## 3 Graph Structure Abstraction for Malicious Attracts
### Traffic Interaction Attribute Graph
#### 3.2.1 Construction of TIAG  
From the analysis of interaction patterns in Section 3.1, we find that using IP addresses as nodes of the graph and interaction patterns between different IP addresses as edges of the graph can effectively differentiate attacks. Therefore, based on the above principles, we design and implement the construction of TIAG, a graph of traffic interaction patterns, and use it to describe the interaction patterns between network hosts. We consider the limitation of using a single flow to reflect user behavior, and multiple flows in a particular time can reflect the user behavior of that network at the moment. The features in a specific time granularity range can reflect user behavior from a more macro and holistic perspective. In addition, when attacks occur, different TIAGs constructed in adjacent periods have significant differences. We abstract each IP address in a specific time range \(\Delta T\) as a node \(v\) in TIAG and abstract the interaction between node \(v_{i}\) and node \(v_{k}\) as a set of directed edges \(\{e_{ik}\}\), where there are often multiple edges of both directions between two nodes. Thus, the TIAG is defined as follows. **Definition 1**(Traffic Interaction Attribute Graph): _A TIAG is a directed graph, which is represented by a four-tuple, TIAG = \((V,E,F,T)\), such that:_  
* \(V\) _is a set of vertices represented by independent and non-repeating IP addresses. Each vertex_ \(v\in V\) _represents a user involved in interaction in_ \(\Delta T\in T\)_, and each vertex of the transformed TIAG (_3.2.2_) possesses a 9-dimensional feature vector_ \(f\in F\) _(_3.2.3_)._
* \(E\) _is a set of edges. Each edge_ \(e\in E\) _connects two interacting nodes, and an edge represents one flow of interaction between two nodes._  
We illustrate the traffic interaction pattern with a sequence of packets in the \(\Delta T\) time range as an example, as shown in Figure 3.  
Figure 3: Interaction patterns of three common attacks. Since the packet sequence usually consists of multiple flows, we divide the whole sequence into individual flows, where each flow is defined as a series of packets with the same 5-tuple (source IP, source port, destination IP, destination port, protocol). In our experiment, we consider the two flows to be different communications for the attacks when two flows have the same IP and port number but different protocols. Each flow has a timestamp which is the arrival time of the first packet in this flow. In addition, the flows are listed in order according to the timestamp. Next, we use the flows in \(\Delta T\) to construct TIAG, and \(\Delta T\) is 50 in our experiment. Anyway, the interval time between two TIAGs is \(T\), which will be discussed in Section 5.3.4. \(T\) is finally set to 200 in our experiment. If a packet disorder problem is found in grouping flows, the flows with disordered packets must be rearranged. In the time interval of \(\Delta T\), A TIAG is denoted as \(G_{t}=(V_{t},E_{t},F_{t})\), the source node set in the time interval of \(\Delta T\) is denoted as \(V_{SIP}=\{SIP_{1},SIP_{2},SIP_{3},\ldots,SIP_{m}\}\), the destination node set is denoted as \(V_{DIP}=\{DIP_{1},DIP_{2},DIP_{3},\ldots,DIP_{n}\}\), and the edges are represented as \(Edges\)=\(Edges_{m\times n}=\{e_{ik}\}\), when there are edges between two nodes \(SIP_{i}\) and \(DIP_{k}\), then \(e_{ik}=1\), otherwise \(e_{ik}=0\). The specific construction algorithm of TIAG is shown Algorithm 1.