A self-explaining unsupervised graph-level contrastive learning method for traffic analysis

Abstract

The application provides a self-explaining unsupervised graph-level contrast learning method for traffic analysis, relates to the technical field of network security, and comprises the following steps: aggregating original traffic messages in a time window to generate a flow vector, which contains a sending end IP, a receiving end IP, a multidimensional traffic feature vector and an attack category label; taking the sending end and the receiving end as nodes and the flow vector as a directed edge, constructing a traffic interaction graph and assigning a graph-level label to the traffic interaction graph; constructing a codebook prototype, mapping the feature vector into a discrete code word index through an exponential moving average vector quantization mechanism, and using a variational autoencoder to double-reconstruct the edge feature and the edge adjacency matrix; freezing the codebook, constructing a double-view based on the traffic interaction graph and its dual hypergraph, and extracting an explanatory subgraph through a hypergraph neural network subgraph extractor; and maximizing the mutual information of the graph-level embedding between subgraphs by using an InfoNCE loss, and performing anomaly detection and edge-level explanation. The application solves the problem that the prior art is difficult to extract the core mode causing the anomaly.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a self-explanatory unsupervised graph-level contrastive learning method for traffic analysis. Background Technology

[0002] Unsupervised graph-level representation learning aims to identify graphs that exhibit significant differences compared to the majority of graphs in a ensemble. However, current work primarily focuses on evaluating graph-level anomalies without providing meaningful explanations for predictions. Due to their black-box nature, these methods cannot be fully trusted and deployed in real-world scenarios. In the field of traffic security analysis, simply detecting anomalies is insufficient to meet practical needs. Models need to provide corresponding root cause inferences while identifying anomalies to support security analysts' attribution analysis and decision-making.

[0003] GNN interpreters can be categorized into two types: instance-based and model-based. The former identifies the structure or attribute that contributes most to the current prediction by masking, perturbing, or scoring the features of subgraphs, nodes, or edges. The latter typically reveals common decision-making patterns of the model across different inputs through rule learning, concept extraction, interpretable representation modeling, or structured parameter constraints. Most existing technologies are based on supervised classification methods, but in actual attack detection, it is often difficult to obtain real anomaly samples during the training phase, which significantly limits the effectiveness of anomaly detection and its interpretability.

[0004] To achieve interpretable unsupervised anomaly detection, only a few approaches rely on bottleneck learning theory and contrastive learning, using subgraph extractors to generate explanations. However, these studies only cover real-world datasets for applications such as molecular property prediction and computer vision, which differ from the application scenario of this invention. Furthermore, the final performance of their models is highly dependent on the performance of the subgraph extractor; as input features become more high-dimensional and variable, extracting the core patterns causing anomalies becomes even more difficult. Summary of the Invention

[0005] This application provides a self-explanatory unsupervised graph-level contrastive learning method for traffic analysis, in order to solve the problem in the prior art that it is difficult to extract the core patterns that cause anomalies based on subgraph extractors.

[0006] The method includes: The original traffic packets are aggregated within a preset time window to generate a flow vector; the flow vector includes the sender's IP address, the receiver's IP address, a multi-dimensional traffic feature vector, and an attack category label. Using the sending end and receiving end as nodes and the flow vector as directed edges, a flow interaction graph containing a set of nodes and a set of edges is constructed, and a graph-level label is assigned to the flow interaction graph; the graph-level label is determined based on whether there are abnormal flow vectors in the flow interaction graph. A codebook prototype containing multiple codewords is constructed. The multidimensional traffic feature vector is mapped to discrete codeword indices through an exponential moving average vector quantization mechanism. The edge feature information and edge adjacency matrix of the traffic interaction graph are reconstructed by a variational autoencoder module to learn and stabilize the codebook prototype. The codebook prototype is frozen, a dual view is constructed based on the traffic interaction graph and its dual hypergraph, and a subgraph extractor based on a hypergraph neural network is used to extract the dual view to obtain several interpretive subgraphs. The graph-level embedding mutual information between the interpretable subgraphs is maximized using the InfoNCE loss function. Unsupervised anomaly detection and edge-level interpretation generation are then performed based on the graph-level embedding mutual information. The edge-level interpretation includes generating an importance score for each edge.

[0007] In some implementations, the flow vector is represented as: ; In the formula, and These are the identifiers for the sending and receiving ends, respectively; , is a d-dimensional flow feature vector; This is a multi-category label; The process of constructing the traffic interaction graph includes: The sequence of continuous flow vectors is divided according to a fixed sliding window size, and a node set is established within each sliding window based on the communication pairs. Each message is set as a directed edge to construct a graph structure, resulting in the traffic interaction graph; the graph-level label definition includes that if any edge in the window has an abnormal label, then the graph is an abnormal graph, otherwise it is a normal graph.

[0008] In some implementations, the exponential moving average vector quantization mechanism includes: The encoder maps the multidimensional traffic feature vector to the latent space to obtain a continuous representation, and the nearest neighbor strategy is used to find the nearest codeword in the codebook prototype as a discrete representation. During training, the codebook vector is normalized and updated by maintaining the sample allocation count and feature accumulation of each codeword, and by using exponential moving average to fuse historical statistical information with the contribution of the current batch. Dual reconstruction using the variational autoencoder module includes: Based on the discrete representation, the hypergraph node features are reconstructed by the first decoder, the hypergraph edge features are reconstructed by the second decoder, and the cosine similarity loss of the edge feature information and the L2 norm loss of the edge adjacency matrix are jointly calculated to adjust the decoder parameters.

[0009] In some embodiments, the dual view includes a first view and a second view; The first view is the dual hypergraph of the traffic interaction graph, the set of nodes in the first view is equal to the set of edges in the traffic interaction graph, and the set of hyperedges in the first view corresponds to the set of nodes in the traffic interaction graph. The second view is the traffic interaction graph; the first view and the second view establish a one-to-one mapping relationship through a hypergraph association matrix; the hypergraph association matrix is ​​used to record the membership relationship between nodes and hyperedges.

[0010] In some implementations, the subgraph extractor includes a first subgraph extractor constructed based on a hypergraph neural network; the first subgraph extractor is used for: Based on the first view, message propagation and aggregation are performed through a hypergraph convolutional layer to obtain the importance probability vector of the hypergraph node; The importance probability vector is mapped to the node importance vector of the second view using the hypergraph association matrix; The mapping rules between the first view and the second view include: The importance score of a node in the original graph is equal to the sum of the importance scores of all hypergraph nodes connected to the original graph node. The feature matrices of each view are weighted row by row using the importance probability vector and the node importance vector to obtain an interpretable subgraph. The interpretable subgraph includes a first interpretable subgraph and a second interpretable subgraph, the first interpretable subgraph corresponding to the first view and the second interpretable subgraph corresponding to the second view.

[0011] In some implementations, calculating the graph-level embedding mutual information between the interpretive subgraphs includes: The first hidden state is obtained by encoding the first interpretive subgraph using the first graph encoder; The second interpretable subgraph is encoded by the second graph encoder to obtain the second hidden state; The first hidden state and the second hidden state are mapped to the target dimension through the first projection head and the second projection head, respectively, to obtain the first graph-level representation vector and the second graph-level representation vector. The mutual information between the first graph-level representation vector and the second graph-level representation vector is calculated based on the InfoNCE loss function. The InfoNCE loss function is used to maximize the similarity of positive sample pairs by bringing the representations of two views of the same graph sample closer together and pushing the representations of different graph samples further apart.

[0012] In some implementations, the InfoNCE loss function is formulated as follows: ; In the formula, B is the set of current data; For a sample of a graph structure, represent the traffic interaction graph with number i in the set; , Let represent the hidden state vectors of the subgraphs on the first and second views of sample i, respectively; I is the mutual information, used to characterize the common information contained in the first and second views; This is a contrastive logarithmic loss based on cosine similarity and temperature coefficient.

[0013] In some implementations, the calculation of the InfoNCE loss function is performed prior to: In the initial stage of training, a binary cross-entropy auxiliary loss function based on edge labels is superimposed on the InfoNCE loss function. The formula for the binary cross-entropy auxiliary loss function is as follows: ; In the formula, Let be the edge importance probability vector. The set of actual labels for the corresponding edges; The binary cross-entropy auxiliary loss function is used to guide the subgraph extractor to learn the edge importance distribution; In the later stages of training, the binary cross-entropy auxiliary loss function is removed, and training and inference are performed using the unsupervised InfoNCE loss function.

[0014] In some implementations, the edge level is interpreted as calculated based on the edge importance probability vector.

[0015] In some implementations, before mapping the multidimensional flow feature vector to discrete codeword indices using an exponential moving average vector quantization mechanism, the method further includes: The multidimensional traffic feature vector is preprocessed, including sequentially deleting fields irrelevant to modeling, encoding and converting non-numerical features, and standardizing all features.

[0016] As can be seen from the above, this application provides a self-explanatory unsupervised graph-level contrastive learning method for traffic analysis. The method includes aggregating raw traffic packets within a preset time window to generate flow vectors; the flow vectors include the sender's IP address, the receiver's IP address, multi-dimensional traffic feature vectors, and attack category labels; constructing a traffic interaction graph containing a set of nodes and a set of edges using the sender and receiver as nodes and the flow vectors as directed edges, and assigning graph-level labels to the traffic interaction graph; the graph-level labels are determined based on whether there are abnormal flow vectors within the traffic interaction graph; constructing a codebook prototype containing multiple codewords, and using an exponential moving average vector quantization mechanism to convert the multi-dimensional flow vectors into a single flow vector. The quantitative feature vector is mapped to a discrete codeword index, and a variational autoencoder module is used to perform dual reconstruction of the edge feature information and edge adjacency matrix of the traffic interaction graph to learn and stabilize the codebook prototype. The codebook prototype is frozen, and a dual view is constructed based on the traffic interaction graph and its dual hypergraph. A subgraph extractor based on a hypergraph neural network is used to extract several interpretive subgraphs. The InfoNCE loss function is used to maximize the graph-level embedding mutual information between the interpretive subgraphs, and unsupervised anomaly detection and edge-level interpretation generation are performed based on this graph-level embedding mutual information. The edge-level interpretation includes generating an importance score for each edge. This application solves the problem in the prior art of extracting core patterns causing anomalies based on a subgraph extractor through the above method. Attached Figure Description

[0017] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a self-explanatory unsupervised graph-level contrastive learning method for traffic analysis proposed in this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0021] It should be noted that, in this application, the terms "exemplary" or "for example" are used to indicate that something is being described as an example, illustration, or illustration. Any embodiment or design described as "exemplary" or "for example" in this application should not be construed as being more preferred or advantageous than other embodiments or design solutions. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0022] See Figure 1 As can be seen, this embodiment provides a self-explanatory unsupervised graph-level contrastive learning method for traffic analysis, the method including: S11, the original traffic packets are aggregated within a preset time window to generate a flow vector; the flow vector includes the sending IP address, the receiving IP address, a multi-dimensional traffic feature vector, and an attack category label.

[0023] Specifically, in this embodiment, the original traffic packets are preprocessed and aggregated into a higher-level structure within a time window to obtain the original flow vector characterized by multi-dimensional network features: ; in and These are the sending and receiving ends, which determine the initial direction of the vector. This represents the flow characteristics in the flow vector. This indicates the N category label corresponding to the stream, such as Normal, DoS, Injection, etc.

[0024] The method further includes: S12, using the sending end and receiving end as nodes and the flow vector as directed edges, construct a traffic interaction graph containing a set of nodes and a set of edges, and assign a graph-level label to the traffic interaction graph; the graph-level label is determined based on whether there are abnormal flow vectors in the traffic interaction graph.

[0025] Specifically, in this embodiment, the original flow vector is divided into flow blocks using a preset sliding window value, and a graph structure is established in each block: ; In the formula, It is a set of nodes; It is a set of edges, serving as a topological representation of the traffic interaction graph.

[0026] If the flow block If there are no abnormal samples, then It is considered a normal graph, otherwise it is an abnormal graph, serving as a graph-level label for the traffic interaction graph.

[0027] The method further includes: S13, construct a codebook prototype containing multiple codewords, map the multidimensional traffic feature vector to discrete codeword indices through an exponential moving average vector quantization mechanism, and use a variational autoencoder module to perform dual reconstruction of the edge feature information and edge adjacency matrix of the traffic interaction graph in order to learn and stabilize the codebook prototype.

[0028] Specifically, in this embodiment, based on the constructed codebook prototype, the flow vector features are vector quantized, and a graph reconstruction task is established on the variational autoencoder (VAE) module to learn a stable codebook prototype as the basis for view representation.

[0029] The method further includes: S14, freeze the codebook prototype, construct a dual view based on the traffic interaction graph and the dual hypergraph of the traffic interaction graph, and extract the dual view through a subgraph extractor based on a hypergraph neural network to obtain several interpretive subgraphs. S15, using the InfoNCE loss function to maximize the graph-level embedding mutual information between the interpretable subgraphs, and performing unsupervised anomaly detection and edge-level interpretation generation based on the graph-level embedding mutual information; the edge-level interpretation includes generating an importance score for each edge.

[0030] Specifically, in this embodiment, after the codebook training is completed in step S13, the parameters are frozen. and codebook ( (For encoder parameters), the focus shifts to learning the downstream task of MSIB anomaly detection. This stage uses the vectors learned in the first stage for quantization representation. As input, parameters are trained by introducing task-related contrastive constraint signals, which can be divided into dual-view construction, quantization execution, subgraph extraction, graph embedding acquisition, and contrastive loss calculation.

[0031] The dual view includes a first view and a second view; the first view is the dual hypergraph of the traffic interaction graph, the set of nodes in the first view is equal to the set of edges in the traffic interaction graph, and the set of hyperedges in the first view corresponds to the set of nodes in the traffic interaction graph; the second view is the traffic interaction graph; the first view and the second view establish a one-to-one mapping relationship through a hypergraph association matrix; the hypergraph association matrix is ​​used to record the membership relationship between nodes and hyperedges.

[0032] The subgraph extractor includes a first subgraph extractor constructed based on a hypergraph neural network; the first subgraph extractor is used to obtain the importance probability vector of the hypergraph nodes by performing message propagation and aggregation through the hypergraph convolutional layer according to the first view; and to map the importance probability vector to the node importance vector of the second view using the hypergraph association matrix.

[0033] The mapping rule between the first view and the second view includes that the importance score of the original graph node is equal to the sum of the importance of all hypergraph nodes connected to the original graph node; the feature matrix of each view is weighted row by row using the importance probability vector and the node importance vector respectively to obtain an interpretable subgraph; the interpretable subgraph includes a first interpretable subgraph and a second interpretable subgraph, the first interpretable subgraph corresponds to the first view, and the second interpretable subgraph corresponds to the second view.

[0034] Furthermore, in some embodiments, the process of constructing the traffic interaction graph includes: The sequence of continuous flow vectors is divided according to a fixed sliding window size, and a node set is established within each sliding window based on the communication pairs. Each message is set as a directed edge to construct a graph structure, resulting in the traffic interaction graph; the graph-level label definition includes that if any edge in the window has an abnormal label, then the graph is an abnormal graph, otherwise it is a normal graph.

[0035] Specifically, in this embodiment, in each traffic block In this model, each normal flow vector is considered label 0, and each abnormal flow vector is considered label 1; flow vector samples As One of the directed edges in the middle, This is the actual label to which this edge belongs, serving as the edge-level label in the traffic interaction graph; if the traffic block If there are no abnormal samples, then It is considered a normal graph, otherwise it is an abnormal graph, serving as a graph-level label for the traffic interaction graph.

[0036] Furthermore, in some embodiments, the exponential moving average vector quantization mechanism includes: The encoder maps the multidimensional traffic feature vector to the latent space to obtain a continuous representation, and the nearest neighbor strategy is used to find the nearest codeword in the codebook prototype as a discrete representation. During training, the codebook vector is normalized and updated by maintaining the sample allocation count and feature accumulation of each codeword, and by using exponential moving average to fuse historical statistical information with the contribution of the current batch.

[0037] Specifically, in this embodiment, a subset of training samples is sampled. , The number of stream vector samples in the subset; via the encoder ( (For encoder parameters) Maps the feature vector to the intermediate dimension : Representing the eigenvector The encoding representation, At the beginning of training, the output of the intermediate dimensions... Perform a k-means clustering and then... Cluster centers As the initial value of the codeword (the vector in the codebook), Indicates the first Each code character Represents the k-th cluster center: ; According to the nearest neighbor strategy, let Indicates the first in the codebook Each codeword represents a continuous sequence. Generate discrete assignment : ; The codebook statistics, including sample allocation counts, are updated using the EMA mechanism. and feature accumulation By integrating historical statistical information with the current sample contribution, a more stable statistical estimate is obtained. Based on the above statistics, the new codebook vector is obtained by normalizing the feature accumulation and sample count. Establish two decoders and , and These are its trainable parameters, used to perform graph reconstruction tasks; Original image Transform into a dual hypergraph , It is the set of nodes in the hypergraph. It is an edge in a hypergraph The set of edges in the original graph is considered as nodes in the dual hypergraph, i.e. The nodes in the original graph correspond to the hyperedges in the dual hypergraph, i.e. , Original image Nodes correspond to edges in the hypergraph. The incidence matrix of the dual hypergraph can be obtained from... express, This indicates the number of elements in the set; In SuperGraph Conduct VAE reconstruction tasks, including edge information reconstruction and edge adjacency matrix reconstruction. Let... Represents all in the original image The matrix formed yes The quantity. It is the edge-to-edge adjacency matrix of the original graph, obtained by projecting the hypergraph incidence matrix H. and Hypergraph node features can be decoded separately. and hypergraph edge features . It is the degree matrix of the hyperedge. The training objective is composed of the following formula: The first term of the weighted formula represents the learning of edge information reconstruction, and the second term represents the learning of edge adjacency matrix reconstruction: ; In the formula, and These are the hyperparameters of the losses from the two reconstruction tasks, respectively. Representation matrix The Middle row element, express The row element, Indicates the contribution adjustment index, This represents the non-linear activation function sigmoid.

[0038] To avoid frequent jumps in encoder output between codebooks, a commitment loss is added, where sg represents the stopping gradient operator. Hyperparameters: ; The final optimization task of the VAE module consists of the two parts of loss mentioned above: .

[0039] For reconstruction loss; L represents the promised loss; L represents the total loss.

[0040] Backpropagation updates the encoder parameters via gradients; codebook parameters are updated via exponential moving averages over multiple iterations.

[0041] Furthermore, in some embodiments, calculating the graph-level embedding mutual information between the interpretive subgraphs includes: The first hidden state is obtained by encoding the first interpretive subgraph using the first graph encoder; The second interpretable subgraph is encoded by the second graph encoder to obtain the second hidden state; The first hidden state and the second hidden state are mapped to the target dimension through the first projection head and the second projection head, respectively, to obtain the first graph-level representation vector and the second graph-level representation vector. The mutual information between the first graph-level representation vector and the second graph-level representation vector is calculated based on the InfoNCE loss function. The InfoNCE loss function is used to maximize the similarity of positive sample pairs by bringing the representations of two views of the same graph sample closer together and pushing the representations of different graph samples further apart.

[0042] Specifically, in this embodiment, the dual-view construction module, in order to reduce redundancy between views and enhance distinguishability, for the image sample... Define the first view as its dual hypergraph. The second view is defined as itself. Replace with the trained codebook prototype The node features, i.e., the flow vector features Convert to Two distinct views have been obtained. and MSIB's goal is to learn the bottleneck subgraphs of both. , .

[0043] Subgraph extractor based on Hypergraph Neural Network (HGNN) , This represents the learnable parameters of the distribution, which are applied to the view. Generate a probability vector of nodes belonging to the subgraph. : .

[0044] Based on hypergraph The topology is used to deduce node importance from edge importance, using the previously generated topology. Guided generation Node importance vector , For indicator functions, Represents the index of the edge in the original graph. Original image Index of the middle node Represents nodes in a hypergraph With edge Relationships: ; in, Represents a view middle The importance score corresponding to the node Represents a view middle Importance score corresponding to the edge. , Used to represent the range of the explanatory subgraphs generated in the two views.

[0045] Using importance vector and Weighted original feature matrix (All-1 matrix) and (Depend on (Stacked together) to extract two subviews and , It is an adjacency matrix. This indicates that the elements are multiplied row by row. and These represent the node feature matrices in the hypergraph and the original graph, respectively: .

[0046] The graph embedding acquisition module uses an HGNN encoder. GNN encoder Received a representation and Then, with the help of two projector heads and Obtain the graph-level representation vector of the target dimension. and Image embedding: .

[0047] The optimization objective of the main task is calculated using InfoNCE loss, and a small number of labels are introduced. The BCE loss calculation is used to assist in optimizing the objective: Based on subgraph hidden state vector and Calculate the mutual information (MI) between them. Indirect comparison and ; The main task is to maximize MI as the learning objective, and to constrain the consistency of the view through InfoNCE loss, where Represents the cosine similarity function. Representative temperature coefficient: ; in, The collection representing the current data consists of multiple graph-structured samples. constitute, This indicates that the set is numbered as Traffic interaction graph. and They represent The view of the sample Figure 1 Hidden state vectors of the subgraph on 2, represent B Number of samples in the inner diagram.

[0048] To constrain the quality of the interpretability subgraph generation, the auxiliary task computes the label set. (Depend on All involved in (Construction) and vector The correctness of subgraph extraction is measured by the BCE loss between the two methods: ; An auxiliary task is introduced in the early stages of training to help the extractor model learn the basic distribution; thereafter, the supervision signal is completely removed, and the model is based solely on the unsupervised objective. Conduct training and reasoning. This represents the loss-weighted hyperparameter. This indicates the preset number of cold start epochs: ; During the reasoning stage, This represents the similarity between two views of the same graph sample. When the value approaches 0, it indicates that the sample is likely normal, and the traffic interaction graph is normal. When it approaches 1, it indicates that an anomaly has been found in the traffic interaction graph.

[0049] This embodiment has the following advantages: It can carry out edge-based reconstruction tasks and adapt to traffic analysis scenarios; Continuous vectors can be replaced with trainable codebook prototypes to reduce the complexity of the representation space. Pre-clustering reduces the burden on the subgraph extractor. This embodiment uses an improved MSIB framework for unsupervised contrastive learning, generating edge importance vectors on the hypergraph as edge-level interpretations, highlighting the role of traffic interaction edges in subgraph extraction. An auxiliary objective is introduced into the loss calculation module, enhancing the quality of the generated interpretations with fewer labels, reducing the impact on the learning of the main objective, and achieving performance gains with lower overhead.

[0050] For ease of explanation, the above description has been provided in conjunction with specific embodiments. However, the discussion in some embodiments is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Various modifications and variations can be obtained based on the above teachings. The selection and description of the above embodiments are for the purpose of better explaining the contents of this disclosure, thereby enabling those skilled in the art to better utilize the embodiments.

Claims

1. A self-explanatory unsupervised graph-level contrastive learning method for traffic analysis, characterized in that, The method includes: The original traffic packets are aggregated within a preset time window to generate a flow vector; the flow vector includes the sender's IP address, the receiver's IP address, a multi-dimensional traffic feature vector, and an attack category label. Using the sending end and receiving end as nodes and the flow vector as directed edges, a flow interaction graph containing a set of nodes and a set of edges is constructed, and a graph-level label is assigned to the flow interaction graph; the graph-level label is determined based on whether there are abnormal flow vectors in the flow interaction graph. A codebook prototype containing multiple codewords is constructed. The multidimensional traffic feature vector is mapped to discrete codeword indices through an exponential moving average vector quantization mechanism. The edge feature information and edge adjacency matrix of the traffic interaction graph are reconstructed by a variational autoencoder module to learn and stabilize the codebook prototype. The codebook prototype is frozen, a dual view is constructed based on the traffic interaction graph and its dual hypergraph, and a subgraph extractor based on a hypergraph neural network is used to extract the dual view to obtain several interpretive subgraphs. The graph-level embedding mutual information between the interpretable subgraphs is maximized using the InfoNCE loss function. Unsupervised anomaly detection and edge-level interpretation generation are then performed based on the graph-level embedding mutual information. The edge-level interpretation includes generating an importance score for each edge.

2. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 1, characterized in that, The flow vector is represented as: ； In the formula, and These are the identifiers for the sending and receiving ends, respectively; , is a d-dimensional flow feature vector; This is a multi-category label; The process of constructing the traffic interaction graph includes: The sequence of continuous flow vectors is divided according to a fixed sliding window size, and a node set is established within each sliding window based on the communication pairs. Each message is set as a directed edge to construct a graph structure, resulting in the traffic interaction graph; the graph-level label definition includes that if any edge in the window has an abnormal label, then the graph is an abnormal graph, otherwise it is a normal graph.

3. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 1, characterized in that, The exponential moving average vector quantization mechanism includes: The encoder maps the multidimensional traffic feature vector to the latent space to obtain a continuous representation, and the nearest neighbor strategy is used to find the nearest codeword in the codebook prototype as a discrete representation. During training, the codebook vector is normalized and updated by maintaining the sample allocation count and feature accumulation of each codeword, and by using exponential moving average to fuse historical statistical information with the contribution of the current batch. Dual reconstruction using the variational autoencoder module includes: Based on the discrete representation, the hypergraph node features are reconstructed by the first decoder, the hypergraph edge features are reconstructed by the second decoder, and the cosine similarity loss of the edge feature information and the L2 norm loss of the edge adjacency matrix are jointly calculated to adjust the decoder parameters.

4. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 1, characterized in that, The dual view includes a first view and a second view; The first view is the dual hypergraph of the traffic interaction graph, the set of nodes in the first view is equal to the set of edges in the traffic interaction graph, and the set of hyperedges in the first view corresponds to the set of nodes in the traffic interaction graph. The second view is the traffic interaction graph; the first view and the second view establish a one-to-one mapping relationship through a hypergraph association matrix; The hypergraph association matrix is ​​used to record the membership relationship between nodes and hyperedges.

5. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 4, characterized in that, The subgraph extractor includes a first subgraph extractor constructed based on a hypergraph neural network; the first subgraph extractor is used for: Based on the first view, message propagation and aggregation are performed through a hypergraph convolutional layer to obtain the importance probability vector of the hypergraph node; The importance probability vector is mapped to the node importance vector of the second view using the hypergraph association matrix; The mapping rules between the first view and the second view include: The importance score of a node in the original graph is equal to the sum of the importance scores of all hypergraph nodes connected to that node in the original graph. The feature matrix of each view is weighted row by row using the importance probability vector and the node importance vector respectively to obtain an interpretable subgraph; the interpretable subgraph includes a first interpretable subgraph and a second interpretable subgraph, the first interpretable subgraph corresponds to the first view, and the second interpretable subgraph corresponds to the second view.

6. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 5, characterized in that, Calculating the graph-level embedding mutual information between the interpretive subgraphs includes: The first hidden state is obtained by encoding the first interpretive subgraph using the first graph encoder; The second interpretable subgraph is encoded by the second graph encoder to obtain the second hidden state; The first hidden state and the second hidden state are mapped to the target dimension through the first projection head and the second projection head, respectively, to obtain the first graph-level representation vector and the second graph-level representation vector. The mutual information between the first graph-level representation vector and the second graph-level representation vector is calculated based on the InfoNCE loss function. The InfoNCE loss function is used to maximize the similarity of positive sample pairs by bringing the representations of two views of the same graph sample closer together and pushing the representations of different graph samples further apart.

7. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 6, characterized in that, The formula for the InfoNCE loss function is as follows: ； In the formula, B is the set of current data; For a sample of a graph structure, represent the traffic interaction graph with number i in the set; , Let represent the hidden state vectors of the subgraphs on the first and second views of sample i, respectively; I is the mutual information, used to characterize the common information contained in the first and second views; This is a contrastive logarithmic loss based on cosine similarity and temperature coefficient.

8. The self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 5, characterized in that, The calculation of the InfoNCE loss function is performed before the following steps are taken: In the initial stage of training, a binary cross-entropy auxiliary loss function based on edge labels is superimposed on the InfoNCE loss function. The formula for the binary cross-entropy auxiliary loss function is as follows: ； In the formula, Let be the edge importance probability vector. The set of actual labels for the corresponding edges; The binary cross-entropy auxiliary loss function is used to guide the subgraph extractor to learn the edge importance distribution; In the later stages of training, the binary cross-entropy auxiliary loss function is removed, and training and inference are performed using the unsupervised InfoNCE loss function.

9. A self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 8, characterized in that, The edge level is interpreted as being calculated based on the edge importance probability vector.

10. A self-explanatory unsupervised graph-level contrastive learning method for flow analysis according to claim 1, characterized in that, Before mapping the multidimensional flow feature vector to discrete codeword indices using the exponential moving average vector quantization mechanism, the method further includes: The multidimensional traffic feature vector is preprocessed, including sequentially deleting fields irrelevant to modeling, encoding and converting non-numerical features, and standardizing all features.

Images