Cross-domain collaborative threat perception method, system and device based on federated graph neural network

Abstract

The application discloses a cross-domain cooperative threat perception method, system and device based on a federal graph neural network, and belongs to the technical field of network security. A client constructs local traffic data into a dynamically evolving threat traffic graph, and extracts an intra-domain embedding vector by using a graph attention network. A server generates a cross-domain feature alignment benchmark, and the client performs inter-domain alignment by using an adaptive gate and uploads after adding noise. The server obtains a global aggregation vector by using iterative weighted aggregation. The client converts the global vector into a modulation vector by using a mapping network, element-by-element modulates a local gradient, and updates model parameters. After cyclic training converges, the model can output a threat type and level. The application actively aligns cross-domain feature distributions, dynamically aggregates global knowledge, and finely modulates gradients, effectively solves the problem of data heterogeneity in multiple security domains, and improves threat detection accuracy and privacy protection capability.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically discloses a cross-domain collaborative threat perception method, system and device based on federated graph neural networks. Background Technology

[0002] As cyberattack methods continue to evolve, single security domains struggle to independently construct high-precision threat detection models due to sparse data samples and fragmented attack patterns. Federated learning can aggregate knowledge from multiple domains while protecting data privacy; however, traditional federated learning heavily relies on the assumption of independent and identically distributed data. In real-world cybersecurity scenarios, the network topology, traffic characteristics, and attack patterns of different security domains exhibit significant heterogeneity, leading to slow model convergence and low detection accuracy.

[0003] Graph neural networks, with their powerful modeling capabilities for graph-structured data, have been introduced into the field of cybersecurity to capture collaborative behavior patterns between communicating entities by modeling network traffic as a graph structure. Existing federated learning solutions combined with graph neural networks mostly employ model averaging or post-distillation to mitigate heterogeneity, failing to address the underlying distribution bias problem at the level of proactive cross-domain feature alignment. They also suffer from shortcomings such as insufficient privacy protection, an imbalance between global knowledge and local specificity, and poor aggregation adaptability, making them unsuitable for cross-domain threat perception scenarios with high heterogeneity and high privacy requirements. Summary of the Invention

[0004] To overcome the shortcomings of existing cross-domain threat perception technologies, such as low federated training efficiency due to heterogeneous network topologies and traffic feature distributions across different security domains, difficulty in proactively aligning cross-domain features, lack of fine-grained modulation of global knowledge fusion and local updates, and imperfect privacy protection mechanisms, this invention proposes a cross-domain collaborative threat perception method, system, and device based on federated graph neural networks. This aims to achieve proactive alignment of cross-domain features, adaptive aggregation of global knowledge, and fine-grained modulation of local gradients, thereby improving the accuracy and efficiency of heterogeneous network security threat detection.

[0005] To achieve the above-mentioned objectives, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a cross-domain collaborative threat perception method based on federated graph neural networks, the method comprising: Each client constructs a dynamically evolving threat traffic map based on local network traffic data, and extracts fixed-dimensional intra-domain embedding vectors through graph neural networks; The server generates a cross-domain feature alignment benchmark based on global feature statistics consisting of a global mean vector and a global standard deviation vector, and distributes it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in conjunction with an adaptive gating mechanism. Under privacy budget constraints, the aligned embedding vector is noise-added before being uploaded. The server aggregates the vectors uploaded by the clients, performs iterative weighted aggregation to obtain a global aggregated vector, and then sends it back. Each client converts the global aggregate vector into a dimension-matched modulation vector through a mapping network, and uses the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters; The federated interactive training is performed repeatedly until the preset convergence condition is met, and the trained local threat perception model is obtained. Input the network traffic data to be tested into the model, and output threat type labels and threat level scores.

[0007] Optionally, the construction of the dynamically evolving threat traffic graph includes: Construct a communication relationship graph within the domain, with network entities within the domain as nodes and communication sessions between entities as edges; the static attributes of the edges include communication frequency, average data packet size, duration, and port distribution entropy; the static attributes of the nodes include IP segment encoding, device type encoding, and open port set encoding. Using the communication relationship graph as a fixed topology, real-time traffic data is collected in continuous time windows to establish a time-series feature sequence for each edge; The time-series feature sequence is aggregated using either the element-wise mean calculation method or the recurrent neural network method, and the aggregation result is used as the dynamic attribute of the edge; the parameters of the recurrent neural network are part of the local model parameters. By combining the static attributes of the node itself with the dynamic attributes of its neighbors, the node features are obtained, and a dynamic evolution threat flow graph that integrates time-series dynamic information is constructed.

[0008] Optionally, the extraction of fixed-dimensional intra-domain embedding vectors via graph neural networks includes: The client uses a multi-head, multi-layer graph attention network as the encoder. Each node aggregates the features of its neighboring nodes and calculates the attention coefficient. Based on the attention coefficient, the neighbor information is aggregated in a weighted manner, and the node feature representation is updated. The concatenation results of the static attributes of each node and the mean of the dynamic attributes of its neighbors are stacked to form a feature matrix, which is used as the input of the encoder; the encoder outputs the node feature matrix after being updated by multiple attention layers. The node feature matrix is ​​subjected to mean pooling along the node dimension, and the pooling result is used as a fixed-dimensional intradomain embedding vector.

[0009] Optionally, the cross-domain feature alignment benchmark generation method includes: The server maintains a global mean vector and a global standard deviation vector, both of which have dimensions equal to the preset embedding dimension. Before each round of federated training begins, a preset number of benchmark vectors are generated based on the global mean vector and the global standard deviation vector. The components of each benchmark vector independently follow a Gaussian distribution with the corresponding global mean and global standard deviation as parameters. A diversity constraint is imposed on the generated reference vector group; the diversity constraint is that the Euclidean distance between any two reference vectors in the group is not less than a preset threshold; after the constraint is satisfied, the reference vector group is sent to each client.

[0010] Optionally, the inter-domain alignment of intra-domain embedding vectors using an adaptive gating mechanism includes: The client configures the transformation matrix and bias vector; the input dimension of the transformation matrix is ​​equal to the sum of the dimension of the in-domain embedded vector and the dimension of a set of reference vectors, and the output dimension is equal to the dimension of the in-domain embedded vector. The in-domain embedded vector is concatenated with a set of reference vectors to form a combined vector; After the combined vector undergoes a linear transformation and a bias vector is added, a gated vector of the same dimension is generated by the softmax activation function. The embedded vector within the domain is multiplied element-wise with the gated vector to obtain the aligned embedded vector.

[0011] Optionally, the global aggregation vector obtained through iterative weighted aggregation includes: The server collects all noisy embedding vectors uploaded by clients; Initialize the weights according to the proportion of each vector's magnitude to the sum of all vector magnitudes, and calculate the initial weight center; Repeat the following iterative steps: For each vector, calculate its weight by weighting the magnitude term and the distance term, where the magnitude term is the magnitude of the vector and the distance term is the negative exponential function of the Euclidean distance between the vector and the current weighted center. Multiply each term by a preset first coefficient and a second coefficient, and then add them together. The sum of the first coefficient and the second coefficient is 1. After normalizing the weights of each vector, update the weighted center. The iteration terminates when the Euclidean distance between two consecutive weighted centers is less than a preset threshold. The global aggregate vector is obtained by summing the weights of each vector using the normalized weights at the end of the iteration.

[0012] Optionally, the step of converting the global aggregation vector into a dimension-matched modulation vector via a mapping network includes: The client is configured with a fully connected mapping network, which contains at least one hidden layer. The input dimension is equal to the sum of the global aggregation vector dimension and the domain embedding vector dimension, and the output dimension is equal to the total number of local model parameters. The client concatenates the global aggregation vector with the local embedded vector in the current round and inputs it into the fully connected mapping network. The output is a modulation vector with a value range of [0,1] after normalization.

[0013] Optionally, the stopping conditions for the cyclic execution of federated interactive training include: Convergence criteria: The change in the Euclidean distance of the global aggregate vector between two adjacent rounds of federated training is less than a preset first threshold, or the decrease in the average value of the local loss function of each client is less than a preset second threshold. Termination condition: The number of federated training rounds reaches the preset maximum number of iteration rounds; When the convergence condition is met, the model training is considered complete and the iteration stops; when the convergence condition is not met but the termination condition is met, the training is forcibly terminated.

[0014] Secondly, the present invention provides a cross-domain collaborative threat perception system based on a federated graph neural network, the system comprising: The vector extraction module is used by each client to construct a dynamic evolution threat traffic map based on local network traffic data, and extracts fixed-dimensional intra-domain embedding vectors through graph neural networks; The processing module is used by the server to generate a cross-domain feature alignment benchmark based on global feature statistics consisting of a global mean vector and a global standard deviation vector, and distribute it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in conjunction with an adaptive gating mechanism. Under the constraint of privacy budget, the aligned embedding vector is noise-added before being uploaded. The aggregation module is used by the server to collect vectors uploaded by clients, and obtain a global aggregated vector through iterative weighted aggregation and then send it back. The modulation update module is used by each client to convert the global aggregate vector into a dimension-matched modulation vector through a mapping network, and then use the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters. The training module is used to perform federated interactive training in a loop until the preset convergence condition is met, and to obtain the trained local threat perception model. The evaluation module is used to input network traffic data to be tested into the model and output threat type labels and threat level scores.

[0015] Thirdly, the present invention provides an electronic device, the electronic device comprising: At least one processor; and a memory communicatively connected to said at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method described in any one of the first aspects.

[0016] Compared with the closest prior art, the present invention has the following beneficial effects: Attached Figure Description To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a flowchart of a cross-domain collaborative threat perception method based on federated graph neural networks provided by the present invention; Figure 2 This is a schematic diagram of the cross-domain collaborative threat perception system based on federated graph neural networks provided by the present invention; Figure 3 This is an internal structure diagram of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of the present invention and are therefore merely examples, and should not be construed as limiting the scope of protection of the present invention.

[0019] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application should have the ordinary meaning as understood by those skilled in the art to which this invention pertains.

[0020] This invention provides a cross-domain collaborative threat perception method, system, and device based on federated graph neural networks. The embodiments of this invention are described below with reference to the accompanying drawings.

[0021] Example 1: As Figure 1 As shown, Embodiment 1 of the present invention provides a cross-domain collaborative threat perception method based on federated graph neural networks, specifically including the following steps: Step S101: Each client constructs a dynamic evolutionary threat traffic map based on local network traffic data, and extracts fixed-dimensional intra-domain embedding vectors through graph neural networks; Step S102: The server generates a cross-domain feature alignment benchmark based on global feature statistics consisting of global mean vector and global standard deviation vector and distributes it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in conjunction with an adaptive gating mechanism. Under the constraint of privacy budget, the aligned embedding vector is noise-added and then uploaded. Step S103: The server aggregates the vectors uploaded by the client, performs iterative weighted aggregation to obtain a global aggregated vector, and then sends it back. Step S104: Each client converts the global aggregation vector into a dimension-matched modulation vector through a mapping network, and uses the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters; Step S105: Execute federated interactive training repeatedly until the preset convergence condition is met to obtain the trained local threat perception model; Step S106: Input the network traffic data to be tested into the model and output the threat type label and threat level score.

[0022] Step S101 also includes: initializing global feature statistics.

[0023] In a federated collaboration, there are N participants, each representing a security domain (corporate intranet, government network, industrial control system network, etc.). Before federated training begins, the server performs the following initialization operations: S11 collects basic information about each security domain, including domain identifier, estimated number of devices, and communication protocol type, but does not collect any raw traffic data or privacy information. S12 randomly initializes the global feature statistics, namely the global mean vector μ(0) and the global standard deviation vector σ(0); the dimensions of μ(0) and σ(0) are both equal to the preset embedding dimension D, which can be set to 16-128, and the initial values ​​can be set to μ(0)=0 and σ(0)=1. S13 sets the number of reference vectors K to satisfy the coverage constraint of K≥2D, preparing for the subsequent generation of cross-domain feature alignment references. In step 101 above, the construction of the dynamically evolving threat traffic graph includes: Construct a communication relationship graph within the domain, with network entities within the domain as nodes and communication sessions between entities as edges; the static attributes of the edges include communication frequency, average data packet size, duration, and port distribution entropy; the static attributes of the nodes include IP segment encoding, device type encoding, and open port set encoding. Using the communication relationship graph as a fixed topology, real-time traffic data is collected in continuous time windows to establish a time-series feature sequence for each edge; The time-series feature sequence is aggregated using either the element-wise mean calculation method or the recurrent neural network method, and the aggregation result is used as the dynamic attribute of the edge; the parameters of the recurrent neural network are part of the local model parameters. By combining the static attributes of the node itself with the dynamic attributes of its neighbors, the node features are obtained, and a dynamic evolution threat flow graph that integrates time-series dynamic information is constructed.

[0024] In one specific implementation, taking client i as an example, the local data processing flow is as follows: The S21 deploys a lightweight traffic acquisition probe to capture real-time network traffic data packets; the acquisition strategy supports two modes: full traffic acquisition and sampling acquisition, and the sampling rate is dynamically adjusted from 1:100 to 1:10000 according to the network load. S22 parses data packets, extracting source IP, destination IP, source port, destination port, protocol type, packet length, and timestamp; it generates network flow records based on five-tuple session aggregation, including statistical features within the time window; S23 constructs an intra-domain communication relationship graph: intra-domain network entities are nodes, and inter-entity communication sessions are edges; edge static attributes include communication frequency, average data packet size, duration, and port distribution entropy; node static attributes include IP segment encoding, device type encoding, and open port set encoding. S24 uses a communication relationship graph as a fixed topology and collects real-time traffic data in continuous time windows to establish a time-series feature sequence for each edge. S25 selects either the element-wise mean calculation method or the recurrent neural network method to perform aggregation processing on the time-series feature sequence, and the aggregation result is used as the edge dynamic attribute; the parameters of the recurrent neural network are part of the local model parameters. The S26 splicing node obtains node features by combining its own static attributes and the dynamic attributes of its neighbors, and constructs a dynamic evolution threat flow map that integrates time-series dynamic information.

[0025] In step 101 above, extracting the fixed-dimensional intra-domain embedding vector using a graph neural network includes: The client uses a multi-head, multi-layer graph attention network as the encoder. Each node aggregates the features of its neighboring nodes and calculates the attention coefficient. Based on the attention coefficient, the neighbor information is aggregated in a weighted manner, and the node feature representation is updated. The concatenation results of the static attributes of each node and the mean of the dynamic attributes of its neighbors are stacked to form a feature matrix, which is used as the input of the encoder; the encoder outputs the node feature matrix after being updated by multiple attention layers. The node feature matrix is ​​subjected to mean pooling along the node dimension, and the pooling result is used as a fixed-dimensional intradomain embedding vector.

[0026] In step 102 above, the method for generating the cross-domain feature alignment benchmark includes: The server maintains a global mean vector and a global standard deviation vector, both of which have dimensions equal to the preset embedding dimension. Before each round of federated training begins, a preset number of benchmark vectors are generated based on the global mean vector and the global standard deviation vector. The components of each benchmark vector independently follow a Gaussian distribution with the corresponding global mean and global standard deviation as parameters. A diversity constraint is imposed on the generated reference vector group; the diversity constraint is that the Euclidean distance between any two reference vectors in the group is not less than a preset threshold; after the constraint is satisfied, the reference vector group is sent to each client.

[0027] Furthermore, after each round of federated training, the server collects the mean and variance of the aligned embedding vectors uploaded by each client, and updates the global mean vector and global standard deviation vector using exponential smoothing.

[0028]

[0029] Where α∈[0.9,0.99] is the smoothing factor. , This refers to the local statistics uploaded by the client. Before the next round of training, the cross-domain feature alignment benchmark is regenerated and distributed using the updated global feature statistics. The benchmark generation rules and diversity constraints are completely consistent with implementation method one.

[0030] In step S102 above, the inter-domain alignment of intra-domain embedding vectors using an adaptive gating mechanism includes: The client configures the transformation matrix and bias vector; the input dimension of the transformation matrix is ​​equal to the sum of the dimension of the in-domain embedded vector and the dimension of a set of reference vectors, and the output dimension is equal to the dimension of the in-domain embedded vector. The in-domain embedded vector is concatenated with a set of reference vectors to form a combined vector; After the combined vector undergoes a linear transformation and a bias vector is added, a gated vector of the same dimension is generated by the softmax activation function. The embedded vector within the domain is multiplied element-wise with the gated vector to obtain the aligned embedded vector.

[0031] The specific implementation method of applying diversity constraints is as follows: Before each round of federated training begins, the server generates a preset number of baseline vectors and then performs the following operations to ensure diversity constraints: Calculate the Euclidean distance between all vector pairs in the current baseline vector group. If there exists any pair of vectors whose Euclidean distance is less than a preset threshold δ, then the group is determined not to meet the diversity constraint. For vector groups that do not meet the constraints, the server uses a rejection sampling method to regenerate the reference vector: vectors that do not meet the distance conditions are removed, vectors that meet the conditions are retained, and step S101 is repeated for the newly generated vectors until the pairwise distance of all vectors is not less than δ, or the preset maximum number of retries (e.g., 100 times) is reached. If the constraint is still not met after reaching the maximum number of retries, the server will use post-processing adjustment: calculate the covariance matrix of the current vector group, and fine-tune the vectors that do not meet the constraint by adding small-amplitude white noise and re-normalizing until the condition is met; After the constraints are satisfied, the final set of reference vectors is sent to each client.

[0032] In step S103, the global aggregation vector obtained through iterative weighted aggregation includes: The server collects all noisy embedding vectors uploaded by clients; Initialize the weights according to the proportion of each vector's magnitude to the sum of all vector magnitudes, and calculate the initial weight center; Repeat the following iterative steps: For each vector, calculate its weight by weighting the magnitude term and the distance term, where the magnitude term is the magnitude of the vector and the distance term is the negative exponential function of the Euclidean distance between the vector and the current weighted center. Multiply each term by a preset first coefficient and a second coefficient, and then add them together. The sum of the first coefficient and the second coefficient is 1. After normalizing the weights of each vector, update the weighted center. The iteration terminates when the Euclidean distance between two consecutive weighted centers is less than a preset threshold. The global aggregate vector is obtained by summing the weights of each vector using the normalized weights at the end of the iteration.

[0033] In one embodiment, the privacy budget constraint is implemented as follows: The server agrees on a total privacy budget with each client and allocates the available budget for each round using either equal distribution or adaptive allocation. The client determines the standard deviation of Gaussian noise or the scale of Laplace noise based on the single-round budget, and then superimposes the noise onto each component of the modulated embedded vector. All parties will tally the total privacy budget expenditures, and once the cumulative value reaches the total budget limit, model training will be terminated.

[0034] Furthermore, the quantitative relationship between the Gaussian noise standard deviation and the privacy budget is determined using the Gaussian mechanism in differential privacy: Let the aligned embedding vector uploaded by the client be z′∈ ,That Sensitivity (i.e., the maximum change in z′ when a single data item changes) is denoted as Δ2. To satisfy ( ε , δ - Differential privacy, with added standard deviation of Gaussian noise. σ It should meet the following requirements:

[0035] in, ε The privacy budget allocated for this round, δ The allowable failure probability (usually taken as 10) 5 (or smaller). In actual implementation, it can be preset. δ= 10 5 And by cropping z′ (e.g., cropping z′'s...) Norm restricted to a fixed threshold C (Internal) makes sensitivity Δ2 =C。The client calculates based on the above formula. σ After that, independently generate and obey N ( 0 , σ 2 The d-dimensional noise vector is added to z′ to obtain the noisy embedding vector. .

[0036] If the Laplace mechanism is used, the added noise scale ;in, for Sensitivity, noise follows Lap (0, λ The server and each client jointly record the cumulative privacy budget consumed. The budget consumed per client per round is... ε (If a Gaussian mechanism is used, the actual consumption ε is calculated by reversing the above formula); when the cumulative consumption exceeds the total budget, training stops.

[0037] In step 104 above, converting the global aggregation vector into a dimension-matched modulation vector via a mapping network includes: The client is configured with a fully connected mapping network, which contains at least one hidden layer. The input dimension is equal to the sum of the global aggregation vector dimension and the domain embedding vector dimension, and the output dimension is equal to the total number of local model parameters. The client concatenates the global aggregation vector with the local embedded vector in the current round and inputs it into the fully connected mapping network. The output is a modulation vector with a value range of [0,1] after normalization.

[0038] The parameters of the mapping network are updated locally on the client side and do not participate in server-side federated aggregation. The mapping network is jointly trained locally on the client side and does not participate in federated aggregation, thus preserving the personalized gradient modulation capability of each domain and avoiding the problem of cross-domain parameter space inconsistency.

[0039] The specific training methods are as follows: Initialization: At the start of training, the weights of the mapping network are initialized uniformly, and the biases are initialized to zero.

[0040] Forward computation: After receiving the global aggregation vector, the client concatenates it with the domain embedding vector extracted in this round, inputs it into the mapping network, outputs the original modulation vector, and then normalizes it to obtain a modulation vector with values ​​ranging from zero to one. The dimension of this vector is the same as the total number of parameters in the local model.

[0041] Gradient Update: The goal of the mapping network is to minimize the local threat detection loss function. Its parameters are updated using a chain rule: first, the encoder parameters are updated using the modulated gradient; then, the sensitivity of the loss to the mapping network output is recalculated based on the updated encoder, and its parameters are updated again through backpropagation within the mapping network itself. In practical implementations, a simplified approach can be adopted, treating the modulation vector as an independent learnable parameter whose gradient is approximately the negative of the square of the local loss gradient, and then backpropagating to the mapping network.

[0042] Update order and learning rate: In each round, the encoder parameters are first updated using the current modulation vector, and then the gradient of the mapping network is calculated based on the updated encoder, and its parameters are updated accordingly. The learning rate of the mapping network is usually set to one-tenth of the encoder's learning rate to avoid training instability.

[0043] Federated participation method: The mapping network parameters do not participate in the server-side federated aggregation; each client trains its own mapping network independently. This is because the role of the mapping network is to adapt global knowledge and local features to the parameter space of each client. Although the parameter spaces of different clients have the same dimension, their meanings are different. Independent training can preserve personalized modulation capabilities while avoiding the difficulties of cross-domain parameter alignment.

[0044] In step 105 above, the stopping conditions for the cyclic execution of federated interactive training include: Convergence criteria: The change in the Euclidean distance of the global aggregate vector between two adjacent rounds of federated training is less than a preset first threshold, or the decrease in the average value of the local loss function of each client is less than a preset second threshold. Termination condition: The number of federated training rounds reaches the preset maximum number of iteration rounds; When the convergence condition is met, the model training is considered complete and the iteration stops; when the convergence condition is not met but the termination condition is met, the training is forcibly terminated.

[0045] In one embodiment, the local model gradient is element-wise modulated using a modulation factor to update the local model parameters, specifically including: The client calculates the gradient of the loss function with respect to the local encoder parameters, and multiplies the modulation vector with the gradient element by element to obtain the modulated gradient. The parameter update is completed by multiplying the modulated gradient by the preset learning rate and subtracting the product from the current parameters.

[0046] In one embodiment, the threat type label and threat level score are output in the following manner: The last layer of the trained local threat perception model outputs a vector whose dimension is equal to the preset total number of threat types plus one. Apply a soft maximum function to the output vector to obtain the probability distribution of each threat type, and take the type with the highest probability as the threat type label; Meanwhile, the activation values ​​corresponding to the threat type in the output vector are normalized, or the relative ratio of the activation value to the preset high threat threshold and low threat threshold is calculated to obtain a continuous threat level score between zero and one, which reflects the severity of the threat.

[0047] In addition, the method described in this embodiment also includes a dynamic update process for cross-domain feature alignment benchmarks: After each federated training round, the server collects the modulated embedding vectors uploaded by each client and calculates the mean and variance of these vectors. The global mean vector and global standard deviation vector maintained by the server are updated using an exponential smoothing method, that is, the statistical measures of the previous round and the statistical measures calculated in the current round are weighted by a smoothing factor. At the start of the next round of federated training, the cross-domain feature-aligned benchmark vector set is regenerated based on the updated global mean and standard deviation, and diversity constraints are imposed on the newly generated benchmark vector set.

[0048] Example 2: Based on the same technical concept, Example 2 of this invention also provides a cross-domain collaborative threat perception system based on federated graph neural networks, such as... Figure 2 As shown, it includes: a vector extraction module 210, a processing module 220, an aggregation module 230, a modulation update module 240, a training module 250, and an evaluation module 260, wherein: The vector extraction module 210 is used by each client to construct a dynamic evolution threat traffic map based on local network traffic data, and extract fixed-dimensional intra-domain embedding vectors through graph neural networks. Processing module 220 is used by the server to generate a cross-domain feature alignment benchmark based on global feature statistics composed of global mean vector and global standard deviation vector and distribute it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in combination with an adaptive gating mechanism. Under the constraint of privacy budget, the aligned embedding vector is noise-added and then uploaded. The aggregation module 230 is used by the server to aggregate vectors uploaded by the client, obtain a global aggregated vector through iterative weighted aggregation, and then send it back. The modulation update module 240 is used by each client to convert the global aggregate vector into a dimension-matched modulation vector through a mapping network, and then use the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters. Training module 250 is used to perform federated interactive training in a loop until the preset convergence condition is met, and to obtain the trained local threat perception model. The evaluation module 260 is used to input the network traffic data to be tested into the model and output threat type labels and threat level scores.

[0049] In one embodiment, the present invention also provides an electronic device, which may be a terminal, and its internal structure diagram may be as follows. Figure 3 As shown. The electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements the cross-domain collaborative threat perception method based on federated graph neural networks as described in any one of steps S101 to S106. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0050] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0051] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0052] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0053] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0054] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that, when performed on the computer or other programmable apparatus, provide for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0055] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.

Claims

1. A cross-domain collaborative threat perception method based on federated graph neural networks, characterized in that, The method includes: Each client constructs a dynamically evolving threat traffic map based on local network traffic data, and extracts fixed-dimensional intra-domain embedding vectors through graph neural networks; The server generates a cross-domain feature alignment benchmark based on global feature statistics consisting of a global mean vector and a global standard deviation vector, and distributes it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in conjunction with an adaptive gating mechanism. Under privacy budget constraints, the aligned embedding vector is noise-added before being uploaded. The server aggregates the vectors uploaded by the clients, performs iterative weighted aggregation to obtain a global aggregated vector, and then sends it back. Each client converts the global aggregate vector into a dimension-matched modulation vector through a mapping network, and uses the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters; The federated interactive training is performed repeatedly until the preset convergence condition is met, and the trained local threat perception model is obtained. Input the network traffic data to be tested into the model, and output threat type labels and threat level scores.

2. The method as described in claim 1, characterized in that, The construction of the dynamic evolution threat traffic graph includes: Construct a communication relationship graph within the domain, with network entities within the domain as nodes and communication sessions between entities as edges; the static attributes of the edges include communication frequency, average data packet size, duration, and port distribution entropy; the static attributes of the nodes include IP segment encoding, device type encoding, and open port set encoding. Using the communication relationship graph as a fixed topology, real-time traffic data is collected in continuous time windows to establish a time-series feature sequence for each edge; The time-series feature sequence is aggregated using either the element-wise mean calculation method or the recurrent neural network method, and the aggregation result is used as the dynamic attribute of the edge; the parameters of the recurrent neural network are part of the local model parameters. By combining the static attributes of the node itself with the dynamic attributes of its neighbors, node features are obtained, and a dynamic evolution threat flow graph that integrates temporal dynamic information is constructed.

3. The method as described in claim 2, characterized in that, The extraction of fixed-dimensional intra-domain embedding vectors via graph neural networks includes: The client uses a multi-head, multi-layer graph attention network as the encoder. Each node aggregates the features of its neighboring nodes and calculates the attention coefficient. Based on the attention coefficient, the neighbor information is aggregated in a weighted manner, and the node feature representation is updated. The concatenation results of the static attributes of each node and the average dynamic attributes of its neighbors are stacked to form a feature matrix, which is used as the input to the encoder; the encoder outputs the node feature matrix after being updated by multiple attention layers. The node feature matrix is ​​subjected to mean pooling along the node dimension, and the pooling result is used as a fixed-dimensional intradomain embedding vector.

4. The method as described in claim 1, characterized in that, The cross-domain feature alignment benchmark generation method includes: The server maintains a global mean vector and a global standard deviation vector, both of which have dimensions equal to the preset embedding dimension. Before each round of federated training begins, a preset number of benchmark vectors are generated based on the global mean vector and the global standard deviation vector. The components of each benchmark vector independently follow a Gaussian distribution with the corresponding global mean and global standard deviation as parameters. A diversity constraint is imposed on the generated reference vector group; the diversity constraint is that the Euclidean distance between any two reference vectors in the group is not less than a preset threshold; after the constraint is satisfied, the reference vector group is sent to each client.

5. The method as described in claim 1, characterized in that, The method of performing inter-domain alignment of intra-domain embedding vectors through adaptive gating includes: The client configures the transformation matrix and bias vector; the input dimension of the transformation matrix is ​​equal to the sum of the dimension of the in-domain embedded vector and the dimension of a set of reference vectors, and the output dimension is equal to the dimension of the in-domain embedded vector. The in-domain embedded vector is concatenated with a set of reference vectors to form a combined vector; After the combined vector undergoes a linear transformation and a bias vector is added, a gated vector of the same dimension is generated by the softmax activation function. The embedded vector within the domain is multiplied element-wise with the gated vector to obtain the aligned embedded vector.

6. The method as described in claim 1, characterized in that, The global aggregation vector obtained through iterative weighted aggregation includes: The server collects noisy embedding vectors uploaded by all clients; Initialize the weights according to the proportion of each vector's magnitude to the sum of all vector magnitudes, and calculate the initial weight center; Repeat the following iterative steps: For each vector, calculate its weight by weighting the magnitude term and the distance term, where the magnitude term is the magnitude of the vector and the distance term is the negative exponential function of the Euclidean distance between the vector and the current weighted center. Multiply each term by a preset first coefficient and a second coefficient, and then add them together. The sum of the first coefficient and the second coefficient is 1. After normalizing the weights of each vector, update the weighted center. The iteration terminates when the Euclidean distance between two consecutive weighted centers is less than a preset threshold. The global aggregate vector is obtained by summing the weights of each vector using the normalized weights at the end of the iteration.

7. The method as described in claim 1, characterized in that, The process of converting the global aggregated vector into a dimension-matched modulation vector via a mapping network includes: The client is configured with a fully connected mapping network, which contains at least one hidden layer. The input dimension is equal to the sum of the global aggregation vector dimension and the domain embedding vector dimension, and the output dimension is equal to the total number of local model parameters. The client concatenates the global aggregation vector with the local embedded vector in the current round and inputs it into the fully connected mapping network. The output is a modulation vector with a value range of [0,1] after normalization.

8. The method as described in claim 1, characterized in that, The stopping conditions for the cyclic execution of federated interactive training include: Convergence criteria: The change in the Euclidean distance of the global aggregate vector between two adjacent rounds of federated training is less than a preset first threshold, or the decrease in the average value of the local loss function of each client is less than a preset second threshold. Termination condition: The number of federated training rounds reaches the preset maximum number of iteration rounds; When the convergence condition is met, the model training is considered complete and the iteration stops; when the convergence condition is not met but the termination condition is met, the training is forcibly terminated.

9. A cross-domain collaborative threat perception system based on federated graph neural networks, characterized in that, The system includes: The vector extraction module is used by each client to construct a dynamic evolution threat traffic map based on local network traffic data, and extracts fixed-dimensional intra-domain embedding vectors through graph neural networks; The processing module is used by the server to generate a cross-domain feature alignment benchmark based on global feature statistics consisting of a global mean vector and a global standard deviation vector, and distribute it to each client. Each client uses this benchmark as a reference and performs inter-domain alignment in conjunction with an adaptive gating mechanism. Under the constraint of privacy budget, the aligned embedding vector is noise-added before being uploaded. The aggregation module is used by the server to collect vectors uploaded by clients, and obtain a global aggregated vector through iterative weighted aggregation and then send it back. The modulation update module is used by each client to convert the global aggregate vector into a dimension-matched modulation vector through a mapping network, and then use the modulation vector to modulate the gradient of the local model parameters element by element to update the model parameters. The training module is used to perform federated interactive training in a loop until the preset convergence condition is met, and to obtain the trained local threat perception model. The evaluation module is used to input network traffic data to be tested into the model and output threat type labels and threat level scores.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1-8.

Images