Network traffic detection method and apparatus, computer device and storage medium

Abstract

This application relates to a network traffic detection method, apparatus, computer device, and storage medium. The method includes: constructing a graph structure using network traffic data of the network to be detected; where nodes represent devices and edges represent multidimensional traffic features between corresponding devices; obtaining a first multidimensional feature of a node, and aggregating the first multidimensional feature of the node with associated multidimensional traffic features to obtain a second multidimensional feature of the node; aggregating the second multidimensional features of each neighboring node according to the attention weights of each neighboring node, and fusing the aggregated features with the second multidimensional feature of the node to obtain a third multidimensional feature of the node; adjusting each dimension of the third multidimensional feature based on its importance for anomaly detection; and inputting the adjusted third multidimensional feature into a pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected. This method can improve detection accuracy.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network traffic detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] The rapid development of internet technology has led to a dramatic expansion of network scale, with increasingly complex and diverse services and applications being carried, resulting in network traffic data exhibiting characteristics of massive volume, high dimensionality, and complex structure. Against this backdrop, network security faces unprecedented challenges. Real-time and accurate identification of abnormal behavior (such as DDoS attacks and port scanning) from massive traffic has become crucial for ensuring stable network operation and business security.

[0003] To address this challenge, machine learning-based anomaly detection techniques have been widely adopted. However, related network traffic anomaly detection methods based on deep graph neural networks exhibit low accuracy when dealing with multi-dimensional and complex network data. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product capable of detecting network traffic with high accuracy in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a network traffic detection method, including:

[0006] A graph structure is constructed using network traffic data of the network to be detected; the nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent multidimensional traffic characteristics between the corresponding devices.

[0007] The first multidimensional feature of the node is obtained, and the first multidimensional feature of the node and the multidimensional traffic feature associated with the node are aggregated to obtain the second multidimensional feature of the node.

[0008] Based on the attention weights of each neighboring node of the node, the second multidimensional features of each neighboring node are aggregated, and the aggregated features and the second multidimensional features of the node are fused to obtain the third multidimensional features of the node.

[0009] Based on the importance of each dimension type in the third multidimensional feature for anomaly detection, adjust each dimension feature in the third multidimensional feature;

[0010] The adjusted third multidimensional feature is input into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

[0011] In one embodiment, the step of aggregating the first multidimensional feature of the node and the multidimensional traffic feature associated with the node to obtain the second multidimensional feature of the node includes:

[0012] Using the first convolutional layer in the graph convolutional network, the first multidimensional feature of the node, the preset dimensionality reduction weight matrix, the multidimensional traffic features associated with the node, and the edge weights corresponding to the multidimensional traffic features are aggregated to obtain the single-dimensional fusion feature of the node; the edge weights are obtained after normalization based on the number of edge connections of each node.

[0013] By utilizing the second convolutional layer in the graph convolutional network, the multi-dimensional fine representation of the node is reconstructed based on the node's single-dimensional fusion features, the preset up-dimensional weight matrix, the multi-dimensional traffic features associated with the node, and the edge weights corresponding to the multi-dimensional traffic features, thus obtaining the node's second multi-dimensional features.

[0014] In one embodiment, the step of obtaining the attention weights of each neighboring node of the node includes:

[0015] The second multidimensional feature of the node is concatenated with the second multidimensional features of the node's neighboring nodes;

[0016] The concatenated features are multiplied by a preset attention vector, and the product is processed using a preset activation function to obtain the attention weights of the neighboring nodes of the node.

[0017] In one embodiment, adjusting the features of the third multidimensional feature based on the importance of each dimension type in the third multidimensional feature for anomaly detection includes:

[0018] Obtain the historical weights of the dimension type and the current importance metric of the dimension type; the current importance metric is obtained based on the importance of the dimension type in the current detection.

[0019] The current weight of a dimension type is obtained by dividing the product of the historical weight and the current importance metric by the sum of the products of the historical weights and their corresponding current importance metrics for each dimension type.

[0020] Based on the current weight of each dimension type, the features of each dimension in the third multidimensional feature are weighted.

[0021] In one embodiment, the step of inputting the adjusted third multidimensional feature into a pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected includes:

[0022] The adjusted third multidimensional feature is input into a pre-trained network traffic anomaly detection model. The distance between the adjusted third multidimensional feature and the hyperplane in the network traffic anomaly detection model is obtained through the network traffic anomaly detection model. If the distance is greater than a preset distance threshold, the node corresponding to the adjusted third multidimensional feature is determined to be an abnormal node, and the transmission traffic of the abnormal node is determined to be abnormal traffic.

[0023] In one embodiment, the step of obtaining the network traffic anomaly detection model includes:

[0024] Obtain a support vector machine as the network traffic anomaly detection model to be trained;

[0025] Obtain normal and abnormal devices from historical network traffic data, and obtain the adjusted third-dimensional feature corresponding to the normal device as a positive sample, and obtain the adjusted third-dimensional feature corresponding to the abnormal device as a negative sample.

[0026] The positive and negative samples are input into the network traffic anomaly detection model to be trained, and the training aims to find a hyperplane to separate the positive and negative samples, thereby obtaining a trained network traffic anomaly detection model.

[0027] In one embodiment, obtaining the first multidimensional feature of the node includes:

[0028] The first multidimensional feature of the node is obtained based on the node's device type, user category, and historical traffic baseline.

[0029] Secondly, this application also provides a network traffic detection device, comprising:

[0030] The graph construction module is used to construct a graph structure using network traffic data of the network to be detected; the nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent multi-dimensional traffic characteristics between the corresponding devices.

[0031] The feature aggregation module is used to obtain the first multidimensional feature of the node, and aggregate the first multidimensional feature of the node and the multidimensional traffic feature associated with the node to obtain the second multidimensional feature of the node.

[0032] The attention aggregation module is used to aggregate the second multi-dimensional features of each neighboring node according to the attention weights of each neighboring node, and fuse the aggregated features with the second multi-dimensional features of the node to obtain the third multi-dimensional features of the node.

[0033] The feature equalization module is used to adjust the features of each dimension in the third multi-dimensional feature based on the importance of each dimension type to anomaly detection.

[0034] The anomaly detection module is used to input the adjusted third multidimensional feature into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

[0035] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in the first aspect.

[0036] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0037] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0038] The aforementioned network traffic detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product construct a graph structure using network traffic data of the network to be detected. Nodes in the graph structure represent devices in the network to be detected, and edges represent multidimensional traffic features between corresponding devices. The method acquires the first multidimensional feature of each node and aggregates the first multidimensional feature of the node with the multidimensional traffic features associated with the node to obtain the second multidimensional feature of the node. Based on the attention weights of each neighboring node, the second multidimensional features of each neighboring node are aggregated, and the aggregated features are fused with the second multidimensional feature of the node to obtain the third multidimensional feature of the node. Based on the importance of each dimension type in the third multidimensional feature for anomaly detection, the features of each dimension in the third multidimensional feature are adjusted. The adjusted third multidimensional feature is input into a pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected. This scheme, through graph structure modeling, aggregating local features of nodes, focusing attention on key associations of neighboring nodes, and balancing feature dimensions—a progressive feature processing flow—can extract deep features that are highly sensitive to anomalies and have strong discriminative power from complex, high-dimensional network traffic data, thereby significantly improving the accuracy of anomaly detection. By focusing attention on key associations of adjacent nodes and balancing feature dimensions, we can dynamically focus on key information and adaptively adjust feature attention, thereby improving robustness in the face of new attacks or changes in the network environment. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart illustrating a network traffic detection method in one embodiment;

[0041] Figure 2 This is a flowchart illustrating the second multidimensional feature acquisition step in one embodiment;

[0042] Figure 3 Here is a block diagram of a network traffic anomaly detection system in another embodiment;

[0043] Figure 4 This is a flowchart illustrating the feature extraction process in a deep graph neural network traffic anomaly detection method based on Hamon multidimensional feature dynamic equalization in one embodiment.

[0044] Figure 5 This is a flowchart illustrating the process of obtaining feature dimension weights during the dynamic balancing of Hamon's multidimensional features in one embodiment.

[0045] Figure 6 This is a structural block diagram of a network traffic detection device in one embodiment;

[0046] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] It should be noted that the terms "first," "second," etc., used in this application may be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more.

[0049] In one exemplary embodiment, such as Figure 1As shown, a network traffic detection method is provided. This method is executed by a computer device, specifically by a terminal or server alone, or by both a terminal and a server. Taking the application of this method to a server as an example, it includes the following steps S102 to S110. Wherein:

[0050] Step S102: Construct a graph structure using the network traffic data of the network to be detected; the nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent the multidimensional traffic characteristics between the corresponding devices.

[0051] Here, an edge can represent a connection between two nodes corresponding to different devices, indicating a traffic transmission relationship. Multidimensional traffic features refer to the set of attributes attached to the edge that quantify and describe this traffic interaction; these are called edge feature vectors. For example, an edge feature vector might contain specific values ​​for multiple dimensions such as average packet size, transmission protocol type encoding, packet arrival time variance, and traffic duration.

[0052] For example, the server uses the network traffic data of the network to be detected to construct a graph structure, treats the devices involved in the network traffic data as nodes, and establishes an edge between the devices corresponding to the nodes if there is data interaction between them. Based on the analysis and statistics of the network traffic data, a feature vector is stored for each edge as the edge feature vector, which is the vector corresponding to the multi-dimensional traffic features.

[0053] Step S104: Obtain the first multidimensional feature of the node, and aggregate the first multidimensional feature of the node and the multidimensional traffic feature associated with the node to obtain the second multidimensional feature of the node.

[0054] The first multidimensional feature can refer to the node's initial or basic features, which are inherent attributes of the node itself and are unrelated to the edge interactions at the current moment. Examples include device type encoding, user identity category, and historical average traffic rate.

[0055] For example, the server first reads the initial attributes of each node to obtain the first multidimensional feature of the node, and then fuses the first multidimensional feature of the target node with the multidimensional traffic features corresponding to all edges connecting to the node, so that the second multidimensional feature of each node contains the interaction information of its direct communication object.

[0056] Step S106: Based on the attention weights of each neighboring node, aggregate the second multidimensional features of each neighboring node, and fuse the aggregated features with the second multidimensional features of the node to obtain the third multidimensional features of the node.

[0057] Among them, the second multidimensional feature is the node feature obtained by aggregating the node's own features and its interaction information with neighboring nodes (edge ​​features), which can reflect the state of the node in the direct communication environment.

[0058] The third multidimensional feature is a node feature obtained by further aggregating neighboring node features through an attention mechanism based on the second multidimensional feature. It not only contains local information but also deeper information from neighbors, filtered according to importance, representing the node's state in the global network context. Attention weights are scalar values ​​used to quantify the importance of the relationship between two connected nodes. They can be dynamically calculated by the model; higher weights mean a greater contribution from the source node to the target node's features during feature aggregation.

[0059] For example, the server obtains the attention weights between the current node and each neighboring node, and then uses these attention weights to perform a weighted summation of the second multidimensional features of each neighboring node to obtain a vector representing a summary of neighboring information. Finally, this summary vector is fused with the second multidimensional features of the current node itself to generate a more discriminative third multidimensional feature.

[0060] Step S108: Adjust the features of each dimension in the third multidimensional feature based on the importance of each dimension type for anomaly detection.

[0061] Here, dimension type can refer to the semantic category of each independent component in the feature vector of a node. For example, the first dimension of the feature vector might correspond to "packet size," and the second dimension to "protocol type." Each type represents a different aspect of the observed network. Importance is an indicator used to measure the contribution of a particular dimension type in distinguishing between normal and abnormal traffic, and can be calculated based on statistics (such as information gain, variance) or model feedback (such as gradient).

[0062] For example, the server obtains the various dimension types in the third multidimensional feature, then determines the importance of each dimension type to the current anomaly detection, further determines the dimension weight corresponding to each dimension type, and then rescales the dimension value corresponding to the dimension type using the dimension weight to obtain the adjusted third multidimensional feature.

[0063] Step S110: Input the adjusted third multidimensional feature into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

[0064] For example, the server loads a pre-trained network traffic anomaly detection model, inputs the adjusted third multidimensional feature into the model, and the model outputs a prediction result about whether the traffic of the node corresponding to the third multidimensional feature is abnormal based on the decision boundary it has learned internally, such as labeling it as normal / abnormal, or an abnormal probability value.

[0065] The aforementioned network traffic detection method employs a progressive feature processing flow: graph structure modeling, aggregation of local features of nodes, focus on key associations of adjacent nodes, and balancing feature dimensions. This process extracts highly sensitive and discriminative deep features from complex, high-dimensional network traffic data, significantly improving anomaly detection accuracy. Focusing on key associations of adjacent nodes and balancing feature dimensions allows for dynamic focusing on key information and adaptive adjustment of feature attention, enhancing robustness against new attacks or changes in the network environment.

[0066] In one exemplary embodiment, such as Figure 2 As shown, step A includes steps S202 to S204. Wherein:

[0067] Step S202: Using the first convolutional layer in the graph convolutional network, the first multidimensional features of the nodes, the preset dimensionality reduction weight matrix, the multidimensional traffic features associated with the nodes, and the edge weights corresponding to the multidimensional traffic features are aggregated to obtain the single-dimensional fusion features of the nodes; the edge weights are obtained after normalization based on the number of edge connections of each node.

[0068] Graph convolutional networks (GCNNs) are used to perform convolution operations on graph data, updating the features of each node to an aggregated feature consisting of its own features and the features of all its neighboring nodes. A convolutional layer is the basic unit for feature propagation and aggregation within this network. The dimensionality reduction weight matrix is ​​a learnable parameter matrix used to map the high-dimensional first multi-dimensional features of the input to a lower-dimensional space, reducing the number of parameters during initial fusion, capturing the most crucial interaction information, and preventing overfitting. Edge weights can be coefficients used to balance the contributions of different neighbors when aggregating neighbor information. In this embodiment, the edge weights are determined by the degree of the node, i.e., obtained by normalizing the number of edge connections of each node.

[0069] Step S204: Using the second convolutional layer in the graph convolutional network, based on the node's single-dimensional fusion features, the preset up-dimensional weight matrix, the multi-dimensional traffic features associated with the node, and the edge weights corresponding to the multi-dimensional traffic features, the node's multi-dimensional fine representation is reconstructed to obtain the node's second multi-dimensional features.

[0070] The upscaling weight matrix is ​​a learnable parameter matrix used to map low-dimensional fused features back to a higher-dimensional space. This restores the expressive power of the features, constructing richer and more refined representations to accommodate subsequent attention mechanisms and Hamon equalization. Multi-dimensional refined representations refer to the restoration or transformation of node features into vectors with multiple dimensions after the second convolution layer. These vectors not only contain information from first-order neighbors but also indirectly aggregate information from second-order neighbors (neighbors' neighbors) through two convolution layers, providing a more detailed and comprehensive characterization of the node's role in the network. In some examples, the server can also utilize graph convolutional networks with more than two convolutional layers for further layers of convolution, further comprehensively characterizing the node's role in the network.

[0071] For example, the server multiplies the first multidimensional feature matrix of a node with the normalized adjacency matrix to aggregate neighbor information. Then, it multiplies by a dimensionality-reduction weight matrix to reduce the feature dimension to one dimension. Finally, it uses an activation function to output a one-dimensional fused feature. The specific calculation process can be represented by the following formula:

[0072]

[0073] in, It is the first multidimensional feature of the node; It is the matrix after adding self-joins to the adjacency matrix; It is the corresponding degree matrix; It is the input node feature matrix; It is the weight matrix of the first layer, i.e., the dimension-reduced weight matrix; It is the activation function (ReLU). The matrix à carries edge features through element-weighted methods (e.g., assigning the quantized multidimensional flow characteristics of the edges to the position of "I" in Ã); the degree matrix... The edge weights are obtained by normalizing the contribution of neighbor features by the number of node connections.

[0074] Then the server uses the above formula to transform the first multidimensional feature. Multiply again by the same normalized adjacency matrix (aggregating second-order neighbor information), and then multiply by the increased-dimensional weight matrix. This increases the feature dimension, resulting in the final second multidimensional feature. The feature dimensions of the second multidimensional feature can be set according to the needs of downstream tasks and matched with the input dimensions of subsequent steps.

[0075] In this embodiment, by cascading two convolutional layers in a graph convolutional network, a hierarchical extraction from local direct interaction features to indirect global context features is achieved. This enables the capture of more complex network patterns, such as associations passed through intermediate nodes, thus enhancing the expressive power of the features. By first increasing the dimensionality and then decreasing it to create an information bottleneck in the intermediate layer, the network is forced to learn the most robust core features, which helps prevent overfitting in deep networks and improves the model's generalization ability.

[0076] In an exemplary embodiment, the step of obtaining the attention weights of each neighboring node of a node includes: concatenating the second multidimensional features of the node with the second multidimensional features of the neighboring nodes of the node; multiplying the concatenated features with a preset attention vector, and processing the product using a preset activation function to obtain the attention weights of the neighboring nodes of the node.

[0077] Here, concatenation refers to the operation of joining two feature vectors end-to-end in a dimensional direction to form a longer feature vector. The pre-defined attention vector is a learnable parameter vector used to map the concatenated high-dimensional features into a scalar score, which represents the original correlation between the two nodes. The activation function can be a non-linear function used to process the original correlation score, such as LeakyReLU, which introduces non-linearity and ensures that the gradient does not completely vanish on negative inputs, enabling the model to learn negatively correlated attention.

[0078] For example, for each edge connecting node i and its neighbor node j in the graph, the server concatenates the second multidimensional feature hi of node i and the second multidimensional feature hj of neighbor node j into vectors. The concatenated vector is then dot-producted with an attention vector a of learnable coefficients to obtain a scalar. This scalar is input into the LeakyReLU activation function to obtain an unnormalized attention score. Finally, the scores of all neighbor nodes j of node i are normalized to obtain the final attention weights. The sum of all attention weights is 1. The attention score can be calculated using the following formula:

[0079]

[0080] and These are the feature vectors of nodes i and j; W is the weight matrix, and a is the attention vector. This indicates vector concatenation.

[0081] This embodiment provides a specific and implementable calculation process for attention weights, clarifying that they rely on the interactive calculation of features from two nodes, rather than static or random assignment, ensuring the rationality and learnability of weight generation. Furthermore, by allowing the model to learn the attention vector, the model can autonomously discover key patterns for judging the importance of node associations, thereby more accurately focusing on network connections most relevant to abnormal behavior and further improving feature quality.

[0082] In an exemplary embodiment, the adjustment of each dimension feature in the third multidimensional feature based on the importance of each dimension type to anomaly detection includes: obtaining the historical weights of the dimension types and obtaining the current importance measure of the dimension types; the current importance measure is obtained based on the importance of the dimension type in the current detection; the current weight of the dimension type is obtained by the ratio of the product of the historical weight and the current importance measure to the sum of the products of the historical weights and their corresponding current importance measures of each dimension type; and the weighted processing of each dimension feature in the third multidimensional feature is performed according to the current weight of each dimension type.

[0083] Historical weights refer to the weight values ​​assigned to a feature dimension type in the previous iteration or time step. Current importance metrics refer to the value by which a feature dimension type contributes to distinguishing between anomalies and normal data in the current specific detection context or current batch of data. This can be calculated in real time, for example, by calculating the point mutual information and variance between the feature value of this dimension and the anomaly label, or by evaluating it through a small neural network.

[0084] For example, the server maintains a dimensional weight vector. For a new batch of third-dimensional features, the current importance metric for each feature dimension can be calculated through online statistical analysis or a lightweight evaluator. The weights are then updated according to a formula, and the updated weights are used to perform element-wise multiplication on the input third-dimensional features to adjust them. Furthermore, the updated weights can be stored in the dimensional weight vector for future updates. The formula for updating the weights is shown below:

[0085]

[0086] in, It is the weight of feature dimension i in the third multidimensional feature at the (t+1)th iteration; It represents the weight of feature dimension i at the t-th iteration; It is a measure of the importance of feature dimension i in the current iteration, obtained by calculating the correlation between the feature and the anomaly label or other feature evaluation methods.

[0087] In this embodiment, the weights of the dimension types are dynamically updated based on the statistical characteristics exhibited by the current data stream, enabling the model to quickly adapt to changes in network traffic patterns or feature shifts from new attacks. Furthermore, the iterative update formula based on historical weights avoids abrupt weight changes, resulting in a smoother convergence of the feature balancing process and more reliable adjusted output features.

[0088] In an exemplary embodiment, the adjusted third multidimensional feature is input into a pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected. This includes: inputting the adjusted third multidimensional feature into the pre-trained network traffic anomaly detection model, obtaining the distance between the adjusted third multidimensional feature and the hyperplane in the network traffic anomaly detection model through the network traffic anomaly detection model, and determining the node corresponding to the adjusted third multidimensional feature as an abnormal node if the distance is greater than a preset distance threshold, and determining the transmission traffic of the abnormal node as abnormal traffic.

[0089] In this context, a hyperplane refers to a decision boundary in a high-dimensional feature space that separates samples from different classes. In Support Vector Machines (SVMs), the optimal hyperplane is the plane that maximizes the margin between the two classes. Distance can refer to the functional or geometric margin between a sample point (adjusted third multi-dimensional feature) and the hyperplane. A larger absolute value indicates that the sample is farther from the decision boundary, and the higher the confidence in belonging to its class. A distance close to 0 indicates that the sample falls near the boundary and is difficult to classify.

[0090] An anomalous node can refer to a network device identified as abnormal by the detection model based on its associated adjusted third-dimensional features, indicating that the device's current behavior pattern significantly deviates from the normal baseline. Abnormal traffic can refer to all or part of the network traffic initiated, received, or forwarded by an anomalous node. By locating the anomalous node, the server can then associate and trace the specific anomalous data stream.

[0091] For example, the server loads the pre-trained model parameters, calculates the distance from the adjusted third multi-dimensional feature to the hyperplane using the loaded detection model, compares the obtained distance with a preset distance threshold, and if the distance is greater than the preset distance threshold, the node corresponding to the feature is determined to be abnormal.

[0092] In this embodiment, the detection results are made clearer by using specific and quantifiable node anomaly judgment criteria based on distance thresholds, making it easier for relevant personnel to understand and adjust the detection sensitivity.

[0093] In an exemplary embodiment, the step of obtaining the network traffic anomaly detection model includes: obtaining a support vector machine as the network traffic anomaly detection model to be trained; obtaining normal devices and abnormal devices from historical network traffic data, and obtaining the adjusted third-dimensional features corresponding to normal devices as positive samples and the adjusted third-dimensional features corresponding to abnormal devices as negative samples; inputting the positive samples and negative samples into the network traffic anomaly detection model to be trained, with the goal of finding a hyperplane to separate the positive samples and negative samples, to obtain a trained network traffic anomaly detection model.

[0094] Support Vector Machines (SVMs) are a supervised learning classification model whose core idea is to find a hyperplane that can separate two classes of samples with the largest margin. Positive samples can refer to the feature vectors corresponding to normal devices. Negative samples can refer to the feature vectors corresponding to abnormal devices (devices that have been attacked or are behaving abnormally). The positive / negative samples are adjusted third-dimensional features obtained after the aforementioned complete processing steps of historical data, to ensure that the feature distribution and generation process of the training data are completely consistent with those of the online real-time detection data.

[0095] For example, historical network traffic data can be collected and labeled by security experts or known attack logs to determine which devices were normal (positive sample sources) and which were abnormal (negative sample sources) during which periods. This historical data is then processed completely through the aforementioned steps to obtain the corresponding adjusted third multi-dimensional features, which are then labeled to form a training dataset. An SVM model is initialized using the prepared training dataset. By solving the aforementioned optimization problem—that is, finding a hyperplane to separate positive and negative samples—the optimal model parameters are learned. The trained parameters are saved for later use.

[0096] In this embodiment, the same feature processing steps as the aforementioned data processing flow are explicitly used to generate training samples, which fundamentally avoids the performance degradation caused by inconsistency between features during training and inference, and ensures the effectiveness of the model in actual deployment.

[0097] In one exemplary embodiment, obtaining the first multidimensional feature of a node includes: obtaining the first multidimensional feature of the node based on the node's device type, user category, and historical traffic baseline.

[0098] Here, "device type" refers to the classification of network devices represented by a node according to their function or role. "User category" refers to the classification of users or entities associated with a node. Different user categories may have different normal behavior patterns. "Historical traffic baseline" refers to the summary characteristics calculated based on the node's traffic statistics over a past period, used to describe its behavioral level. For example, the average traffic rate over the past 24 hours, the variance of the traffic rate over the past week, and the encoding of common destination port sets provide a reference benchmark for judging whether the current behavior deviates from the norm.

[0099] For example, a server can query the asset database or infer the device type (such as a server) and user category (such as an individual user) based on the node's IP address, MAC address, or other identifiers. Then, it can statistically analyze the node's key traffic metrics over a past baseline period from the historical traffic database to calculate its historical traffic baseline vector. Finally, the feature vectors from these three parts are combined to form the node's first multidimensional feature vector. For example: First multidimensional feature = CONCAT(Device type code, User category code, Historical traffic baseline vector).

[0100] In this embodiment, the first multidimensional feature integrates the device's static attributes (device type, user category) and dynamic historical patterns (historical baseline), providing rich and physically meaningful initial input for subsequent network operations. This prior knowledge effectively guides model learning, accelerates convergence, and improves performance in cold start or data-sparse scenarios. Because the initial features have clear business implications (e.g., "This is a database server used by an administrator, and its historical traffic is very low"), subsequent analysis results based on these features (e.g., why it was judged as abnormal) are more easily understood and trusted by relevant personnel.

[0101] In one exemplary embodiment, this application also provides a method for detecting network traffic anomalies based on a deep graph neural network with dynamic equalization of Hamon's multidimensional features, such as... Figure 3 As shown, this method is implemented based on a network traffic anomaly detection system composed of the following system modules:

[0102] Network traffic data acquisition module: responsible for collecting raw traffic data from the network, including but not limited to information such as packet size, timestamp, source address, destination address, and protocol type.

[0103] Graph model building module: Converts the collected network traffic data into a graph structure, with devices, users, etc. as nodes and traffic relationships as edges, providing a foundation for subsequent graph neural network processing.

[0104] Feature extraction module: Uses Graph Convolutional Network (GCN) and Graph Attention Network (GAT) to extract features from the constructed graph model and obtain the initial feature representations of the nodes.

[0105] Hamon Multidimensional Feature Dynamic Equalization Module: Utilizing the Hamon multidimensional feature dynamic equalization mechanism, this module automatically adjusts the weights of different feature dimensions, enhancing the model's ability to capture key features and optimizing feature representation.

[0106] Anomaly detection module: Based on the optimized feature representation, an anomaly detection model is built to detect network traffic in real time and determine whether there is abnormal traffic.

[0107] Output and Early Warning Module: Outputs anomaly detection results and issues early warning signals in a timely manner when an anomaly is detected, reminding network administrators to take appropriate measures.

[0108] Then, the above-mentioned network traffic anomaly detection method based on Hamon's multidimensional feature dynamic equalization deep graph neural network can specifically include:

[0109] Step 1: Network Traffic Data Acquisition. The network traffic data acquisition module collects network traffic data in real time from key nodes and links in the network. The collected data includes detailed information such as packet size, timestamp, source address, destination address, protocol type, transport layer port number, and packet arrival time interval. Taking a typical network scenario as an example, assuming data acquisition is performed at the egress router of a large data center, the data acquisition frequency is set to collect traffic data once per second. The amount of data collected each time is dynamically adjusted according to the actual network bandwidth and traffic conditions. For example, the higher the traffic of the network being collected, the higher the acquisition frequency, ensuring that the key characteristic information of the network traffic can be completely obtained, providing a rich data foundation for subsequent graph model construction.

[0110] In one example, the specific data format collected can be shown in the table below:

[0111]

[0112] Step 2: Graph Model Construction. The collected network traffic data is converted into a graph structure. Using network devices (such as servers, routers, switches, etc.) and user terminals as nodes in the graph, edges are constructed between nodes based on traffic transmission relationships. For example, when a data packet is sent from server A to user terminal B, a directed edge is constructed from node A to node B in the graph, and the traffic characteristics of this edge are recorded, such as packet size and transmission protocol. Simultaneously, initial attribute information, such as device type and user category, is added to each node. When constructing the graph model, the network topology and the temporal characteristics of the traffic also need to be considered. Considering these factors helps to construct a more accurate graph model that reflects the true dynamic changes in network traffic, providing a reliable foundation for subsequent analysis. In one example, assuming the constructed graph model has 5 nodes (nodes 1-5), representing different network devices and user terminals, the adjacency matrix A constructed based on the collected data can be shown in the following table:

[0113]

[0114] In the adjacency matrix, an element value of 1 indicates that there is a traffic transmission relationship between two nodes, while 0 indicates that there is no traffic transmission relationship. The traffic characteristics (such as packet size) of each edge are shown in the table below:

[0115]

[0116] Step 3: Feature extraction. For example... Figure 4 As shown, Graph Convolutional Network (GCN) and Graph Attention Network (GAT) are used to extract features from the constructed graph model. First, the node features and edge structure of the graph model are input into the GCN, and the node features are aggregated and updated through graph convolution operations to obtain the preliminary feature representation of the nodes.

[0117] In this graph model, "nodes" correspond to entities in the network (such as servers, routers, user terminals, etc.), and "node features" are the quantitative representations of the attributes of these entities. The core features include two parts: first, the inherent attributes of the entity, namely the static attributes mentioned in this application, such as device type (e.g., server, terminal) and user type (e.g., individual user, enterprise user), which are the basic identifiers of the node; second, the traffic attributes associated with the entity, such as the dynamic features related to the node, such as the size of historical data packets and transmission protocol preferences. These features provide core data support for GCN to aggregate node information and achieve preliminary feature extraction through convolution operations. The "edge structure" is a combination of inter-node interaction relationships and traffic features: on the one hand, the 0 / 1 values ​​in the adjacency matrix clearly indicate whether there is traffic transmission between nodes (1 indicates a transmission relationship, 0 indicates no), defining the interaction links in the network topology; on the other hand, each edge is accompanied by specific traffic features (such as the data packet size, transmission protocol, and data packet arrival time interval mentioned in this application). These features not only reflect the dynamic attributes of traffic between nodes but also provide necessary interaction dimension information for GAT to capture key associations between nodes and optimize feature representation through attention mechanisms.

[0118] Taking a two-layer GCN as an example, the convolution operation in the first layer is as follows:

[0119]

[0120] in, It is the matrix after adding self-joins to the adjacency matrix; It is the corresponding degree matrix; It is the input node feature matrix; It is the weight matrix of the first layer; It is the activation function (ReLU). Assume the initial node feature matrix... for:

[0121]

[0122] weight matrix for:

[0123]

[0124] Wherein, the initial node feature matrix Feature dimensions 1, 2, and 3 focus on the initial inherent attributes and static association features of the nodes themselves, specifically corresponding to three core dimensions: First, the device type dimension, which quantifies the hardware or functional type of the node (e.g., distinguishing between servers, routers, and user terminals); second, the user category dimension, which quantifies the user attributes associated with the node (e.g., distinguishing between enterprise users and individual users); and third, the node's historical traffic baseline dimension, such as static baseline values ​​like the node's historical average data packet size and historical average transmission frequency. This aligns with the description in step 2 of the graph model construction above, which states that "initial attribute information, such as device type and user category, is added to each node." These are basic features that can be directly labeled on the nodes themselves, clearly distinguishing them from the real-time dynamic traffic features of the edges. The reason why it does not directly contain edge structure features is because Positioned as the "initial feature matrix of nodes," it requires providing the node's own attribute anchor points, while edge structure features (such as real-time data packet size and transmission protocol) are dynamic features generated by interactions between nodes. Their fusion is achieved through the network structure design of GCN: In the formula, the adjacency matrix Ã(A+I) can carry edge features through element weighting (such as quantizing the flow characteristics of the edges and assigning them to the position of "I" in Ã), and the degree matrix... The contribution of neighbor features is balanced by normalizing the number of node connections. Finally, in the convolution operation, the edge structure features and the initial node features are dynamically aggregated and integrated. In the initial feature representation of the nodes, the edge structure features are not unfused, but feature fusion is achieved through the core operation mechanism of GCN.

[0125] The node feature matrix after the first convolution operation The calculation is as follows: First, calculate the degree matrix. For the adjacency matrix after adding self-connections The degree of each node is:

[0126] Node 1: 1 (self-connection) + 1 (edge ​​to node 2) = 2.

[0127] Node 2: 1 (self-connection) + 1 (edge ​​to node 3) = 2.

[0128] Node 3: 1 (self-connection) + 1 (edge ​​to node 4) = 2.

[0129] Node 4: 1 (self-connection) + 1 (edge ​​to node 5) = 2.

[0130] Node 5: 1 (self-connect) = 1.

[0131] so, Given a diagonal matrix with diagonal elements [2, 2, 2, 2, 1]. Then, calculate... This corresponds to the description above: balancing neighbor feature contributions by normalizing the number of node connections; assuming the result is matrix M. Next, ... Multiply, we get The result is:

[0132]

[0133] Multiplying matrix M by the above result dynamically aggregates the edge structure features and the initial node features, and then processes this aggregation using the ReLU activation function to obtain... for:

[0134]

[0135] In the table, the feature value of each node is a single-dimensional aggregated feature obtained by the first layer of GCN through convolution operation, which fuses the initial multi-dimensional features of the node (such as device type and historical traffic baseline) with the edge information of the interaction of neighboring nodes. Its core function is to provide "preliminary associated node features" for subsequent processes. It retains the basic attributes of the node itself and incorporates the traffic interaction information of neighboring nodes. This provides a foundation for the Graph Attention Network (GAT) to further capture key associations between nodes and for the Hamon multi-dimensional feature dynamic balancing mechanism to adjust feature weights. Ultimately, it supports the anomaly detection model (such as SVM) to accurately distinguish the traffic behavior of normal and abnormal nodes.

[0136] Next, a second convolutional operation is performed, similar to the calculation in the first layer, to further fuse the features of neighboring nodes, ultimately obtaining the feature representation of the node. .

[0137] In this system, the input to the second-layer GCN is the output of the first-layer GCN. (Single-dimensional aggregated features) and graph structure information (adjacency matrix, degree matrix) (Unchanged, because the network topology has not changed) Output The design uses three-dimensional features, which is a reasonable setting based on subsequent needs in this application: the first convolutional layer focuses on "initial aggregation of neighbor information," compressing the multi-dimensional initial features into a single dimension to simplify the first round of information fusion; the second convolutional layer uses a weight matrix... The dimensional mapping (e.g., mapping from 1D back to 3D) reconstructs a multi-dimensional, refined representation of nodes, deepening the feature extraction hierarchy (capturing multi-level indirect relationships between nodes, such as the chain interaction of "node 1-node 2-node 3") and restoring the multi-dimensional attributes of features. This satisfies the core requirement of Hamon's multi-dimensional feature dynamic balancing mechanism to "adjust the weights of multi-dimensional features." The key benefit of performing a second convolution is improving feature representation capabilities: nodes in graph data often have multi-level indirect interactions (e.g., devices communicate indirectly through intermediate nodes). A single layer cannot fully capture such complex relationships. The second convolution, by aggregating "aggregated features of neighbors," can more comprehensively characterize the global behavior patterns of nodes in the network, reducing false positives and false negatives in anomaly detection caused by insufficient feature extraction. This is the core reason why deep graph neural networks are more suitable for complex network traffic data than shallow models.

[0138] Then, the features extracted by GCN are input into GAT, and the complex relationships and importance between nodes are further captured through the graph attention mechanism. The attention calculation formula of GAT is:

[0139]

[0140] in, and These are the feature vectors of nodes i and j; W is the weight matrix, and a is the attention vector. This indicates vector concatenation.

[0141] Suppose that in GAT, the weight matrix W maps the node feature dimension from 3D to 2D. The weight matrix W can be:

[0142]

[0143] The purpose of using the weight matrix W for dimensionality reduction is mainly to reduce the dimensionality of node features, reduce model complexity and computational cost, simplify the model, reduce the risk of overfitting, and also help to highlight more important features.

[0144] Assuming the node feature matrix is ​​extracted by GCN for:

[0145]

[0146] Will Multiplying by W yields a new feature representation:

[0147]

[0148] Then, the attention coefficient between nodes is calculated. Taking node 1 and node 2 as an example, the calculation process is as follows:

[0149]

[0150] Since 1.485 is greater than 0, it is directly taken as 1.485. Similarly, the attention coefficients between other nodes are calculated and normalized to obtain the final attention weight matrix.

[0151] The final attention weight matrix is ​​the core basis for optimizing node features in the Graph Attention Network (GAT), used to quantify the importance of information interactions between nodes. When updating node features, instead of equally aggregating the features of all neighboring nodes, the matrix's weights are used as the scale—the higher the weight, the greater the contribution of the neighboring node's feature information to the current node. This focuses on key interactions between nodes, providing more accurate feature support for subsequent feature analysis and anomaly detection. The attention weights between nodes change the node's own multi-dimensional features through "weighted aggregation of neighboring node multi-dimensional features": for any node, the multi-dimensional features of each of its neighboring nodes are multiplied by their corresponding attention weights according to the attention weight matrix to achieve importance weighting; then, the weighted neighboring node multi-dimensional features are fused with the current node's own multi-dimensional features to generate optimized node multi-dimensional features. For example, if the attention weights of node 1 and node 2 are significantly higher than other neighbors, the updated multi-dimensional features of node 1 will retain more effective information from node 2's features, thereby strengthening the characterization of key relationships between nodes and improving the feature's ability to represent network traffic patterns.

[0152] Step 4: Dynamic Equalization of Hamon's Multidimensional Features. For example... Figure 5 As shown, the Hamon multidimensional feature dynamic balancing mechanism is used to automatically adjust the weights of different feature dimensions. Assume we have d feature dimensions, and the initial weight of each feature dimension i is... The Hamon multidimensional feature dynamic balancing mechanism dynamically adjusts the weights based on the importance of features in anomaly detection. The specific algorithm formula is as follows:

[0153]

[0154] in, It represents the weight of feature dimension i at the (t+1)th iteration; It represents the weight of feature dimension i at the t-th iteration; It is a measure of the importance of feature dimension i in the current iteration, obtained by calculating the correlation between the feature and the anomaly label or other feature evaluation methods.

[0155] The aforementioned process first extracts node features from the network traffic graph model using GCN and GAT, retaining independent values ​​for dimensions such as "packet size, transmission protocol, and packet arrival time interval." Then, the Hamon mechanism is used to dynamically weight these independent dimensional features. Finally, the weighted features are fused and used as input to the anomaly detection model (SVM). It's important to note that Hamon's dynamic balancing of multidimensional features must be performed "after feature extraction and before multidimensional feature fusion." If multidimensional features have already been fused during feature extraction (e.g., merging dimensional values ​​into a single vector), the fused features must be split to restore the independence of each dimension before Hamon weighting; otherwise, the weights cannot be accurately applied to individual dimensions, negating the purpose of dynamic balancing focused on key features.

[0156] In network traffic anomaly detection, assuming that preliminary analysis reveals a high correlation between sudden changes in packet size and network attack behavior (such as DDoS attacks), its The value is relatively high. For example, initially, all feature dimensions have equal weights. Suppose there are 3 feature dimensions (data packet size, transmission protocol, and data packet arrival time interval), and the initial weights are all equal. After the first iteration, the importance of each feature dimension was calculated as follows:

[0157]

[0158] The weights after the first iteration are then updated as follows:

[0159]

[0160]

[0161]

[0162] The first iteration calculates feature importance and updates weights based on the correlation between features and anomaly labels. Training is performed using historical data, and the applied version directly uses the trained weights. Subsequent iterations repeatedly execute the Hamon multidimensional feature dynamic balancing weight update process: each iteration updates weights based on the current weights of each feature dimension and their importance in anomaly detection. The calculation formula is recalculated to recalculate the weights, continuously strengthening the weight ratio of feature dimensions that are more important for anomaly detection, until the weights converge (the change is less than the threshold) or the preset number of iterations is reached, ultimately achieving a dynamic and accurate balance of feature weights.

[0163] After several iterations, the weights of key feature dimensions (such as the data packet size in the above assumption) gradually increase, while the weights of non-key feature dimensions (such as the transmission protocol in the above assumption) decrease, enabling the model to focus more on features that have a significant impact on anomaly detection.

[0164] The following details the input acquisition and output logic through three steps: feature extraction, Harmon weighting, and anomaly detection input:

[0165] Step 1: Feature Extraction (GCN+GAT) Input: The completed graph model, containing two core data components: Initial multi-dimensional node features: Raw attributes directly derived from network traffic data, such as independent values ​​for dimensions like "packet size, transmission protocol, and packet arrival time interval," as well as inherent attributes like device type and user type; Edge structure between nodes: Reflecting the traffic transmission relationships between nodes and the dynamic features attached to edges (such as real-time packet size). Output: Multi-dimensional node feature representations retaining the independence of each dimension (e.g., values ​​for dimensions like packet size and transmission protocol are not fused), serving as input to the Hamon multi-dimensional feature dynamic balancing mechanism.

[0166] Step Two: Harmon Multidimensional Feature Dynamic Balancing Input: Independent dimensional features output from Step One (such as feature values ​​for each dimension, including packet size and transmission protocol); "Importance of Anomaly Detection" for each feature dimension: calculated using the feature's discriminatory power against anomalies (such as information gain and chi-square test results). Processing and Output: The weights of each feature dimension are dynamically adjusted using the formula here, outputting the weighted feature values ​​for each dimension (e.g., the value of the "Packet Size" dimension multiplied by its dynamic weight, and the same applies to the "Transmission Protocol" dimension).

[0167] Step 3: Feature Fusion and Input to Anomaly Detection Model. Input: Weighted features from Step 2 (e.g., weighted packet size, transmission protocol, packet arrival time interval, etc.). Processing and Output: Concatenate and fuse the weighted features into a single feature vector, which is then input into the anomaly detection model (e.g., SVM) to train the model to identify abnormal patterns in network traffic, ultimately achieving accurate anomaly detection.

[0168] Step 5: Anomaly Detection Model Construction. Based on the optimized feature representation, an anomaly detection model is constructed. A supervised learning method is employed, using samples labeled as normal and abnormal from historical traffic data as training data. Support Vector Machine (SVM) is selected as the anomaly detection model. The training process aims to find a hyperplane that separates normal and abnormal samples. The optimization problem is as follows:

[0169]

[0170] The constraints are:

[0171]

[0172] Where w is the weight vector, b is the bias term, and C is the penalty parameter. It is a slack variable. It is a feature mapping function that maps input features to a high-dimensional space. These are sample labels (1 for normal, -1 for abnormal). Their physical meaning is that a small number of samples can be misclassified (through...). and Under the premise of control, the margin between the features of normal samples and abnormal samples is maximized, thereby obtaining a decision boundary with strong generalization ability.

[0173] Historical data needs to be processed through steps 2-4 to ensure that the characteristics of the training data are consistent with those of the subsequent real-time detection data. First, step 2 outputs the graph structure and initial features; step 3 outputs the extracted feature representations; and step 4 outputs the optimized feature representations for training and real-time detection. First, let's clarify the input-output and dimensional correspondence of steps 2-4: Step 2 (graph model construction) takes the original network traffic data as input and outputs two parts: one is the graph structure reflecting nodes (devices / users) and edges (traffic relationships), and the other is the initial node feature matrix (assuming it's 3-dimensional, corresponding to device type, user type, historical traffic baseline, etc.). Step 3 (GCN+GAT feature extraction) takes the graph structure and the 3-dimensional initial node feature matrix output from step 2 as input. After extracting node association information through convolution and attention mechanisms, it outputs a 3-dimensional feature representation with unchanged dimensions (still corresponding to the original feature dimensions, but incorporating neighbor interaction information). Step 4 (Hamon multidimensional feature balancing) takes the 3-dimensional feature representation from step 3 as input. By dynamically adjusting the weights of each dimension, it finally outputs a weighted 3-dimensional optimized feature representation. The data dimensions of each step are always aligned to ensure that the input of the next level can directly match the output of the previous level. Next, let's explain the logic of how these steps are used in the training and real-time detection processes: During training, historical traffic data (including normal / abnormal labels) first goes through steps 2-4 completely: Step 2 first constructs the labeled graph structure and initial features, then Step 3 extracts features, and Step 4 optimizes weights to obtain 3D weighted features. These features, along with the labels, are used as input to train the SVM model. During real-time detection, newly collected network traffic data follows the exact same step chain: Step 2 constructs the real-time graph structure and initial features, Step 3 extracts real-time features, and Step 4 optimizes real-time features to obtain 3D weighted real-time features. These features are directly input into the already trained SVM model to output the anomaly detection results. Both processes rely on the complete processing chain of Steps 2-4 to process the data, ensuring feature quality and model adaptability.

[0174] Suppose we have a training dataset containing 10 normal samples and 5 abnormal samples (samples are feature representations of nodes in a graph, each sample corresponds to one node, and the feature dimension is 3). The feature dimensions are 3 (data packet size, transmission protocol, and data packet arrival time interval). The feature weights after optimization using the Hamon multidimensional feature dynamic equalization mechanism are [0.6, 0.2, 0.2]. The training data is shown in the table below:

[0175]

[0176] During training, cross-validation is used to adjust the parameters C and kernel function parameters (RBF kernel). (Parameters). The SVM model trained in this way can achieve an accuracy of over 95% and a recall of over 90% on the validation set.

[0177] In subsequent applications, pre-stored fixed weights are not used simply by determining the feature dimensions. Instead, the weight logic optimized through the Hamon mechanism during historical data training (such as the ratio of "data packet size weight 0.6, transmission protocol weight 0.2") is dynamically adapted to the feature dimensions of real-time data. If the feature dimensions of the real-time data are consistent with those during historical training (still data packet size, transmission protocol, and data packet arrival time interval), the optimized weight ratio will be used. If new or adjusted feature dimensions are added in the real-time scenario, the weights will be recalibrated based on the historical weight optimization logic and the importance of the new dimensions to ensure that the weights are adapted to the current data features. The "feature weights optimized by the Hamon multi-dimensional feature dynamic balancing mechanism" only mentions the balancing optimization process, but it does not omit the feature extraction in step 3. Rather, feature extraction in step 3 is the prerequisite for balancing optimization and subsequent detection. Whether in historical training or real-time applications, multi-dimensional features of nodes (such as specific values ​​of data packet size, transmission protocol, etc.) must first be extracted from the graph model through step 3 (GCN+GAT), and then the extracted features are input into step 4 for balancing optimization. This section focuses on the application of the optimized weights, based on the premise that feature extraction has been completed in step 3. It does not skip this step; the two are in a progressive relationship of "extraction first, then balancing" in the data processing chain, and neither can be omitted. The core logic of "historical data is used to determine feature weights, and these weights are directly used in application" is as follows: the historical data stage goes through steps 3 (GCN+GAT feature extraction) and 4 (Hamon multidimensional feature balancing): first, multidimensional features are extracted from the graph model constructed from historical traffic using GCN+GAT; then, fixed weights (such as [0.6, 0.2, 0.2]) are optimized based on these features and stored. In the application stage, there is no need to recalculate the weights; the optimization results are directly reused. It should be further clarified that "no need to repeat feature extraction in application" means that the entire process of "feature extraction and weight optimization of historical data" is not repeated, not that feature extraction is completely omitted. The application phase deals with real-time new traffic data. This type of data does not have readily available feature representations, so it is still necessary to perform feature extraction in step 3 (extracting multi-dimensional features such as packet size and transmission protocol from the graph model constructed from real-time traffic), and then substitute the extracted real-time features into the pre-stored weights for balancing, finally obtaining the input features adapted to the anomaly detection model. The premise of "reusing weights" is to first complete the feature extraction in step 3 on the real-time data.

[0178] Step 6: Real-time Anomaly Detection. After real-time network traffic data undergoes graph model construction, feature extraction, and Hammon multidimensional feature dynamic equalization, it is input into a pre-trained anomaly detection model for real-time detection. For each new network traffic sample, the probability of it being an anomaly or its deviation from normal traffic is calculated. (The probability or deviation calculation is based on the output of the SVM model, which determines the anomaly probability or deviation by the distance between the sample and the hyperplane.) The SVM model determines whether the traffic is abnormal based on the distance of the sample on the hyperplane. The formula for calculating the distance is:

[0179]

[0180] in, is the weight vector of the SVM model, and b is the bias term. It is the feature mapping of the input sample. If If the absolute value of a network traffic sample exceeds a set threshold, it is considered abnormal traffic. The threshold can be adjusted based on the actual network environment and security requirements to balance the false positive and false negative rates. For example, in a real-world network environment, the threshold can be set to 0.8. If a network traffic sample, after the above processing, calculates... Its absolute value is greater than the threshold of 0.8, so the system judges it as abnormal traffic.

[0181] Step 7: Result Output and Early Warning. Output the anomaly detection results and issue an early warning signal promptly when an anomaly is detected. The result output includes detailed information about the abnormal traffic, such as source address, destination address, anomaly type (e.g., DDoS attack, port scan), and the time of anomaly occurrence. Early warning signals can be sent in various ways, such as displaying a warning message on the monitoring interface, sending an SMS or email notification to network administrators, etc. The detailed information about the abnormal traffic is obtained by analyzing the characteristics and attributes of the abnormal samples, such as source address, destination address, anomaly type, and timestamp.

[0182] The aforementioned network traffic anomaly detection method based on Hamon's multidimensional feature dynamic balancing deep graph neural network converts network traffic data into a graph structure and utilizes GCN and GAT to extract node features. This effectively handles complex data, captures node relationships, and provides high-quality features for anomaly detection. It automatically adjusts feature weights, focuses on key features, improves the accuracy of anomaly detection, and reduces the risk of false positives and false negatives. A supervised learning method is used to train the SVM model to achieve anomaly detection, providing reliable real-time security monitoring and ensuring network security and stability. This solution constructs a graph model and extracts features using a deep graph neural network, combining the Hamon multidimensional feature balancing mechanism to dynamically adjust weights, focusing on key features, improving the accuracy of network traffic anomaly detection, and reducing the risk of false positives and false negatives. The SVM-based detection model can monitor traffic in real time, provide early warnings of anomalies, and ensure network security. After implementation, it can reduce operational losses and fault compensation caused by abnormal traffic, improve customer experience and trust, enhance market competitiveness, bring long-term economic benefits, and create business opportunities in areas such as cybersecurity insurance, demonstrating promising application prospects.

[0183] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0184] Based on the same inventive concept, this application also provides a network traffic detection device for implementing the network traffic detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more network traffic detection device embodiments provided below can be found in the limitations of the network traffic detection method described above, and will not be repeated here.

[0185] In one exemplary embodiment, such as Figure 6 As shown, a network traffic detection device is provided, including: a graph construction module, a feature aggregation module, an attention aggregation module, a feature equalization module, and an anomaly detection module, wherein:

[0186] The graph construction module is used to construct a graph structure using network traffic data of the network to be detected. The nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent the multidimensional traffic characteristics between the corresponding devices.

[0187] The feature aggregation module is used to obtain the first multidimensional feature of a node, and aggregate the first multidimensional feature of the node and the multidimensional traffic feature associated with the node to obtain the second multidimensional feature of the node.

[0188] The attention aggregation module is used to aggregate the second multi-dimensional features of each neighboring node based on the attention weights of each neighboring node, and then fuse the aggregated features with the second multi-dimensional features of the node to obtain the third multi-dimensional features of the node.

[0189] The feature equalization module is used to adjust the features of each dimension in the third multidimensional feature based on the importance of each dimension type to anomaly detection.

[0190] The anomaly detection module is used to input the adjusted third multidimensional feature into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

[0191] In an exemplary embodiment, the feature aggregation module is further configured to utilize the first convolutional layer in the graph convolutional network to aggregate the first multidimensional features of the node, a preset dimensionality reduction weight matrix, multidimensional traffic features associated with the node, and edge weights corresponding to the multidimensional traffic features to obtain the single-dimensional fusion features of the node; the edge weights are obtained after normalization based on the number of edge connections of each node; and utilize the second convolutional layer in the graph convolutional network to reconstruct the multidimensional fine representation of the node based on the single-dimensional fusion features of the node, a preset dimensionality increase weight matrix, multidimensional traffic features associated with the node, and edge weights corresponding to the multidimensional traffic features to obtain the second multidimensional features of the node.

[0192] In an exemplary embodiment, the attention aggregation module is further configured to concatenate the second multidimensional features of a node with the second multidimensional features of its neighboring nodes; multiply the concatenated features with a preset attention vector; and process the product using a preset activation function to obtain the attention weights of the neighboring nodes of the node.

[0193] In an exemplary embodiment, the feature equalization module described above is further configured to obtain the historical weights of the dimension types and the current importance measure of the dimension types; the current importance measure is obtained based on the importance of the dimension type in the current detection; the current weight of the dimension type is obtained by the ratio of the product of the historical weight and the current importance measure to the sum of the products of the historical weights of each dimension type and their corresponding current importance measures; and the dimension features in the third multidimensional feature are weighted according to the current weights of each dimension type.

[0194] In an exemplary embodiment, the above-mentioned anomaly detection module is further configured to input the adjusted third multidimensional feature into a pre-trained network traffic anomaly detection model, obtain the distance between the adjusted third multidimensional feature and the hyperplane in the network traffic anomaly detection model through the network traffic anomaly detection model, and determine the node corresponding to the adjusted third multidimensional feature as an abnormal node if the distance is greater than a preset distance threshold, and determine the transmission traffic of the abnormal node as abnormal traffic.

[0195] In an exemplary embodiment, the above-mentioned anomaly detection module is further configured to obtain a support vector machine as a network traffic anomaly detection model to be trained; obtain normal devices and abnormal devices from historical network traffic data, and obtain the adjusted third-dimensional features corresponding to normal devices as positive samples and the adjusted third-dimensional features corresponding to abnormal devices as negative samples; input the positive samples and negative samples into the network traffic anomaly detection model to be trained, with the goal of finding a hyperplane to separate the positive samples and negative samples, to obtain a trained network traffic anomaly detection model.

[0196] In an exemplary embodiment, the feature aggregation module described above is further configured to obtain the first multidimensional features of a node based on the node's device type, user category, and historical traffic baseline.

[0197] Each module in the aforementioned network traffic detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0198] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a network traffic detection method.

[0199] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0200] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0201] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0202] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0203] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0204] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0205] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0206] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network traffic detection method, characterized in that, The method includes: A graph structure is constructed using network traffic data of the network to be detected; the nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent multidimensional traffic characteristics between the corresponding devices. The first multidimensional feature of the node is obtained, and the first multidimensional feature of the node and the multidimensional traffic feature associated with the node are aggregated to obtain the second multidimensional feature of the node. Based on the attention weights of each neighboring node of the node, the second multidimensional features of each neighboring node are aggregated, and the aggregated features and the second multidimensional features of the node are fused to obtain the third multidimensional features of the node. Based on the importance of each dimension type in the third multidimensional feature for anomaly detection, adjust each dimension feature in the third multidimensional feature; The adjusted third multidimensional feature is input into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

2. The method according to claim 1, characterized in that, The step of aggregating the first multidimensional features of the node and the multidimensional traffic features associated with the node to obtain the second multidimensional features of the node includes: Using the first convolutional layer in the graph convolutional network, the first multidimensional feature of the node, the preset dimensionality reduction weight matrix, the multidimensional traffic features associated with the node, and the edge weights corresponding to the multidimensional traffic features are aggregated to obtain the single-dimensional fusion feature of the node; the edge weights are obtained after normalization based on the number of edge connections of each node. By utilizing the second convolutional layer in the graph convolutional network, the multi-dimensional fine representation of the node is reconstructed based on the node's single-dimensional fusion features, the preset up-dimensional weight matrix, the multi-dimensional traffic features associated with the node, and the edge weights corresponding to the multi-dimensional traffic features, thus obtaining the node's second multi-dimensional features.

3. The method according to claim 1, characterized in that, The steps for obtaining the attention weights of each neighboring node of the node include: The second multidimensional feature of the node is concatenated with the second multidimensional features of the node's neighboring nodes; The concatenated features are multiplied by a preset attention vector, and the product is processed using a preset activation function to obtain the attention weights of the neighboring nodes of the node.

4. The method according to claim 1, characterized in that, The adjustment of each dimension of the third multidimensional feature based on the importance of each dimension type for anomaly detection includes: Obtain the historical weights of the dimension type and the current importance metric of the dimension type; the current importance metric is obtained based on the importance of the dimension type in the current detection. The current weight of a dimension type is obtained by dividing the product of the historical weight and the current importance metric by the sum of the products of the historical weights and their corresponding current importance metrics for each dimension type. Based on the current weight of each dimension type, the features of each dimension in the third multidimensional feature are weighted.

5. The method according to claim 1, characterized in that, The step of inputting the adjusted third multidimensional feature into a pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected includes: The adjusted third multidimensional feature is input into a pre-trained network traffic anomaly detection model. The distance between the adjusted third multidimensional feature and the hyperplane in the network traffic anomaly detection model is obtained through the network traffic anomaly detection model. If the distance is greater than a preset distance threshold, the node corresponding to the adjusted third multidimensional feature is determined to be an abnormal node, and the transmission traffic of the abnormal node is determined to be abnormal traffic.

6. The method according to claim 5, characterized in that, The steps for obtaining the network traffic anomaly detection model include: Obtain a support vector machine as the network traffic anomaly detection model to be trained; Obtain normal and abnormal devices from historical network traffic data, and obtain the adjusted third-dimensional feature corresponding to the normal device as a positive sample, and obtain the adjusted third-dimensional feature corresponding to the abnormal device as a negative sample. The positive and negative samples are input into the network traffic anomaly detection model to be trained, and the training aims to find a hyperplane to separate the positive and negative samples, thereby obtaining a trained network traffic anomaly detection model.

7. The method according to any one of claims 1 to 6, characterized in that, The acquisition of the first multidimensional feature of the node includes: The first multidimensional feature of the node is obtained based on the node's device type, user category, and historical traffic baseline.

8. A network traffic detection device, characterized in that, The device includes: The graph construction module is used to construct a graph structure using network traffic data of the network to be detected; the nodes of the graph structure represent devices in the network to be detected, and the edges of the graph structure represent multi-dimensional traffic characteristics between the corresponding devices. The feature aggregation module is used to obtain the first multidimensional feature of the node, and aggregate the first multidimensional feature of the node and the multidimensional traffic feature associated with the node to obtain the second multidimensional feature of the node. The attention aggregation module is used to aggregate the second multi-dimensional features of each neighboring node according to the attention weights of each neighboring node, and fuse the aggregated features with the second multi-dimensional features of the node to obtain the third multi-dimensional features of the node. The feature equalization module is used to adjust the features of each dimension in the third multi-dimensional feature based on the importance of each dimension type to anomaly detection. The anomaly detection module is used to input the adjusted third multidimensional feature into the pre-trained network traffic anomaly detection model to obtain the network traffic detection result of the network to be detected.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images