Multi-layer network flow dynamic monitoring and analysis method based on graph neural network

Abstract

The invention discloses a multi-layer network flow dynamic monitoring and analysis method based on a graph neural network. The method comprises the following steps: S1, collecting data of each node in real time and preprocessing the data; s2, dividing the preprocessed data based on a preset time window, and constructing graph structure data; s3, carrying out topology learning on the constructed graph structure data by adopting an improved EvolveGCN, and generating final feature representation of dynamic change of a network topology structure; s4, carrying out modeling on the preprocessed data by utilizing Graph WaveNet, and extracting final feature representations of space-time dependency and local spatial correlation; s5, performing feature fusion to generate a comprehensive feature vector; s6, generating a final monitoring result based on the comprehensive feature vector; and S7, transmitting the final monitoring result to a network flow management platform for data processing and analysis. According to the method, an efficient and scientific optimization scheme can be provided in dynamic monitoring of the network traffic, and remarkable technical values and economic benefits are brought to practical application.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic monitoring, and in particular to a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network. Background Art

[0002] Existing network traffic monitoring and analysis methods mainly rely on traditional statistical models and shallow machine learning algorithms, such as ARIMA, support vector machines and simple neural network models. These methods have certain effects when processing static network traffic data. However, with the continuous expansion of network scale and the increasing complexity of network structure, traditional methods face difficulties such as dynamic topological changes and complex spatiotemporal characteristics in multi-layer networks. It is difficult to accurately capture the dependencies and traffic characteristics between nodes in the network that evolve over time. Traditional methods usually only focus on the traffic data itself and ignore the network topology information, resulting in insufficient accuracy of the monitoring system in anomaly detection and traffic prediction.

[0003] In recent years, graph neural networks have been introduced into the field of network traffic monitoring as an emerging technology that can directly process graph structured data, and a variety of models have gradually developed, such as EvolveGCN and Graph WaveNet. EvolveGCN uses graph convolution and recursive neural network modules to model the topological structure of dynamic graphs, which can better capture the time-varying dependencies between network nodes. Graph WaveNet extracts timing information and local spatial correlations in traffic data through causal dilated convolution modules, and has achieved initial results in traffic prediction. Although these methods have strong expressive power in theory, in practical applications, a single model is often difficult to simultaneously take into account the efficient integration of dynamic changes in network topology and spatiotemporal traffic characteristics, resulting in certain lags and errors in monitoring results.

[0004] In addition, existing methods lack a unified and efficient solution in the process of data preprocessing, feature extraction and model fusion. Key steps such as data format conversion, adjacency matrix normalization, and residual mapping in multi-layer convolution operations fail to fully utilize the structural information and timing dependencies of the network, thus affecting the real-time and accuracy of the overall system. Especially in large-scale network environments, how to simultaneously achieve dynamic monitoring and anomaly detection of multi-layer network traffic is still a difficult problem that needs to be solved urgently.

[0005] In summary, the existing technologies in the dynamic monitoring and analysis of multi-layer network traffic have defects such as insufficient learning of dynamic graph topology information, incomplete extraction of spatiotemporal features, and lack of efficient fusion of prediction models and anomaly detection modules. It is urgent to develop a new method based on graph neural networks. Through the synergy of advanced models such as EvolveGCN and Graph WaveNet, the deep fusion of network topology and traffic data can be achieved, thereby improving the response speed and accuracy of the monitoring system to traffic changes in dynamic network environments. Summary of the invention

[0006] One purpose of the present invention is to propose a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network. The present invention can provide an efficient and scientific optimization solution in the dynamic monitoring of network traffic, bringing significant technical value and economic benefits to practical applications.

[0007] A multi-layer network traffic dynamic monitoring and analysis method based on a graph neural network according to an embodiment of the present invention comprises the following steps:

[0008] S1. By deploying network traffic collection devices and network topology collection devices, data of each node is collected in real time and pre-processed;

[0009] S2. Divide the preprocessed data based on the preset time window, generate a node set and an edge set for each time window, and construct graph structure data;

[0010] S3. Using the improved EvolveGCN to perform topological learning on the constructed graph structure data, the improved EvolveGCN consists of a graph convolution operation module and a Transformer-based timing update module. The graph convolution operation module is used to aggregate the node neighborhood information in the graph structure data at each time step, and the Transformer-based timing update module is used to dynamically update the node embedding to generate the final feature representation of the dynamic change of the network topology structure;

[0011] S4, use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependency and local spatial correlation;

[0012] S5. Based on the weighted summation method, the final feature representation of the dynamic change of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector.

[0013] S6. Generate the predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error according to the actually monitored network traffic, and generate the final monitoring result;

[0014] S7. The final monitoring results are transmitted to the network traffic management platform through a standard data interface for data processing and analysis.

[0015] Optionally, the S1 includes the following steps:

[0016] S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time;

[0017] S12, deploying network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time;

[0018] S13. De-noising and normalizing the collected raw data, and filling in missing values ​​to obtain pre-processed data D".

[0019] Optionally, S2 includes the following steps:

[0020] S21, based on the pre-processed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows. n Indicates that n = 1, 2, ..., N;

[0021] S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as;

[0022] a i =[S i ,Δt i ,L i ];

[0023] Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate;

[0024] S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as:

[0025] a ij =[C ij ,Pij ,T ij ];

[0026] Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information;

[0027] S24, construct each time window T n The graph structure data G in n :

[0028] G n =(V n ,E n ,A n );

[0029] Among them, V n represents a node set, E n represents the edge set, A n Represents the set of attributes of all nodes and edges.

[0030] Optionally, S3 includes the following steps:

[0031] S31, for each time window T n The graph structure data G in n =(V n ,E n ,A n ), define each node i∈V n The neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation:

[0032]

[0033] Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the kth head, W (k) is the learnable weight matrix of the kth head, ∥ represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function;

[0034] S32, for the continuous time window T n-1 With T n For each node i∈V n The embedding representation of is dynamically updated using a Transformer-based temporal update module;

[0035] Define the query vector Q i , key vector Ki Sum value vector V i They are:

[0036]

[0037] Among them, W Q , W K , W V is the learnable projection matrix;

[0038] Obtained by weighted summation

[0039]

[0040] Among them, d k is the dimension of the key vector;

[0041] Using residual connection and layer normalization to update the node embedding representation is:

[0042]

[0043] Among them, LayerNorm(.) represents the layer normalization operation;

[0044] Further update through the feedforward neural network is:

[0045]

[0046] Among them, FFN(·) represents a two-layer fully connected network;

[0047] S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in the network topology.

[0048] Optionally, S4 includes the following steps:

[0049] S41, generate time series data from the preprocessed data D" according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed:

[0050]

[0051] Where T is the number of time steps;

[0052] S42, constructing the original adjacency matrix A according to the graph structure data G=(V, E, A), And calculate the normalized form of A

[0053]

[0054] Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N );

[0055] Combining graph structure information with time series data, the input matrix I is constructed as:

[0056]

[0057] Among them, θ k is a learnable parameter, K is the preset graph convolution order;

[0058] S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to convolve the input matrix I. The output of the lth layer at time step t is:

[0059]

[0060] in, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer in the filtering branch for the m-th order neighborhood, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel of the l-th layer in the gated branch for the m-th order neighborhood, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-by-element multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function;

[0061] S44. The output feature sequence Z processed by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependency and local spatial correlation:

[0062] Z=X (L) ;

[0063] Among them, L is the total number of convolutional modules.

[0064] Optionally, S5 includes the following steps:

[0065] S51. Final feature representation of the dynamic changes of network topology extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i :

[0066]

[0067] Among them, β is the fusion weight coefficient.

[0068] Optionally, the S6 comprises the following steps:

[0069] S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i

[0070]

[0071] Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer;

[0072] S62, let the actual monitored network traffic be y i , calculate the prediction error e i :

[0073]

[0074] Among them, δ is the preset threshold;

[0075] S63, based on the prediction error e i and the comprehensive feature vector f i Generate anomaly scores i :

[0076] s i =σ(α·e i +λ·ReLU(W s f i +b s )+β);

[0077] Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias;

[0078] S64: The predicted network traffic of each node i With anomaly scores i Combine and generate the final monitoring results.

[0079] The beneficial effects of the present invention are:

[0080] (1) By combining EvolveGCN with Graph WaveNet, the present invention realizes the deep integration of multi-layer network traffic monitoring and analysis, and has made significant breakthroughs in capturing the dynamic changes of network topology and spatiotemporal traffic characteristics. The network topology is dynamically modeled using graph neural networks, and the causal dilated convolution module is combined to extract advanced features of time series data, so that the system can realize real-time data processing and high-precision prediction in large-scale complex network environments. Through unified data preprocessing, adjacency matrix normalization and the design of multi-layer advanced convolution modules, the structural information and traffic evolution laws between network nodes are fully mined, thereby effectively improving the accuracy and real-time performance of anomaly detection and traffic prediction.

[0081] (2) The present invention adopts a timing update module based on the attention mechanism and Transformer to dynamically update the node embedding, thereby achieving an accurate characterization of the continuous evolution process of the network topology structure. The prediction module and the anomaly detection module use a learnable fusion strategy to efficiently integrate the comprehensive feature vector, thereby capturing subtle traffic fluctuations and timely discovering potential abnormal behaviors during the monitoring process. This method not only optimizes the limitations of existing technologies in multi-layer network environments, but also has high robustness and scalability, providing reliable technical support for network security and traffic management. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0083] Figure 1 This is a flow chart of a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network proposed by the present invention;

[0084] Figure 2 This is a flowchart for generating comprehensive feature vectors in a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network proposed in the present invention. DETAILED DESCRIPTION

[0085] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0086] refer to Figure 1-Figure 2 , a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network, comprising the following steps:

[0087] S1. By deploying network traffic collection devices and network topology collection devices, data of each node is collected in real time and pre-processed;

[0088] S2. Divide the preprocessed data based on the preset time window, generate a node set and an edge set for each time window, and construct graph structure data;

[0089] S3. Using the improved EvolveGCN to perform topological learning on the constructed graph structure data, the improved EvolveGCN consists of a graph convolution operation module and a Transformer-based timing update module. The graph convolution operation module is used to aggregate the node neighborhood information in the graph structure data at each time step, and the Transformer-based timing update module is used to dynamically update the node embedding to generate the final feature representation of the dynamic change of the network topology structure;

[0090] S4, use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependency and local spatial correlation;

[0091] S5. Based on the weighted summation method, the final feature representation of the dynamic change of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector.

[0092] S6. Generate the predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error according to the actually monitored network traffic, and generate the final monitoring result;

[0093] S7. The final monitoring results are transmitted to the network traffic management platform through a standard data interface for data processing and analysis.

[0094] In this implementation, S1 includes the following steps:

[0095] S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time;

[0096] S12, deploying network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time;

[0097] S13. De-noising and normalizing the collected raw data, and filling in missing values ​​to obtain pre-processed data D".

[0098] In this implementation, S2 includes the following steps:

[0099] S21, based on the pre-processed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows.n Indicates that n = 1, 2, ..., N;

[0100] S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as;

[0101] a i =[S i ,Δt i ,L i ];

[0102] Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate;

[0103] S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as:

[0104] a ij =[C ij ,P ij ,T ij ];

[0105] Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information;

[0106] S24, construct each time window T n The graph structure data G in n :

[0107] G n =(V n ,E n ,A n );

[0108] Among them, V n represents a node set, E n represents the edge set, A n Represents the set of attributes of all nodes and edges.

[0109] In this implementation, S3 includes the following steps:

[0110] S31, for each time window T n The graph structure data G n =(V n ,E n ,A n ), define each node i∈V n The neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation:

[0111]

[0112] Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the kth head, W (k) is the learnable weight matrix of the kth head, ∥ represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function;

[0113] S32, for the continuous time window T n-1 With T n For each node i∈V n The embedding representation of is dynamically updated using a Transformer-based temporal update module;

[0114] Define the query vector Q i , key vector K i Sum value vector V i They are:

[0115]

[0116] Among them, W Q , W K , W V is the learnable projection matrix;

[0117] Obtained by weighted summation

[0118]

[0119] Among them, d k is the dimension of the key vector;

[0120] Using residual connection and layer normalization to update the node embedding representation is:

[0121]

[0122] Among them, LayerNorm(.) represents the layer normalization operation;

[0123] Further update through the feedforward neural network is:

[0124]

[0125] Among them, FFN(·) represents a two-layer fully connected network;

[0126] S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in the network topology.

[0127] In this implementation, S4 includes the following steps:

[0128] S41, generate time series data from the preprocessed data D" according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed:

[0129]

[0130] Where T is the number of time steps;

[0131] S42, constructing the original adjacency matrix A according to the graph structure data G=(V, E, A), And calculate the normalized form of A

[0132]

[0133] Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N );

[0134] Combining graph structure information with time series data, the input matrix I is constructed as:

[0135]

[0136] Among them, θ k is a learnable parameter, K is the preset graph convolution order;

[0137] S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to convolve the input matrix I. The output of the lth layer at time step t is:

[0138]

[0139] in, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer in the filtering branch for the m-th order neighborhood, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel of the l-th layer in the gated branch for the m-th order neighborhood, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-by-element multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function;

[0140] S44. The output feature sequence Z processed by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependency and local spatial correlation:

[0141] Z=X (L) ;

[0142] Among them, L is the total number of convolutional modules.

[0143] In this implementation, S5 includes the following steps:

[0144] S51. Final feature representation of the dynamic changes of network topology extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i :

[0145]

[0146] Among them, β is the fusion weight coefficient.

[0147] In this implementation, S6 includes the following steps:

[0148] S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i

[0149]

[0150] Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer;

[0151] S62, let the actual monitored network traffic be y i , calculate the prediction error e i :

[0152]

[0153] Among them, δ is the preset threshold;

[0154] S63, based on the prediction error e i and the comprehensive feature vector f i Generate anomaly scores i :

[0155] s i =σ(α·e i +λ·ReLU(W s f i +b s )+β);

[0156] Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias;

[0157] S64: The predicted network traffic of each node i With anomaly scores i Combine and generate the final monitoring results.

[0158] Example:

[0159] This embodiment selects the network of a core data center of a large enterprise in the East China region for monitoring from March 2024 to September 2024. The monitoring scenario covers the multi-layer network architecture of the headquarters and its more than 10 branches, including core switches, routers, firewalls and various terminal devices. There are nearly 500 network nodes in the network environment. The network traffic data acquisition module collects the data packet header information, transmission delay, packet loss rate and device status of each node in real time. At the same time, the network topology acquisition module collects the link connection status, port status and physical topology information between each node. The original data is denoised, normalized and missing value filled to form standard format data, which provides a basis for the subsequent dynamic graph model construction.

[0160] In this scenario, the implementer first divides the continuous network traffic data into several time segments according to the preset time window division scheme, constructs the graph structure data in each time window, and each graph data contains node and edge information, and reflects the connection strength between nodes through the normalized adjacency matrix. Next, the multi-head attention graph convolution module is combined with the Transformer timing update module to calculate and dynamically update the node embedding in each time window, fully capturing the evolution characteristics of the network topology at each time step.

[0161] After the above processing, the implementers used Graph WaveNet's advanced causal dilated convolution module to extract spatiotemporal features, performed multi-layer convolution operations on the preprocessed spatiotemporal traffic data, and introduced gating mechanisms, residual connections, and layer normalization into the formula to obtain high-level feature representations of network traffic. Finally, the node embeddings were fused with the spatiotemporal features through weighted summation to generate a comprehensive feature vector, providing high-quality input features for subsequent prediction modules and anomaly detection modules.

[0162] To verify the beneficial effects of the present invention, the implementers deployed a complete system in the enterprise network and compared the performance of the traditional method and the method of the present invention in traffic prediction and anomaly detection. After six months of continuous monitoring and data collection, the results showed that in terms of network traffic prediction, the average prediction error of the traditional method was about 12.8%, while the method of the present invention reduced the prediction error to 5.3%, and the prediction delay was shortened from an average of 15 seconds to less than 5 seconds; in terms of anomaly detection, the detection accuracy of the traditional method was only 78%, while the detection accuracy of the method of the present invention was increased to 93%, and an alarm could be issued in real time. The average abnormal response time was shortened from the original 20 seconds to 7 seconds. The average daily network traffic peak of the data center reached 3.2TB, and the system was able to maintain stable operation under high traffic conditions without data loss or serious delays.

[0163] During the experiment, the amount of raw data collected by the implementers after preprocessing averaged more than 5 million records per day, and the number of nodes and links were maintained within a reasonable range to ensure the representativeness and reliability of the data.

[0164] The following table shows the performance comparison data of the present invention and traditional methods in network traffic prediction and anomaly detection

[0165] Table 1 Performance comparison data of the present invention and traditional methods in network traffic prediction and anomaly detection

[0166] index Traditional methods Method of the present invention Improvement ratio Average prediction error 12.8％ 5.3％ 58.6％ Prediction delay 15 seconds 4.8 seconds 68％ Anomaly detection accuracy 78％ 93％ 19.2％ Abnormal response time 20 seconds 7 seconds 65％ Average daily data processing volume 4.8 million records 5.2 million records —

[0167] The above detailed embodiments and data show that the present invention not only overcomes the limitations of traditional methods in theory, but also significantly improves the accuracy and real-time performance of dynamic monitoring and analysis of multi-layer network traffic in practical applications. The integrated design and optimized processing of the entire system enable network abnormal events to be quickly discovered and responded to, providing a strong guarantee for network security and stable operation.

[0168] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A multi-layer network traffic dynamic monitoring and analysis method based on graph neural network, characterized in that: The steps include: S1, collect data from each node in real time and perform preprocessing; S2. Divide the preprocessed data based on the preset time window, generate a node set and an edge set for each time window, and construct graph structure data; S3. Using the improved EvolveGCN to perform topological learning on the constructed graph structure data, the improved EvolveGCN consists of a graph convolution operation module and a Transformer-based timing update module. The graph convolution operation module is used to aggregate the node neighborhood information in the graph structure data at each time step, and the Transformer-based timing update module is used to dynamically update the node embedding to generate the final feature representation of the dynamic change of the network topology structure; S4, use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependency and local spatial correlation; S5. Based on the weighted summation method, the final feature representation of the dynamic change of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector. S6. Generate the predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error according to the actually monitored network traffic, and generate the final monitoring result; S7. The final monitoring results are transmitted to the network traffic management platform through a standard data interface for data processing and analysis.

2. According to claim 1, a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network is characterized in that: The S1 comprises the following steps: S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time; S12, deploying network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time; S13. De-noising and normalizing the collected raw data, and filling in missing values ​​to obtain pre-processed data D".

3. According to claim 1, a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network is characterized in that: The S2 comprises the following steps: S21, based on the preprocessed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows. n Indicates that n = 1, 2, ..., N; S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as; a i =[S i ,Δt i ,L i ]; Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate; S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as: a ij =[C ij ,P ij ,T ij ]; Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information; S24, construct each time window T n The graph structure data G in n : G n =(V n ,E n ,A n ); Among them, V n represents a node set, E n represents the edge set, A n Represents the set of attributes of all nodes and edges.

4. According to claim 1, a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network is characterized in that: The S3 comprises the following steps: S31, for each time window T n The graph structure data G in n =(V n ,E n ,A n ), define each node i∈V n The neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation: Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the kth head, W (k) is the learnable weight matrix of the kth head, ∥ represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function; S32, for the continuous time window T n-1 With T n For each node i∈V n The embedding representation of is dynamically updated using a Transformer-based temporal update module; Define the query vector Q i , key vector K i Sum value vector V i They are: Among them, W Q , W K , W V is the learnable projection matrix; Obtained by weighted summation Among them, d k is the dimension of the key vector; Using residual connection and layer normalization to update the node embedding representation is: Among them, LayerNorm(.) represents the layer normalization operation; Further update through the feedforward neural network is: Among them, FFN(·) represents a two-layer fully connected network; S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in the network topology.

5. According to claim 1, a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network is characterized in that: The S4 comprises the following steps: S41, generate time series data from the preprocessed data D" according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed: Where T is the number of time steps; S42, constructing the original adjacency matrix A according to the graph structure data G=(V, E, A), And calculate the normalized form of A Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N ); Combining graph structure information with time series data, the input matrix I is constructed as: Among them, θ k is a learnable parameter, K is the preset graph convolution order; S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to convolve the input matrix I. The output of the lth layer at time step t is: Among them, X (0) =I, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer in the filtering branch for the m-th order neighborhood, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel of the l-th layer in the gated branch for the m-th order neighborhood, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-by-element multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function; S44. The output feature sequence Z processed by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependency and local spatial correlation: Z=X (L) ; Among them, L is the total number of convolutional modules.

6. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S5 comprises the following steps: S51. Final feature representation of the dynamic changes of network topology extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i : Among them, β is the fusion weight coefficient.

7. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S6 comprises the following steps: S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer; S62, let the actual monitored network traffic be y i , calculate the prediction error e i : Among them, δ is the preset threshold; S63, based on the prediction error e i and the comprehensive feature vector f i Generate anomaly scores i : s i =σ(α·e i +λ·ReLU(W s f i +b s )+b); Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias; S64: The predicted network traffic of each node i With anomaly scores i Combine and generate the final monitoring results.

Images