Unknown network attack detection method and system based on dynamic causal graph

Abstract

The application discloses a method and system for unknown network attack detection based on a dynamic causal diagram, comprising the following steps: step one: collecting and preprocessing original multi-dimensional data sources to obtain a multi-dimensional feature data set; step two: using a Granger causality test method to construct a preliminary causal relationship diagram; step three: inputting the preliminary causal relationship diagram into an improved Graphormer model to perform causal reasoning; step four: dynamically adjusting the edge weight and node connection relationship in the causal reasoning relationship diagram; step five: generating potential attack features through a generative adversarial network, and identifying normal behavior and abnormal behavior by using a discriminator; step six: performing feature selection by using a CART decision tree to obtain an optimal attack detection feature set; and step seven: performing anomaly detection on the optimal attack detection feature set. Through the improved Graphormer model, the application realizes accurate detection and real-time response of unknown network attacks.

Images