基于流量交互图分析的Web服务威胁检测方法

余北缘; 曾广杰; 彭浩; 刘建伟; 李洪亮; 谭学士

doi:10.11959/j.issn.2096-109x.AQ25264

您当前的位置：

首页 >

文章列表页 >

基于流量交互图分析的Web服务威胁检测方法

学术论文 | 更新时间：2026-05-11

- 基于流量交互图分析的Web服务威胁检测方法
- Web service threat detection method based on traffic interaction graph analysis
- 网络与信息安全学报 2026年12卷第2期页码：41-54
- 作者机构：
  
  1.北京航空航天大学网络空间安全学院，北京 100191
  2.北京航空航天大学计算机学院，北京 100191
  3.奇安信科技集团股份有限公司，北京 100088
- 作者简介：
  
  [ "余北缘（1996- ），男，北京航空航天大学博士生，主要研究方向为Web安全。" ]
  [ "曾广杰（1997- ），男，北京航空航天大学博士生，主要研究方向为图数据挖掘。" ]
  [ "彭浩（1987- ），男，博士，北京航空航天大学教授、博士生导师，主要研究方向为事件检测。" ]
  [ "刘建伟（1964- ），男，博士，北京航空航天大学教授、博士生导师，主要研究方向为密码学与网络安全。" ]
  [ "李洪亮（1980- ），男，奇安信科技集团股份有限公司网络安全部总经理，主要研究方向为企业安全防护体系建设、高级威胁对抗、安全基础设施。" ]
  [ "谭学士（1984- ），男，奇安信科技集团股份有限公司网络安全部安全平台组负责人，主要研究方向为网络安全算法与人工智能应用。" ]
- 基金信息：
  
  国家重点研发计划资助项目(2024YFB3108901);国家自然科学基金资助项目(U21B2021;62472015;62202027)
- DOI：10.11959/j.issn.2096-109x.AQ25264
  中图分类号： TP393
- 收稿：2025-10-23，
  
  修回：2026-03-23，
  
  录用：2026-03-24，
  
  纸质出版：2026-04-25
- 稿件说明：
移动端阅览
余北缘, 曾广杰, 彭浩, 等. 基于流量交互图分析的Web服务威胁检测方法[J]. 网络与信息安全学报, 2026, 12(2): 41-54.

Yu Beiyuan, Zeng Guangjie, Peng Hao, et al. Web service threat detection method based on traffic interaction graph analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 41-54.
余北缘, 曾广杰, 彭浩, 等. 基于流量交互图分析的Web服务威胁检测方法[J]. 网络与信息安全学报, 2026, 12(2): 41-54. DOI： 10.11959/j.issn.2096-109x.AQ25264.

Yu Beiyuan, Zeng Guangjie, Peng Hao, et al. Web service threat detection method based on traffic interaction graph analysis[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 41-54. DOI： 10.11959/j.issn.2096-109x.AQ25264.

摘要

随着Web服务应用功能的不断扩展，其面临的安全威胁日益严峻，对服务安全性与可靠性的要求也逐步提高。在服务资源规模持续增长的同时，攻击面不断扩大，攻击者的能力不断增强，使得未知威胁与群体性攻击逐渐增多。特别是在实际网络环境中存在大量无标签流量数据的情况下，实现Web服务流量的轻量化交互关系表征、有效检测多源威胁，以及在无标签环境下构建具备良好的可解释性的检测模型，成为突破当前安全瓶颈的关键。为此，提出了一种基于流量分析的轻量化流量交互图构建方法，以实现高效表征。通过引入结构熵博弈划分机制，实现了对流量交互图社区的自适应划分。在此基础上，通过分析社区子图的拓扑特性，并借助图指标排序识别关键社区。进一步提出了一种基于

分数的威胁顶点自适应检测方法，以有效识别关键社区中的高威胁顶点。同时，提出基于结构熵的群体威胁检测方法，以精准发现群体威胁实体。该方法无须依赖先验知识与数据标签，兼具对未知威胁的适应能力、对加密流量的鲁棒性、模型的可解释性。在公开数据集与实际网络流量数据上的测试结果表明，该方法能够有效识别多种威胁Web服务可用性的实体与攻击行为，具有较高的检测准确率和实际工程应用价值。

Abstract

With the continuous expansion of Web service functionalities

the security threats they face have become increasingly severe

leading to growing demands for service security and reliability. As service resources scale up

the attack surface widens

and attacker capabilities strengthen

resulting in a rise in unknown threats and swarm attack. Particularly in real-world network environments where large amounts of unlabeled traffic data exist

key challenges include achieving lightweight characterization of Web service traffic interactions

effectively detecting multi-source threats

and constructing a detection model with good interpretability in an unlabeled environment . These issues are critical to overcoming current security bottlenecks. To address these challenges

a lightweight traffic interaction graph construction method based on traffic analysis for efficient characterization was proposed. By introducing the structural entropy game partitioning mechanism

the adaptive partitioning of the communities in the traffic interaction graph has been achieved. On this basis

the topological cha

racteristics of communities subgraphs were analyzed

and key communities were identified through graph metric ranking. Furthermore

-score-based adaptive threat vertex detection method was proposed to effectively identify high-threat vertices in key communities. Simultaneously

a structural entropy-based swarm threat detection method was introduced to accurately detect swarm threat entities. The proposed method operates without relying on prior knowledge or data labels

while maintaining adaptability to unknown threats

robustness to encrypted traffic

and good interpretability. Experimental results on public datasets and real-world network traffic data demonstrated that the method could effectively identify various entities and attack behaviors that threaten the availability of Web services

achieving high detection accuracy and practical engineering application value.

关键词

Keywords

references

Bronte R , Bronte R , Shahriar H , et al . A signature-based intrusion detection system for web applications based on genetic algorithm [C ] // Proceedings of the 9th International Conference on Security of Information and Networks . New York : ACM , 2016 : 32 - 39 .

Díaz-Verdejo J , Muñoz-Calle J , Estepa Alonso A , et al . On the detection capabilities of signature-based intrusion detection systems in the context of web attacks [J ] . Applied Sciences , 2022 , 12 ( 2 ): 852 .

Yang R , Wang X , Luo K , et al . SWIDE: a semantic-aware detection engine for successful web injection attacks [C ] // Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2024 : 540 - 554 .

Kumar J , Santhanavijayan A , Rajendran B . Cross site scripting attacks classification using convolutional neural network [C ] // Proceedings of the 2022 International Conference on Computer Communication and Informatics (ICCCI) . Piscataway : IEEE Press , 2022 : 1 - 6 .

Alazab A , Khraisat A , Alazab M , et al . Detection of obfuscated malicious JavaScript code [J ] . Future Internet , 2022 , 14 ( 8 ): 217 .

Zhou Y H , Zhu H Y , Chai Y D , et al . Towards trustworthy web attack detection: an uncertainty-aware ensemble deep kernel learning model[PP] . arXiv [2025-10-13 ] . arXiv:arXiv . 2410 . 07725 .

Song X Y , Chen C , Cui B J , et al . Malicious JavaScript detection based on bidirectional LSTM model [J ] . Applied Sciences , 2020 , 10 ( 10 ): 3440 .

Liu M Y , Gou G P , Xiong G , et al . Enhanced detection of obfuscated HTTPS tunnel traffic using heterogeneous information network [J ] . Computer Networks , 2025 , 257 : 110975 .

Karbab E B , Debbabi M , Derhab A , et al . Scalable and robust unsupervised Android malware fingerprinting using community-based network partitioning [J ] . Computers & Security , 2020 , 96 : 101932 .

Li Y , Chen X S , Tang W Y , et al . Interaction matters: Encrypted traffic classification via status-based interactive behavior graph [J ] . Applied Soft Computing , 2024 , 155 : 111423 .

Li A S , Pan Y C . Structural information and dynamical complexity of networks [J ] . IEEE Transactions on Information Theory , 2016 , 62 ( 6 ): 3290 - 3339 .

Holt C A , Roth A E . The Nash equilibrium: a perspective [J ] . Proceedings of the National Academy of Sciences of the United States of America , 2004 , 101 ( 12 ): 3999 - 4002 .

Xian Y T , Xian Y T , Li P , et al . Community detection in large-scale complex networks via structural entropy game [C ] // Proceedings of the ACM on Web Conference 2025 . New York : ACM , 2025 : 3930 - 3941 .

Fenton A , Gillooly L , Vasilica C M . Female fans and social media: micro-communities and the formation of social capital [J ] . European Sport Management Quarterly , 2023 , 23 ( 2 ): 370 - 390 .

Montanari A . Finding one community in a sparse graph [J ] . Journal of Statistical Physics , 2015 , 161 ( 2 ): 273 - 299 .

Gleich D F . PageRank beyond the web [J ] . SIAM Review , 2015 , 57 ( 3 ): 321 - 363 .

Peng H , Zhang J Y , Huang X , et al . Unsupervised social bot detection via structural information theory [J ] . ACM Transactions on Information Systems , 2024 , 42 ( 6 ): 1 - 42 .

Fu C P , Li Q , Xu K . Flow interaction graph analysis: unknown encrypted malicious traffic detection [J ] . IEEE/ACM Transactions on Networking , 2024 , 32 ( 4 ): 2972 - 2987 .

Pellegrino G , Johns M , Koch S , et al . Deemon: detecting CSRF with dynamic analysis and property graphs [C ] // Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security . New York : ACM , 2017 : 1757 - 1771 .

Caballero J , Grier C , Kreibich C , et al . Measuring pay-per-install: the commoditization of malware distribution [C ] // Proceedings of the USENIX Security Symposium . Berkeley : USENIX Association , 2011 : 1 - 13 .

Ahmed M , Seraj R , Islam S M S . The k-means algorithm: a comprehensive survey and performance evaluation [J ] . Electronics , 2020 , 9 ( 8 ): 1295 .

Qi X Q , Wu Q , Zhang Y S , et al . A novel model for DNA sequence similarity analysis based on graph theory [J ] . Evolutionary Bioinformatics Online , 2011 , 7 : 149 - 158 .

Karbab E B , Debbabi M . ToGather: automatic investigation of Android malware cyber-infrastructures [C ] // Proceedings of the 13th International Conference on Availability, Reliability and Security . New York : ACM , 2018 : 1 - 10 .

张子龙 , 董卫宇 , 王奕森 . 保留因果关系的溯源图压缩方法 [J ] . 网络与信息安全学报 , 2025 , 11 ( 6 ): 105 - 119 .

Zhang Z L , Dong W Y , Wang Y S . Causality-preserving compression method on provenance graph [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 6 ): 105 - 119 .

Zhao Y , Xie Y , Yu F , et al . BotGraph: Large scale spamming botnet detection [C ] // Proceedings of the USENIX Symposium on Networked Systems Design and Implementation . Berkeley : USENIX Association , 2009 : 321 - 334 .

Zeng X H , Peng H , Li A S . Proactive bot detection based on structural information principles [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2026 , 48 ( 4 ): 4726 - 4743 .

Peng H , Huang X , Sun S , et al . Adaptive and robust DBSCAN with multi-agent reinforcement learning [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2025 , 48 ( 4 ): 4860 - 2877 .

李一凡 , 李家印 , 林兴澎 , 等 . 基于数据增强的多视图对比学习图异常检测 [J ] . 网络与信息安全学报 , 2024 , 10 ( 5 ): 163 - 174 .

Li Y F , Li J Y , Lin X P , et al . Data augmentation based multi-view contrastive learning graph anomaly detection [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 5 ): 163 - 174 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于动态浏览器指纹的链接检测技术研究

基于SQL语法树的SQL注入过滤方法研究