Method and system for detecting intrusions in a computer network using machine learning

Abstract

A method for detecting malicious flows in a computer network comprising the steps of: Capturing a set of network flows, Creating a graph whose nodes represent each captured flow, two nodes of the graph being connected if the two associated flows are emitted by the same user or are transmitted to the same user, Executing an artificial intelligence engine trained to detect an intrusion into the computer network from the graphs and comprising the substeps of: Applying to the graphs at least one graph neural network trained to generate, for each flow, a second vector of features capable of discriminating an authorized flow from a malicious flow, the training of said graph neural network exploiting at least the topology of the graphs,Applying to the second set of characteristic vectors an artificial neural network trained to classify the flows into two classes corresponding respectively to authorized flows and malicious flows. Figure 4,

Description

Title of the invention: Method and system for detecting intrusions into a computer network using machine learning

[0001] The invention relates to the field of cybersecurity of computer or telecommunications networks.

[0002] The invention relates to a method and a system for detecting intrusions into a computer network by means of a detection method implementing a machine learning model exploiting a particular representation of the data in the form of a graph.

[0003] Intrusion Detection Systems (IDS) have the function of detecting intrusions or more generally detecting anomalies in a network. Their objective is to act in addition to preventive security mechanisms of the cryptographic or access control type. There are mainly two types of IDS systems depending on the attack detection method implemented. Two types of intrusion detection methods exist mainly: intrusion detection methods by signatures or by anomalies.

[0004] Signature detection relies on a database of attack signatures. The various elements observed by the IDS system (for example, network flows in the case of a network intrusion detection system) are compared to the various entries in this database. A match means that the system under surveillance is the target of the attack whose signature corresponded to the observation. These systems aim to detect attacks by comparing network traffic to predefined patterns of attacks already known.

[0005] Anomaly detection systems are based on the detection of an abnormal operation, compared to previous observations, in the observed element. These systems have the advantage of allowing the detection of unknown attacks, never observed before and for which signatures have not yet been able to be formed. However, they are also characterized by high false positive rates for the detection of unknown attacks. We speak of a false positive when an event that is not an intrusion is identified as an anomaly. This case occurs, for example, during a network failure that causes an abnormal phenomenon that can be detected as an intrusion.

[0006] Signature-based IDS systems are effective in detecting known attacks with a low false positive rate, but fail to detect new types of attacks. Therefore, in recent years, anomaly detection concepts using machine learning have emerged. Machine Learning (ML) and Deep Learning (DL) were investigated to identify any abnormal behavior in the network. These techniques show encouraging results in detecting new attacks.

[0007] US patent application US20220021695 proposes an adaptive intrusion detection method that is based on the deployment of a network traffic capture and network packet trace collection system that is used by a network audit tool to extract features from the collected network packets. Then, the extracted features are considered as unlabeled data and combined with a labeled training set capturing examples of malicious network traffic to be used with the new learned representation of the unlabeled data to modify the labeled training set and obtain a new training set. The new training data thus obtained is used to train a machine learning model for traffic classification.A disadvantage of this approach is that it only considers data extracted from packets to classify traffic and in particular does not take into account the network topology, especially spatial information related to attacks.

[0008] US patent US7260846 uses a network analyzer to collect network packets and extract individual data therefrom, as well as a traffic recorder. Next, a vector builder is configured to generate multidimensional vectors from the collected features of the packet header fields. Self-organizing clustering modules are configured to process the multidimensional vectors to produce a self-organizing map of clusters. Next, an anomaly detector can detect anomalous correlations between individual clusters of the self-organizing map based on at least one configurable correlation metric. Finally, a classifier classifies the traffic as malicious or normal using the calculated anomalous correlations.

[0009] US patent application US20200137083 relates to a method for detecting malicious program behavior that includes performing a program audit based on system activity data. An analysis of unverified program data identified from the program audit is performed to detect abnormal events, including analyzing host-level events to detect abnormal events. The analysis is based on learning a graph-based program representation embedded in a graph-based attentional architecture invariant between different system entities, generating detection results based on the analysis, and performing at least one corrective action based on the detection results.

[0010] International application WO202189196 relates to a detection method intrusion detection method to detect malicious threat activities in a network consisting of multiple interconnected user profiles by learning a behavioral model for each user profile based on multiple activity events, in which the determination of the behavioral model is performed by a recurrent neural network. The differentiation between normal and abnormal activity events for hidden users is performed by a feed-forward neural network trained using multiple behavioral models. A disadvantage of this method is that it only considers user behavior data in the training procedure and does not consider any relationship of the user with other users in the network.

[0011] The scientific publication “Unveilling the potential of graph neural networks for robust intrusion detection, David Pujol-Perich et al” is based on the use of several artificial intelligence algorithms applied to graphs or “Graph Neural Network (GNN)” to develop network intrusion detection systems (NIDS). This document proposes a graph-based representation that represents the properties of communication flows and their relationships in the network combined with a new GNN neural network architecture specifically designed to learn and generalize previous graph-structured information. The authors create a connection graph between hosts where each node corresponds to a network user. They first propose to create a generous heterograph where they introduce two types of nodes; the first type represents users, and the second represents flows.

[0012] Generally, there is a need to improve the methods of the prior art in order to better highlight the characteristic patterns of an intrusion into a network.

[0013] The invention proposes a new method based on a particular type of graph whose structure is created in such a way as to provide more relevant spatial information on the reasons for intrusions. In particular, the nodes of the graph are associated with flows and no longer with users.

[0014] This new flow-based graph structure allows the learning model to distinguish between normal and malicious flows, including flows generated by camouflaged attackers (i.e., attackers trying to conceal their malicious activities to evade detection). First, the first phase of the proposed method is to transform the captured network traffic into a graph and then spatial and non-spatial features are extracted from the graph by a set of neural networks acting as a machine learning model.

[0015] The technical advantages of the invention are induced by the relevant information that can be extracted from the structure. The present invention proposes to model communication flows in the form of a new graph structure. This structure makes it possible to extract relevant topological information allowing an artificial intelligence model to learn a generalization of characteristic attack patterns during a training phase and to recognize abnormal behavior while following the detection procedure. The proposed method models communications in the network in the form of a graph where each node represents a flow. Links between nodes are created to connect flows coming from the same user or directed to the same user.

[0016] An advantage of such a graph structure is that the nodes of the graph correspond to communication flows and not to network users. Indeed, intrusion detection based solely on user-related information can easily be circumvented by impersonation. Attacks in a network have a behavioral model that models the attack steps performed by the attacker. These models are the information that the cybersecurity specialist looks for to detect an attack. The graph structure proposes that two communications belong to the same attack pattern if they are directed towards or generated by the same user. In other words, two flows generated by the same user or intended for the same user are connected in the graph structure to give artificial intelligence models the ability to extract communications that could belong to the same attack.This information can be combined with communication attributes to differentiate between normal communications and malicious behavior.

[0017] Most state-of-the-art solutions represent the network as a graph where the nodes are the users (or machines / hosts in the network), each identified with an IP address alone or combined with a port number as a second identifier. However, this representation is too simple and has several drawbacks. First, using this structure, the problem is transformed into a task of classifying the edges of the graph, but intrusion detection consists of capturing malicious flows and not attackers. Indeed, detecting users with malicious behavior is more difficult than detecting the malicious flows themselves and it can be evaded easily. For this, attackers usually modify their IP addresses using virtual private networks.Moreover, the edge classification task is not yet well studied using graph-based neural network (GNN) theory, and therefore, the state-of-the-art results are not encouraging.

[0018] On the other hand, the present invention is simpler than the solution proposed by David Pujol-Perich et al. Indeed, this state-of-the-art solution, previously introduced, is characterized by a node for each network user. On the contrary, the invention is based on a graph whose nodes are only associated with communication flows. Therefore, the invention is more efficient in terms of resource consumption (memory usage and reduced energy / electricity consumption).

[0019] The invention exploits the graphs created in a first step by means of a first trained artificial intelligence model to determine a discriminative representation of the characteristics of the communication flows so as to maximize a dissimilarity between a legitimate flow and a malicious flow. Then, one or more graph neural network models are applied to exploit the topology of the graph in order to extract additional characteristics which are finally transmitted to a trained decision module to classify the flows between legitimate and malicious flows.

[0020] The subject of the invention is a method, implemented by computer, for detecting malicious flows in a computer network comprising the steps of: - Capturing a set of network flows, each network flow being associated with a first vector of measured flow characteristics and a measurement instant, - Creating, for each measurement instant, a graph whose nodes represent each captured flow, two nodes of the graph being connected if the two associated flows are emitted by the same user or are transmitted to the same user, each node being provided with said first vector of characteristics, - Executing an artificial intelligence engine trained to detect an intrusion into the computer network from the graphs and comprising the sub-steps of: i. Applying to the graphs at least one trained graph neural network to generate, for each flow, a second vector of characteristics capable of discriminating an authorized flow from a malicious flow, the training of said graph neural network exploiting at least the topology of the graphs, ii. Apply to the second feature vectors an artificial neural network classifier trained to classify the flows into two classes corresponding respectively to authorized flows and malicious flows.

[0021] According to a particular aspect of the invention, the step of executing the artificial intelligence engine further comprises a step, prior to the application of the at least one graph neural network, consisting of applying to the first characteristic vectors at least one artificial neural network trained to reduce the dimension of the first vectors by extracting discriminating characteristics an authorized flow of a

[0022]

[0023]

[0024]

[0025]

[0026]

[0027]

[0028]

[0029]

[0030] malicious flow, the training of said artificial neural network not exploiting the topology of graphs. According to a particular aspect of the invention, the at least one artificial neural network is a multi-layer perceptron. In an alternative embodiment, the method comprises a step of preprocessing the first vectors of measured characteristics consisting at least of a normalization of the values ​​and / or a categorical encoding of the values. In an alternative embodiment, the method further comprises a step of calculating, for each edge of the graph, a similarity score between the first characteristic vectors of the two flows associated with the two nodes connected by the edge. In an alternative embodiment, the similarity score is calculated using a cosine similarity measure. In an alternative embodiment, the at least one graph neural network is a convolutional graph neural network. In an alternative embodiment, the graph convolutional neural network comprises several layers configured to implement a convolution calculation of the type: h (M) = are the respective outputs of the layers with indices 1,1+1 4 — A + I with A an adjacency matrix whose entries (i,j) are equal to 0 if nodes i and j of the graph are not connected and equal to the similarity score if nodes i and j are connected, D is a diagonal matrix whose values ​​are equal to the degrees of each node, |y(0) corresponds to the parameters of the layer with index 1 which are learned, G is an activation function, for example a ReLu function According to a particular aspect of the invention, the at least one graph neural network is a graph attention network. According to a particular aspect of the invention, the graph attention network comprises a graph neural network and an attention layer trained using an attention model configured to learn attention values ​​for each edge of the graph and calculate a feature for each node using a weighting of the features of neighboring nodes based on the attention values. According to a particular aspect of the invention, several graph neural networks are executed in parallel and the method comprises a step of concatenating the second feature vectors generated by each graph neural network to provide a concatenated vector to the classifying artificial neural network.

[0031] According to a particular aspect of the invention, the classifying artificial neural network is a multi-layer perceptron.

[0032] According to a particular aspect of the invention, the first vector of measured characteristics contains information characteristic of the flows among: the source and destination addresses, the protocols used, statistics relating to the packets transmitted via this flow.

[0033] According to a particular aspect of the invention, the artificial intelligence engine is trained in a supervised or unsupervised manner.

[0034] The invention also relates to a system for detecting malicious flows in a telecommunications network comprising at least one probe capable of acquiring a network flow or a set of network frames transiting in said network and at least one device for detecting malicious flows configured to implement the steps of the method for detecting malicious flows according to the invention, from the network flow or the set of network frames.

[0035] Other characteristics and advantages of the present invention will appear better on reading the description which follows in relation to the following appended drawings.

[0036] [Fig-1] represents a general diagram of an intrusion detection device in a computer network,

[0037] [Fig.2] represents a diagram of a graph structure modeling a set of network flows according to one embodiment of the invention,

[0038] [Fig.3] represents a diagram of several graph structures modeling a intrusion into a network,

[0039] [Fig.4] represents a diagram of an intrusion detection method according to a mode of carrying out the invention,

[0040] [Fig.l] represents an example of implementation of an intrusion detection system NIDS according to an embodiment of the invention. Such a NIDS system acts at the network level to classify flows coming from a computer network into legitimate or malicious flows. The malicious flows are reported to a network administrator AR who is responsible for analyzing the malicious flows and implementing actions to prevent potential attacks. The flows classified as malicious by the NIDS detection system are saved in a specific database BD.

[0041] The NIDS detection system collects the flows passing through the computer network, via a PF firewall. The flows can come from a local network RL or from an external network RE, for example the Internet network.

[0042] The NIDS detection system is configured to execute an intrusion detection method according to one embodiment of the invention. To this end, it is capable of capturing network packets transmitted within the network and transforming them into streams of communications identified by various characteristics including protocol type (IP), source / destination port number, source / destination IP address, timestamp, and any other statistical information extracted from packet headers or calculated from information extracted from packet headers.

[0043] [Fig.2] represents, on two comparative diagrams, a graph structure according to the prior art and a graph structure according to the invention applied to a computer network.

[0044] On the left of [Fig.2], a first example of graph GR-1 is shown according to a representation used in the prior art. Graph GR-1 is structured such that the nodes IPI, IP2, IP3, IP4 of the graph correspond to users of the network, for example identified by their IP address, and the edges of the network F1, F2, F3, F4, F5 correspond to communication flows between a source node and a destination node. For example, flow F1 is between source IP2 and destination IPI.

[0045] On the right of [Fig.2], for the same example of computer network used for graph GR-1, an example of graph structure GR-2 proposed by the invention is shown. Graph GR-2 is structured so that the nodes of the graph this time correspond to the communication flows F1, F2, F3, F4, F5. Two nodes of graph GR-2 are connected by an edge if the associated flows come from the same source or are intended for the same destination.

[0046] In the example of [Fig.2], the flows F1, F2 and F4 are connected together because they share the same source IP2. The flows F2 and F3 are connected because they share the same destination IP3. The flows F4 and F5 are connected because they share the same destination IP4.

[0047] The GR-2 graph structure has the advantage of greater efficiency in terms of information provided compared to the prior art GR-1 structure. The GR-2 graph makes it possible to provide artificial intelligence models based on neural graph networks with relevant structural information in order to better distinguish malicious communication flows from authorized flows.

[0048] For example, in the case of a reconnaissance attack (or "footprinting attack") or a distributed denial of service DDoS attack, we obtain a graph structure where all malicious flows are interconnected. Neural graph network models can quickly learn this interconnection, thus improving the detection of malicious flows.

[0049] Furthermore, in a particular embodiment of the invention, each edge of the graph GR-2 is assigned a similarity score between the two nodes connected by the edge. The similarity score C.. is an indicator of the similarity between the two flows F; and E. Each edge of the GR-2 graph is thus provided with a weight which makes it possible to improve the re-

[0050]

[0051]

[0052]

[0053]

[0054]

[0055] knowledge of the shapes of models based on neural graph networks by providing information about the two nodes connected by that edge. Indeed, the communication flows involved in attack traffic generally have a certain similarity, for example when the attack corresponds to a survey, a DDoS payload or a single attack that propagates. The similarity score between two flows can notably increase if two flows share the same source or the same destination, if two flows are similar in terms of their specificities, for example in terms of duration, volume, or traffic pattern. The similarity score can also increase inversely proportionally to the time elapsed between the appearance of these two flows. The similarity score is for example a cosine similarity score defined by the relation: di,dj are vectors containing the measured characteristics for the communication flows F;,Fj, Nf. [Fig. 3] schematizes several comparative examples of graphs according to the prior art and according to the invention, applied to attack scenarios. The graphs according to the method of the prior art GR-1-1, GR-1-2, GR-1-3, GR-1-4 are represented on the left of the figure while the graphs according to the invention GR-2-1, GR-2-2, GR-2-3, GR-2-4 are represented on the right of the figure. The attack scenarios considered in the example of [Fig.3] correspond to the following time sequence: - At time tb the attacker IP0 collects information simultaneously on several devices of the network IPI, IP2, IP3, IP4, it thus generates flows Fl, F2, F3, F4. This step is represented by graphs GR-1-1 and GR-2-1; - At time t2, the attacker implements an SQL injection to exploit a security flaw in one of the IPI devices. To do this, the attacker IP0 generates the flows Fi1, Fi2, Fi3 towards the target IPI. This step is represented by graphs GR-1-2 and GR-2-2; - At time t3, the attacker attempts to crack a password of user IP4 to gain access to the network. To do this, he generates the flows F4*, F42, F43, F44, F45 to the target IP4. This step is represented by graphs GR-1-3 and GR-2-3; - At time t4, the attacker usurps the identity of IP4 after five connection attempts. To do this, he generates the flows F'4', F'42, F'43, F'44, F'45 towards the target IP4. This step is represented by graphs GR-1-4 and GR-2-4.

[0056] For the sake of simplification, not all edges have been shown in [Fig.3], in particular the edges connecting the nodes of the graph GR-2-3 to the flows F1, F2, F3.

[0057] The representations of graphs GR-2-1, GR-2-2, GR-2-3, GR-2-4 according to the invention make it possible to highlight certain particular patterns in the structure of the graphs which are characteristic of the aforementioned attacks. Also, it can be noted that there is a link between graph GR-2-1 which represents the information collection step and the other graphs GR-2-2, GR-2-3, GR-2-4 which correspond to the steps linked to the attacks.

[0058] The invention implements a particular artificial intelligence engine which exploits the particular structure of the proposed graph to learn to recognize characteristic patterns of behavior associated with attacks or more generally with malicious flows and to differentiate them from authorized flows.

[0059] [Fig.4] shows schematically the implementation of the method for detecting malicious flows according to one embodiment of the invention.

[0060] The proposed method implements a trained artificial intelligence model to classify captured flows in a computer network into two categories: malicious flows or authorized flows. This model can be trained in a supervised or unsupervised manner.

[0061] For this purpose, the method begins with a network data capture step DR. The network flows are captured by collecting the network frames and then identifying each flow from its source address and its destination address and by collecting a set of characteristics relating to the flow including characteristics relating to the protocol used, such as the type and version of the protocol (4 or 6), the length of the IP header, the type of service, the total length of the packet or datagram, the identification number, the indicators or flags, the fragment offset, the lifetime, the protocol number, the checksum field, the source and destination IP addresses or other protocol options which can be extracted from the IP header. The characteristics can also be determined from information taken from the frame.These characteristics concern, for example, timestamp or time information between two consecutive frames. They can concern activities relating to different protocols, SSL, HTTP, DNS.

[0062] More generally, other characteristics can also be obtained from the analysis of a flow or a connection, without the need to analyze each network frame. Indeed, a network analyzer or probe generally has this capacity to analyze and restore characteristics associated with a flow or a connection. Statistical characteristics can also be considered, for example statistics relating to the distribution of certain parameters of a flow such as the packet length, duration of a stream, number of packets in a stream, time between two packets, number of occurrences of a flag in a frame of a stream, size of a header, number of packets per second, this list is not exhaustive. Statistical operations can be applied to each of these characteristics, for example the mean, median, minimum, maximum or even the standard deviation.

[0063] In step 401, preprocessing of the captured data, i.e. the characteristics measured for each stream, is carried out in order to format this data for processing by a machine learning engine. The preprocessing phase may include a step of normalizing the data in order to bring it back to a scale of common values. It may also include a step of encoding the non-numeric data, for example using a “one-hot” encoding method in order to provide only numeric data as input to artificial intelligence algorithms.

[0064] The preprocessing phase 401 is applied both to the data collected on the network to be analyzed and to any training data DE in the case where supervised training methods are used. In this second case, the training data consists of authorized and illegal communication flows which are stored in a database which can, for example, be supplied by the classification method according to the invention itself. In the case of supervised training, the preprocessing phase 401 may include a step of subsampling the training data in order to limit the proportion of data corresponding to authorized flows compared to the proportion of data corresponding to malicious flows.

[0065] Step 402 then consists of creating a graph from the captured flows. A graph is generated for each measurement time instant.

[0066] At the output of step 402, a temporal sequence of graphs is therefore obtained, each graph GR being composed of nodes representing the captured communication flows and edges. The nodes of the network are associated with characteristic vectors of each flow. In one embodiment of the invention, the edges of the network are associated with similarity scores.

[0067] Then, an artificial intelligence engine 403 trained to extract, for each communication flow, a vector of relevant characteristics which make it possible to distinguish a malicious flow from an authorized flow is applied to this temporal sequence of graphs.

[0068] The artificial intelligence engine 403 consists of two steps. The first step 404 consists of the application of a trained artificial neural network to reduce the dimension of the initial feature vectors and provide as output, for each flow, a vector of reduced-dimensional characteristics that are more representative of the characteristic patterns of malicious or authorized flows. A particularity of this first step 404 is that it does not exploit information relating to the structure of the graph, i.e. the topology of the nodes and edges, but only the values ​​of the characteristics associated with each node.

[0069] The artificial neural network implemented in step 404 is, for example, a multi-layer perceptron trained to generate discriminative features or embeddings. The neural network model is trained to learn to perform a correspondence between the initial data space (of dimension equal to the number of initial features) to a smaller and more relevant space. In other words, the neural network of step 404 is trained to learn to generate a discriminative representation between the data extracted from the legitimate and malicious communication flows. This first step 404 makes it possible, on the one hand, to reduce the size of the data to be processed and to reinforce the differences between legitimate and malicious flows.

[0070] The first artificial neural network 404 is followed by at least one second graph neural network 405, 406. A graph neural network or “Graph Neural Network” designates a category of artificial intelligence techniques which are intended to process data in the form of structured graphs. A graph neural network model generally contains several layers which interface with each other by an updated representation of a graph. Each layer of the network produces as output a vector of characteristics for each node of the graph which is then used as input to the next layer. An objective of the model which a graph neural network aims to represent is to construct embeddings for each node of the graph by integrating both the initial characteristics of each node and topological information on the neighborhood of the node in the graph.

[0071] A graph neural network implements several types of tasks, including tasks executed at the node level and other tasks executed at the edge level and others executed at the level of the entire graph. A principle of operation of a graph neural network is that it updates each node of the graph by aggregating characteristics of neighboring nodes iteratively. A graph neural network has the advantage of allowing the extraction of structural information and detecting patterns in the topology of the graphs that go beyond the characteristics associated with each node. Thus, a graph neural network exploits the topology of the graphs for its learning unlike the artificial neural network used in step 404 which does not exploit this topology.

[0072] One or more graph neural networks, of different types, can be applied at the output of step 404.

[0073] In one embodiment of the invention, a first graph convolutional neural network or "Graph convolutional network" GCN in English is applied in step 405. The function of the graph convolutional neural network 405 is to extract discriminating characteristics but by exploiting the topology of the graph, that is to say the spatial information, for example the relationships between neighboring nodes.

[0074] An example of a convolutional graph neural network or GCN network is described in the publication “Convolutional Neural Networks on Graphs with fast localized spectral filtering”, M. Defferrard et al. 30th Conference on Neural Information Processing Systems (NIPS 2016).

[0075] The GCN network implements convolution operations on the graphs provided as input and iteratively updates the values ​​of the characteristics attached to each node by aggregating the characteristics of the neighboring nodes and taking into account the similarity scores of the edges between neighboring nodes.

[0076] The convolution operation implemented by the GCN network can be defined by the following relation:

[0077]

[0078] are the respective outputs of the layers with indices 1,1+1

[0079] A = A + / with A an adjacency matrix whose entries (i,j) are equal to 0 if nodes i and j of the graph are not connected and are equal to the similarity score if nodes i and j are connected,

[0080] D is a diagonal matrix whose values ​​are equal to the degrees of each node,

[0081] y / (0 corresponds to the parameters of the index 1 layer which are learned,

[0082] J is an activation function, for example a ReLu function

[0083] The GCN network outputs a vector of characteristics of dimension N, noted h'sFE=[h'i, h'2, h'N] for each node of the graph corresponding to each communication flow.

[0084] For example, the GCN network implemented in step 405 comprises two convolution layers which are trained to learn reduced-dimensional representations which make it possible to capture the graph topology, node-to-node relationships, temporal patterns and other information making it possible to discriminate behaviors associated with authorized communication flows from those associated with malicious communication flows.

[0085] An advantage of using a graph network is that it allows spatial information about the connections between neighboring nodes in a graph to be taken into account. Furthermore, the convolution equation (2) takes into account the values ​​of si-

[0086]

[0087]

[0088]

[0089]

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096]

[0097]

[0098]

[0099] milarities associated with graph edges to exploit similarities between communication flows in learning discriminative features. Alternatively, or in parallel with the application of the GCN network 405, a second graph network 406 of the graph attention network or “Graph Attention Network” (GAT) type can be applied in order to generate a second vector of characteristics for each node. The GAT graph attention network can be implemented as described in the publications “Graph Attention Networks”, P Velickovic et al, ICLR 2018 or “How attentive are graph attention networks?”, S. Brody et al, ICLR 2022. A graph attention network is composed of a graph neural network followed by a graph attention layer. The graph attention layer takes as input a feature vector h=[hi, h2, hN] provided as output of the graph neural network and produces as output a transformed feature vector h'AFE=[h'i, h'2, h'N]. The graph attention layer introduces the notion of attention value hÿ between two graph nodes i and j, which is defined by the following relation: hij^c^W'h^ W hj, a() is a projection function that takes two vectors as arguments and outputs a real value. W' and W' ' are two linear transformation matrices. C. is - y the similarity score associated with the edge between node i and node j. The attention value hÿ represents the relative importance of the edge connecting nodes i and j in the graph. This attention value can be used to estimate the importance of node i. The attention model is trained to learn attention parameters or weights for each edge in the graph and to collect information about a node's neighboring nodes to determine the output features using the following relationship: a'i is a coefficient that reflects the relative attention of an edge to a neighborhood in the graph. This coefficient can be calculated using the following relation: Q is the set of neighboring nodes of node i R;n is the set of edges that connect nodes i and n. ° is an activation function, for example the ReLU function One goal of the attention layer is to estimate relative importance to different neighboring nodes of the considered node rather than considering them all with the same weight.

[0100] When several graph neural networks are used, for example two networks 405,406 as in the example of [Fig.4], a recombination module 407 is applied to concatenate the feature vectors h'An and h'sFE into a single vector, for each of the nodes of the network. This step 407 is optional if only one graph neural network is used.

[0101] Finally, a final flow classification step 408 is applied to each feature vector associated with each flow to determine whether the flow is authorized or malicious. The classification step 408 may be implemented using an artificial neural network such as a multi-layer perceptron. For example, the neural network 408 may comprise several layers trained to distinguish legitimate flows from malicious flows based on the analysis of the features received as input.

[0102] Each layer can perform a convolution calculation of the type given by the following relation:

[0103] Zs = f(WlmZlA + k

[0104] Z^ ZA are the respective outputs of the layers of index 1 and 1-1,

[0105] and are the synaptic weights and biases of the index layer 1,

[0106] e is the reconstruction error and its corresponding weight.

[0107] The last layer of the classification network 408 has a single output which gives a probability score Pm of the legitimate or malicious aspect of a flow. If this score is higher than a given threshold, the flow is considered malicious.

[0108] All of the artificial intelligence models used to create the artificial intelligence engine 403 can be trained in a supervised or unsupervised manner.

[0109] Supervised training involves the use of DE training data comprising legitimate and malicious communication flows. This training data is used to train the models 404,405,406 jointly.

[0110] In the case where the training is unsupervised, unsupervised artificial intelligence algorithms are used to carry out steps 404, 405 and 406. For example, the algorithms described in the publications “Unsupervised universal self-attention network for graph classification”, Dai Quoc Nguyen et al, ICLR 2020 Conference or “Toward unsupervised graph neural network: interactive clustering and embedding via optimal transport”, Liang Yang, 2020 IEEE International Conference on Data Mining, can be used.

[0111] The invention can be implemented within an intrusion detection system. NIDS as described in [Fig.l]. The intrusion detection system may comprise a network probe for capturing network flows or network frames transiting in a computer network. The intrusion detection system comprises a processor configured to execute the steps of the intrusion detection method according to any one of the embodiments of the invention.

[0112] The invention may be implemented as a computer program comprising instructions for its execution. The computer program may be recorded on a recording medium readable by a processor.

[0113] Reference to a computer program that, when executed, performs any of the functions described above, is not limited to an application program running on a single host computer. Rather, the terms computer program and software are used herein in a general sense to refer to any type of computer code (e.g., application software, firmware, microcode, or any other form of computer instruction) that can be used to program one or more processors to implement aspects of the techniques described herein. The computing means or resources may notably be distributed (“Cloud computing”), possibly using peer-to-peer technologies.The software code may be executed on any suitable processor (e.g., a microprocessor) or processor core or set of processors, whether provided in a single computing device or distributed among several computing devices (e.g., as may be accessible in the device environment). The executable code of each program enabling the programmable device to implement the processes according to the invention may be stored, for example, in the hard disk or in read-only memory. Generally, the program(s) may be loaded into one of the storage means of the device before being executed. The central unit may control and direct the execution of the instructions or portions of software code of the program(s) according to the invention, instructions which are stored in the hard disk or in read-only memory or in the other aforementioned storage elements.

[0114] The NDIS intrusion detection device can be implemented on a computer based, for example, on an embedded processor. The processor can be a generic processor, a specific processor, an application-specific integrated circuit (also known as an ASIC for “Application-Specific Integrated Circuit”) or an in situ programmable gate array (also known as an FPGA for “Field-Programmable Gate Array”). The computing device can use one or more dedicated electronic circuits or a general-purpose circuit. The technique of the invention can be implemented on a reprogrammable computing machine (a processor or a microcontroller for example) executing a program comprising a sequence of instructions, or on a dedicated computing machine (e.g. a set of logic gates like an FPGA or ASIC, or any other hardware module).

[0115] The invention makes it possible to improve the performance of detecting malicious flows compared to the techniques of the prior art which are based on more conventional graphs. In particular, the detection accuracy is improved, i.e. the ratio between the number of malicious flows correctly detected and all the malicious flows detected (including those which correspond to false positives).

Claims

Claims

1. A computer-implemented method for detecting malicious flows in a computer network comprising the steps of: - Capturing a set of network flows, each network flow being associated with a first vector of measured flow characteristics and a measurement time, - Creating (402), for each measurement time, a graph (GR) whose nodes represent each captured flow, two nodes of the graph being connected if the two associated flows are emitted by the same user or are transmitted to the same user, each node being provided with said first vector of characteristics, - Executing (403) an artificial intelligence engine trained to detect an intrusion into the computer network from the graphs and comprising the sub-steps of: i.Applying to the graphs at least one graph neural network (405,406) trained to generate, for each flow, a second vector of characteristics capable of discriminating an authorized flow from a malicious flow, the training of said graph neural network exploiting at least the topology of the graphs, ii. Applying (408) to the second vectors of characteristics an artificial neural network classifier trained to classify the flows among two classes corresponding respectively to authorized flows and to malicious flows.

2. Method for detecting malicious flows in a computer network according to claim 1 in which the step of executing (403) the artificial intelligence engine further comprises a step (404), prior to the application of the at least one graph neural network (405,406), consisting of applying to the first characteristic vectors at least one artificial neural network (404) trained to reduce the dimension of the first vectors by extracting characteristics discriminating an authorized flow from a malicious flow, the training of said artificial neural network not exploiting the topology of the graphs.

3. Method for detecting malicious flows in a computer network according to claim 2 in which the at least one artificial neural network (404) is a multi-layer perceptron.

4. Method for detecting malicious flows in a computer network according to any one of the preceding claims comprising a step of preprocessing (401) the first vectors of measured characteristics consisting at least of a normalization of the values and / or a categorical encoding of the values.

5. Method for detecting malicious flows in a computer network according to any one of the preceding claims further comprising a step of calculating (402), for each edge of the graph (GR), a similarity score between the first characteristic vectors of the two flows associated with the two nodes connected by the edge.

6. A method of detecting malicious flows in a computer network according to claim 5 wherein the similarity score is calculated using a cosine similarity measure.

7. A method of detecting malicious flows in a computer network according to any one of the preceding claims wherein the at least one graph neural network is a convolutional graph neural network (405).

8. Method for detecting malicious flows in a computer network according to claim 7 in combination with claim 5 or 6 wherein the graph convolutional neural network (405) comprises several layers configured to implement a convolution calculation of the type: wU) j' ^(0 ^+0 are the respective outputs of the layers of indices 1,1+1 A — A + / with A an adjacency matrix whose entries (i,j) are equal to 0 if the nodes i and j of the graph are not connected and are equal to the similarity score if the nodes i and j are connected, D is a diagonal matrix whose values are equal to the degrees of each node, corresponds to the parameters of the layer of index 1 which are learned, ü is an activation function, for example a ReLu function.

9. A method of detecting malicious flows in a computer network according to any one of the preceding claims wherein the at least one graph neural network is a graph attention network (406).

10. A method for detecting malicious flows in a computer network according to claim 9 wherein the graph attention network (406) comprises a graph neural network and an attention layer trained using an attention model configured to learn attention values for each edge of the graph and calculate a feature for each node using a weighting of the features of neighboring nodes based on the attention values.

11. Method for detecting malicious flows in a computer network according to any one of the preceding claims in which several graph neural networks (405,406) are executed in parallel and the method comprises a step of concatenating (407) the second characteristic vectors generated by each graph neural network to provide a concatenated vector to the classifying artificial neural network (408).

12. A method of detecting malicious flows in a computer network according to any one of the preceding claims wherein the classifying artificial neural network (408) is a multi-layer perceptron.

13. Method for detecting malicious flows in a computer network according to any one of the preceding claims in which the first vector of measured characteristics contains information characteristic of the flows among: the source and destination addresses, the protocols used, statistics relating to the packets transmitted via this flow.

14. A method of detecting malicious flows in a computer network according to any one of the preceding claims wherein the artificial intelligence engine (403) is trained in a supervised or unsupervised manner.

15. System for detecting malicious flows in a telecommunications network comprising at least one probe capable of acquiring a network flow or a set of network frames transiting in said network and at least one malicious flow detection device (NIDS) configured to implement the steps of the malicious flow detection method according to one of the preceding claims, from the network flow or the set of network frames.

Images