A 5G network unsupervised intrusion detection method and system based on graph contrast learning and attention mechanism

Abstract

The application discloses a 5G network unsupervised intrusion detection method and system based on graph contrast learning and an attention mechanism. First, the discrete 5G traffic is structured and mapped into a 5G traffic attribute graph with communication edges as the main body; then, an attention edge feature coding module is used to calculate and assign the relative weight of the communication link and extract deep edge embedding features; then, a generative edge subgraph contrast learning framework is used to form an original edge subgraph, and the relative weight is used for feature weighted interpolation and topology reconstruction in the latent space to generate positive sample enhanced views and negative sample views, and a structured contrast loss function based on the optimal transport theory is introduced to perform self-supervised joint optimization training on the model; finally, the online detection and alarm module is cascaded to output network intrusion detection results and alarm information. Without relying on attack labels, the application significantly improves the detection accuracy and multi-dataset noise robustness of the system in a real complex noisy scene.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an unsupervised intrusion detection method for 5G networks based on graph contrastive learning and attention mechanisms. This method achieves high-precision unsupervised network intrusion detection in highly dynamic, high-dimensional 5G network traffic environments without relying on massive attack labels by jointly optimizing the construction of 5G traffic attribute graphs, edge feature encoding based on attention mechanisms, and a generative self-supervised contrastive learning framework for edge subgraphs based on optimal transmission theory. Background Technology

[0002] The statements in this section are merely background information relating to this disclosure, and these statements may constitute prior art. In the process of developing this invention, the inventors discovered at least the following problems in the prior art.

[0003] In recent years, 5G networks, with their high bandwidth, low latency, and massive connectivity, have become a critical information infrastructure in core areas such as the digital economy and the industrial internet. However, with the increasing openness of network architecture and the diversification of business scenarios, the security threats faced by 5G networks are becoming increasingly complex. Network Intrusion Detection Systems (NIDS), as the first line of defense for network security, have received widespread attention from academia and industry.

[0004] However, existing 5G network intrusion detection technologies, such as the patent application No. 202511569019.2 entitled "A Dynamic Feature Fusion Intrusion Detection Method," still face the following serious challenges: First, existing intrusion detection methods are mostly based on traditional deep learning or machine learning architectures. These methods treat high-dimensional 5G network traffic (such as NetFlow records) as independent statistical samples, failing to effectively integrate and utilize the dynamic link connection features and topological relationships between various communication entities within the network, resulting in insufficient accuracy in identifying complex, collaborative attacks. Second, although mainstream graph neural networks (GNNs) have been introduced into network topology modeling, they mostly focus on extracting representations of "nodes" (such as IP addresses), ignoring the fact that network traffic is essentially characterized by "edges" (communication links), making it impossible to directly and finely characterize abnormal traffic on the links. Furthermore, existing supervised learning models heavily rely on high-quality, large-scale labeled data with accurate attack types. However, in actual 5G network environments, new attacks emerge constantly, and obtaining a large number of attack labels is not only costly but also suffers from severe lag. Finally, the 5G network environment contains a large amount of background traffic noise. When faced with noisy training scenarios, the existing unsupervised or self-supervised graph anomaly detection models usually experience a significant decrease in their representation ability and noise robustness, which can easily lead to a high false alarm rate.

[0005] Therefore, it is urgent to break through the limitations of traditional methods and supervised models, and explore the construction of a long-term unsupervised network intrusion detection framework that takes into account both link topology characteristics and high noise robustness. Summary of the Invention

[0006] In view of the above problems, the purpose of this invention is to solve some of the problems in the prior art, or at least alleviate these problems.

[0007] An unsupervised intrusion detection method for 5G networks based on graph contrastive learning and attention mechanisms includes the following steps:

[0008] Obtain raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body;

[0009] The 5G traffic attribute graph structure is input into an attention-based edge feature encoder. A graph attention mechanism is introduced during the neighborhood aggregation process of the local topology to calculate and assign relative weights to communication links based on the feature differences of nodes and associated edges. The high-dimensional features are initially mapped to deep edge-embedded feature representations, resulting in an attribute graph after feature embedding.

[0010] The attribute map after feature embedding is input into the generative edge subgraph contrastive learning framework. Local subgraphs are sampled using communication links as anchor points to form the original edge subgraph, and the relative weights are then used. Feature-weighted interpolation and topology reconstruction are performed in the latent space to generate positive sample enhanced views and negative sample views; then a structured contrastive loss function based on optimal transport theory is introduced to perform self-supervised joint optimization training of the model;

[0011] The 5G network traffic to be detected is mapped to the trained model, deep edge embedding feature representation is extracted and input into the unsupervised anomaly detector, and network intrusion detection results and alarm information are output.

[0012] Furthermore, the communication entities and traffic statistical features are extracted to construct a 5G traffic attribute graph structure with communication edges as the main body, including the following steps:

[0013] The collected discrete 5G network traffic intrusion detection traffic data records are cleaned.

[0014] The cleaned data records are then structured and mapped, including mapping the IP addresses of communication entities in the network to nodes in a graph structure, with the node set denoted as . Communication between entities is mapped to directed edges, and the set of edges is denoted as . Based on this, the duration, number of bytes, and message statistical characteristics of 5G traffic are attached to the communication link as edge attributes, ultimately constructing a 5G traffic attribute graph. ,in Represents the node feature matrix, Represents the edge attribute matrix.

[0015] Furthermore, the edge feature encoder adopts the ATE-SAGE network architecture, and the steps for obtaining the attribute map after feature embedding are as follows:

[0016] When performing neighborhood aggregation of local topology, the edge feature encoder introduces a graph attention mechanism to adaptively calculate the target communication edge. The association weights of nodes and adjacent edges within its neighborhood are determined, and relative weights are dynamically assigned to different communication links based on the interaction differences between node features and edge features. ;

[0017] Using the relative weights By weighted aggregation of neighborhood features, high-dimensional, dynamic 5G network traffic features are transformed into low-dimensional deep edge embedding feature representations. .

[0018] Furthermore, adaptive computation of target communication edge The association weights with its neighboring nodes and adjacent edges include the following steps:

[0019] The edge attribute vector of the target communication edge is concatenated with the feature vectors of its source node and the feature vector of its destination node, and then projected onto a unified metric space through a learnable linear transformation matrix.

[0020] The association score between the target communication edge and its neighboring edges in the metric space is calculated using the attention weight calculation function, and then normalized using the Softmax function to obtain the relative weight of each communication link.

[0021] Furthermore, the steps for inputting the attribute map after feature embedding into the generative edge subgraph contrastive learning framework to generate the original edge subgraph, the positive sample augmented view, and the negative sample view are as follows:

[0022] Using any communication link in the attribute graph after embedding the features as an anchor edge, sample its local neighborhood in the graph to form the original edge subgraph;

[0023] Using the relative weights output by the edge feature encoder, the features of the original edge subgraph are weighted and reconstructed in the latent feature space to generate an enhanced view that maintains semantic association with the original edge subgraph, which is then used as a positive sample for contrastive learning.

[0024] Within the 5G traffic attribute graph structure, negative samples for contrastive learning are constructed through cross-graph sampling or random perturbation.

[0025] Furthermore, the steps for weighted interpolation and reconstruction of the features of the original edge subgraph in the latent feature space are as follows:

[0026] Based on the relative weights, feature scaling or Gaussian noise perturbation is applied to the low-weight background traffic features in the original edge subgraph, and cross-channel linear interpolation mixing is performed on the high-weight features.

[0027] While maintaining the original attack semantic pattern of the original edge subgraph, a positive sample augmentation view with perturbation diversity in feature distribution and topology is constructed.

[0028] Furthermore, a structured contrastive loss function based on optimal transport theory is introduced to perform self-supervised joint optimization training of the model, including the following steps:

[0029] The original edge subgraph, the positive sample enhanced view, and the negative sample view are used to... Figure 1 The data is then fed into the loss function calculation module.

[0030] Wasserstein distance is used to measure the consistency of deep edge embedding feature distribution between the original edge subgraph and the positive sample augmented view, and a feature distribution contrast loss is constructed. Simultaneously, the Gromov-Wasserstein distance metric is used to measure the difference in graph topological relationships between the original edge subgraph and the positive sample augmented view, and a topological contrast loss is constructed. ;

[0031] The global self-supervised joint optimization objective function is defined as:

[0032]

[0033] in, Control parameters that balance control characteristics and global topology;

[0034] Minimize iteratively This is used to collaboratively optimize and update the model parameters of the edge feature encoder.

[0035] Furthermore, the steps for outputting network intrusion detection results and alarm information are as follows:

[0036] During the detection phase, the 5G network traffic to be detected will be captured in real time and the attribute graph structure of the 5G traffic to be detected will be constructed.

[0037] The 5G traffic attribute graph structure to be tested is input into the trained edge feature encoder to extract the deep edge embedding feature representation of each communication link online.

[0038] The deep edge embedding feature representation of each communication link is uniformly input into the unsupervised anomaly detector to calculate the anomaly probability score of each communication link.

[0039] In noisy training scenarios where attack samples are mixed in, background noise is filtered out by setting a security threshold. When the anomaly probability score of a certain link exceeds the security threshold, the system determines that the 5G traffic corresponding to that link is an intrusion attack and triggers the security defense system to issue an alarm response.

[0040] A system employing the aforementioned graph contrastive learning and attention-based unsupervised intrusion detection method for 5G networks includes:

[0041] Traffic acquisition and graph construction module: used to acquire raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body;

[0042] Attention edge encoding module: used to build an edge feature encoder based on attention mechanism. It introduces graph attention mechanism in the neighborhood aggregation process of local topology, adaptively assigns relative weights according to the feature differences of nodes and associated edges, and extracts highly robust deep edge embedding feature representations.

[0043] Self-supervised contrastive training module: used to construct a generative edge subgraph contrastive learning framework, sample local subgraphs with communication links as anchor points, use the relative weights to perform feature weighted interpolation and topology reconstruction in the latent space, generate positive sample enhanced views and negative sample views, and introduce a structured contrastive loss function based on optimal transmission theory to perform self-supervised joint optimization training of the model;

[0044] Online detection and alarm module: used to map the 5G network traffic to be detected to the trained model, extract deep edge embedding features and input them into the unsupervised anomaly detector, and output network intrusion detection results and alarm information.

[0045] The present invention has the following beneficial effects:

[0046] This invention constructs a joint optimization framework for graph contrastive learning and self-supervised feature extraction for abnormal traffic monitoring in 5G networks. By introducing a graph attention mechanism into local topology aggregation, this invention achieves amplified representation of potential abnormal edges and effective suppression of background normal traffic noise. Simultaneously, by utilizing a generative subgraph contrastive learning strategy combined with both Wasserstein and Gromov-Wasserstein optimal transmission distance losses, and addressing the adversarial optimization from both the feature space distribution and graph topological geometry levels, it ensures extremely high noise robustness of the learned embedding representation.

[0047] To demonstrate the significant advancements of the present invention compared to existing technologies, the present invention incorporates multiple sets of real experimental results to visually illustrate the following advantages of the present invention:

[0048] 1. Extremely strong noise immunity: such as Figure 4 As shown, on the 5G-NIDD benchmark dataset, when the noise ratio of unlabeled attack traffic in the training set continuously increases from 0% to 5% or even higher, the detection F1 score curve of the method of this invention can always remain within a high and stable range, without exhibiting the drastic degradation phenomenon of traditional models. This directly proves that the latent spatial attention interpolation and optimal transmission constraints designed in this invention can effectively filter environmental noise and establish accurate normal distribution boundaries.

[0049] 2. Completely surpasses existing cutting-edge solutions: such as Figure 5 and Figure 6 As shown, in a clean training environment, the method of this invention significantly outperforms leading mainstream solutions in the industry, such as E-GraphSAGE, Anomaly-E, GADAM, and CoLA, in the detection F1 score on both the 5G-NIDD dataset and the self-developed 5G Threat dataset. Furthermore, as... Figure 7 and Figure 8 As shown, in a 5% high-noise training scenario simulating a real network environment, the performance of the aforementioned traditional baseline schemes all suffered a severe decline due to noise contamination. In contrast, the method of this invention maintained excellent anomaly detection accuracy and F1 score on both datasets. This not only demonstrates the invention's superior cross-dataset and multi-scenario generalization ability but also highlights its extremely high engineering practical value and continuous protection in real, complex 5G noisy environments. Attached Figure Description

[0050] Figure 1 This is an overall architecture diagram of the 5G network unsupervised intrusion detection model (ATE-ESC) based on graph contrastive learning and attention mechanism proposed in this embodiment of the invention;

[0051] Figure 2 This is a schematic diagram of the 5G network traffic communication graph construction process provided in an embodiment of the present invention;

[0052] Figure 3 A flowchart illustrating the operational logic of the self-supervised contrastive learning framework (ESC-L) based on edge subgraph generation provided in this embodiment of the invention.

[0053] Figure 4 The line graph showing the evolution of the model F1 value on the 5G-NIDD dataset as a function of the proportion of noise mixed in unlabeled attack traffic, provided in an embodiment of the present invention.

[0054] Figure 5A horizontal comparison bar chart of the F1 scores of the method of the present invention and various existing graph anomaly detection baseline methods in a clean training environment of the 5G-NIDD dataset provided in this embodiment of the invention;

[0055] Figure 6 A horizontal comparison bar chart of the F1 scores of the method of the present invention and various existing graph anomaly detection baseline methods in a clean training environment of the 5G Threat dataset, provided for embodiments of the present invention.

[0056] Figure 7 This is a horizontal comparison bar chart of the F1 scores of the method of the present invention and various existing graph anomaly detection baseline methods under a noisy training environment with 5% attack traffic on the 5G-NIDD dataset, provided in an embodiment of the present invention.

[0057] Figure 8 This is a horizontal comparison bar chart of the F1 scores of the method of the present invention and various existing graph anomaly detection baseline methods in a noisy training environment with 5% attack traffic on the 5G Threat dataset, provided as an embodiment of the present invention. Detailed Implementation

[0058] The present invention will be further described below with reference to the accompanying drawings. The embodiments of the present invention are only used to illustrate the present invention and not to limit the present invention. Various substitutions and modifications made based on ordinary technical knowledge and common practices in the art without departing from the technical concept of the present invention should be included within the scope of the present invention.

[0059] The purpose of this invention is to address the shortcomings of existing 5G network intrusion detection technologies, such as ignoring link connection characteristics, highly relying on attack labels, insufficient detection accuracy, and poor robustness in noisy training environments. To address these shortcomings, this invention proposes an unsupervised intrusion detection method (ATE-ESC) for 5G networks based on graph contrastive learning and attention mechanisms, comprising the following steps:

[0060] Obtain raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body;

[0061] The 5G traffic attribute graph structure is input into an attention-based edge feature encoder. A graph attention mechanism is introduced during the neighborhood aggregation process of the local topology to calculate and assign relative weights to communication links based on the feature differences of nodes and associated edges. The high-dimensional features are initially mapped to deep edge-embedded feature representations, resulting in an attribute graph after feature embedding.

[0062] The attribute map after feature embedding is input into the generative edge subgraph contrastive learning framework. Local subgraphs are sampled using communication links as anchor points to form the original edge subgraph, and the relative weights are then used. Feature-weighted interpolation and topology reconstruction are performed in the latent space to generate positive sample enhanced views and negative sample views; then a structured contrastive loss function based on optimal transport theory is introduced to perform self-supervised joint optimization training of the model;

[0063] The 5G network traffic to be detected is mapped to the trained model, deep edge embedding feature representation is extracted and input into the unsupervised anomaly detector, and network intrusion detection results and alarm information are output.

[0064] This invention breaks away from the limitations of conventional supervised classification and simple node representation. It introduces a self-supervised contrastive learning strategy, which jointly optimizes the construction of 5G traffic attribute graphs, introduces an edge feature encoder with graph attention mechanism (ATE-SAGE), uses an edge subgraph generative contrastive learning framework based on feature weighted interpolation (ESC-L), and co-optimizes a structured loss function based on optimal transmission theory (Wasserstein and Gromov-Wasserstein distance). Under unsupervised conditions that strictly do not depend on high-quality attack labels, it maximizes the extraction of highly robust deep edge embedding feature representations, thereby significantly improving the detection effect and noise resistance of abnormal attack behavior in 5G networks.

[0065] Specific steps are as follows Figure 1 As shown.

[0066] S1: Step 1: Construct a 5G traffic attribute graph model to structurally map discrete data streams into topological graph relationships.

[0067] In the complex network environment of 5G with its high speed and massive connectivity, network traffic exists in the form of massive, discrete, and dynamic NetFlow records. This invention performs data cleaning and structured mapping on the collected discrete 5G network traffic NetFlow records.

[0068] This invention first uses a traffic acquisition and graph construction module to capture these discrete records, and then cleans and filters the raw data. Communication entities (source IP address, destination IP address) in the network are statically or dynamically mapped to nodes in a graph structure, and the set of all nodes is denoted as... Various communication sessions or message flows between entities are mapped to directed edges connecting the two ends, and the set of edges is denoted as . .

[0069] Meanwhile, this invention extracts high-dimensional statistical features from NetFlow traffic records, such as duration, total number of bytes transmitted, total number of packets, and specific network protocol flags. These multi-dimensional statistical features are directly attached as edge attributes to the corresponding communication links, ultimately constructing a 5G traffic attribute graph. ,in Represents the node feature matrix, This represents the edge attribute matrix. Through this mapping mechanism, traditional independent and scattered traffic statistics samples are transformed into a structured graph representation rich in global topological context and dynamic link behavior features.

[0070] Figure 2 This invention provides a schematic diagram of the 5G network traffic communication graph construction process, detailing the underlying physical mapping mechanism for converting independent and scattered discrete traffic records into a structured topological attribute graph. It demonstrates how, after cleaning the original network data, IP addresses are abstracted into graph nodes, and communication behaviors and statistical characteristics are abstracted into directed edges and edge attribute matrices in a structured mapping process. The specific steps are as follows:

[0071] First, obtain the original "Network Intrusion Detection Traffic Data" record. This traffic record form contains high-dimensional and scattered fields such as source IP address, source port, destination IP address, destination port, characteristics, category, and debugging label.

[0072] Subsequently, the data flow enters the "downsampling" module (i.e., the data cleaning module), which cleans and denoises the massive discrete traffic records, removes redundant business ports and other highly scattered and interfering fields, and retains only the core communication entity session and traffic statistics features.

[0073] Next, proceed to the "Split Training and Test Sets" module. The structured traffic data is then divided into a "training set" for model self-supervised training and a "test set" for generalization verification according to a preset engineering or experimental ratio.

[0074] Finally, the core mapping process of "converting to a graph structure" is performed: the system statically or dynamically maps the IP addresses of communication entities in the traffic data (such as source IP 59.166.0.9, destination IP 149.171.126.7) to a set of nodes in a graph structure. (Corresponding to letter nodes A, B, C, etc. in the diagram); Simultaneously, various communication behaviors between entities are mapped to a set of directed edges connecting the two endpoints. Based on this, duration, number of bytes, and message statistical characteristics are attached to the link as edge attributes (forming an edge attribute matrix). Finally, a 5G traffic attribute graph structure rich in global topological geometric context is constructed.

[0075] S2: Local topological neighborhood aggregation and adaptive embedding extraction are performed using an attention-based edge feature encoder.

[0076] This invention designs and constructs an edge feature encoder (executed by an attention edge encoding module) employing the ATE-SAGE network architecture. When performing topological feature aggregation of local neighborhoods on the graph, this encoder explicitly introduces a graph attention mechanism. Specifically, it targets communication edges... The edge attribute vector is concatenated with its source node feature vector and destination node feature vector, and projected onto a unified metric space through a learnable linear transformation matrix. Using an attention weight calculation function, the association score between the target communication edge and its neighboring edges in the metric space is calculated, and normalized using a Softmax function to obtain the adaptive relative weights of each communication link. .

[0077] The model dynamically assigns the aforementioned relative weights based on the interaction differences between node features and edge features, thereby significantly amplifying and highlighting potential network attack traffic (which typically exhibits highly anomalous statistical mutations on specific edges), while substantially filtering and suppressing background noise interference from massive amounts of normal daily business traffic. Finally, the encoder utilizes these attention relative weights to perform weighted operations and fusion aggregation on the neighborhood features surrounding the target edge, successfully transforming the original high-dimensional traffic features into a low-dimensional, robust deep edge embedding feature representation that contains deep behavioral topological characteristics. .

[0078] S3: Unsupervised self-supervised model training is performed using an edge subgraph generative contrastive learning framework and a dual optimal transport joint loss function.

[0079] To achieve self-supervised model training in the absence of attack labels, this invention constructs a generative edge subgraph contrastive learning framework (ESC-L) through a self-supervised contrastive training module, thus enabling self-supervised learning without high-order attack labels. First, any communication link in the attribute graph after feature embedding is used as an anchor edge, and its local neighborhood is sampled in the overall attribute graph to form the corresponding original edge subgraph. Based on this, the relative weights output by the edge feature encoder in S2 are extracted. In the latent feature space, low-weight background traffic features in the original edge subgraph are subjected to feature scaling or Gaussian noise perturbation based on their relative weights, while high-weight features are mixed via cross-channel linear interpolation. This smoothly generates an enhanced view that includes both the core semantics of the original subgraph and certain micro-representational distribution variations, which serves as a positive sample for contrastive learning. Simultaneously, negative samples for contrastive learning are constructed by performing cross-graph sampling within the global graph, thus providing quantitative supervision signals for contrastive learning without relying on a large amount of labeled data. Here, the global graph refers to the complete 5G traffic attribute graph constructed in S1, encompassing the entire network topology.

[0080] To guide the contrastive learning process, this invention further introduces optimal transport theory to construct a structured contrastive loss function, measuring the differences in spatial feature distribution and topological structure between the original edge subgraph and the enhanced view. Specifically:

[0081] (1) The Wasserstein distance is used to refine the spatial probability distribution of deep edge embedding feature representations between the original edge subgraph and the positive sample augmented view. The negative sample view is used as the rejection benchmark to construct the feature distribution contrast loss. ;

[0082] (2) The Gromov-Wasserstein distance is used to measure the variation and difference of the intrinsic graph topological geometry between the original edge subgraph and the positive sample augmented view due to interpolation reconstruction. Combined with the negative sample view, a topological contrast loss is constructed to bring positive samples closer and push negative samples away. .

[0083] Among them, the Wasserstein distance aims to measure the "minimum transmission cost" of transforming between two probability distributions in a feature space. It can still provide a smooth and continuous distance metric even if the two distributions have little overlap. The Gromov-Wasserstein distance aims to measure the topological difference in the "relative geometric relationship" within two heterogeneous spaces (or graph structures), breaking the restriction of requiring absolute coordinate alignment.

[0084] The global self-supervised joint optimization objective function of this invention is ultimately defined as:

[0085]

[0086] in A pre-defined control parameter (optimally set to 0.5 in this embodiment) is used to balance the global weights of feature space distribution and network topology geometry during the contrastive learning process. This global joint loss objective function is iteratively minimized using gradient descent during the training phase. The network parameters of the edge feature encoder are optimized and continuously updated in a collaborative manner, enabling the model to spontaneously grasp the highly robust network traffic representation rules without any prior attack labels.

[0087] S4: Map the real-time traffic to be tested to the unsupervised anomaly detector, calculate the anomaly score, and execute the defense response.

[0088] During the actual detection phase, the online detection and alarm module captures the traffic records to be detected in the 5G network in real time, and dynamically feeds them into the trained edge feature encoder through the mapping logic of S1, extracting the low-dimensional deep edge embedding feature representation of each active communication link online and with low latency.

[0089] Subsequently, these deep edge-embedded features are uniformly input into a back-end cascaded unsupervised anomaly detector (in this embodiment, an isolated forest model is used). The detector calculates the distance of the test sample from the boundary of normal service traffic distribution and outputs the corresponding anomaly probability score for each communication link in real time. By setting a reasonable security defense judgment threshold, the system can perfectly filter out occasional background service fluctuation noise; once the real-time anomaly probability score of a certain communication link exceeds the preset threshold, the system determines that the 5G network traffic corresponding to that link belongs to malicious intrusion attack behavior and immediately triggers the associated security defense system to block and intercept and synchronize alarm response.

[0090] A system employing the aforementioned graph contrastive learning and attention-based unsupervised intrusion detection method for 5G networks includes:

[0091] Traffic acquisition and graph construction module: used to acquire raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body;

[0092] Attention edge encoding module: used to build an edge feature encoder based on attention mechanism. It introduces graph attention mechanism in the neighborhood aggregation process of local topology, adaptively assigns relative weights according to the feature differences of nodes and associated edges, and extracts highly robust deep edge embedding feature representations.

[0093] Self-supervised contrastive training module: used to construct a generative edge subgraph contrastive learning framework, sample local subgraphs with communication links as anchor points, use the relative weights to perform feature weighted interpolation and topology reconstruction in the latent space, generate positive sample enhanced views and negative sample views, and introduce a structured contrastive loss function based on optimal transmission theory to perform self-supervised joint optimization training of the model;

[0094] Online detection and alarm module: used to map the 5G network traffic to be detected to the trained model, extract deep edge embedding features and input them into the unsupervised anomaly detector, and output network intrusion detection results and alarm information.

[0095] The traffic acquisition and graph construction module is specifically used to map the IP addresses of communication entities in the network to a set of nodes in a graph structure. Mapping inter-entity communication behaviors as a set of directed edges. The duration, number of bytes, and message statistical characteristics of 5G traffic are attached to the communication link as edge attributes, ultimately constructing a 5G traffic attribute graph. ,in Represents the node feature matrix, Represents the edge attribute matrix.

[0096] The attention edge encoding module adopts the ATE-SAGE network architecture, specifically used to introduce a graph attention mechanism to adaptively calculate the association weights between the target edge and its neighboring nodes and adjacent edges. It dynamically allocates relative weights based on the interaction differences between node features and edge features, and uses the relative weights to perform weighted aggregation of neighborhood features, transforming them into a low-dimensional deep edge embedding feature representation.

[0097] The self-supervised contrastive training module uses Wasserstein distance to measure the consistency of deep edge embedding feature distributions between the original edge subgraph and the augmented view to construct a feature distribution contrastive loss. The difference in topological relationships between Gromov-Wasserstein distance metric graphs is used to construct a topological contrast loss. And minimize the objective function through iteration. Collaborative optimization updates model parameters.

[0098] In noisy training scenarios where attack samples are mixed in, the online detection and alarm module filters background noise through a set security threshold. When the anomaly probability score of a certain link exceeds the preset threshold, it determines that the 5G traffic corresponding to that link is an intrusion attack and triggers the security defense system to issue an alarm response.

[0099] Figure 1 This is a flowchart illustrating the overall architecture of the 5G network unsupervised intrusion detection model (ATE-ESC) based on graph contrastive learning and attention mechanisms proposed in this invention. It shows the complete data flow and module connections from discrete 5G traffic input, attribute graph mapping, feature encoding, self-supervised contrastive training of edge subgraphs, to final unsupervised anomaly detection and alarm. It is divided into a training phase and a detection phase.

[0100] During the training phase, the raw 5G network traffic is first acquired through the traffic acquisition and graph construction module. Communication entities and traffic statistical features are extracted, and a 5G traffic attribute graph structure with communication edges as the main body is constructed. .

[0101] Then, the attribute graph Input the "ATE-ESC Representation Learning" module. This module internally couples an attention-based edge encoder module, which includes edge feature encoding, and a self-supervised contrastive training module for subgraph generation. The system first introduces a graph attention mechanism using the ATE-SAGE edge feature encoder to calculate and assign relative weights to communication links. The high-dimensional features are initially mapped to deep edge embedding feature representations. Next, in the latent feature space, local subgraphs are sampled using communication links as anchor points, and relative weights are utilized. Feature weighted interpolation and reconstruction are performed to generate positive sample enhanced views and negative sample views. Finally, based on deep edge embedding, the geometric difference between feature distribution and topology is calculated and a global joint loss is constructed to collaboratively optimize and update encoder model parameters.

[0102] During the detection phase, the network traffic of the 5G network under test is captured in real time and a test attribute map is constructed. The feature is then input into the trained edge feature encoder to extract the deep edge embedding feature representation of each communication link online. Finally, the feature is input into the classifier to output the detection result of normal or abnormal.

[0103] Figure 3 The flowchart illustrating the operational logic of the self-supervised contrastive learning framework (ESC-L) based on edge subgraph generation provided by this invention demonstrates the closed-loop mechanism for model self-parameter updating within the system under a strict zero-attack label background. It describes subgraph sampling anchored by communication edges, feature-weighted interpolation based on attention weights, generation of positive sample views through topology reconstruction, and a self-supervised optimization iterative mechanism based on joint loss calculation of dual optimal transmission distances and gradient backpropagation. The specific steps are as follows:

[0104] First, the constructed 5G traffic attribute graph structure with communication edges as the main body is input into the system. The initial feature extraction is performed by the front-end edge feature encoder, which maps the original high-dimensional traffic features into a preliminary "feature embedding" state.

[0105] Then, the "sampling" module is entered. Using any communication link in the attribute graph after feature embedding as the anchor edge, its local neighborhood is sampled in the whole graph and segmented to form the corresponding "sampling subgraph" (i.e. the original edge subgraph).

[0106] Next, the module enters the "Generation" module. Using the attention relative weights output by the side feature encoder, feature scaling or noise perturbation is applied to the low-weight background traffic features in the sampled subgraph in the latent feature space, and cross-channel linear interpolation is performed on the high-weight features. While keeping the original attack semantic pattern of the subgraph unchanged, the "Generation Comparison Subgraph" is smoothly reconstructed, and the "positive sample" enhanced view and "negative sample" view required for comparison learning are constructed accordingly.

[0107] Finally, the positive sample, negative sample views, and original edge sub-views are combined. Figure 1 The same data is fed into the "ESC-L Optimization Objective" calculation module on the right: The Wasserstein distance (WD) is used to refine the spatial probability distribution consistency of deep edge embedding feature representations between the original subgraph and the enhanced view, thus constructing the "edge contrast loss" (i.e., feature distribution contrast loss). Meanwhile, the Gromov-Wasserstein distance (GWD) is used to rigorously measure the variability of the intrinsic graph topological geometry between the two due to interpolation reconstruction, and a topological contrast loss is constructed. Ultimately, through operators The two sets of losses are linearly combined into a global joint optimization objective function. The network parameters of the entire network are collaboratively optimized and updated by iteratively minimizing this objective function.

[0108] Experimental verification and effect evaluation:

[0109] To objectively and comprehensively verify the detection performance and inventiveness of the method of this invention, it was thoroughly tested on two sets of industry-recognized high-performance experimental datasets. Dataset 1 is the publicly available 5G network-specific benchmark dataset 5G-NIDD; Dataset 2 is a self-developed 5G Threat dataset simulating highly complex real-world evolutionary adversarial scenarios. This experiment uses the internationally accepted F1 score as the core comprehensive evaluation metric, and the existing baseline technologies compared horizontally include E-GraphSAGE, Anomaly-E, GADAM, and CoLA.

[0110] in:

[0111] E-GraphSAGE: An improved graph neural network intrusion detection model that can directly capture node attributes and communication edge features from network stream data.

[0112] Anomal-E: A self-supervised network intrusion detection framework based on graph neural networks, focusing on jointly utilizing edge features and graph topology for reconstructing training of positive and negative samples.

[0113] GADAM: A graph anomaly detection algorithm based on adaptive message passing, which effectively alleviates the "oversmoothing" problem of graph models by introducing a neighborhood-free attention strategy.

[0114] CoLA: A contrastive self-supervised anomaly detection framework for attribute networks that scores unsupervised anomalies by measuring the feature consistency between network nodes and their local subgraphs.

[0115] 1. Experimental analysis of the evolution of the model's noise robustness

[0116] This invention specifically addresses the pain point of "inability to obtain absolutely pure training data" in real-world 5G environments by conducting noise resistance stability tests on unlabeled attack traffic. Figure 4The line graph provided for this embodiment of the invention shows the evolution of the model F1 score on the 5G-NIDD dataset as the proportion of unlabeled attack traffic noise increases. It shows the evolution curve of the model detection F1 score on the 5G-NIDD dataset as the proportion of malicious noise in the training samples gradually increases from 0% to more than 5%.

[0117] As can be seen from the trend of the broken line, traditional graph anomaly detection methods are highly susceptible to noise interference, causing the normal boundary to shift, and their performance collapses significantly with increasing noise. However, the method of this invention (ATE-ESC) introduces attentional relative weights that can suppress noise flow in step 2, and applies dual probabilistic constraints on the positive samples after latent feature interpolation using Wasserstein distance and Gromov-Wasserstein distance in step 3. This results in the model's F1 score exhibiting extremely strong and stable anti-noise and anti-interference capabilities across the entire noise range.

[0118] 2. Head-to-head performance comparison of multiple datasets in a clean environment

[0119] This invention first validates the generalization performance of different methods in an ideal, pure training environment with no noise pollution.

[0120] (1) Comparison based on 5G-NIDD dataset (e.g.) Figure 5 As shown, the detection performance differences of various schemes under ideal conditions without noise pollution are illustrated: Under the embodiment of this invention, the system's detection F1 score reaches the industry-leading highest level, significantly surpassing the GADAM and CoLA models that simply focus on node representation or traditional full-graph random perturbations. This directly confirms that "constructing attribute graphs with communication edges as the main body" is more in line with the physical nature of 5GNetFlow traffic records.

[0121] (2) Comparison based on 5G Threat dataset (e.g.) Figure 6 As shown, this invention is used to double-verify the baseline accuracy of each invention under different traffic distribution scenarios: To eliminate the randomness caused by a single dataset, this invention underwent double verification on the self-developed 5G Threat dataset. Experimental results show that the F1 score of the method of this invention still firmly occupies the first position, proving that the algorithm has a very strong adaptive generalization ability for different topologies and traffic distributions.

[0122] 3. Performance comparison in real-world scenarios with 5% high noise:

[0123] In actual 5G industrial internet or core network environments, massive background services are often accompanied by complex zero-day attacks, resulting in training sets typically containing about 5% hidden noise samples.

[0124] (1) As Figure 7 (5G-NIDD dataset) and Figure 8 As shown in the 5G Threat dataset, when 5% malicious attack traffic noise is added during training, the F1 performance of traditional baseline models (such as E-GraphSAGE, Anomaly-E, etc.) shows an extremely severe precipitous drop, with a significant increase in both false positive and false negative rates.

[0125] (2) In contrast, the method of this invention (ATE-ESC) in... Figure 7 and Figure 8 It demonstrated remarkable consistency and stability, with its F1 score on both datasets almost matching that of the clean environment, remaining within the optimal range and overwhelmingly outperforming all the comparison schemes.

[0126] The above two sets of datasets and the complete set of closed-loop experimental data under two environments (clean / noisy) Figures 4-8 This invention irrefutably demonstrates that it not only achieves profound innovation in underlying algorithmic mechanisms, but also brings about leapfrog and significant technological progress in engineering implementation.

[0127] This invention first uses a traffic acquisition and graph construction module to structure discrete 5G traffic into a 5G traffic attribute graph with communication edges as the main components. Then, using an attention-based edge feature encoding module, it adaptively allocates relative weights through feature splicing projection and normalization calculation to extract deep edge embedding representations and suppress background noise. Next, a self-supervised contrastive training module constructs a generative edge subgraph contrastive learning framework. It uses relative weights to scale or perturb low-weight features and performs cross-channel linear interpolation reconstruction on high-weight features to generate positive sample enhanced views. Furthermore, a structured contrastive loss function constructed from Wasserstein distance and Gromov-Wasserstein distance is introduced to collaboratively optimize and update model parameters. Finally, a cascaded online detection and alarm module calculates the anomaly probability score of active communication links to achieve anomaly defense response. This invention breaks through the limitations of traditional methods and supervised models, exploring and constructing a long-lasting unsupervised network intrusion detection framework that balances link topology features with high noise robustness. Without relying on attack labels, it significantly improves the system's detection accuracy and noise robustness across multiple datasets in real, complex, and noisy scenarios.

[0128] The above description describes specific embodiments of the present invention and the technical principles employed. Any changes made in accordance with the concept of the present invention that do not exceed the spirit of the specification and drawings should still fall within the protection scope of the present invention.

Claims

1. An unsupervised intrusion detection method for 5G networks based on graph contrastive learning and attention mechanisms, characterized in that, Includes the following steps: Obtain raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body; The 5G traffic attribute graph structure is input into an attention-based edge feature encoder. A graph attention mechanism is introduced during the neighborhood aggregation process of the local topology to calculate and assign relative weights to communication links based on the feature differences of nodes and associated edges. The high-dimensional features are initially mapped to deep edge-embedded feature representations, resulting in an attribute graph after feature embedding. The attribute map after feature embedding is input into the generative edge subgraph contrastive learning framework. Local subgraphs are sampled using communication links as anchor points to form the original edge subgraph, and the relative weights are then used. Feature-weighted interpolation and topology reconstruction are performed in the latent space to generate positive sample enhanced views and negative sample views; then a structured contrastive loss function based on optimal transport theory is introduced to perform self-supervised joint optimization training of the model; The 5G network traffic to be detected is mapped to the trained model, deep edge embedding feature representation is extracted and input into the unsupervised anomaly detector, and the network intrusion detection results and alarm information are output.

2. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 1, characterized in that, Extracting communication entity and traffic statistical features, and constructing a 5G traffic attribute graph structure with communication edges as the main body, includes the following steps: The collected discrete 5G network traffic intrusion detection traffic data records are cleaned. The cleaned data records are then structured and mapped, including mapping the IP addresses of communication entities in the network to nodes in a graph structure, with the node set denoted as . Communication between entities is mapped to directed edges, and the set of edges is denoted as . Based on this, the duration, number of bytes, and message statistical characteristics of 5G traffic are attached to the communication link as edge attributes, ultimately constructing a 5G traffic attribute graph. ,in Represents the node feature matrix, Represents the edge attribute matrix.

3. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 1, characterized in that, The edge feature encoder adopts the ATE-SAGE network architecture, and the steps for obtaining the attribute map after feature embedding are as follows: When performing neighborhood aggregation of local topology, the edge feature encoder introduces a graph attention mechanism to adaptively calculate the target communication edge. The association weights between the node and its neighboring nodes and adjacent edges are determined, and relative weights are dynamically assigned to different communication links based on the interaction differences between node features and edge features. ; Using the relative weights By weighted aggregation of neighborhood features, high-dimensional, dynamic 5G network traffic features are transformed into low-dimensional deep edge embedding feature representations. .

4. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 3, characterized in that, Adaptive computation of target communication edge The association weights with its neighboring nodes and adjacent edges include the following steps: The edge attribute vector of the target communication edge is concatenated with the feature vectors of its source node and the feature vector of its destination node, and then projected onto a unified metric space through a learnable linear transformation matrix. The association score between the target communication edge and its neighboring edges in the metric space is calculated using the attention weight calculation function, and then normalized using the Softmax function to obtain the relative weight of each communication link.

5. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 1, characterized in that, The steps for inputting the feature-embedded attribute map into the generative edge subgraph contrastive learning framework to generate the original edge subgraph, the positive sample augmentation view, and the negative sample view are as follows: Using any communication link in the attribute graph after embedding the features as an anchor edge, sample its local neighborhood in the graph to form the original edge subgraph; Using the relative weights output by the edge feature encoder, the features of the original edge subgraph are weighted and reconstructed in the latent feature space to generate an enhanced view that maintains semantic association with the original edge subgraph, which is then used as a positive sample for contrastive learning. Within the 5G traffic attribute graph structure, negative samples for contrastive learning are constructed through cross-graph sampling or random perturbation.

6. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 5, characterized in that, The steps for weighted interpolation and reconstruction of the features of the original edge subgraph in the latent feature space are as follows: Based on the relative weights, feature scaling or Gaussian noise perturbation is applied to the low-weight background traffic features in the original edge subgraph, and cross-channel linear interpolation mixing is performed on the high-weight features. While maintaining the original attack semantic pattern of the original edge subgraph, a positive sample augmentation view with perturbation diversity in feature distribution and topology is constructed.

7. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 1, characterized in that, The model is trained using a structured contrastive loss function based on optimal transport theory, and includes the following steps: The original edge sub-image, the positive sample augmentation view, and the negative sample view are all sent to the loss function calculation module. Wasserstein distance is used to measure the consistency of deep edge embedding feature distribution between the original edge subgraph and the positive sample augmented view, and a feature distribution contrast loss is constructed. Simultaneously, the Gromov-Wasserstein distance metric is used to measure the difference in graph topological relationships between the original edge subgraph and the positive sample augmented view, and a topological contrast loss is constructed. ; The global self-supervised joint optimization objective function is defined as: in, Control parameters that balance control characteristics and global topology; Minimize iteratively This is used to collaboratively optimize and update the model parameters of the edge feature encoder.

8. The 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism according to claim 1, characterized in that, The steps for outputting network intrusion detection results and alarm information are as follows: During the detection phase, the 5G network traffic to be detected will be captured in real time and the attribute graph structure of the 5G traffic to be detected will be constructed. The 5G traffic attribute graph structure to be tested is input into the trained edge feature encoder to extract the deep edge embedding feature representation of each communication link online. The deep edge embedding feature representation of each communication link is uniformly input into the unsupervised anomaly detector to calculate the anomaly probability score of each communication link. In noisy training scenarios where attack samples are mixed in, background noise is filtered out by setting a security threshold. When the anomaly probability score of a certain link exceeds the security threshold, the system determines that the 5G traffic corresponding to that link is an intrusion attack and triggers the security defense system to issue an alarm response.

9. A system employing the 5G network unsupervised intrusion detection method based on graph contrastive learning and attention mechanism as described in any one of claims 1 to 8, characterized in that, include: Traffic Acquisition and Graph Construction Module: Used to acquire raw 5G network traffic, extract communication entities and traffic statistical features, and construct a 5G traffic attribute graph structure with communication edges as the main body; Attention edge encoding module: used to build an edge feature encoder based on attention mechanism. It introduces graph attention mechanism in the neighborhood aggregation process of local topology, adaptively assigns relative weights according to the feature differences of nodes and associated edges, and extracts highly robust deep edge embedding feature representations. Self-supervised contrastive training module: used to construct a generative edge subgraph contrastive learning framework, sample local subgraphs with communication links as anchor points, use the relative weights to perform feature weighted interpolation and topology reconstruction in the latent space, generate positive sample enhanced views and negative sample views, and introduce a structured contrastive loss function based on optimal transmission theory to perform self-supervised joint optimization training of the model; Online detection and alarm module: used to map the 5G network traffic to be detected to the trained model, extract deep edge embedding features and input them into the unsupervised anomaly detector, and output network intrusion detection results and alarm information.

Images