面向入侵检测的元图神经网络构建与分析  

Construction and Analysis of Meta Graph Neural Network for Intrusion Detection

作　　者：王振东 徐振宇 李大海 王俊岭[1] WANG Zhen-Dong;XU Zhen-Yu;LI Da-Hai;WANG Jun-Ling(School of Information Engineering,Jiangxi University of Science and Technology,Ganzhou 341000)

机构地区：[1]江西理工大学信息工程学院,赣州341000

出　　处：《自动化学报》2023年第7期1530-1548,共19页Acta Automatica Sinica

基　　金：国家自然科学基金(62062037,61763017);江西省自然科学基金(20212BAB202014,20181BBE58018)资助。

摘　　要：网络入侵样本数据特征间存在未知的非欧氏空间图结构关系,深入挖掘并利用该关系可有效提升网络入侵检测方法的检测效能.对此,设计一种元图神经网络(Meta graph neural network,MGNN),MGNN能够对样本数据特征内部隐藏的图结构关系进行挖掘与利用,在应对入侵检测问题时优势明显.首先,设计元图网络层(Meta graph network layer,MGNL),挖掘出样本数据特征内部隐藏的图结构关系,并利用该关系对样本数据的原始特征进行更新;然后,针对MGNN存在的图信息传播过程中父代信息湮灭现象提出反信息湮灭策略,并设计了注意力损失函数,简化MGNN中实现注意力机制的运算过程.KDD-NSL、UNSW-NB15、CICDoS2019数据集上的实验表明,与经典深度学习算法深度神经网络(Deep neural network,DNN)、卷积神经网络(Convolutional neural network,CNN)、循环神经网络(Recurrent neural network,RNN)、长短期记忆(Long short-term memory,LSTM)和传统机器学习算法支持向量机(Support vector machine,SVM)、决策树(Decision tree,DT)、随机森林(Random forest,RF)、K-最近邻(K-nearest neighbor,KNN)、逻辑回归(Logistic regression,LR)相比,MGNN在准确率、F1值、精确率、召回率评价指标上均具有良好效果.There is an unknown non-European spatial graph structure relationship among network intrusion sample data characteristics.Deeply digging and using this relationship can effectively improve the detection efficiency of network intrusion detection methods.In this regard,this paper designs a meta graph neural network(MGNN).MGNN can mine and utilize the hidden graph structure relationships within the sample data features,which has obvious advantages in dealing with intrusion detection problems.First,the meta graph network layer(MGNL)meta graph network layer(MGNL)is designed to mine the hidden graph structure relationship within the sample data features,and use this relationship to update the original features of the sample data;then,the parental information is annihilated in the process of dissemination of graph information that exists in MGNN phenomenon proposes an anti-information annihilation strategy,and designs an attention loss function to simplify the calculation process of the attention mechanism in MGNN.Experiments on the KDD-NSL,UNSW-NB15,and CICDoS2019 datasets show that compared with the classic deep learning algorithms DNN(deep neural network),CNN(convolutional neural network),RNN(recurrent neural network),LSTM(long short-term memory)and traditional machine learning algorithms SVM(support vector machine),DT(decision tree),RF(random forest),KNN(K-nearest neighbor),LR(logistic regression),MGNN has an accuracy rate,F1 value,accuracy rate,recall rate evaluation indicators have good results.

关 键 词：入侵检测 元图神经网络 深度学习 图结构 

分 类 号：TP183[自动化与计算机技术—控制理论与控制工程] TP309[自动化与计算机技术—控制科学与工程]