A multi-layer network traffic dynamic monitoring and analysis method based on graph neural network

Abstract

The present invention discloses a multi-layer network traffic dynamic monitoring and analysis method based on a graph neural network. The method comprises the following steps: S1: real-time data collection and preprocessing of each node; S2: partitioning the preprocessed data based on a preset time window to construct graph structure data; S3: topological learning of the constructed graph structure data using an improved EvolveGCN to generate a final feature representation of the dynamic changes in the network topology; S4: modeling the preprocessed data using Graph WaveNet to extract the final feature representation of spatiotemporal dependency and local spatial correlation; S5: feature fusion to generate a comprehensive feature vector; S6: generating a final monitoring result based on the comprehensive feature vector; and S7: transmitting the final monitoring result to a network traffic management platform for data processing and analysis. The present invention can provide an efficient and scientific optimization solution for dynamic network traffic monitoring, bringing significant technical value and economic benefits to practical applications.

Description

Technical Field

[0001] The present invention relates to the technical field of network traffic monitoring, and in particular to a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network. Background Art

[0002] Existing network traffic monitoring and analysis methods mainly rely on traditional statistical models and shallow machine learning algorithms, such as ARIMA, support vector machines, and simple neural network models. These methods are effective in processing static network traffic data. However, with the continuous expansion of network scale and the increasing complexity of network structure, traditional methods face difficulties such as dynamic topological changes and complex spatiotemporal characteristics in multi-layer networks. It is difficult to accurately capture the dependencies and traffic characteristics that evolve over time between nodes in the network. Traditional methods usually only focus on the traffic data itself and ignore the network topology information, resulting in insufficient accuracy of the monitoring system in anomaly detection and traffic prediction.

[0003] In recent years, graph neural networks have been introduced into the field of network traffic monitoring as an emerging technology that can directly process graph-structured data, and a variety of models have gradually developed, such as EvolveGCN and Graph WaveNet. EvolveGCN uses graph convolution and recursive neural network modules to model the topological structure of dynamic graphs, which can better capture the time-varying dependencies between network nodes. Graph WaveNet extracts temporal information and local spatial correlations in traffic data through causal dilated convolution modules, and has achieved initial results in traffic prediction. Although these methods have strong expressive power in theory, in practical applications, a single model often finds it difficult to simultaneously take into account the efficient integration of dynamic changes in network topology and spatiotemporal traffic characteristics, resulting in certain lags and errors in monitoring results.

[0004] In addition, existing methods lack a unified and efficient solution in the processes of data preprocessing, feature extraction, and model fusion. Key steps such as data format conversion, adjacency matrix normalization, and residual mapping in multi-layer convolution operations fail to fully utilize the network's structural information and temporal dependencies, thereby affecting the real-time and accuracy of the overall system. Especially in large-scale network environments, how to simultaneously achieve dynamic monitoring and anomaly detection of multi-layer network traffic remains a difficult problem that needs to be solved urgently.

[0005] In summary, existing technologies in the dynamic monitoring and analysis of multi-layer network traffic have defects such as insufficient learning of dynamic graph topology information, incomplete extraction of spatiotemporal features, and lack of efficient integration of prediction models and anomaly detection modules. It is urgent to develop a new method based on graph neural networks. Through the synergy of advanced models such as EvolveGCN and Graph WaveNet, the deep integration of network topology and traffic data can be achieved, thereby improving the response speed and accuracy of the monitoring system to traffic changes in dynamic network environments. Summary of the Invention

[0006] One purpose of the present invention is to propose a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network. The present invention can provide an efficient and scientific optimization solution in the dynamic monitoring of network traffic, bringing significant technical value and economic benefits to practical applications.

[0007] A method for dynamic monitoring and analysis of multi-layer network traffic based on a graph neural network according to an embodiment of the present invention includes the following steps:

[0008] S1. By deploying network traffic collection devices and network topology collection devices, data from each node is collected in real time and pre-processed;

[0009] S2. Divide the preprocessed data based on preset time windows, generate a node set and an edge set for each time window, and construct graph structure data;

[0010] S3. Use the improved EvolveGCN to perform topology learning on the constructed graph structure data. The improved EvolveGCN consists of a graph convolution operation module and a Transformer-based temporal update module. The graph convolution operation module is used to aggregate node neighborhood information in the graph structure data at each time step, and the Transformer-based temporal update module is used to dynamically update node embeddings to generate a final feature representation of the dynamic changes in the network topology structure.

[0011] S4. Use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependencies and local spatial correlations;

[0012] S5. Based on the weighted summation method, the final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector;

[0013] S6. Generate predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error based on the actual monitored network traffic, and generate the final monitoring result;

[0014] S7. The final monitoring results are transmitted to the network traffic management platform through the standard data interface for data processing and analysis.

[0015] Optionally, the S1 includes the following steps:

[0016] S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time;

[0017] S12. Deploy network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time;

[0018] S13. De-noising and normalizing the collected raw data, and filling in missing values ​​to obtain pre-processed data D".

[0019] Optionally, the S2 includes the following steps:

[0020] S21, based on the pre-processed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows. n Indicates that n = 1, 2, ..., N;

[0021] S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as;

[0022] a i =[S i ,Δt i ,L i ];

[0023] Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate;

[0024] S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as:

[0025] a ij =[C ij ,Pij ,T ij ];

[0026] Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information;

[0027] S24, construct each time window T n The graph structure data G within n :

[0028] G n =(V n ,E n ,A n );

[0029] Among them, V n Represents a node set, E n represents the edge set, A n Represents the set of attributes of all nodes and edges.

[0030] Optionally, S3 includes the following steps:

[0031] S31, for each time window T n The graph structure data G within n =(V n ,E n ,A n ), define each node i∈V n Neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation:

[0032]

[0033] Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the k-th head, W (k) is the learnable weight matrix of the k-th head, ∥ represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function;

[0034] S32, for the continuous time window T n-1 With T n Each node i∈V n Embedding representation, the node embedding is dynamically updated using the Transformer-based temporal update module;

[0035] Define the query vector Q i , key vector Ki Sum value vector V i They are:

[0036]

[0037] Among them, W Q 、W K 、W V is the learnable projection matrix;

[0038] Obtained by weighted summation

[0039]

[0040] Among them, d k is the dimension of the key vector;

[0041] Using residual connection and layer normalization to update the node embedding is expressed as:

[0042]

[0043] Among them, LayerNorm(.) represents the layer normalization operation;

[0044] Further updated by the feedforward neural network:

[0045]

[0046] Among them, FFN(·) represents a two-layer fully connected network;

[0047] S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in network topology.

[0048] Optionally, the S4 includes the following steps:

[0049] S41. Generate time series data from the preprocessed data D' according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed:

[0050]

[0051] Where T is the number of time steps;

[0052] S42. Construct the original adjacency matrix A based on the graph structure data G = (V, E, A). And calculate the normalized form of A

[0053]

[0054] Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N );

[0055] Combining graph structure information with time series data, the input matrix I is constructed as:

[0056]

[0057] Among them, θ k is a learnable parameter, and K is the preset graph convolution order;

[0058] S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to perform convolution processing on the input matrix I. The output of the lth layer at time step t is:

[0059]

[0060] in, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-wise multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function;

[0061] S44. The output feature sequence Z after processing by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependencies and local spatial correlations:

[0062] Z=X (L) ;

[0063] Where L is the total number of layers in the convolution module.

[0064] Optionally, the S5 includes the following steps:

[0065] S51. Final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i :

[0066]

[0067] Among them, β is the fusion weight coefficient.

[0068] Optionally, the S6 includes the following steps:

[0069] S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i

[0070]

[0071] Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer;

[0072] S62. Assume that the actual monitored network traffic is y i , calculate the prediction error e i :

[0073]

[0074] Among them, δ is the preset threshold;

[0075] S63, based on the prediction error e i and the comprehensive eigenvector f i Generate anomaly score s i :

[0076] s i =σ(α·e i +λ·ReLU(W s f i +b s )+β);

[0077] Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias;

[0078] S64, the predicted network traffic of each node i and abnormality scores i Combine and generate the final monitoring results.

[0079] The beneficial effects of the present invention are:

[0080] (1) By combining EvolveGCN with Graph WaveNet, the present invention realizes the deep integration of multi-layer network traffic monitoring and analysis, and has made significant breakthroughs in capturing the dynamic changes of network topology and spatiotemporal traffic characteristics. It uses graph neural networks to model the network topology in a dynamic graph, and then combines the causal dilated convolution module to extract advanced features of time series data, so that the system can achieve real-time data processing and high-precision prediction in large-scale complex network environments. Through unified data preprocessing, adjacency matrix normalization and the design of multi-layer advanced convolution modules, it fully mines the structural information and traffic evolution laws between network nodes, thereby effectively improving the accuracy and real-time performance of anomaly detection and traffic prediction.

[0081] (2) The present invention adopts a timing update module based on the attention mechanism and Transformer to dynamically update the node embedding, thereby achieving an accurate characterization of the continuous evolution process of the network topology structure. The prediction module and the anomaly detection module use a learnable fusion strategy to efficiently integrate the comprehensive feature vectors, thereby capturing subtle traffic fluctuations and timely discovering potential abnormal behaviors during the monitoring process. This method not only optimizes the limitations of existing technologies in multi-layer network environments, but also has high robustness and scalability, providing reliable technical support for network security and traffic management. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0083] Figure 1 This is a flowchart of a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network proposed by the present invention;

[0084] Figure 2 This is a flowchart for generating comprehensive feature vectors in a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network proposed by the present invention. DETAILED DESCRIPTION

[0085] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0086] refer to Figure 1-Figure 2 , a multi-layer network traffic dynamic monitoring and analysis method based on graph neural network, including the following steps:

[0087] S1. By deploying network traffic collection devices and network topology collection devices, data from each node is collected in real time and pre-processed;

[0088] S2. Divide the preprocessed data based on preset time windows, generate a node set and an edge set for each time window, and construct graph structure data;

[0089] S3. Use the improved EvolveGCN to perform topology learning on the constructed graph structure data. The improved EvolveGCN consists of a graph convolution operation module and a Transformer-based temporal update module. The graph convolution operation module is used to aggregate node neighborhood information in the graph structure data at each time step, and the Transformer-based temporal update module is used to dynamically update node embeddings to generate a final feature representation of the dynamic changes in the network topology structure.

[0090] S4. Use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependencies and local spatial correlations;

[0091] S5. Based on the weighted summation method, the final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector;

[0092] S6. Generate predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error based on the actual monitored network traffic, and generate the final monitoring result;

[0093] S7. The final monitoring results are transmitted to the network traffic management platform through the standard data interface for data processing and analysis.

[0094] In this embodiment, S1 includes the following steps:

[0095] S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time;

[0096] S12. Deploy network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time;

[0097] S13. De-noising and normalizing the collected raw data, and filling in missing values ​​to obtain pre-processed data D".

[0098] In this embodiment, S2 includes the following steps:

[0099] S21, based on the pre-processed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows.n Indicates that n = 1, 2, ..., N;

[0100] S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as;

[0101] a i =[S i ,Δt i ,L i ];

[0102] Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate;

[0103] S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as:

[0104] a ij =[C ij ,P ij ,T ij ];

[0105] Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information;

[0106] S24, construct each time window T n The graph structure data G within n :

[0107] G n =(V n ,E n ,A n );

[0108] Among them, V n Represents a node set, E n represents the edge set, A n Represents the set of attributes of all nodes and edges.

[0109] In this embodiment, S3 includes the following steps:

[0110] S31, for each time window T n The graph structure data G within n =(V n ,E n ,A n ), define each node i∈V n Neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation:

[0111]

[0112] Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the k-th head, W (k) is the learnable weight matrix of the k-th head, ∥ represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function;

[0113] S32, for the continuous time window T n-1 With T n Each node i∈V n Embedding representation, the node embedding is dynamically updated using the Transformer-based temporal update module;

[0114] Define the query vector Q i , key vector K i Sum value vector V i They are:

[0115]

[0116] Among them, W Q 、W K 、W V is the learnable projection matrix;

[0117] Obtained by weighted summation

[0118]

[0119] Among them, d k is the dimension of the key vector;

[0120] Using residual connection and layer normalization to update the node embedding is expressed as:

[0121]

[0122] Among them, LayerNorm(.) represents the layer normalization operation;

[0123] Further updated by the feedforward neural network:

[0124]

[0125] Among them, FFN(·) represents a two-layer fully connected network;

[0126] S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in network topology.

[0127] In this embodiment, S4 includes the following steps:

[0128] S41. Generate time series data from the preprocessed data D' according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed:

[0129]

[0130] Where T is the number of time steps;

[0131] S42. Construct the original adjacency matrix A based on the graph structure data G = (V, E, A). And calculate the normalized form of A

[0132]

[0133] Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N );

[0134] Combining graph structure information with time series data, the input matrix I is constructed as:

[0135]

[0136] Among them, θ k is a learnable parameter, and K is the preset graph convolution order;

[0137] S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to perform convolution processing on the input matrix I. The output of the lth layer at time step t is:

[0138]

[0139] in, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-wise multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function;

[0140] S44. The output feature sequence Z after processing by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependencies and local spatial correlations:

[0141] Z=X (L) ;

[0142] Where L is the total number of layers in the convolution module.

[0143] In this embodiment, S5 includes the following steps:

[0144] S51. Final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i :

[0145]

[0146] Among them, β is the fusion weight coefficient.

[0147] In this embodiment, S6 includes the following steps:

[0148] S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i

[0149]

[0150] Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer;

[0151] S62. Assume that the actual monitored network traffic is y i , calculate the prediction error e i :

[0152]

[0153] Among them, δ is the preset threshold;

[0154] S63, based on the prediction error e i and the comprehensive eigenvector f i Generate anomaly score s i :

[0155] s i =σ(α·e i +λ·ReLU(W s f i +b s )+β);

[0156] Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias;

[0157] S64, the predicted network traffic of each node i and abnormality scores i Combine and generate the final monitoring results.

[0158] Example:

[0159] This embodiment selects the network of a core data center of a large enterprise in East China for monitoring from March 2024 to September 2024. The monitoring scenario covers the multi-layer network architecture of the headquarters and its more than 10 branches, including core switches, routers, firewalls and various terminal devices. There are nearly 500 network nodes in the network environment. The network traffic data acquisition module collects the data packet header information, transmission delay, packet loss rate and device status of each node in real time. At the same time, the network topology acquisition module collects the link connection status, port status and physical topology information between each node. The original data is denoised, normalized and missing value filled to form standard format data, providing a basis for subsequent dynamic graph model construction.

[0160] In this scenario, the implementer first divides the continuous network traffic data into several time segments according to the preset time window division scheme, constructs the graph structure data in each time window, and each graph data contains node and edge information, and reflects the connection strength between nodes through the normalized adjacency matrix. Next, the multi-head attention graph convolution module is combined with the Transformer timing update module to calculate and dynamically update the node embedding in each time window, fully capturing the evolution characteristics of the network topology at each time step.

[0161] After the above processing, the implementers used Graph WaveNet's advanced causal dilated convolution module to extract spatiotemporal features and performed multi-layer convolution operations on the preprocessed spatiotemporal traffic data. The formula introduced a gating mechanism, residual connections, and layer normalization to obtain a high-level feature representation of network traffic. Finally, the node embeddings were fused with the spatiotemporal features through weighted summation to generate a comprehensive feature vector, providing high-quality input features for the subsequent prediction module and anomaly detection module.

[0162] To verify the beneficial effects of the present invention, the implementers deployed a complete system in the enterprise network and compared the performance of traditional methods and the method of the present invention in traffic prediction and anomaly detection. After six months of continuous monitoring and data collection, the results showed that in terms of network traffic prediction, the average prediction error of the traditional method was about 12.8%, while the method of the present invention reduced the prediction error to 5.3%, and the prediction delay was shortened from an average of 15 seconds to less than 5 seconds; in terms of anomaly detection, the detection accuracy of the traditional method was only 78%, while the detection accuracy of the method of the present invention was increased to 93%, and it was able to issue alarms in real time. The average anomaly response time was shortened from the original 20 seconds to 7 seconds. The average daily network traffic peak of the data center reached 3.2TB, and the system was able to maintain stable operation under high traffic conditions without data loss or serious delays.

[0163] During the experiment, the raw data collected by the implementers after preprocessing averaged more than 5 million records per day, and the number of nodes and links remained within a reasonable range, ensuring the representativeness and reliability of the data.

[0164] The following table shows the performance comparison data of the present invention and traditional methods in network traffic prediction and anomaly detection

[0165] Table 1 Performance comparison data of the present invention and traditional methods in network traffic prediction and anomaly detection

[0166] index Traditional methods Method of the present invention Improvement ratio Average prediction error 12.8％ 5.3％ 58.6％ Prediction Delay 15 seconds 4.8 seconds 68％ Anomaly detection accuracy 78％ 93％ 19.2％ Abnormal response time 20 seconds 7 seconds 65％ Average daily data processing volume 4.8 million records 5.2 million records —

[0167] The above detailed examples and data show that the present invention not only overcomes the limitations of traditional methods in theory, but also significantly improves the accuracy and real-time performance of dynamic monitoring and analysis of multi-layer network traffic in practical applications. The integrated design and optimized processing of the entire system enable network anomalies to be quickly discovered and responded to, providing strong protection for network security and stable operation.

[0168] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A multi-layer network traffic dynamic monitoring and analysis method based on graph neural network, characterized in that: The steps include: S1, real-time data collection and pre-processing of each node; S2. Divide the preprocessed data based on preset time windows, generate a node set and an edge set for each time window, and construct graph structure data; S3. Use the improved EvolveGCN to perform topology learning on the constructed graph structure data. The improved EvolveGCN consists of a graph convolution operation module and a Transformer-based temporal update module. The graph convolution operation module is used to aggregate node neighborhood information in the graph structure data at each time step, and the Transformer-based temporal update module is used to dynamically update node embeddings to generate a final feature representation of the dynamic changes in the network topology structure. S4. Use Graph WaveNet to model the preprocessed data and extract the final feature representation of spatiotemporal dependencies and local spatial correlations; S5. Based on the weighted summation method, the final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN is fused with the final feature representation of the spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to generate a comprehensive feature vector; S6. Generate predicted network traffic of the node based on the comprehensive feature vector, calculate the prediction error based on the actual monitored network traffic, and generate the final monitoring result; S7. Transmit the final monitoring results to the network traffic management platform through a standard data interface for data processing and analysis; The S3 includes the following steps: S31, for each time window T n The graph structure data G within n =(V n ,E n ,A n ), define each node i∈V n Neighborhood set N i , a multi-head attention graph convolution module is used to calculate the node embedding representation: Where k = 1, 2, ..., K is the attention head index, x i is the initial eigenvector of node i, a (k) is the learnable attention parameter vector of the k-th head, W (k) is the learnable weight matrix of the k-th head, || represents vector concatenation, exp(.) is the natural exponential function, and σ is the sigmoid activation function; S32, for the continuous time window T n-1 With T n Each node i∈V n Embedding representation, the node embedding is dynamically updated using the Transformer-based temporal update module; Define the query vector Q i , key vector K i Sum value vector V i They are: Among them, W Q 、W K 、W V is the learnable projection matrix; Obtained by weighted summation Among them, d k is the dimension of the key vector; Using residual connection and layer normalization to update the node embedding is expressed as: Among them, LayerNorm(.) represents the layer normalization operation; Further updated by the feedforward neural network: Among them, FFN(·) represents a two-layer fully connected network; S33, embedding the updated node into the representation The set serves as the final feature representation of the dynamic changes in network topology.

2. A multi-layer network traffic dynamic monitoring and analysis method based on graph neural network according to claim 1, characterized in that: Said S1 comprises the following steps: S11. Deploy network traffic collection devices in each layer of the network to collect data packet header information, transmission delay, packet loss rate and device status of each node in real time; S12. Deploy network topology collection devices in each layer of the network to collect link connection status, port status and physical topology information between nodes in real time; S13. De-noise and normalize the collected raw data, and fill in missing values ​​to obtain pre-processed data D".

3. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S2 comprises the following steps: S21, based on the pre-processed data D', the continuous time series is divided into several time windows according to the preset time window division scheme, and each time window is divided into several time windows. n Indicates that n = 1, 2, ..., N; S22, for each time window T n Data D" (T n ) Extract network device information and generate node set V n , each node i∈V n The attribute vector of is represented as; a i =[S i ,Δt i ,L i ]; Among them, a i represents the attribute vector of each node i, S i is the device status, Δt i is the transmission delay, L i is the packet loss rate; S23, for each time window T n Data D" (T n ) Extract the communication records and link information between devices and generate the edge set E n , each edge (i,j)∈E n The attribute vector of is represented as: a ij =[C ij ,P ij ,T ij ]; Among them, C ij P is the link connection state. ij is the port status, T ij is the physical topology information; S24, construct each time window T n The graph structure data G within n : G n =(V n ,E n ,A n ); Among them, V n Represents a node set, E n represents the edge set, A n Represents the attribute set of all nodes and edges.

4. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S4 comprises the following steps: S41. Generate time series data from the preprocessed data D' according to time steps t = 1, 2, ..., T, and define a single time step data vector F is the feature dimension, and the time series matrix is ​​constructed: Where T is the number of time steps; S42. Construct the original adjacency matrix based on the graph structure data G = (V, E, A) And calculate the normalized form of A Among them, I N is the N×N unit matrix, D is the diagonal matrix, and the diagonal element is D ii =∑ j (A ij +I N ); Combining graph structure information with time series data, the input matrix I is constructed as: Among them, θ k is a learnable parameter, and K is the preset graph convolution order; S43, Graph WaveNet uses a multi-layer advanced convolution module based on fusion graph convolution and temporal causal dilated convolution to perform convolution processing on the input matrix I. The output of the lth layer at time step t is: Among them, X (0) =I, represents the feature representation of the lth layer at time step t, is the weight of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the bias of the k-th convolution kernel of the l-th layer for the m-th order neighborhood in the filtering branch, is the weight of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, is the bias of the k-th convolution kernel in the l-th layer for the m-th order neighborhood in the gated branch, d is the dilation factor, K is the causal convolution kernel length, M is the graph convolution order, represents the residual mapping achieved by 1×1 convolution, ⊙ represents element-wise multiplication, tanh(·) is the hyperbolic tangent function, and σ(·) is the sigmoid activation function; S44. The output feature sequence Z after processing by the multi-layer advanced convolution module is used as the final feature representation of Graph WaveNet to extract spatiotemporal dependencies and local spatial correlations: Z=X (L) ; Where L is the total number of layers in the convolution module.

5. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S5 comprises the following steps: S51. Final feature representation of the dynamic changes of the network topology structure extracted by EvolveGCN using weighted summation It is fused with the final feature representation Z of spatiotemporal dependency and local spatial correlation extracted by Graph WaveNet to form a comprehensive feature vector f i : Among them, β is the fusion weight coefficient.

6. The method for dynamic monitoring and analysis of multi-layer network traffic based on graph neural network according to claim 1 is characterized in that: The S6 comprises the following steps: S61, using a multi-layer residual prediction module to predict the comprehensive feature vector f i Processing is performed to generate the predicted network traffic of node i Among them, L P is the number of prediction layers, is the weight matrix of the jth layer, is the bias of the lth layer; S62. Assume that the actual monitored network traffic is y i , calculate the prediction error e i : Among them, δ is the preset threshold; S63, based on the prediction error e i and the comprehensive eigenvector f i Generate anomaly scores i : s i =σ(α·e i +λ·ReLU(W s f i +b s )+b); Among them, σ(.) is the Sigmoid activation function, α, λ, β are learnable parameters, W s is the weight matrix, b s is bias; S64, the predicted network traffic of each node i and abnormality scores i Combine and generate the final monitoring results.

Images