistically analyzing and calculating the proportion of identified communication relationships, includes: based on the current detection traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set, performing protocol phase identification according to the order of occurrence of messages within each communication session, and writing the communication quintuple, protocol phase identifier, phase start time, and phase end time into the current detection traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set; classifying records with the same communication quintuple and the same protocol phase identifier into the same type of communication relationship, and classifying records with different communication quintuples or different protocol phase identifiers into different types of communication relationships, and counting the number of occurrences of each type of communication relationship in each statistical window; and comparing the number of occurrences of each type of communication relationship with the sum of the number of occurrences of all communication relationships in the same statistical window to form the current detection traffic communication relationship proportion sequence, the historical normal traffic communication relationship proportion sequence, and the historical confirmed abnormal traffic communication relationship proportion sequence.

[0009] As a preferred embodiment of the network traffic anomaly detection method based on knowledge graphs described in this invention, the construction of the network traffic knowledge graph based on the historical normal traffic communication relationship percentage sequence and the historical confirmed abnormal traffic communication relationship percentage sequence includes: summarizing the percentage of the same communication relationship in the historical normal traffic communication relationship percentage sequence in chronological order across all historical normal statistical windows to form a historical normal percentage sequence for a single type of communication relationship; performing distribution statistics on the historical normal percentage sequence for a single type of communication relationship to obtain the median and interquartile range of the historical normal percentage; and then calculating the median and interquartile range of the historical normal percentage corresponding to each type of communication relationship. Interquartile ranges are recorded in the normal communication template layer; the historical confirmed abnormal traffic communication relationship ratio sequence is checked one by one in the historical confirmed abnormal statistical window, and communication relationships with a ratio greater than zero are taken as actual communication relationships. All actual communication relationships in the same historical confirmed abnormal statistical window are combined and statistically analyzed, and the co-occurrence of communication relationships in all historical confirmed abnormal statistical windows is accumulated to obtain the number of times each pair of communication relationships co-occurs. Each pair of simultaneously occurring communication relationships and the corresponding number of times they co-occur are recorded in the attack semantic layer; a network traffic knowledge graph is constructed based on the normal communication template layer and the attack semantic layer.

[0010] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the following steps are included: The offset resolution of the current detected traffic communication relationship proportion sequence includes: based on the current communication relationship proportion of each type of communication relationship in the current detected traffic communication relationship proportion sequence, and the median and interquartile range of the historical normal proportion of the same communication relationship in the normal communication template layer, the absolute difference between the current detected traffic communication relationship proportion and the median of the historical normal proportion is recorded as the current offset; the offset resolution coefficient is calculated based on the current offset, the median of the historical normal proportion, and the interquartile range of the historical normal proportion, and the offset resolution coefficient is used to offset the current offset to obtain the residual intensity; communication relationships with non-zero residual intensity are considered as communication relationships that have not been resolved.

[0011] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the step of generating the current detection traffic residual deformation subgraph and calculating the current detection traffic average residual intensity includes: retaining the order of the communication relationships that have not been resolved in the communication relationship proportion sequence of the current detection traffic; connecting adjacent unresolved communication relationships in the order of arrangement to form communication relationship edges; and summarizing the unresolved communication relationships and communication relationship edges to form the current detection traffic residual deformation subgraph; performing mean square summation on the residual intensity of various communication relationships in the current detection traffic residual deformation subgraph; and taking the square root of the ratio of the sum of squares of the residual intensity of various communication relationships in the current detection traffic residual deformation subgraph to the number of communication relationships in the current detection traffic residual deformation subgraph to obtain the current detection traffic average residual intensity.

[0012] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the step of performing semantic loop closure determination on the current detected traffic residual deformation subgraph and calculating the current detected traffic anomaly determination value in combination with the current detected traffic average residual strength includes: performing pairwise checks on the communication relationships in the current detected traffic residual deformation subgraph; identifying associated communication relationships based on the co-occurrence frequency of communication relationships in the attack semantic layer; calculating the co-occurrence support between associated communication relationships; determining closed support paths for associated communication relationships; calculating the path loop closure strength; and recording the maximum path loop closure strength as the current detected traffic semantic loop closure strength; and harmonicly coupling the current detected traffic average residual strength with the current detected traffic semantic loop closure strength to obtain the current detected traffic anomaly determination value.

[0013] As a preferred embodiment of the knowledge graph-based network traffic anomaly detection method of the present invention, the step of statistically analyzing the anomaly determination values ​​of historical normal traffic to obtain an anomaly determination threshold and completing the anomaly determination includes: statistically analyzing the anomaly determination values ​​of the historical normal traffic communication relationship ratio sequence within each historical normal statistical window according to the anomaly determination criteria of the current detected traffic to form a historical normal traffic anomaly determination value sequence; performing distribution statistics on the historical normal traffic anomaly determination value sequence to obtain an anomaly determination threshold; and comparing the current detected traffic anomaly determination value with the anomaly determination threshold to complete the anomaly determination.

[0014] In a second aspect, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the knowledge graph-based network traffic anomaly detection method described in the first aspect of the present invention.

[0015] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the knowledge graph-based network traffic anomaly detection method described in the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: by constructing a network traffic knowledge graph and organizing the distribution patterns of communication relationships and the patterns of abnormal associations in the normal communication template layer and the attack semantic layer respectively, a unified semantic expression of communication relationships and a historical behavior association representation are achieved, enabling anomaly detection to have stable knowledge support; by continuously eliminating communication relationship offsets and performing semantic closed-loop judgment on residual communication relationships, anomaly offset focusing and anomaly semantic closure support recognition are achieved, making anomaly judgment both targeted, stable and structured in expression. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a knowledge graph-based network traffic anomaly detection method.

[0019] Figure 2 A flowchart for segmenting network traffic sessions and statistically analyzing communication relationships.

[0020] Figure 3 A flowchart for constructing and offsetting a network traffic knowledge graph.

[0021] Figure 4 This is a flowchart for semantic closed-loop determination and anomaly determination of network traffic. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figures 1-4 This is one embodiment of the present invention, which provides a network traffic anomaly detection method based on knowledge graphs, including the following steps: S1. Collect current detected traffic, historical normal traffic, and historical confirmed abnormal traffic. Perform session segmentation and protocol phase identification on network traffic. Statistically analyze and calculate the proportion of the identified communication relationships to obtain the communication relationship proportion sequence of current detected traffic, the communication relationship proportion sequence of historical normal traffic, and the communication relationship proportion sequence of historical confirmed abnormal traffic.

[0026] Furthermore, it collects current detected traffic, historical normal traffic, and historically confirmed abnormal traffic.

[0027] Current detected traffic refers to network traffic collected in real time and awaiting analysis within the current statistics window; historical normal traffic refers to network traffic that does not show an abnormal state in existing operation records, handling records, and alarm records; historical confirmed abnormal traffic refers to network traffic that has shown an abnormal state in existing operation records, handling records, alarm records, or review records.

[0028] The data collection locations include switch mirror ports, gateway forwarding record locations, host connection record locations, and border traffic record locations; the data collection content includes packet arrival time, source address, destination address, source port, destination port, and protocol type.

[0029] To ensure that current detected traffic, historical normal traffic, and historical confirmed abnormal traffic are processed under the same statistical caliber, each batch of message records generated from continuous collection is used as a statistical window, and these are separately compiled into current detected traffic message records, historical normal traffic message records, and historical confirmed abnormal traffic message records.

[0030] Furthermore, session segmentation is performed based on current detected traffic packet records, historical normal traffic packet records, and historical confirmed abnormal traffic packet records.

[0031] Session segmentation refers to arranging message records with the same communication quintuple in the same statistical window according to the order of message arrival time, and merging message records into a communication session based on whether the time difference between adjacent message records falls within a continuous communication interval.

[0032] Use the source address, destination address, source port, destination port, and protocol type as the communication quintuple.

[0033] All message records within the same statistical window are compared using a communication quintuple. Message records with identical communication quintuples are grouped into the same message group. The message records in each message group are then arranged in ascending order of message arrival time to form a message arrival time sequence. The difference between the arrival times of two adjacent messages in the message arrival time sequence is calculated, and all time differences are recorded in the order of arrangement to form a message interval sequence. The message interval sequence is statistically analyzed to calculate the median and interquartile range of the message interval sequence. The sum of the median and interquartile range of the message interval sequence is taken as the continuous communication interval.

[0034] The median of a message interval sequence refers to the value in the middle position after the message interval sequence is arranged according to its size. The interquartile range of a message interval sequence refers to the difference between the upper quartile and the lower quartile in the message interval sequence.

[0035] The message records in the same message group are checked one by one in the order of message arrival time. When the time difference between adjacent message records is not greater than the continuous communication interval, the message records with unchanged communication quintuple and continuous time are merged into the same communication session. When the time difference between adjacent message records is greater than the continuous communication interval, the message records before and after the time difference are divided into different communication sessions.

[0036] For each completed communication session, record the communication quintuple, the communication session start time, and the communication session end time. Then, summarize all communication sessions formed by the current detection traffic packet records to form the current detection traffic session record set, summarize all communication sessions formed by the historical normal traffic packet records to form the historical normal traffic session record set, and summarize all communication sessions formed by the historical confirmed abnormal traffic packet records to form the historical confirmed abnormal traffic session record set.

[0037] Furthermore, protocol phase identification is performed based on the current detection traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set.

[0038] Protocol phase identification refers to dividing the connection establishment process, connection maintenance process, and connection termination process in the communication process according to the order of appearance of messages within a communication session record, and adding a protocol phase identifier.

[0039] Protocol phase identifiers are records of the communication phase to which messages within a communication session belong, including connection establishment phase, connection hold phase, connection termination phase, start phase, hold phase, and termination phase.

[0040] Based on the protocol type in the communication quintuple, communication session records with the protocol type of Transmission Control Protocol (TCP) are classified as Transmission Control Protocol (TCP) communication session records, while communication session records with the protocol type of User Datagram Protocol (UDP) or other protocols that do not establish a connection through a handshake process are classified as connectionless protocol communication session records. Transmission Control Protocol (TCP) communication session records refer to communication session records with the protocol type of Transmission Control Protocol that establish a connection through a handshake process, while connectionless protocol communication session records refer to communication session records with the protocol type of User Datagram Protocol (UDP) or other protocols that do not establish a connection through a handshake process.

[0041] For Transmission Control Protocol (TCP) communication session records, the connection initiation flag, connection acknowledgment flag, connection end flag, and connection reset flag are checked in order of message arrival time. Message records where the connection initiation flag appears first, followed by the connection acknowledgment flag, and belong to the same continuous message interval are recorded as the connection establishment phase. Continuous message records that continue to transmit application content after the connection establishment phase and do not contain connection end flags or connection reset flags are recorded as the connection maintenance phase. Continuous message records that contain either the connection end flag or the connection reset flag are recorded as the connection termination phase. The connection initiation flag is a synchronization flag used to initiate a connection, the connection acknowledgment flag is an acknowledgment flag used to confirm the connection, the connection end flag is an end flag used to terminate a connection, and the connection reset flag is a reset flag used to interrupt a connection.

[0042] A service message refers to a message record that does not contain connection initiation markers, connection confirmation markers, connection end markers, and connection reset markers, but carries application content. For connectionless protocol communication session records, service messages are checked in order of message arrival time. The first consecutive service message record is recorded as the start phase, the consecutive service message records that continue to appear after the start phase are recorded as the hold phase, and the last consecutive service message record that appears within the continuous communication interval is recorded as the end phase. The start phase refers to the consecutive message record in a connectionless protocol communication session record where a service message first appears, the hold phase refers to the consecutive message record where service message transmission continues after the start phase, and the end phase refers to the consecutive message record in a connectionless protocol communication session record where a service message last appears.

[0043] Write the communication quintuple, protocol phase identifier, phase start time and phase end time of each phase in each communication session into the current detection traffic session record set, the historical normal traffic session record set and the historical confirmed abnormal traffic session record set.

[0044] Furthermore, communication relationship statistics and percentage calculations are performed based on the current detected traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set.

[0045] A communication relationship is a type of communication record identified by both the communication quintuple and the protocol phase identifier. Records with the same communication quintuple and the same protocol phase identifier are grouped into the same type of communication relationship, while records with different communication quintuples or different protocol phase identifiers are grouped into different types of communication relationships.

[0046] The records in the current detected traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set are classified and summarized according to the communication quintuple and protocol stage identifier. The number of times each type of communication relationship appears in each statistical window is counted to form the current detected traffic communication relationship occurrence sequence, the historical normal traffic communication relationship occurrence sequence, and the historical confirmed abnormal traffic communication relationship occurrence sequence.

[0047] The percentage calculation is to compare the number of times a single type of communication relationship occurs with the total number of times all communication relationships occur within the same statistical window. This ratio is used to represent the distribution proportion of a single type of communication relationship in the current statistical window.

[0048] The occurrence counts of each type of communication relationship are compared with the total occurrence counts of all communication relationships within the same statistical window. The results are then arranged in the order of source address, destination address, source port, destination port, protocol type, and protocol stage identifier to form the current detection traffic communication relationship percentage sequence, the historical normal traffic communication relationship percentage sequence, and the historical confirmed abnormal traffic communication relationship percentage sequence.

[0049] S2. Construct a network traffic knowledge graph based on the historical normal traffic communication relationship ratio sequence and the historical confirmed abnormal traffic communication relationship ratio sequence. Perform distribution statistics on historical normal traffic communication relationships to form a normal communication template layer, and perform co-occurrence statistics on historical confirmed abnormal traffic communication relationships to form an attack semantic layer.

[0050] Furthermore, a network traffic knowledge graph refers to a knowledge structure that uses communication relationships as the core recording object and organizes the distribution patterns of communication relationships under normal conditions and the association patterns under abnormal conditions in a hierarchical manner.

[0051] The network traffic knowledge graph includes a normal communication template layer and an attack semantic layer. The normal communication template layer records the concentration level and fluctuation range of various communication relationships in historical normal traffic. The attack semantic layer records the co-occurrence relationship and co-occurrence frequency of various communication relationships in historically confirmed abnormal traffic.

[0052] The statistical results of the distribution of various communication relationships in historical normal traffic are written into the normal communication template layer, and the statistical results of the co-occurrence of various communication relationships in historically confirmed abnormal traffic are written into the attack semantic layer. The communication relationships are recorded according to the order of the communication relationship proportion sequence in historical normal traffic and the communication relationship proportion sequence in historically confirmed abnormal traffic, forming a network traffic knowledge graph.

[0053] Furthermore, based on the historical normal traffic communication relationship ratio sequence, a distribution statistics are performed to form a normal communication template layer.

[0054] The percentage of the same communication relationship in the historical normal traffic communication relationship percentage sequence within all historical statistical windows is summarized in chronological order to form a historical normal percentage sequence for a single type of communication relationship.

[0055] The historical normal percentage sequence of a single type of communication relationship refers to the sequence of the percentage of the same communication relationship in all historical normal statistical windows.

[0056] The historical normal percentage sequence of a single type of communication relationship is statistically analyzed to calculate the median and interquartile range of the historical normal percentage. The median of the historical normal percentage refers to the percentage value in the middle position after the historical normal percentage sequence of a single type of communication relationship is arranged according to the size rule, which represents the concentration level of the single type of communication relationship under normal conditions. The interquartile range of the historical normal percentage refers to the difference between the upper quartile and the lower quartile in the historical normal percentage sequence of a single type of communication relationship, which represents the fluctuation range of the single type of communication relationship under normal conditions.

[0057] The median value of the historical normal proportion and the interquartile range of the historical normal proportion for each type of communication relationship are written into the normal communication template layer to form a normal distribution template that is recorded one by one according to the communication relationship.

[0058] Furthermore, based on the historically confirmed proportion of abnormal traffic communication relationships, co-occurrence statistics are performed to form an attack semantic layer.

[0059] The communication relationship percentage sequence in each historical confirmed anomaly statistics window is checked, and communication relationships with a percentage greater than zero are considered as actual communication relationships appearing in the current historical confirmed anomaly statistics window. The communication relationship percentage refers to the ratio of the number of times a communication relationship appears in the current statistics window to the total number of times all communication relationships appear in the current statistics window. A communication relationship percentage greater than zero indicates that the corresponding communication relationship appears at least once in the current historical confirmed anomaly statistics window, and a communication relationship percentage equal to zero indicates that the corresponding communication relationship does not appear in the current historical confirmed anomaly statistics window.

[0060] All actual communication relationships that appear within the same historical confirmed anomaly statistics window are combined and statistically analyzed. When two types of communication relationships appear simultaneously within the same historical confirmed anomaly statistics window, a co-occurrence of communication relationships is recorded. When two types of communication relationships do not appear simultaneously within the same historical confirmed anomaly statistics window, co-occurrence of communication relationships is not recorded.

[0061] The co-occurrence of communication relationships in all historical confirmed anomaly statistics windows is accumulated to obtain the number of times communication relationships co-occur between various types of communication relationships; the number of times communication relationships co-occur refers to the cumulative number of times two types of communication relationships appear simultaneously in historical confirmed anomaly traffic.

[0062] Write the two types of communication relationships that occur simultaneously and the corresponding number of times they co-occur into the attack semantic layer to form an abnormal association record stored according to the communication relationship.

[0063] Furthermore, the normal communication template layer and the attack semantic layer are written into the same network traffic knowledge graph.

[0064] For each type of communication relationship in the normal communication template layer, record the median value of the historical normal proportion and the interquartile range of the historical normal proportion; for each pair of communication relationships that occur simultaneously in the attack semantic layer, record the number of times the communication relationship co-occurs.

[0065] By incorporating the statistical results of the distribution of various communication relationships under historical normal conditions and the statistical results of their co-occurrence under historical abnormal conditions into the network traffic knowledge graph, a network traffic knowledge graph containing a normal communication template layer and an attack semantic layer is formed.

[0066] S3. Call the normal communication template layer in the network traffic knowledge graph, perform offset resolution on the current detection traffic communication relationship ratio sequence, retain the communication relationships that have not been resolved, generate the current detection traffic residual deformation subgraph, and calculate the current detection traffic average residual intensity.

[0067] Furthermore, the normal communication template layer in the network traffic knowledge graph is invoked to check each type of communication relationship in the current detected traffic communication relationship percentage sequence.

[0068] For each type of communication relationship, read the current communication relationship percentage in the current detected traffic communication relationship percentage sequence. Simultaneously, read the median and interquartile range of the historical normal percentage for the same communication relationship in the normal communication template layer. The median of the historical normal percentage represents the distribution center of the communication relationship under normal conditions. The absolute difference between the current detected traffic communication relationship percentage and the median of the historical normal percentage is recorded as the current offset, expressed as: ; in, For statistics window Inner The current offset of the class communication relationship. For statistics window Inner The proportion of communication relationships in the current detected traffic communication relationship sequence. For the first The median historical proportion of normal communication relationships within the normal communication template layer. This is the communication relationship sequence number. This is the serial number of the statistics window.

[0069] The range of its value is from zero to one; The larger the value, the more significantly the single-type communication relationship deviates from the historical normal distribution center; A value of zero indicates that the single-type communication relationship is consistent with the historical normal distribution center.

[0070] The current offset represents the degree of deviation of a single type of communication relationship within the current statistical window from the historical normal distribution center.

[0071] The closer the current offset is to zero, the closer the current communication relationship is to the normal state; the greater the current offset is, the more the current communication relationship deviates from the normal state.

[0072] Furthermore, the interquartile range of the historical normal proportion is used as a reference for the natural fluctuation of the current offset. The interquartile range of the historical normal proportion represents the fluctuation range of the communication relationship under normal conditions. The closer the current detected traffic communication relationship proportion is to the median value of the historical normal proportion, and the more the current offset falls within the fluctuation range represented by the interquartile range of the historical normal proportion, the higher the degree of offset resolution. The more the current detected traffic communication relationship proportion deviates from the median value of the historical normal proportion, and the more the current offset exceeds the fluctuation range represented by the interquartile range of the historical normal proportion, the lower the degree of offset resolution.

[0073] Based on the proportional relationship between the increase in the degree of resolution when the current offset decreases, and the increase in the degree of resolution when the median value of the historical normal proportion and the interquartile range of the historical normal proportion increase, the offset resolution coefficient is calculated and expressed as: ; in, For statistics window Inner The offset resolution coefficient of the communication relationship. For the first The historical normal proportion of class communication relationships in the normal communication template layer is the interquartile range.

[0074] When the The historical normal proportion of the communication relationship in the normal communication template layer has an interquartile range of zero, and the statistical window... Inner When the current offset of a class communication relationship is zero, the offset resolution coefficient is recorded as 1.

[0075] The range of its value is between zero and one; Approaching a certain point indicates that a significant portion of the current offset can be resolved. When it is close to zero, it means that a large portion of the current offset is retained.

[0076] The offset resolution coefficient represents the proportion of the current offset that can be resolved.

[0077] Furthermore, the current offset is offset by offset reduction coefficient. Offset reduction means compressing the part of the current offset that falls within the normal distribution range, retaining the part that still exceeds the normal distribution range, and recording the part that is still retained after offset reduction as the residual strength.

[0078] The complementary amount of the offset resolution coefficient represents the offset retention ratio, the square of the current offset represents the enhancement of the offset retention degree, and the median and interquartile range of the historical normal percentage represent the constraints in the residual retention process. The residual strength is calculated using the offset retention ratio, the current offset, the median of the historical normal percentage, and the interquartile range of the historical normal percentage, and is expressed as: ; in, For statistics window Inner The residual strength of the communication relationship.

[0079] When the The historical normal proportion of the communication relationship in the normal communication template layer has an interquartile range of zero, and the statistical window... Inner When the current offset of a class communication relationship is zero, the residual strength is recorded as zero.

[0080] The range of its value is between zero and one; The larger the value, the higher the value within the current statistical window. The higher the degree of deviation retained after offset resolution, the better the communication relationship. A value of zero indicates the number of elements in the current statistics window. The residuals were not preserved in the class communication relationship.

[0081] The residual intensity represents the degree of deviation of a single type of communication relationship from its historical normal distribution range after the offset resolution is completed.

[0082] Furthermore, communication relationships with non-zero residual strength are considered as unresolved communication relationships, and the order of unresolved communication relationships in the current detection traffic communication relationship proportion sequence is retained. Adjacent unresolved communication relationships are connected sequentially according to the order to form communication relationship edges, and all unresolved communication relationships and communication relationship edges are summarized to form the current detection traffic residual deformation subgraph.

[0083] The current detected traffic residual deformation subgraph refers to a local relational structure composed of unresolved communication relationships within the current statistical window as graph nodes and adjacent communication relationships connected according to the order of the current detected traffic communication relationship proportion sequence as graph edges. By recording the graph nodes and graph edges according to the order of the current detected traffic communication relationship proportion sequence, the communication relationships in the current detected traffic residual deformation subgraph can maintain the same comparison caliber as the communication relationships in the normal communication template layer.

[0084] Furthermore, the mean square summation is performed on the residual intensities of various communication relationships in the current detected traffic residual deformation subgraph. The mean square summation refers to taking the square root of the ratio of the sum of squares of the residual intensities of various communication relationships in the residual deformation subgraph to the number of communication relationships in the residual deformation subgraph, thus obtaining the average residual intensity of the current detected traffic, expressed as: ; in, For statistics window The average residual intensity of the current detected flow rate within the range, For statistics window The set of sequence numbers of communication relationships in the current detected traffic residual deformation subgraph. For statistics window The number of communication relationships in the current detected traffic residual deformation subgraph.

[0085] The range of its value is between zero and one; The larger the value, the higher the overall deviation of the communication relationships that have not been eliminated within the current statistical window; When the value is zero, it indicates that no residual communication relationships are retained within the current statistical window.

[0086] The average residual intensity of the current detected flow represents the overall deviation level of the communication relationship that has not been eliminated within the current statistical window.

[0087] The squared term of residual strength is used to enhance the distinguishing effect of high residual communication relationships in the overall deviation level. The number of communication relationships in the residual deformation subplot is used to constrain the overall deviation level from being directly amplified as the number of communication relationships increases.

[0088] S4. Based on the attack semantic layer in the network traffic knowledge graph, perform semantic loop closure judgment on the residual deformation subgraph of the current detected traffic, calculate the anomaly judgment value of the current detected traffic by combining the average residual intensity of the current detected traffic, and statistically analyze the anomaly judgment values ​​of historical normal traffic to obtain the anomaly judgment threshold and complete the anomaly judgment.

[0089] Furthermore, based on the attack semantic layer in the network traffic knowledge graph, semantic loop closure is determined for the residual deformation subgraph of the current detected traffic.

[0090] Semantic loop closure determination includes semantic association recognition and closure support path determination.

[0091] Semantic association identification refers to performing pairwise checks on the communication relationships in the residual deformation subgraph of the current detected traffic. Two types of communication relationships that coexist in the residual deformation subgraph of the current detected traffic and have a co-occurrence count greater than zero in the attack semantic layer are recorded as associated communication relationships. The co-occurrence count of communication relationships refers to the cumulative number of times the two types of communication relationships have appeared simultaneously in historically confirmed abnormal traffic. A co-occurrence count of communication relationships greater than zero indicates that the corresponding two types of communication relationships have at least one simultaneous occurrence record in historically confirmed abnormal traffic. A co-occurrence count of communication relationships equal to zero indicates that the corresponding two types of communication relationships have no co-occurrence support in historically confirmed abnormal traffic.

[0092] The co-occurrence support between associated communication relationships is calculated by the number of times these relationships co-occur, and is expressed as follows: ; in, For communication relationship Communication relationship Co-occurrence support between them For communication relationship Communication relationship The number of times communication relationships co-occur in the attack semantic layer For communication relationship A set of communication relationships that have a certain number of co-occurrences. This is the sequence number of the communication relationship currently being examined. To and The sequence number of the association communication relationship used for co-occurrence support calculation. To and The sequence number of communication relationships that co-occur multiple times.

[0093] The range of its value is between zero and one; The larger the value, the stronger the communication relationship. Communication relationship The higher the degree of co-occurrence in historically confirmed abnormal traffic; When the value is zero, it indicates a communication relationship. Communication relationship There is no co-occurrence support in the attack semantic layer.

[0094] Furthermore, after the associated communication relationships are identified, the associated communication relationships in the current detected traffic residual deformation subgraph are used to determine the closed support path.

[0095] The communication relationship sequence formed by sequentially connecting the edges in the graph is taken as the candidate communication relationship sequence; the candidate communication relationship sequence in which the first and last communication relationships in the candidate communication relationship sequence also have co-occurrence support in the attack semantic layer and are continuously connected with the other adjacent communication relationships in the path is denoted as the closed communication relationship sequence; the closed communication relationship sequence composed of associated communication relationships is denoted as the closed support path.

[0096] Communication relationships in a closed support path do not appear repeatedly within the same path, associated communication relationships in a closed support path are not counted repeatedly within the same path, and the number of associated communication relationships in a closed support path is no less than three and no greater than the number of communication relationships in the current detected traffic residual deformation subgraph.

[0097] The path closure strength is calculated using all co-occurring support values ​​in the closed support path, and is expressed as: ; in, For statistics window Inner closed support path The path closed-loop strength, For statistics window Closed support path within, To close the support path The number of associated communication relationships, To close the support path The associated communication relationship formed by two adjacent types of communication relationships.

[0098] The range of its value is between zero and one; The larger the value, the more stable the semantic associations within the closed support path; The smaller the value, the weaker the semantic association within the closed support path.

[0099] The path closure strength represents the overall support level of a closed support path in the attack semantic layer.

[0100] Furthermore, the path loop closure strengths of all closed support paths are compared, and the maximum path loop closure strength is taken as the semantic loop closure strength of the current detected traffic, expressed as: ; in, For statistics window The current detection traffic semantic loop closure strength within the current detection range. For statistics window The set of all closed support paths is defined as follows: for a sequence of closed communication relationships formed by the same set of communication relationships and differing only in their starting positions, or a sequence of closed communication relationships with opposite connection directions, it is recorded as a closed support path in the set of all closed support paths.

[0101] The range of its value is between zero and one; The larger the value, the stronger the closed-loop support of the current detection traffic residual deformation subgraph in the attack semantic layer; When the value is zero, it indicates that the current detected flow residual deformation subgraph has not formed a closed support path.

[0102] The semantic loop closure strength of the current detected traffic represents the strongest loop closure support level of the residual deformation subgraph of the current detected traffic in the attack semantic layer.

[0103] Furthermore, the average residual strength of the current detected traffic is harmonicly coupled with the semantic closed-loop strength of the current detected traffic to calculate the anomaly judgment value of the current detected traffic, expressed as: ; in, For statistics window The current abnormal traffic detection value within the system.

[0104] The range of its value is between zero and one; The larger the value, the higher the overall deviation of the current detected flow and the higher the degree of closed-loop support. When the value is zero, it indicates that the current detected traffic does not show any obvious abnormal characteristics.

[0105] Harmonious coupling refers to the situation where the current detected flow anomaly judgment value increases when both the average residual strength and the semantic closed-loop strength of the current detected flow are high; and the current detected flow anomaly judgment value is suppressed when either of them is low.

[0106] Furthermore, anomaly detection values ​​are statistically analyzed for historical normal traffic within each historical statistical window.

[0107] Anomaly determination value statistics refer to the process of calculating the current offset, offset reduction coefficient, residual strength, historical normal traffic residual deformation subgraph generation, historical normal traffic average residual strength, semantic association identification, closed support path determination, historical normal traffic semantic closed loop strength, and anomaly determination value within each historical statistical window, according to the offset reduction, residual deformation subgraph generation, semantic closed loop determination, and anomaly determination value calculation methods corresponding to the current detected traffic.

[0108] The abnormal judgment values ​​obtained from each historical statistical window are summarized in chronological order to form a sequence of abnormal judgment values ​​for historical normal traffic. Each abnormal judgment value in the sequence of abnormal judgment values ​​for historical normal traffic represents an abnormal judgment value obtained by a historical normal statistical window under the current detection traffic judgment caliber.

[0109] Distribution statistics are performed on the historical normal traffic anomaly judgment value sequence to obtain the anomaly judgment threshold, which is expressed as: ; in, This is the threshold for anomaly detection. These are the anomaly determination values ​​in the historical normal traffic anomaly determination value sequence. This represents the number of historical normal statistical windows. For median operations, This is for interquartile range calculation.

[0110] The anomaly detection threshold ranges from zero to one; when the sum of the median calculation result and the interquartile range calculation result is greater than 1, 1 is used as the upper limit of the anomaly detection threshold.

[0111] Furthermore, the current abnormal traffic detection value is compared with the abnormal detection threshold.

[0112] When the current detected traffic anomaly value is greater than the anomaly threshold, the current detected traffic is recorded as abnormal; when the current detected traffic anomaly value is not greater than the anomaly threshold, the current detected traffic is recorded as normal, thus completing the anomaly determination.

[0113] This embodiment also provides a computer device applicable to the knowledge graph-based network traffic anomaly detection method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the knowledge graph-based network traffic anomaly detection method proposed in the above embodiment.

[0114] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0115] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the knowledge graph-based network traffic anomaly detection method as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0116] In summary, this invention constructs a network traffic knowledge graph and organizes the distribution patterns of communication relationships and the patterns of abnormal associations in the normal communication template layer and the attack semantic layer, respectively, to achieve a unified semantic expression of communication relationships and a historical behavior association representation, thus providing stable knowledge support for anomaly detection. By continuously resolving communication relationship offsets and performing semantic closed-loop judgment on residual communication relationships, it achieves anomaly offset focusing and anomaly semantic closure support identification, making anomaly judgment both targeted, stable, and structured in its expression capabilities.

[0117] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for detecting network traffic anomalies based on knowledge graphs, characterized in that, include: Collect current detected traffic, historical normal traffic, and historical confirmed abnormal traffic; perform session segmentation and protocol phase identification on network traffic; statistically analyze and calculate the proportion of the identified communication relationships to obtain the communication relationship proportion sequence of current detected traffic, the communication relationship proportion sequence of historical normal traffic, and the communication relationship proportion sequence of historical confirmed abnormal traffic. A network traffic knowledge graph is constructed based on the historical normal traffic communication relationship ratio sequence and the historical confirmed abnormal traffic communication relationship ratio sequence. The distribution statistics of historical normal traffic communication relationships are used to form a normal communication template layer, and the co-occurrence statistics of historical confirmed abnormal traffic communication relationships are used to form an attack semantic layer. The normal communication template layer in the network traffic knowledge graph is called to perform offset resolution on the current detection traffic communication relationship ratio sequence, retain the communication relationships that have not been resolved, generate the current detection traffic residual deformation subgraph, and calculate the current detection traffic average residual intensity. Based on the attack semantic layer in the network traffic knowledge graph, semantic loop closure is performed on the residual deformation subgraph of the current detected traffic. The anomaly judgment value of the current detected traffic is calculated by combining the average residual intensity of the current detected traffic. The anomaly judgment value of historical normal traffic is statistically analyzed to obtain the anomaly judgment threshold and complete the anomaly judgment.

2. The network traffic anomaly detection method based on knowledge graph as described in claim 1, characterized in that, The process of segmenting network traffic into sessions includes collecting current detected traffic, historical normal traffic, and historical confirmed abnormal traffic; extracting packet arrival time, source address, destination address, source port, destination port, and protocol type; and using a batch of packet records formed by each continuous collection as a statistical window to form current detected traffic packet records, historical normal traffic packet records, and historical confirmed abnormal traffic packet records, respectively. Session segmentation is performed based on current detected traffic packet records, historical normal traffic packet records, and historical confirmed abnormal traffic packet records. The source address, destination address, source port, destination port, and protocol type are used as communication quintuples. Packet records with the same communication quintuple are arranged in order of packet arrival time. The time difference between adjacent packet records is calculated to form a packet interval sequence. The sum of the median of the packet interval sequence and the interquartile range of the packet interval sequence is used as the continuous communication interval. Based on whether the time difference between adjacent message records is not greater than the continuous communication interval, message records with unchanged communication quintuples and continuous time are grouped into the same communication session, forming the current detection traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set, respectively.

3. The network traffic anomaly detection method based on knowledge graph as described in claim 2, characterized in that, The protocol phase identification, which involves statistically analyzing and calculating the proportion of identified communication relationships, includes identifying protocol phases based on the current detected traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set, according to the order of appearance of the internal messages of each communication session, and writing the communication quintuple, protocol phase identifier, phase start time, and phase end time into the current detected traffic session record set, the historical normal traffic session record set, and the historical confirmed abnormal traffic session record set. Records with the same communication quintuple and the same protocol phase identifier are grouped into the same type of communication relationship, and records with different communication quintuples or different protocol phase identifiers are grouped into different types of communication relationships. The number of times each type of communication relationship appears in each statistical window is counted. The frequency of each type of communication relationship is compared with the total frequency of all communication relationships within the same statistical window to form the current detection traffic communication relationship percentage sequence, the historical normal traffic communication relationship percentage sequence, and the historical confirmed abnormal traffic communication relationship percentage sequence.

4. The network traffic anomaly detection method based on knowledge graph as described in claim 1, characterized in that, The construction of the network traffic knowledge graph based on the historical normal traffic communication relationship ratio sequence and the historical confirmed abnormal traffic communication relationship ratio sequence includes: summarizing the proportion of the same communication relationship in all historical normal statistical windows in the historical normal traffic communication relationship ratio sequence in chronological order to form a single type of communication relationship historical normal ratio sequence; performing distribution statistics on the single type of communication relationship historical normal ratio sequence to obtain the historical normal ratio median and historical normal ratio interquartile range; and recording the historical normal ratio median and historical normal ratio interquartile range corresponding to each type of communication relationship in the normal communication template layer. The sequence of historically confirmed abnormal traffic communication relationships is checked one by one in the historically confirmed abnormal statistical window. Communication relationships with a proportion greater than zero are considered as actual communication relationships. All actual communication relationships within the same historically confirmed abnormal statistical window are combined and statistically analyzed. The co-occurrence of communication relationships in all historically confirmed abnormal statistical windows is accumulated to obtain the number of times each pair of communication relationships co-occurs. Each pair of communication relationships that occur simultaneously and the corresponding number of times they co-occur are recorded in the attack semantic layer. A network traffic knowledge graph is constructed based on a normal communication template layer and an attack semantic layer.

5. The network traffic anomaly detection method based on knowledge graph as described in claim 4, characterized in that, The offset resolution of the current detected traffic communication relationship ratio sequence includes, based on the current communication relationship ratio of various communication relationships in the current detected traffic communication relationship ratio sequence, and the median value of the historical normal ratio and the interquartile range of the historical normal ratio of the same communication relationship in the normal communication template layer, recording the absolute difference between the current detected traffic communication relationship ratio and the median value of the historical normal ratio as the current offset; The offset reduction coefficient is calculated based on the current offset, the median of the historical normal proportion, and the interquartile range of the historical normal proportion. The current offset is then offset and reduced using the offset reduction coefficient to obtain the residual strength. Communication relationships with non-zero residual strength are considered as unresolved communication relationships.

6. The network traffic anomaly detection method based on knowledge graph as described in claim 5, characterized in that, The process of generating the residual deformation subgraph of the current detection traffic and calculating the average residual intensity of the current detection traffic includes: retaining the order of the communication relationships that have not been eliminated in the communication relationship proportion sequence of the current detection traffic; connecting the adjacent communication relationships that have not been eliminated in the order of the arrangement to form communication relationship edges; and summarizing the communication relationships that have not been eliminated and the communication relationship edges to form the residual deformation subgraph of the current detection traffic. The residual intensity of each type of communication relationship in the current detection flow residual deformation subgraph is summed by mean square. The average residual intensity of the current detection flow is obtained by taking the square root of the ratio of the sum of squares of the residual intensity of each type of communication relationship in the current detection flow residual deformation subgraph to the number of communication relationships in the current detection flow residual deformation subgraph.

7. The knowledge graph-based network traffic anomaly detection method as described in claim 1 or 6, characterized in that, The step of performing semantic loop closure determination on the residual deformation subgraph of the current detected traffic and calculating the anomaly determination value of the current detected traffic in combination with the average residual intensity of the current detected traffic includes: performing pairwise checks on the communication relationships in the residual deformation subgraph of the current detected traffic, identifying associated communication relationships based on the number of co-occurrences of communication relationships in the attack semantic layer, and calculating the co-occurrence support between associated communication relationships. Closed support path determination is performed on the associated communication relationship, the path closure strength is calculated, and the maximum path closure strength is recorded as the semantic closure strength of the current detected traffic. By harmonic coupling the average residual strength of the current detected traffic with the semantic closed-loop strength of the current detected traffic, an anomaly judgment value for the current detected traffic is obtained.

8. The network traffic anomaly detection method based on knowledge graph as described in claim 1, characterized in that, The process of statistically analyzing the abnormal judgment values ​​of historical normal traffic to obtain an abnormal judgment threshold and complete the abnormal judgment includes: statistically analyzing the abnormal judgment values ​​of the historical normal traffic communication relationship ratio sequence within each historical normal statistical window according to the current abnormal judgment criteria of the detected traffic to form a historical normal traffic abnormal judgment value sequence. The distribution statistics of historical normal traffic anomaly judgment values ​​are analyzed to obtain the anomaly judgment threshold; The current abnormal traffic value is compared with the abnormal judgment threshold to complete the abnormal judgment.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the knowledge graph-based network traffic anomaly detection method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the knowledge graph-based network traffic anomaly detection method according to any one of claims 1 to 8.

Images