A Network Threat Detection Method and System Based on Unified Clustering
By constructing a temporal network graph and combining node-level and graph-level clustering branches for collaborative optimization, the problem of difficulty in identifying complex attacks in existing technologies is solved, achieving efficient network threat detection and interpretable attack pattern identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- JILIN UNIVERSITY
- Filing Date
- 2026-03-02
- Publication Date
- 2026-06-02
AI Technical Summary
Existing network security detection technologies struggle to identify complex attacks orchestrated by multiple malicious entities working together. Furthermore, traditional methods are prone to missing alerts when their effects are not readily apparent on a single node. Graph-level analysis also struggles to pinpoint the core of an attack, resulting in poor interpretability of alerts.
A network threat detection method based on unified clustering is adopted. By constructing a temporal network graph and combining node-level and graph-level clustering branches, the unified graph clustering network is used for collaborative optimization, and a threat detection report of abnormal network entities and attack patterns is output.
It achieves multi-layered threat perception of complex attacks, improves the accuracy and interpretability of detection, and can effectively identify abnormal network entities and attack patterns, forming a self-evolving threat detection system.
Smart Images
Figure CN122137611A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to a network threat detection method and system based on unified clustering. Background Technology
[0002] With the expansion of network scale and the increasing sophistication of attack methods, traditional network security detection technologies face severe challenges. Existing detection methods are mainly divided into two categories:
[0003] The first category is detection methods based on single-point analysis, including feature-based intrusion detection systems (IDS) and host detection systems based on statistical anomalies (HIDS). These methods extract features and identify anomalies in individual IP addresses or network flow records, enabling them to detect obvious malicious behaviors such as port scanning and brute-force attacks. However, these methods have significant limitations: they lack awareness of network topology and overall attack patterns, and cannot identify complex attacks carried out collaboratively by multiple malicious entities (such as APT attacks and distributed denial-of-service attacks). When attack behavior is not obvious on a single node, these methods are prone to false negatives.
[0004] The second category is graph analysis-based detection methods. These methods model network traffic as a graph structure and analyze it using graph theory or graph neural network techniques. This can be further divided into two sub-directions: one is node-level analysis, which treats IP addresses as nodes and uses graph neural networks to learn node representations for anomaly detection or clustering. However, this method ignores the overall pattern of attack behavior. The other is graph-level analysis, which performs anomaly detection on the entire network graph or subgraphs. This can identify abnormal communication patterns, but it is difficult to accurately pinpoint which specific nodes are the core of the attack, resulting in poor interpretability of alerts and difficulty in guiding emergency response. Summary of the Invention
[0005] The purpose of this invention is to provide a network threat detection method and system based on unified clustering to solve the problems mentioned in the background art.
[0006] To achieve the above objectives, the present invention provides the following technical solution:
[0007] A network threat detection method based on unified clustering, the method comprising:
[0008] Obtain network flow data within a preset time window, and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities;
[0009] The temporal network graph is input into a pre-trained unified graph clustering network. Through the parallel node-level clustering branch and graph-level clustering branch in the unified graph clustering network, node-level node clustering results and graph-level subgraph clustering results are output respectively. The node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns.
[0010] Based on a preset joint comparison learning objective, the node-level clustering results and the graph-level clustering results are collaboratively optimized, and a threat detection report containing the abnormal network entities and the attack patterns is output.
[0011] As a further embodiment of the present invention, the unified graph clustering network includes:
[0012] A node-level clustering branch is used to learn the embedded representation of nodes and assign nodes to different behavior categories based on a preset prototype vector to generate the node clustering result.
[0013] A graph-level clustering branch is used to learn representations of multiple subgraphs divided from the temporal network graph and to cluster the learned subgraph representations to generate the subgraph clustering results;
[0014] The joint contrastive learning module is used to calculate and minimize the inter-node contrastive loss, inter-subgraph contrastive loss, and node-subgraph contrastive loss through a preset joint contrastive learning objective, so as to collaboratively optimize the node-level clustering branch and the graph-level clustering branch.
[0015] As a further embodiment of the present invention, the node-level clustering branch is specifically used for:
[0016] The graph convolutional network encoder aggregates the neighbor information of a node to generate an embedded representation of the node;
[0017] Through the prototype learning layer, the similarity between the embedded representation of the node and multiple preset prototype vectors is calculated to generate the probability distribution of the node belonging to each behavior category, which serves as the node clustering result.
[0018] As a further embodiment of the present invention, the graph-level clustering branch is specifically used for:
[0019] Based on the prototype information provided by the node-level clustering branch, the temporal network graph is subjected to prototype-guided graph partitioning to obtain multiple subgraphs;
[0020] The graph isomorphic network GIN is used to learn the representation of each subgraph, thus obtaining the subgraph-level representation;
[0021] Clustering is performed on the subgraph-level representation to identify different attack patterns, which are then used as the subgraph clustering results.
[0022] As a further embodiment of the present invention, the joint contrastive learning module is specifically used for:
[0023] Calculate the contrast loss between nodes to bring adjacent positive sample nodes closer together in the embedding space and to keep the representation of the same node consistent across different data augmentation views;
[0024] Calculate the inter-subgraph contrast loss to bring subgraphs with similar structures or properties closer together in the embedding space; calculate the node-subgraph contrast loss to distinguish nodes from each other in different subgraphs.
[0025] The joint contrast learning objective is constructed based on the weighted sum of the inter-node contrast loss, inter-subgraph contrast loss, and node-subgraph contrast loss.
[0026] As a further aspect of the present invention, the collaborative optimization step also includes a two-way feedback mechanism:
[0027] Using the graph-level clustering results as pseudo-labels, the graph-level attack pattern information is fed back to the node-level clustering branch by optimizing the difference between the distribution of the node clustering results and the distribution of the pseudo-labels.
[0028] The present invention also provides a network threat detection system based on unified clustering, the system comprising:
[0029] A network graph construction module is used to acquire network flow data within a preset time window and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities;
[0030] A unified clustering module is used to input the temporal network graph into a pre-trained unified graph clustering network, and output node-level node clustering results and graph-level subgraph clustering results respectively through parallel node-level clustering branches and graph-level clustering branches in the unified graph clustering network; wherein, the node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns.
[0031] The optimization module is used to collaboratively optimize the node-level clustering results and the graph-level clustering results based on a preset joint comparative learning objective, and output a threat detection report containing the abnormal network entities and the attack patterns.
[0032] Compared with existing technologies, the beneficial effects of this invention are: This invention innovatively integrates node-level clustering and graph-level clustering tasks into a single framework, achieving multi-level threat perception through a collaborative optimization mechanism. This invention, through a unified clustering framework, enables micro-entity behavior and macro-attack patterns to mutually reinforce each other during the learning process, forming a self-evolving threat detection system. Attached Figure Description
[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention.
[0034] Figure 1 This diagram compares the method provided in this embodiment of the invention with existing graph clustering methods.
[0035] Figure 2 This is a structural diagram of a network threat detection system based on UGCN provided in an embodiment of the present invention.
[0036] Figure 3 Clustering performance graphs of different variants of UGCN on five datasets provided in this embodiment of the invention. Detailed Implementation
[0037] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.
[0038] In this embodiment of the invention, a network threat detection method based on unified clustering is provided, the method comprising:
[0039] Obtain network flow data within a preset time window, and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities;
[0040] The temporal network graph is input into a pre-trained unified graph clustering network. Through the parallel node-level clustering branch and graph-level clustering branch in the unified graph clustering network, node-level node clustering results and graph-level subgraph clustering results are output respectively. The node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns.
[0041] Based on a preset joint comparison learning objective, the node-level clustering results and the graph-level clustering results are collaboratively optimized, and a threat detection report containing the abnormal network entities and the attack patterns is output.
[0042] like Figure 1 and Figure 2 As shown, in this embodiment, the network stream data is first standardized to transform it into a graph structure representation suitable for graph neural network analysis. For each fixed time window Δt (typically set to 5 minutes), a network graph with temporal characteristics is constructed. The set of nodes Includes all active IP addresses within this time period, with the number of nodes denoted as n. t Edge set Adjacency matrix represents the communication relationships between IP addresses. Each element a ij Represents the connection strength between nodes i and j, calculated based on the total traffic or session frequency between the two IPs. Node Feature Matrix Each line x i The d-dimensional feature vector is constructed as follows:
[0043] Connection statistics: Number of connections f per unit time conn Number of active connections f active New connection speed f rate ;
[0044] Port behavior characteristics: the number of destination ports f ports Port distribution entropy ;
[0045] Traffic characteristics: number of bytes sent f sent Number of bytes received f recv Upstream and downstream ratio ;
[0046] Failure characteristics: Connection failure rate f fail TCP RST ratio f rst ICMP unreachable ratio f icmp ;
[0047] Temporal characteristics: a measure of the periodicity of the connection time distribution f periodic ;
[0048] This graph representation method can simultaneously capture network topology and node behavior characteristics, forming a set of time-series graph sequences. This provides foundational data for subsequent unified cluster analysis.
[0049] As a preferred embodiment of the present invention, the unified graph clustering network includes:
[0050] A node-level clustering branch is used to learn the embedded representation of nodes and assign nodes to different behavior categories based on a preset prototype vector to generate the node clustering result.
[0051] A graph-level clustering branch is used to learn representations of multiple subgraphs divided from the temporal network graph and to cluster the learned subgraph representations to generate the subgraph clustering results;
[0052] The joint contrastive learning module is used to calculate and minimize the inter-node contrastive loss, inter-subgraph contrastive loss, and node-subgraph contrastive loss through a preset joint contrastive learning objective, so as to collaboratively optimize the node-level clustering branch and the graph-level clustering branch.
[0053] In this embodiment, a Unified Clustering Network (UGCN) is used, which handles both node-level and graph-level clustering tasks. The architecture comprises two parallel branches: a node-level clustering branch responsible for learning node representations and prototypes, and a graph-level clustering branch responsible for learning subgraph and graph representations. These two branches are connected through joint comparison to learn the target. The node-level clustering branch employs a GCN-based encoder to extract node features.
[0054] By employing a unified clustering framework, micro-level entity behaviors and macro-level attack patterns mutually reinforce each other during the learning process, forming a self-evolving threat detection system. The overall system structure diagram is shown below. Figure 2 As shown.
[0055] The node-level clustering branch is specifically used for:
[0056] The graph convolutional network encoder aggregates the neighbor information of a node to generate an embedded representation of the node;
[0057] Through the prototype learning layer, the similarity between the embedded representation of the node and multiple preset prototype vectors is calculated to generate the probability distribution of the node belonging to each behavior category, which serves as the node clustering result.
[0058] Transformation of layer l:
[0059] ;
[0060] in, Let i represent the set of neighbors of node i. and These are the learnable parameters of the l-th layer. We employ the ReLU activation function. To fully leverage the advantages of autoencoders and GCNs, we alternately use the adjacency matrix A and the identity matrix I as inputs, ensuring that the learned representation simultaneously contains structural information and its own features. A prototype learning mechanism introduces a centroid layer to learn prototype vectors. ,in They represent different categories of behavior.
[0061] The probability of a node being assigned to a prototype:
[0062] ;
[0063] in, Control the softness or hardness of the allocation. It is the final representation of node i after being encoded through layer L. These prototypes include various types such as normal office hosts, servers, scanners, C2 servers, and data leakage nodes, with each prototype serving as a representative feature of a type of behavior.
[0064] The graph-level clustering branch is specifically used for:
[0065] Based on the prototype information provided by the node-level clustering branch, the temporal network graph is subjected to prototype-guided graph partitioning to obtain multiple subgraphs;
[0066] The graph isomorphic network GIN is used to learn the representation of each subgraph, thus obtaining the subgraph-level representation;
[0067] Clustering is performed on the subgraph-level representation to identify different attack patterns, which are then used as the subgraph clustering results.
[0068] Prototype-guided graph partitioning combines original node features with prototype information and performs graph partitioning using a defined normalized cut criterion:
[0069] ;
[0070] Where the edge weight Similarity calculation based on node features. We will use the original node features x i With the corresponding prototype vector c i splicing: This allows the partitioning process to utilize the semantic information provided by the prototype.
[0071] Subgraph representation learning employs a Graph Isomorphism Network (GIN), with the following update rule:
[0072] ;
[0073] For each partitioned subgraph GIN is applied to learn node representations, and then pooling is used to obtain the subgraph-level representation s. m These subgraph representations capture the structural and semantic properties of the graph, providing input for graph-level clustering.
[0074] In a preferred embodiment of the present invention, the joint comparison learning module is specifically used for:
[0075] Calculate the contrast loss between nodes to bring adjacent positive sample nodes closer together in the embedding space and to keep the representation of the same node consistent across different data augmentation views;
[0076] Calculate the inter-subgraph contrast loss to bring subgraphs with similar structures or properties closer together in the embedding space; calculate the node-subgraph contrast loss to distinguish nodes from each other in different subgraphs.
[0077] The joint contrast learning objective is constructed based on the weighted sum of the inter-node contrast loss, inter-subgraph contrast loss, and node-subgraph contrast loss.
[0078] In this embodiment, a unified optimization of node-level and graph-level clustering is achieved through triple contrastive learning, which is the core innovation of the method. The triple contrastive learning includes inter-node contrastive learning, inter-subgraph contrastive learning, and node-subgraph contrastive learning.
[0079] Inter-node comparison loss:
[0080] ;
[0081] in, It is the set of positive sample neighbors of node i. It is a temperature parameter. The first term brings adjacent positive sample nodes closer together in the representation space, and the second term ensures that the representation of the same node remains consistent across different networks.
[0082] in, Is it Figure G? i and G j The similarity between the graph kernels is T, where T is the threshold parameter.
[0083] Inter-subgraph contrast loss:
[0084] ;
[0085] This loss causes subgraphs with high similarity (positive samples) to be closer together in the representation space, while subgraphs with low similarity (negative samples) are moved further apart.
[0086] Node-subgraph contrastive learning is key to connecting the two levels. First, the importance weights of nodes are calculated:
[0087] ;
[0088] in, It is a local structural weight. It is global intermediary centrality. It is eigenvector centrality. It is a balance parameter.
[0089] The node-subgraph contrast loss is:
[0090] ;
[0091] Where T is the mutual information discriminator, These are negative samples. This loss ensures that the model can learn to distinguish nodes from different subgraphs, while making nodes from the same subgraph closer together in the embedding space.
[0092] The overall optimization objective is to integrate three contrast losses:
[0093] ;
[0094] in , , These are weighting coefficients that control the relative importance of each loss term, achieved by minimizing... The model simultaneously optimizes node-level and graph-level representations, achieving a synergistic improvement in clustering at both levels.
[0095] In a preferred embodiment of the present invention, the collaborative optimization step further includes a bidirectional feedback mechanism:
[0096] Using the graph-level clustering results as pseudo-labels, the graph-level attack pattern information is fed back to the node-level clustering branch by optimizing the difference between the distribution of the node clustering results and the distribution of the pseudo-labels.
[0097] In this embodiment, in actual network threat detection, the above process corresponds to the following steps: Node-level threat detection utilizes prototype-based probability allocation. Identify anomalous nodes; mark a node as suspicious when its similarity to an anomalous prototype exceeds a threshold. Graph-level attack pattern identification is based on subgraph representations. m Clustering is performed to group similar attack subgraphs into the same pattern category. Co-optimization is achieved through a loss function. Backpropagation updates both node-level and graph-level model parameters simultaneously. This bidirectional feedback mechanism enables mutual reinforcement between the two levels. Node-level clustering provides prototype information to guide graph-level clustering, while the pseudo-labels generated by graph-level clustering are fed back to guide node-level clustering via the K-means algorithm. Specifically, the graph-level clustering results serve as a supervisory signal, influencing node-level learning in the following ways:
[0098] ;
[0099] Where, q i It is the prototype distribution of node i, p i It is a target distribution adjusted based on graph-level pseudo-labels.
[0100] This feedback loop creates a closed-loop optimization: node-level prototypes guide subgraphs and graph-level clustering, while graph-level pseudo-labels provide feedback to enhance node-level clustering.
[0101] This invention also provides a network threat detection system based on unified clustering, the system comprising:
[0102] A network graph construction module is used to acquire network flow data within a preset time window and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities;
[0103] A unified clustering module is used to input the temporal network graph into a pre-trained unified graph clustering network, and output node-level node clustering results and graph-level subgraph clustering results respectively through parallel node-level clustering branches and graph-level clustering branches in the unified graph clustering network; wherein, the node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns.
[0104] The optimization module is used to collaboratively optimize the node-level clustering results and the graph-level clustering results based on a preset joint comparative learning objective, and output a threat detection report containing the abnormal network entities and the attack patterns.
[0105] In practical deployments, the method of this invention demonstrates superior performance on multiple datasets. Node-level experimental results are shown in Table 1, and graph-level experimental results are shown in Table 2. Taking the CIC-IDS2017 dataset as an example, this dataset contains various attack types such as Botnet, DDoS, and Infiltration. The experiment uses an Adam optimizer with a learning rate of 0.001 and a decay rate of 5 × 10⁻⁶. -4 The batch size was 256. Evaluation metrics included accuracy (ACC), normalized mutual information (NMI), adjusted RAND index (ARI), and F1 score.
[0106] Table 1. Experimental results of node-level performance of the UGCN-based network threat detection system
[0107]
[0108] Table 2. Experimental results of graph-level performance of the UGCN-based network threat detection system.
[0109]
[0110] Node-level clustering performance: In the task of identifying malicious network entities, the method of this invention demonstrates superior performance. On the COX2 dataset, the method achieves an accuracy (ACC) of 78.5%, which is 12 percentage points higher than the current state-of-the-art node-level clustering method SCGC (66.5%). It achieves an NMI of 0.153, better than SCGC's 0.081, and an ARI of 0.203, significantly higher than SCGC's 0.106. On the BZR dataset, the method achieves an accuracy of 80.1%, an improvement of 13.3 percentage points compared to the ABR method's 66.8%. It achieves NMI and ARI of 0.216 and 0.252 respectively, comprehensively outperforming all comparable methods. On the DHFR, PROTEINS, and SW-620 datasets, the method also achieves best results in all metrics, including ACC, NMI, ARI, and F1, especially demonstrating significant advantages in NMI and ARI, two key metrics for measuring clustering quality.
[0111] Graph-level clustering performance: In attack pattern recognition tasks, the method of this invention also performs excellently. Experimental data shows that the clustering performance of this method on multiple datasets comprehensively surpasses traditional graph kernel methods (RW, LT) and existing deep learning methods (InfoGraph, GraphCL, JOAO, GFW, GLCC, etc.). Specifically, this method outperforms the comparison methods in all clustering metrics on the COX2 dataset; it demonstrates stronger pattern discrimination ability on the BZR dataset; and on the DHFR and PROTEINS datasets, this method achieves significant progress in NMI and ARI metrics while maintaining high accuracy. This is mainly due to the effective synergy between the prototype-guided graph partitioning mechanism and the node-subgraph contrastive learning strategy, which enables similar attack patterns to be clustered together more accurately.
[0112] Unified clustering advantage verification: The contribution of each component is verified through ablation experiments, such as... Figure 3 , Figure 3 The first row represents node-level tasks, and the second row represents graph-level tasks. Removing prototype guidance (without GP) resulted in a 6.3% decrease in ACC; removing subgraph partitioning (without SP) resulted in a 9.8% decrease in NMI; and removing triple contrastive learning (without TC) resulted in an overall performance decline, with ACC decreasing by 12.7% and NMI decreasing by 15.4%. These results demonstrate that each component of the unified clustering framework is indispensable.
[0113] Computational efficiency analysis: The time complexity of UGCN is... The first term corresponds to GIN and GCN encoding, the second term corresponds to N-cut partitioning, and the last two terms correspond to triple constraints. In actual deployment, processing a 5-minute window network graph containing 50,000 nodes and 200,000 edges, the average inference time per GPU is 32 seconds, meeting the requirements for near real-time detection.
[0114] The technological innovations of this invention are reflected in three aspects. Theoretical innovation: For the first time, a unified clustering framework is proposed, which coordinates the optimization of node-level and graph-level clustering tasks under a unified loss function, and defines the complete computation process through formulas (1)-(9). Algorithm innovation: A prototype-guided graph partitioning mechanism is designed to integrate node-level semantic information into graph structure analysis; a triple contrastive learning is proposed, especially the node-subgraph contrastive loss weighted by node importance, to establish a strong correlation between micro and macro threat views. Application innovation: The unified clustering theory is applied to network threat detection to achieve end-to-end automated analysis from raw traffic to actionable intelligence.
[0115] The system adopts a modular architecture, comprising a data acquisition layer, a graph computation layer, a model inference layer, and a presentation layer. The data acquisition layer supports multiple streaming data formats such as NetFlow, sFlow, and IPFIX; the graph computation layer implements distributed graph processing based on Apache SparkGraphX; the model inference layer uses PyTorch Geometric to implement a GNN model; and the presentation layer provides a web interface to display threat graphs and detection reports. The system supports horizontal scaling, allowing the addition of computing nodes to handle larger-scale network traffic.
[0116] The system supports both on-premises deployment and cloud service deployment. On-premises deployment is suitable for large enterprises and institutions, while the cloud service model provides SaaS-based threat detection services for small and medium-sized enterprises. The system offers rich API interfaces, allowing integration with existing SIEM and SOAR platforms to form a complete cybersecurity operations system.
[0117] This invention presents a network threat detection method based on unified clustering. Through rigorous mathematical formula definitions and systematic algorithm design, it achieves deep collaboration between node-level and graph-level threat perception. Experiments demonstrate that this method significantly outperforms existing technologies in terms of detection accuracy, interpretability, and adaptability, providing an effective solution for addressing increasingly complex network threats.
[0118] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A network threat detection method based on unified clustering, characterized in that, The method includes: Obtain network flow data within a preset time window, and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities; The temporal network graph is input into a pre-trained unified graph clustering network. Through the parallel node-level clustering branch and graph-level clustering branch in the unified graph clustering network, node-level node clustering results and graph-level subgraph clustering results are output respectively. The node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns. Based on a preset joint comparison learning objective, the node-level clustering results and the graph-level clustering results are collaboratively optimized, and a threat detection report containing the abnormal network entities and the attack patterns is output.
2. The network threat detection method based on unified clustering according to claim 1, characterized in that, The unified graph clustering network includes: A node-level clustering branch is used to learn the embedded representation of nodes and assign nodes to different behavior categories based on a preset prototype vector to generate the node clustering result. A graph-level clustering branch is used to learn representations of multiple subgraphs divided from the temporal network graph and to cluster the learned subgraph representations to generate the subgraph clustering results; The joint contrastive learning module is used to calculate and minimize the inter-node contrastive loss, inter-subgraph contrastive loss, and node-subgraph contrastive loss through a preset joint contrastive learning objective, so as to collaboratively optimize the node-level clustering branch and the graph-level clustering branch.
3. The network threat detection method based on unified clustering according to claim 2, characterized in that, The node-level clustering branch is specifically used for: The graph convolutional network encoder aggregates the neighbor information of a node to generate an embedded representation of the node; Through the prototype learning layer, the similarity between the embedded representation of the node and multiple preset prototype vectors is calculated to generate the probability distribution of the node belonging to each behavior category, which serves as the node clustering result.
4. The network threat detection method based on unified clustering according to claim 2, characterized in that, The graph-level clustering branch is specifically used for: Based on the prototype information provided by the node-level clustering branch, the temporal network graph is subjected to prototype-guided graph partitioning to obtain multiple subgraphs; The graph isomorphic network GIN is used to learn the representation of each subgraph, thus obtaining the subgraph-level representation; Clustering is performed on the subgraph-level representation to identify different attack patterns, which are then used as the subgraph clustering results.
5. The network threat detection method based on unified clustering according to claim 2, characterized in that, The joint contrastive learning module is specifically used for: Calculate the contrast loss between nodes to bring adjacent positive sample nodes closer together in the embedding space and to keep the representation of the same node consistent across different data augmentation views; Calculate the contrast loss between subgraphs to bring subgraphs with similar structures or properties closer together in the embedding space; Calculate the node-subgraph contrast loss to distinguish nodes in different subgraphs; The joint contrast learning objective is constructed based on the weighted sum of the inter-node contrast loss, inter-subgraph contrast loss, and node-subgraph contrast loss.
6. The network threat detection method based on unified clustering according to claim 1, characterized in that, The collaborative optimization step also includes a two-way feedback mechanism: Using the graph-level clustering results as pseudo-labels, the graph-level attack pattern information is fed back to the node-level clustering branch by optimizing the difference between the distribution of the node clustering results and the distribution of the pseudo-labels.
7. A network threat detection system based on unified clustering, used to implement the network threat detection method based on unified clustering as described in any one of claims 1-6, characterized in that, The system includes: A network graph construction module is used to acquire network flow data within a preset time window and construct a time-series network graph based on the network flow data; wherein, the nodes of the time-series network graph represent network entities, and the edges represent the communication relationships between network entities; A unified clustering module is used to input the temporal network graph into a pre-trained unified graph clustering network, and output node-level node clustering results and graph-level subgraph clustering results respectively through parallel node-level clustering branches and graph-level clustering branches in the unified graph clustering network; wherein, the node-level clustering results are used to identify abnormal network entities, and the graph-level clustering results are used to identify attack patterns. The optimization module is used to collaboratively optimize the node-level clustering results and the graph-level clustering results based on a preset joint comparative learning objective, and output a threat detection report containing the abnormal network entities and the attack patterns.