Intelligent detection and defense method and system for network attacks based on graph neural network

Abstract

The application discloses a network attack intelligent detection and defense method and system based on a graph neural network, relates to the technical field of network security, and comprises the following steps: acquiring network flow data to construct an initial graph structure; constructing feature semantic representation and structure semantic representation of nodes on the graph data respectively, and modeling by using a shared graph encoder; comparing representation level differences and relationship level differences between the nodes in the two semantics to obtain cross-semantic difference information; extracting a local neighborhood of the nodes, and calculating a local anomaly score; dynamically weighting and fusing the cross-semantic difference and the local anomaly score to obtain a comprehensive anomaly score; constructing a node trust weight according to the comprehensive anomaly score and performing weighted training; tracking network topology evolution in combination with a dynamic graph updating mechanism; and constructing an attack behavior knowledge base in combination with active learning of attack modes to form a closed-loop defense. The application effectively improves the security and robustness of the graph neural network in the network attack scene by using the above method and system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for intelligent detection and defense against network attacks based on graph neural networks. Background Technology

[0002] With the continuous development of internet technology and the ongoing evolution of cyberattack methods, complex cyberattacks such as distributed denial-of-service (DDoS) attacks, advanced persistent threats (APFSDS), and fake data injection attacks pose an increasingly serious threat to cyberspace security. According to relevant statistics, the frequency of DDoS attacks is increasing year by year, the scale of attacks is expanding, the complexity of attacks is constantly evolving, and the stealth of application-layer attacks is continuously strengthening, bringing unprecedented challenges to traditional attack detection and defense systems.

[0003] Existing technologies primarily focus on network attack defense research in areas such as anomaly detection, data cleaning, sample filtering, and robust training. One type of method emphasizes node attributes, identifying potential anomalous nodes by analyzing node feature distribution, the degree of feature anomaly, or embedding space deviation. Another type focuses on graph structure, identifying suspicious nodes by analyzing node connectivity, neighborhood structure patterns, or topological consistency. Some methods, after detecting anomalous nodes, directly remove the corresponding nodes, edges, or samples from the training set, or enhance the model's resistance to attacks through additional training strategies.

[0004] However, existing technologies still have significant limitations. First, some methods model node anomalies from a single semantic perspective, such as relying solely on node feature information or graph structure information. This makes it difficult to simultaneously characterize the consistency and differences of nodes across different semantic spaces, resulting in limited ability to identify highly concealed backdoor attack nodes. Second, some methods focus more on global distribution or overall statistical characteristics, ignoring the relative anomalous behavior of nodes in their local neighborhoods. However, backdoor attack nodes often do not exhibit significant global outliers in actual attacks, but rather show inconsistencies with their neighboring nodes. Therefore, relying solely on global anomaly analysis is insufficient to accurately identify this type of covert attack. Third, some methods directly delete, filter, or sever connections after identifying suspicious nodes. While this can mitigate the impact of the attack to some extent, it can also easily damage the original graph structure and its effective semantic information, thus affecting the model's performance on normal samples. Fourth, some methods rely on additional auxiliary models, complex training processes, or high prior conditions, leading to significant computational overhead and complex engineering deployment. Fifth, existing methods lack the ability to actively learn attack behavior patterns, making it difficult to effectively detect and continuously protect against known and unknown attacks with limited labeled data. The defense capabilities cannot continuously evolve with the evolution of attack methods.

[0005] Graph neural networks, with their powerful relational modeling and contextual reasoning capabilities, are naturally suited for analyzing network security data composed of entities such as hosts, processes, users, and network connections, and their dynamic interactions. However, how to effectively extract multi-semantic information, local structural information, and temporal evolution information from network data using graph neural networks to achieve high-precision, low-false-miss, and robust network attack detection and defense remains a pressing technical challenge. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for intelligent detection and defense against network attacks based on graph neural networks. It combines node feature semantics and graph structure semantics to characterize the cross-semantic differences of nodes, and further combines local neighborhood information to model the relative anomalies of nodes. It achieves effective identification and suppression of attacking nodes without destroying the original graph structure. At the same time, it introduces a dynamic graph update mechanism and an active learning mechanism for attack patterns to realize a closed-loop defense from anomaly identification to training suppression and then to knowledge accumulation, thereby improving the security, robustness and adaptability of graph neural networks in network attack scenarios.

[0007] To achieve the above objectives, this invention provides a method for intelligent detection and defense against network attacks based on graph neural networks, including the following: Obtain network traffic data and system log data, extract network entities and their interaction relationships, and construct an initial network graph structure. Network entities include IP addresses, hosts, user accounts and processes, and interaction relationships include communication connections, access requests and data transmission. For the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the node are constructed respectively, and the feature semantic representation and structural semantic representation of the node are modeled using a shared graph encoder; By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes can be obtained. Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node. The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for the nodes; Node trust weights are constructed based on comprehensive anomaly scores, and the graph neural network model is trained with weights based on these trust weights to obtain an attack-defense optimized graph neural network model.

[0008] Preferably, for the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the nodes are constructed respectively, and modeling is performed using a shared graph encoder, specifically: For any two nodes A feature semantic propagation matrix is ​​constructed based on the composite similarity between node semantic features: ; in, For nodes Normalized feature vectors for Norm, The Gaussian kernel bandwidth parameter; the normalized extended adjacency matrix. As the structural semantic propagation matrix, the normalized extended adjacency matrix is: ,in , This is the original adjacency matrix. It is the identity matrix. for The degree matrix; the feature semantic propagation matrix and the structural semantic propagation matrix are constructed respectively through a dual-path residual graph encoder: ; ; in The feature semantic representation matrix, The structural semantic representation matrix, The node feature matrix, , To share encoder parameters, The residual mapping matrix is... The encoder parameters are the nonlinear activation function, the feature semantic propagation matrix, and the structural semantic propagation matrix. , shared.

[0009] Preferably, the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of a node are compared to obtain cross-semantic difference information of the node, specifically: Based on nodes Feature semantic representation and structural semantic representation The representation-level semantic differences are calculated using a hybrid angle-distance metric: ; in, , Preset weighting coefficients; Define nodes First-order semantic neighborhood First-order structure neighborhood Constructing differences in cross-level relationships: ; By fusing representation-level semantic differences and relation-level differences, cross-semantic difference information of nodes is obtained: ; in, For scaling parameters, .

[0010] Preferably, the local neighborhood set of a node is extracted, and the degree of deviation or consistency of the node's representation relative to its neighboring nodes is analyzed to obtain a local anomaly score for the node. Specifically: For any target node Extract the local neighborhood node set The local neighborhood set is the set of one-hop neighborhood nodes. Or a set of two-hop neighborhood nodes Based on structural semantic representation, attention-weighted aggregation of neighboring nodes is performed to obtain the local neighborhood reference representation of the target node: ; Among them, attention weight Defined as: ; This is a learnable attention parameter vector. This represents a vector concatenation operation; Structural semantic representation based on target nodes With local neighborhood reference representation Calculate the local anomaly score: ; Mini-maximum normalization was applied to the local anomaly scores: .

[0011] Preferably, the cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for the nodes, specifically as follows: Define nodes Neighborhood structure entropy: ; Based on neighborhood structure entropy Define dynamic fusion weights: ; in The score for local anomalies after normalization; Node comprehensive anomaly score for: ; Where tanh(·) is the hyperbolic tangent function.

[0012] Preferably, node trust weights are constructed based on comprehensive anomaly scores, and the graph neural network model is trained using these trust weights. Specifically: Node trust weights are constructed using a soft weight mapping with temperature scaling. ; in, For temperature parameters, For the total number of nodes in the training set, when Soft weights degenerate into hard truncation when All weights tend to approach 1; Construct a weighted loss function based on trust weights: ; in, The regularization coefficient is . The first term is the single-sample loss function, and the second term is the weight entropy regularization term. Model parameters The weighted gradient update rule is as follows: ; in, For learning rate, To prevent tiny constants with a denominator of zero.

[0013] Preferably, it also includes a dynamic graph update step: The graph structure is incrementally updated according to a preset time window, adding newly appearing nodes and edges, removing edges that have not been updated after the timeout, and updating node and edge features. Define nodes and Side In the time window Fraction of activity within: ; in, For indicator functions, As the time decay factor, when Remove the edge when the time is right; use discrete-time dynamic graph modeling to divide continuous time into multiple time steps. Build a graph snapshot at each time step , forming graph sequence data Based on graph sequence data, a time-series model of the node representation of a graph snapshot is performed using a bidirectional gated cyclic unit: ; ; in, For the first A matrix representing nodes at each time step. The temporal hidden state matrix, This indicates vector concatenation.

[0014] Preferably, it also includes an active attack pattern learning step: For nodes whose comprehensive anomaly scores exceed the dynamic threshold, the characteristic patterns and topology patterns of the attacking nodes are extracted. The dynamic threshold is automatically set based on the quantiles of the anomaly score distribution under historical normal traffic. ; in For the distribution of historical anomaly scores quantiles, Preset ratio; attack pattern feature vector Defined as: ; in, For node degree, Clustering coefficient, For eigenvector centrality, Homogeneity coefficient; Construct an attack behavior knowledge base The knowledge base uses a knowledge graph format to store the three-dimensional relationships between attack tactics, techniques, and processes, and updates the knowledge base based on extracted attack patterns. ; in, This is a tag for attack type. Score the confidence level; Attack patterns from the attack behavior knowledge base are used as prior constraints to guide subsequent detection: ; in, For nodes Prior attack risk score, For the first Bandwidth parameters for each attack mode.

[0015] Preferably, it also includes an adaptive defense response step: Comprehensive abnormal score With dynamic threshold If a comparison is made, Then determine the node As a potential attack node; Based on the potential attack node, a security response action is triggered. The security response action includes at least one of the following: alarm, fine-grained traffic capture, blocking the communication of the attack node, and attack tracing. When blocking communication of attacking nodes, a weighted training optimization method is used for soft suppression. The target task prediction is performed based on the weighted trained graph neural network model. The target task includes at least one of the following: node classification, link prediction, and anomaly detection.

[0016] A network attack intelligent detection and defense system based on graph neural networks includes: The data acquisition and graph construction module is used to acquire network traffic data and system log data, extract network entities and their interaction relationships, and construct and dynamically update the initial network graph structure. The dual semantic representation learning module is used to construct feature semantic representations and structural semantic representations of nodes based on node attribute information and graph topology information in graph data, respectively, and to model them using a shared graph encoder. The cross-semantic difference module is used to compare the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes to obtain cross-semantic difference information of nodes; The local anomaly scoring module is used to extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node. The comprehensive anomaly scoring module is used to fuse cross-semantic difference information and local anomaly scores of nodes to obtain a comprehensive anomaly score for the nodes. The weighted training module is used to construct node trust weights based on the comprehensive anomaly score, and to perform weighted training on the graph neural network model based on the trust weights to obtain a graph neural network model optimized for attack and defense. The dynamic graph update module is used to incrementally update the graph structure according to a preset time window and to learn the temporal representation based on the graph sequence data. The attack pattern active learning module is used to extract attack patterns based on attack detection results, build an attack behavior knowledge base, and guide subsequent detection and defense.

[0017] Therefore, the present invention employs the above-mentioned intelligent network attack detection and defense method and system based on graph neural networks, which has the following beneficial effects: (1) By constructing a dual semantic representation mechanism of feature semantics and structural semantics, the abnormal behavior of nodes can be characterized from different semantic perspectives. Compared with the detection method based on only a single semantic information, it can more effectively identify attack nodes with strong concealment.

[0018] (2) Joint modeling of nodes from the perspectives of cross-semantic differences and local neighborhood anomalies can more effectively identify attack nodes that are more concealed and difficult to discover through a single global statistical feature.

[0019] (3) Dynamically weighted fusion of dual semantic difference signals and local anomaly scores to obtain a more stable comprehensive node anomaly score, and construct node trust weights based on the comprehensive anomaly score, thereby weighted training of the graph neural network model, reducing the impact of abnormal nodes on model parameter updates without directly deleting nodes or destroying the original graph structure.

[0020] (4) By introducing a dynamic graph update mechanism, real-time tracking and time-series modeling of the network topology over time are realized, which can effectively capture the time-series evolution characteristics of attack behavior and further improve the timeliness and accuracy of detection.

[0021] (5) By introducing an active learning mechanism for attack patterns, the detection results are fed back to the attack behavior knowledge base, enabling the continuous evolution of defense capabilities. This effectively addresses new and unknown attacks and makes up for the lack of adaptive learning capabilities in existing methods.

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] Figure 1 This is an overall flowchart of an embodiment of the intelligent network attack detection and defense method based on graph neural networks of the present invention; Figure 2 This is a structural diagram of an embodiment of the intelligent network attack detection and defense system based on graph neural networks of the present invention; Figure 3 This is a schematic diagram illustrating dual semantic representation learning and cross-semantic difference calculation in an embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the calculation of local neighborhood anomaly scores in an embodiment of the present invention. Detailed Implementation

[0024] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0025] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0026] This embodiment proposes an intelligent network attack detection and defense method based on graph neural networks. It can effectively identify potential attack nodes by leveraging the feature semantics and structural semantics of nodes in network graph data without relying on external auxiliary models. Furthermore, it suppresses the interference of attack nodes on the model training process through an anomaly-aware training optimization mechanism. Simultaneously, it achieves adaptive closed-loop defense by combining dynamic graph updates and proactive attack pattern learning. This method is applicable to graph learning tasks such as node classification, link prediction, and anomaly detection, and is particularly suitable for graph neural network applications where training data may be contaminated and the model faces the risk of covert attacks.

[0027] Example 1 Please see Figures 1-4 This invention provides a method for intelligent detection and defense against network attacks based on graph neural networks, including: By acquiring network traffic data and system log data to be processed, network entities and their interaction relationships are extracted to construct an initial network graph structure, providing a unified graph data input foundation for subsequent bi-semantic representation learning and attack detection. In this embodiment, the following specific sub-steps may be included: Acquire network traffic data and system log data. Network graph data can be obtained from traffic logs in network security monitoring systems, alarm logs in intrusion detection systems, system audit logs, etc. Network entities include, but are not limited to, IP addresses, host devices, user accounts, processes, etc.; the interaction relationships between entities include, but are not limited to, network communication connections, access requests, data transmission, permission changes, etc. This embodiment does not impose specific limitations on these aspects.

[0028] Construct the initial graph structure. Based on the node set V and edge set E, construct the adjacency matrix of the graph. Where n is the number of nodes. When the node With nodes When there is an interaction relationship, otherwise, Construct the node feature matrix , where d is the node feature dimension. Node features may include node degree, traffic statistics features, behavioral features, etc.

[0029] The graph structure is preprocessed. To preserve node information during graph neural network propagation, self-loops are added to the original adjacency matrix to obtain an expanded adjacency matrix. , where | denotes the identity matrix. Symmetric normalization is performed on the extended adjacency matrix: ; in For degree matrix, .

[0030] Node features are preprocessed. To reduce the impact of differences in the dimensions of different features on feature semantic construction, L2 normalization is performed on the node features. For nodes... eigenvectors ; in This represents the L2 norm.

[0031] This embodiment performs representation learning on nodes from two semantic perspectives: node feature information and graph topology information. It obtains the feature semantic representation and structural semantic representation of nodes in a unified latent space, thereby providing a foundation for subsequent cross-semantic difference calculation.

[0032] Construct feature semantic relationships. For any two nodes... Define a composite similarity between node semantic features, which measures both directional similarity and magnitude similarity between node features: in, For nodes Normalized feature vectors This is the Gaussian kernel bandwidth parameter. The feature semantic propagation matrix... The self-similarity of each node is set to 1 to ensure that the node's own information is preserved.

[0033] Define structural semantic relationships. Use a normalized extended adjacency matrix. As a structural semantic propagation matrix, it reflects the connection relationships of nodes in the topological space.

[0034] Shared graph encoder modeling. The feature semantic propagation matrix and the structural semantic propagation matrix are modeled separately using a dual-path residual graph encoder: ; ; in, , To share encoder parameters, The residual mapping matrix is... It is a non-linear activation function. The feature semantic representation matrix, It is a structural semantic representation matrix.

[0035] Through sharing between two semantic perspectives , Enabling encoder parameter sharing avoids additional biases introduced by encoder structural differences from different semantic perspectives, making subsequent dual semantic differences more reflective of the semantic inconsistencies of the nodes themselves.

[0036] Constraints and alignment are applied to the dual semantic representations. To improve the stability of subsequent cross-semantic difference analysis, scale alignment is performed on the feature semantic representation and the structural semantic representation: .

[0037] This step is used to model the inconsistency of nodes in different semantic spaces based on feature semantic representation and structural semantic representation, thereby obtaining cross-semantic difference information of nodes and providing an important basis for subsequent anomaly detection.

[0038] Compute the representation-level semantic differences of nodes. Based on nodes. Feature semantic representation and structural semantic representation An angle-distance hybrid metric is used to calculate representation-level semantic differences, which simultaneously considers both directional and magnitude differences in node representations. Where α and β are preset weight coefficients. Normally, normal nodes have high consistency in feature semantics and structural semantics, while nodes affected by attacks often show a large shift in representation between the two semantic spaces.

[0039] Construct differences in cross-level relationships. To further characterize the semantic inconsistency of nodes, define nodes. First-order semantic neighborhood First-order structure neighborhood Constructing differences in cross-level relationships: ; The above The physical meaning of is: the difference between the degree to which a node deviates from its feature neighbors in the structural semantic space and the degree to which it deviates from its structural neighbors in the feature semantic space.

[0040] The fusion yields cross-semantic difference information. Representation-level semantic differences and relation-level differences are fused to obtain cross-semantic difference information for nodes: ; in, For scaling parameters, sigmoid , is used to normalize the difference values ​​to the (0,1) interval.

[0041] Local Neighborhood Anomaly Scoring. This step, based on cross-semantic difference analysis of nodes, further models the degree of anomaly of a node relative to its neighborhood by combining the local graph structure environment in which the node is located. This helps identify potential attack nodes that are not obvious in the global distribution but exhibit significant inconsistencies in their local neighborhood.

[0042] Extract the local neighborhood set of the target node. For any target node... Extract the local neighborhood node set In one embodiment, the local neighborhood set is defined as the set of one-hop neighborhood nodes. In other embodiments, the local neighborhood set is expanded to a two-hop neighborhood node set. .

[0043] Construct a local neighborhood reference representation. Based on the structural semantic representation, perform attention-weighted aggregation on the neighborhood nodes to obtain the local neighborhood reference representation of the target node: ; Among them, attention weight Defined as: ; This is a learnable attention parameter vector. This indicates a vector concatenation operation.

[0044] Calculate local neighborhood anomaly scores. Based on the structural semantic representation of the target node. With local neighborhood reference representation Calculate the local anomaly score: ; Local anomaly scores are normalized. Minimum-maximum normalization is then applied to the local anomaly scores. ; Comprehensive Anomaly Scoring and Attack Detection. This step fuses cross-semantic difference signals of nodes with local neighborhood anomaly scores to construct a unified comprehensive node anomaly score, which is then compared with a dynamically adjusted detection threshold to determine attack nodes. Define neighborhood structure entropy. Define nodes. The neighborhood structure entropy is used to quantify the topological complexity of a node's local neighborhood: ; Dynamic weighted fusion. Based on neighborhood structure entropy. Define dynamic fusion weights: ; Node comprehensive anomaly score for: ; in, It is the hyperbolic tangent function.

[0045] Dynamic threshold setting and attack detection. Comprehensive anomaly scoring. With dynamically adjusted detection threshold Comparison: If Then determine the node These are potential attack nodes.

[0046] Dynamic threshold Automatically set based on the quantiles of abnormal score distribution under historical normal traffic conditions: ; in For the distribution of historical anomaly scores quantiles, The preset ratio (within a range of 90%-99%, preferably) is used. .

[0047] Adaptive defense response and weighted training. This step is used to trigger corresponding security response actions based on the comprehensive anomaly score of nodes and attack detection results, and to assign corresponding training weights to each node, thereby reducing the impact of attacking nodes during model training.

[0048] Security response actions are triggered. Based on nodes whose comprehensive anomaly scores exceed dynamic thresholds, security response actions are triggered. These actions include at least one of the following: alarm, fine-grained traffic capture, blocking communication of attacking nodes, and attack attribution.

[0049] Node trust weight construction. Node trust weights are constructed using a soft weight mapping with temperature scaling: ; in, For temperature parameters, This represents the total number of nodes in the training set. When... Soft weights degenerate into hard truncation when All weights tend to be close to .

[0050] Construction of the weighted loss function. The weighted loss function is constructed based on the trust weights: ; in, The regularization coefficient is . The first term is the single-sample loss function (such as cross-entropy loss), and the second term is the weight correction term, which is used to prevent the weight distribution from becoming too concentrated.

[0051] Weighted gradient update. Model parameters. The weighted gradient update rule is as follows: ; in, For learning rate, To prevent tiny constants with a denominator of zero.

[0052] After weighted training, an attack-defense optimized graph neural network model is obtained, and the target task prediction is performed based on the model. The target task includes at least one of the following: node classification, link prediction, and anomaly detection.

[0053] Dynamic graph update and temporal representation learning. Network security data has obvious temporal dynamic characteristics. This embodiment realizes real-time response to network topology changes through a dynamic graph update mechanism.

[0054] Dynamic graph incremental updates. Based on a preset time window. Incremental updates to the graph structure (e.g., every 5, 10, or 30 minutes): adding newly appearing nodes and edges, removing edges that have timed out and not been updated, and updating node and edge features. Define nodes. and Side In the time window Fraction of activity within: ; in, For indicator functions, This is the time decay factor. When... Remove the edge when the condition is met.

[0055] Discrete-time dynamic graph modeling. Dividing continuous time into multiple time steps. A graph snapshot is built at each time step. To form graph sequence data .

[0056] Temporal representation learning. Based on graph sequence data, a bidirectional gated recurrent unit is used to perform temporal modeling of the node representations of graph snapshots: ; ; in, For the first A matrix representing nodes at each time step. The temporal hidden state matrix, This indicates vector concatenation.

[0057] Active learning of attack patterns and knowledge base construction. This embodiment utilizes an active learning mechanism for attack patterns to feed detection results back to an attack behavior knowledge base, enabling continuous evolution of defense capabilities.

[0058] Attack Pattern Extraction. Based on the set of attack nodes whose comprehensive anomaly scores exceed a dynamic threshold, feature patterns and topological patterns of the attack nodes are extracted. Attack Pattern Feature Vectors Defined as: ; in, For node degree, Clustering coefficient, For eigenvector centrality, This is the homogeneity coefficient.

[0059] Building and updating the attack behavior knowledge base. Building the attack behavior knowledge base. The knowledge base uses a knowledge graph format to store the three-dimensional relationships between attack tactics, techniques, and processes. The knowledge base is updated based on extracted attack patterns. ; in, The attack type is labeled (confirmed via security response). Calculate the confidence level.

[0060] Attack pattern guidance and feedback. Using attack patterns from the attack behavior knowledge base as prior constraints, a prior attack risk score for each node is calculated. ; in, For nodes Prior attack risk score, For the first Bandwidth parameters for each attack mode.

[0061] Example 2 This embodiment illustrates the technical solution of the present invention in a specific application scenario. The application scenario is the task of abnormal user detection and information dissemination analysis in a social network.

[0062] In this scenario, users are represented as nodes in a graph, and the relationships of interest and interaction between users constitute the edge structure of the graph. Node features are composed of user behavioral characteristics, interest tags, or historical interaction information. Attackers may construct malicious accounts with specific behavioral patterns and embed specific structures in their relationships to induce bias in the graph neural network model during node classification tasks.

[0063] This embodiment constructs feature semantic representations (based on user behavior, interests, etc.) and structural semantic representations (based on connection topology features formed by social relationships) of user nodes to characterize user behavior features from multiple semantic perspectives. It also combines local neighborhood anomaly modeling methods to evaluate the degree of anomaly in a user's social relationships. Experiments show that this embodiment improves the detection accuracy by 8%-15% compared to existing methods in the task of detecting abnormal users on social networks.

[0064] Example 3 This embodiment illustrates the technical solution of the present invention in another specific application scenario. The application scenario is the distributed denial-of-service attack detection and defense task in the Industrial Internet.

[0065] In this scenario, devices in an industrial control system are represented as nodes in a graph, and the communication connections between devices form the edge structure of the graph. Node characteristics include device type, communication frequency, and data packet statistics. When a DDoS attack occurs, a large amount of attack traffic floods into the target device, causing a significant change in the in-degree cardinality of the target device.

[0066] This embodiment effectively captures abnormal changes in the in-degree cardinality of target devices through structural semantic representation, identifies inconsistencies between target devices and their neighbors through local neighborhood anomaly scoring, and automatically adapts to detection requirements under different network sizes through dynamic threshold setting. Experimental results show that this embodiment achieves a detection accuracy of 99.1% and an F1 score of 98.6% on the CIC-DDoS2019 dataset.

[0067] Example 4 This embodiment provides a network attack intelligent detection and defense system based on graph neural networks, including: The data acquisition and graph construction module is used to acquire network traffic data and system log data, extract network entities and their interaction relationships, and construct and dynamically update the initial network graph structure.

[0068] The dual semantic representation learning module is used to construct feature semantic representations and structural semantic representations of nodes based on node attribute information and graph topology information in graph data, and to model them using a shared graph encoder.

[0069] The cross-semantic difference module is used to compare the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, and obtain cross-semantic difference information of nodes.

[0070] The local anomaly scoring module is used to extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node.

[0071] The comprehensive anomaly scoring module is used to fuse the cross-semantic difference information of nodes with local anomaly scores to obtain the comprehensive anomaly score of the nodes.

[0072] The weighted training module is used to construct node trust weights based on the comprehensive anomaly score, and to perform weighted training on the graph neural network model based on the trust weights to obtain a graph neural network model optimized for attack and defense.

[0073] The dynamic graph update module is used to incrementally update the graph structure according to a preset time window and to learn the temporal representation based on the graph sequence data.

[0074] The attack pattern active learning module is used to extract attack patterns based on attack detection results, build an attack behavior knowledge base, and guide subsequent detection and defense.

[0075] Therefore, this invention adopts the above-mentioned intelligent detection and defense method and system for network attacks based on graph neural networks. It combines node feature semantics and graph structure semantics to characterize the cross-semantic differences of nodes, and further combines local neighborhood information to model the relative anomalies of nodes. It achieves effective identification and suppression of attacking nodes without destroying the original graph structure. At the same time, it introduces a dynamic graph update mechanism and an active learning mechanism for attack patterns to realize a closed-loop defense from anomaly identification to training suppression and then to knowledge accumulation, thereby improving the security, robustness and adaptability of graph neural networks in network attack scenarios.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for intelligent detection and defense against network attacks based on graph neural networks, characterized in that, Includes the following: Acquire network traffic data and system log data, extract network entities and their interaction relationships, and construct an initial network graph structure; For the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the node are constructed respectively, and the feature semantic representation and structural semantic representation of the node are modeled using a shared graph encoder; By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes can be obtained. Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node. The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for the nodes; Node trust weights are constructed based on comprehensive anomaly scores, and the graph neural network model is trained with weights based on these trust weights to obtain an attack-defense optimized graph neural network model.

2. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that, For the node attribute information and graph topology information in the graph data, feature semantic representation and structural semantic representation of the nodes are constructed respectively, and modeling is performed using a shared graph encoder, specifically: For any two nodes A feature semantic propagation matrix is ​​constructed based on the composite similarity between node semantic features: ； in, For nodes Normalized feature vectors for Norm, The Gaussian kernel bandwidth parameter; the normalized extended adjacency matrix. As the structural semantic propagation matrix, the normalized extended adjacency matrix is: ,in , This is the original adjacency matrix. It is the identity matrix. for The degree matrix; the feature semantic propagation matrix and the structural semantic propagation matrix are constructed respectively through a dual-path residual graph encoder: ； ； in The feature semantic representation matrix, The structural semantic representation matrix, The node feature matrix, , To share encoder parameters, The residual mapping matrix is... The encoder parameters are the nonlinear activation function, the feature semantic propagation matrix, and the structural semantic propagation matrix. , shared.

3. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that, By comparing the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes, cross-semantic difference information of nodes is obtained, specifically: Based on nodes Feature semantic representation and structural semantic representation The representation-level semantic differences are calculated using a hybrid angle-distance metric: ； in, , Preset weighting coefficients; Define nodes First-order semantic neighborhood First-order structure neighborhood Constructing differences in cross-level relationships: ； By fusing representation-level semantic differences and relation-level differences, cross-semantic difference information of nodes is obtained: ； in, For scaling parameters, .

4. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that: Extract the local neighborhood set of a node, analyze the degree of representation deviation or relationship consistency of the node relative to its neighboring nodes, and obtain the local anomaly score of the node, specifically: For any target node Extract the local neighborhood node set The local neighborhood set is the set of one-hop neighborhood nodes. Or a set of two-hop neighborhood nodes Based on structural semantic representation, attention-weighted aggregation of neighboring nodes is performed to obtain the local neighborhood reference representation of the target node: ； Among them, attention weight Defined as: ； This is a learnable attention parameter vector. This represents a vector concatenation operation; Structural semantic representation based on target nodes With local neighborhood reference representation Calculate the local anomaly score: ； Mini-maximum normalization was applied to the local anomaly scores: 。 5. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that, The cross-semantic difference information of nodes is fused with local anomaly scores to obtain a comprehensive anomaly score for each node, specifically: Define nodes Neighborhood structure entropy: ； Based on neighborhood structure entropy Define dynamic fusion weights: ； in The score for local anomalies after normalization; Node comprehensive anomaly score for: ； Where tanh(·) is the hyperbolic tangent function.

6. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that, Node trust weights are constructed based on comprehensive anomaly scores, and the graph neural network model is then trained using these trust weights. Specifically: Node trust weights are constructed using a soft weight mapping with temperature scaling. ； in, For temperature parameters, For the total number of nodes in the training set, when Soft weights degenerate into hard truncation when All weights tend to approach 1; Construct a weighted loss function based on trust weights: ； in, The regularization coefficient is . The first term is the single-sample loss function, and the second term is the weight entropy regularization term. Model parameters The weighted gradient update rule is as follows: ； in, For learning rate, To prevent tiny constants with a denominator of zero.

7. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 1, characterized in that: It also includes the dynamic graph update steps: The graph structure is incrementally updated according to a preset time window, adding newly appearing nodes and edges, removing edges that have not been updated after the timeout, and updating node and edge features. Define nodes and Side In the time window Fraction of activity within: ； in, For indicator functions, As the time decay factor, when Remove the edge when the time is right; use discrete-time dynamic graph modeling to divide continuous time into multiple time steps. Build a graph snapshot at each time step , forming graph sequence data Based on graph sequence data, a time-series model of the node representation of a graph snapshot is performed using a bidirectional gated cyclic unit: ； ； in, For the first A matrix representing nodes at each time step. The temporal hidden state matrix, This indicates vector concatenation.

8. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 7, characterized in that: It also includes the active learning step of attack patterns: For nodes whose comprehensive anomaly scores exceed the dynamic threshold, the characteristic patterns and topology patterns of the attacking nodes are extracted. The dynamic threshold is automatically set based on the quantiles of the anomaly score distribution under historical normal traffic. ； in For the distribution of historical anomaly scores quantiles, Preset ratio; attack pattern feature vector Defined as: ； in, For node degree, Clustering coefficient, For eigenvector centrality, Homogeneity coefficient; Construct an attack behavior knowledge base The knowledge base uses a knowledge graph format to store the three-dimensional relationships between attack tactics, techniques, and processes, and updates the knowledge base based on extracted attack patterns. ； in, This is a tag for attack type. Score the confidence level; Attack patterns from the attack behavior knowledge base are used as prior constraints to guide subsequent detection: ； in, For nodes Prior attack risk score, For the first Bandwidth parameters for each attack mode.

9. The intelligent detection and defense method for network attacks based on graph neural networks according to claim 8, characterized in that: It also includes adaptive defense response steps: Comprehensive abnormal score With dynamic threshold If a comparison is made, Then determine the node As a potential attack node; Trigger security response actions based on potential attack nodes; When blocking communication between attacking nodes, a weighted training optimization method is used for soft suppression, and the target task prediction is performed based on the weighted trained graph neural network model.

10. A network attack intelligent detection and defense system based on graph neural networks, employing the network attack intelligent detection and defense method based on graph neural networks as described in any one of claims 1-9, characterized in that, include: The data acquisition and graph construction module is used to acquire network traffic data and system log data, extract network entities and their interaction relationships, and construct and dynamically update the initial network graph structure. The dual semantic representation learning module is used to construct feature semantic representations and structural semantic representations of nodes based on node attribute information and graph topology information in graph data, respectively, and to model them using a shared graph encoder. The cross-semantic difference module is used to compare the representation-level and relation-level differences between the feature semantic representation and the structural semantic representation of nodes to obtain cross-semantic difference information of nodes; The local anomaly scoring module is used to extract the local neighborhood set of a node, analyze the degree of deviation of the node's representation from its neighboring nodes or the consistency of its relationships, and obtain the local anomaly score of the node. The comprehensive anomaly scoring module is used to fuse cross-semantic difference information and local anomaly scores of nodes to obtain a comprehensive anomaly score for the nodes. The weighted training module is used to construct node trust weights based on the comprehensive anomaly score, and to perform weighted training on the graph neural network model based on the trust weights to obtain a graph neural network model optimized for attack and defense. The dynamic graph update module is used to incrementally update the graph structure according to a preset time window and to learn the temporal representation based on the graph sequence data. The attack pattern active learning module is used to extract attack patterns based on attack detection results, build an attack behavior knowledge base, and guide subsequent detection and defense.

Images