Patent ID: 11934536
Assignee: UNIVERSITY OF CHINESE ACADEMY OF SCIENCES
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A dynamic network risk predicting method based on a graph neural network, comprising the following steps:
S1, selecting a time period, adopting a zero-copy message capture technology to capture network data packets of a dynamic network to be predicted in the time period, standardizing data in the network data packets, constructing a network data sequence graph by using standardized data, and preprocessing the network data sequence graph by using a method of image enhancement and image transformation;
in the S1, specific ways of preprocessing the network data sequence graph by using the method of image enhancement and image transformation are as follows: carrying out a frequency domain enhancement by high-pass filtering and low-pass filtering on the network data sequence graph firstly, and then transforming the network data sequence graph from a spatial domain to a frequency domain by Fourier transform;
S2, extracting a time sequence of the network data sequence graph through time sequence sub-sequence mining, and mining a frequent time sequence sub-sequence through an extracted time sequence to obtain a time sequence feature graph of the network data;
S3, selecting different time points firstly, modeling the time sequence feature graph through the graph neural network, extracting network attribute features and network structure features of the time sequence feature graph at the different time points, and then extracting network change features of the time sequence feature graph by using a long-short term memory model and by combining extracted features of the time sequence feature graph at the different time points;
in the S3, specific steps of extracting the network change features are as follows: using a long-short term memory cyclic neural network to model sequence change on the time sequence feature graph, and then using a long-short term memory network to extract the network change features of the time sequence feature graph in this model;
S4, according to extracted network attribute features, network structure features and network change features, performing a representation vector learning by using a method of maximizing mutual information between a maximization global representation vector and a local representation vector, and obtaining a representation vector of the time sequence feature graph;
in the S4, specific steps of performing the representation vector learning are as follows: obtaining a global representation of the time sequence feature graph from a representation vector of nodes and edges on the time sequence feature graph through a reading function, and then by using the method of maximizing the mutual information to perform a maximizing training of the mutual information of the global representation vector and the local representation vector, and obtaining the representation vector of the time sequence feature graph; and
S5, constructing an anomaly detection model by using an anomaly algorithm on a data stream, and then carrying out an anomaly detection of the representation vector of the time sequence feature graph by using the anomaly detection model, and giving an anomaly score; and finally, performing a risk prediction on the dynamic network according to the anomaly score;
in the S5, the anomaly detection model uses a robust random cutting forest algorithm combined with the data structures thereof to perform an anomaly detection on the representation vector of time sequence feature graph, and the anomaly score is given according to detection results, and finally a dynamic network risk is predicted according to the anomaly score, and a network defense is deployed in advance according to prediction results.