Network traffic abnormity intelligent monitoring system fused with artificial intelligence

Abstract

The invention relates to the technical field of combination of communication network management and artificial intelligence, in particular to an intelligent network traffic anomaly monitoring system fused with artificial intelligence, which comprises a data acquisition unit, a feature extraction and processing unit, an intelligent anomaly detection unit, a fault prediction and health management evaluation unit, a decision response unit and a continuous model optimization unit. Through multi-modal intelligent fusion, lightweight modeling and hybrid modeling technologies, real-time accurate identification and potential threat positioning of network flow abnormal behaviors are realized, network equipment faults and health states are predicted based on interpretable AI and physical law fusion, a transparent and prospective decision basis is provided for network operation and maintenance, and the network flow abnormal behavior prediction method has the advantages of high reliability and high reliability. The anomaly detection accuracy is greatly improved, the fault prediction advance exceeds 24 hours, and the network security and reliability are remarkably enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of combining communication network management with artificial intelligence, and in particular to an intelligent monitoring system for network traffic anomalies that integrates artificial intelligence. Background Art

[0002] In the field of computer networks, network traffic refers to the amount of data transmitted in a network over a period of time. It is usually measured in units such as bits, bytes, and packets. It reflects the state of data flow between devices such as servers, computers, and mobile phones, and is a core indicator reflecting network usage and load. As the scale of networks expands and the complexity of services increases. In existing technologies, traditional network monitoring methods rely on fixed thresholds, resulting in high rates of missed reports / false alarms, high fault handling delays, insufficient accuracy of single-modal modeling, lack of model interpretability, and inability to proactively predict equipment failures.

[0003] Based on this, the present invention provides an intelligent network traffic anomaly monitoring system that integrates artificial intelligence to solve the above-mentioned technical problems. Summary of the Invention

[0004] The purpose of the present invention is to provide an intelligent network traffic anomaly monitoring system that integrates artificial intelligence. The multimodal intelligent fusion, lightweight modeling and hybrid modeling technology of the present invention can realize real-time and accurate identification of abnormal network traffic behavior and positioning of potential threats, and predict network equipment failures and health status based on the fusion of explainable AI and physical laws, providing a transparent and forward-looking decision-making basis for network operation and maintenance, greatly improving the accuracy of anomaly detection, and predicting failures in advance by more than 24 hours, significantly enhancing network security and reliability.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The present invention provides an intelligent network traffic anomaly monitoring system integrating artificial intelligence, including a data acquisition unit, a feature extraction and processing unit, an intelligent anomaly detection unit, a fault prediction and health management assessment unit, a decision response unit, and a model continuous optimization unit, wherein:

[0007] The data collection unit is responsible for collecting original multi-source traffic data from the network;

[0008] The feature extraction and processing unit is used to extract key features for anomaly detection and perform standardization, dimensionality reduction and denoising;

[0009] The intelligent anomaly detection unit is used to identify abnormal behaviors and potential threats in traffic through multimodal intelligent fusion and lightweight adaptive modeling;

[0010] The fault prediction and health management assessment unit: Based on explainable AI technology and hybrid modeling methods, it achieves high-precision fault prediction and health status visual assessment, and outputs explainable decision-making basis;

[0011] The decision response unit generates dynamic response strategies based on reinforcement learning or rule engines, and implements automated closed-loop processing through SDN / NFV technologies;

[0012] The model continuous optimization unit is used to continuously update model parameters through online learning and feedback mechanisms to avoid catastrophic forgetting.

[0013] The data acquisition unit includes a traffic acquisition module, an edge preprocessing module, and a dynamic scheduling module, wherein:

[0014] The traffic collection module is used to collect multi-source data such as original traffic data packets, traffic statistics, and log files from the network by mirroring the NetFlow / sFlow / SNMP protocols on the switch port;

[0015] The edge preprocessing module is used to perform preliminary filtering and compression on the collected data at the network edge node to remove duplicate data;

[0016] The dynamic scheduling module dynamically adjusts the data collection frequency and sampling depth based on network load and device performance indicators.

[0017] The feature extraction and processing unit includes a feature extraction module, a standardization module, and a dimensionality reduction and denoising module, wherein:

[0018] The feature extraction module is used to extract key information of time series features, statistical features and protocol features from the original traffic data by using sliding window and Fourier transform technology;

[0019] The standardization module is used to normalize the extracted features, unify the data scale, and eliminate the dimension effect;

[0020] The dimensionality reduction and denoising module is used to reduce the data dimension by using principal component analysis and t-SNE algorithms, remove redundant information, and filter the noisy data by using wavelet transform and median filtering techniques.

[0021] The intelligent anomaly detection unit includes a multimodal fusion module, a lightweight modeling module, and an anomaly recognition module, wherein:

[0022] The multimodal fusion module integrates network traffic characteristics, device status data, and user behavior data to form a multi-dimensional data representation through tensor fusion and feature splicing technologies;

[0023] The lightweight modeling module: Based on the lightweight neural network architecture of MobileNet and TinyML, combined with model pruning and quantization technology, builds an efficient anomaly detection model;

[0024] The anomaly identification module uses the trained model to perform real-time analysis on the fused data, identify abnormal behaviors such as DDoS attacks, virus propagation, and bandwidth abuse, and locate the anomaly source and the affected scope.

[0025] The multimodal fusion module integrates network traffic characteristics, device status data, and user behavior data, and forms a multi-dimensional data representation through tensor fusion and feature splicing technologies. The specific operations are as follows:

[0026] A1: Time series normalization: network traffic characteristics Perform Z-score standardization to generate the first eigenvector

[0027]

[0028] in, and are the mean and standard deviation of the dimension respectively, ∈ is the smoothing parameter to prevent the denominator from being zero;

[0029] A2: Sliding window statistics: device status data Apply a sliding window of size w to generate the second eigenvector

[0030] F2[t]=[mean(X device [tw:t]),std(X device [tw:t]),…]

[0031] Among them, mean and std are the mean and standard deviation statistics within the window respectively, and D3 is the statistical feature latitude;

[0032] A3: Weighted fusion of attention mechanism: Calculate weight α through multi-head attention mechanism t , F1 and F2 are combined to obtain a joint representation

[0033]

[0034] Among them, Q, K, V are linear transformation functions, and Softmax is a normalization function;

[0035] A4: Graph Embedding Algorithm: Map user behavior data into a graph structure G = (V, E) and generate the third eigenvector through a graph neural network

[0036]

[0037] Among them, N(v) is the neighbor set of node v, c v,u is a normalization constant, W is a learnable weight matrix, and σ is an activation function;

[0038] A5: Tensor concatenation and aggregation: The joint representation H and the third eigenvector F3 are combined through tensor product operations to generate a multi-dimensional data representation.

[0039]

[0040] in, represents the Kronecker product, D6 = D4 × D5.

[0041] The lightweight modeling module uses a lightweight neural network architecture based on MobileNet and TinyML, combined with model pruning and quantization techniques, to build an efficient anomaly detection model. The specific operations are as follows:

[0042] B1: Reconstruct the MobileNet backbone network using depthwise separable convolution, reducing the number of parameters by more than 70%;

[0043] B2: Iterative weight pruning based on gradient magnitude, which compresses the model size to 30% of its original size while retaining key connections;

[0044] B3: Implement 8-bit fixed-point quantization on model weights and 4-bit dynamic quantization on activation values ​​to balance accuracy and inference speed;

[0045] B4: Generate a lightweight inference engine that can run on ARM Cortex-M series chips through the TFLite conversion tool.

[0046] The fault prediction and health management assessment unit includes an explainable AI module, a hybrid modeling module, and a health assessment module, wherein:

[0047] The explainable AI module is used to use SHAP and LIME algorithms to provide visual and understandable feature importance explanations for fault prediction results and health assessment conclusions;

[0048] The hybrid modeling module is used to combine the LSTM and Transformer-based time series prediction model with the physical model based on the network topology aging equation to make high-precision predictions of network equipment failures and performance degradation;

[0049] The health assessment module is used to build a network health scoring system, which integrates indicators such as device health, link stability, and security threat level to generate a report on the overall health status of the network, and visually displays it in the form of heat maps and topology maps.

[0050] The hybrid modeling module combines a time series prediction model based on LSTM and Transformer with a physical model based on physical equations to perform high-precision predictions of network device failures and performance degradation. The specific operations are as follows:

[0051] C1: Network topology aging equation As a regularization term, the LSTM loss function is added, where R is the device reliability and S is the stress factor;

[0052] C2: Time series data is input into the Transformer encoder, and physical state variables are input into the physical equation solver;

[0053] C3: Dynamically adjust the output weights of the data model and the physical model through a gating mechanism:

[0054] y final =g·y data +(1-g)·y physics ,g=σ(W[h data ||h physics ])

[0055] Among them, y data is the LSTM hidden state, h physics Output for physical simulation;

[0056] C4: Based on the Kalman filter, the physical simulation parameters are corrected in real time to minimize the prediction error.

[0057] The decision response unit includes a policy generation module, an SDN / NFV execution module, and a hierarchical response module, wherein:

[0058] The strategy generation module is used to optimize the response strategy through the reinforcement learning algorithm based on the results of intelligent anomaly detection and fault prediction, or quickly match the corresponding disposal plan based on the preset rule engine;

[0059] The SDN / NFV execution module is used to dynamically adjust network traffic paths and bandwidth allocation using a software-defined network controller, and to deploy security functions such as virtual firewalls and intrusion detection systems on demand using network function virtualization technology;

[0060] The hierarchical response module is used to classify anomalies and faults into different levels according to their severity, triggering differentiated response measures such as automatic blocking, flow limiting, and manual intervention, and balancing disposal efficiency and risk.

[0061] The model continuous optimization unit includes an online learning module, an anti-forgetting module, and an active learning module, wherein:

[0062] The online learning module is used to update model parameters in real time when new data is generated by adopting incremental learning and federated learning technologies;

[0063] The anti-forgetting module is used to retain historical learning results during the model update process by using elastic weight consolidation and knowledge distillation methods;

[0064] The active learning module: based on the strategies of uncertainty sampling and density peak sampling, it selects the most valuable samples from massive unlabeled data and guides manual labeling.

[0065] Compared with the prior art, the present invention has the following beneficial effects:

[0066] 1. This invention uses multimodal intelligent fusion, lightweight modeling, and hybrid modeling technologies to achieve real-time and accurate identification of abnormal network traffic behavior and location of potential threats. It also predicts network equipment failures and health status based on the fusion of explainable AI and physical laws, providing a transparent and forward-looking decision-making basis for network operation and maintenance. This greatly improves the accuracy of anomaly detection, predicts failures more than 24 hours in advance, and significantly enhances network security and reliability.

[0067] 2. This invention generates dynamic response strategies by combining reinforcement learning with a rule engine, and relies on SDN / NFV technology to implement traffic path adjustment, dynamic deployment of security functions, and hierarchical closed-loop disposal, shortening the abnormal response time to seconds and reducing the false alarm rate. At the same time, it balances operation and maintenance efficiency and risk control through differentiated strategies, significantly improving the network's automated defense capabilities and management effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a system diagram of the network traffic anomaly intelligent monitoring system integrated with artificial intelligence in the present invention.

[0069] Figure 2 This is a decision-making response flow chart of the network traffic anomaly intelligent monitoring system integrated with artificial intelligence in the present invention.

[0070] Description of Figure Numbers:

[0071] 100. Data acquisition unit; 101. Traffic acquisition module; 102. Edge preprocessing module; 103. Dynamic scheduling module; 200. Feature extraction and processing unit; 201. Feature extraction module; 202. Standardization module; 203. Dimensionality reduction and denoising module; 300. Intelligent anomaly detection unit; 301. Multimodal fusion module; 302. Lightweight modeling module; 303. Anomaly identification module; 400. Fault prediction and health management assessment unit; 401. Explainable AI module; 402. Hybrid modeling module; 403. Health assessment module; 500. Decision response unit; 501. Policy generation module; 502. SDN / NFV execution module; 503. Hierarchical response module; 600. Model continuous optimization unit; 601. Online learning module; 602. Anti-forgetting module; 603. Active learning module. DETAILED DESCRIPTION

[0072] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0073] Example:

[0074] like Figure 1-Figure 2 As shown, this embodiment provides an intelligent network traffic anomaly monitoring system that integrates artificial intelligence, including a data acquisition unit 100, a feature extraction and processing unit 200, an intelligent anomaly detection unit 300, a fault prediction and health management evaluation unit 400, a decision response unit 500, and a model continuous optimization unit 600, wherein: the data acquisition unit 100 is responsible for collecting original multi-source traffic data from the network; the feature extraction and processing unit 200 is used to extract key features for anomaly detection and perform standardization, dimensionality reduction, and denoising; the intelligent anomaly detection unit 300 is used to identify abnormal behaviors and potential threats in traffic through multimodal intelligent fusion and lightweight adaptive modeling; the fault prediction and health management evaluation unit 400 is based on explainable AI technology and hybrid modeling methods to achieve high-precision fault prediction and health status visualization assessment, and output explainable decision basis; the decision response unit 500 generates dynamic response strategies based on reinforcement learning or rule engines, and realizes automated closed-loop disposal through SDN / NFV technology; the model continuous optimization unit 600 is used to continuously update model parameters through online learning and feedback mechanisms to avoid catastrophic forgetting.

[0075] In this embodiment, it should be noted that: the data acquisition unit 100 obtains network traffic data in real time, and after being converted into structured features by the feature extraction and processing unit 200, the intelligent anomaly detection unit 300 performs multimodal fusion analysis to identify threats, the fault prediction and health management assessment unit 400 predicts risks and assesses health status based on hybrid modeling, the decision response unit 500 dynamically generates disposal strategies and executes them through SDN / NFV, and the model continuous optimization unit 600 optimizes the AI ​​models of each link through closed-loop feedback.

[0076] In the present invention, the data collection unit 100 includes a flow collection module 101, an edge preprocessing module 102, and a dynamic scheduling module 103, wherein: the flow collection module 101 is used to collect multi-source data of original flow data packets, flow statistics, and log files from the network by mirroring the NetFlow / sFlow / SNMP protocol on the switch port; the edge preprocessing module 102 is used to perform preliminary filtering and compression on the collected data at the network edge node to eliminate duplicate data; the dynamic scheduling module 103 is used to dynamically adjust the data collection frequency and sampling depth based on the network load and equipment performance indicators.

[0077] In this embodiment, it should be noted that: the traffic collection module 101 collects raw data using multiple protocols, which is filtered and compressed in real time by the edge preprocessing module 102, and then the dynamic scheduling module 103 intelligently adjusts the collection parameters according to the network status.

[0078] In addition, it should be noted that the switch mirror port simultaneously captures NetFlow metadata (sampling ratio 1:1000) and sFlow data packets (sampling ratio 1:500), and synchronously collects device CPU / memory indicators of the SNMP protocol, with timestamp alignment accuracy controlled within ±10ms. The edge pre-processing module 102 uses Bloom filters to identify duplicate data (false positive rate <0.1%), and compresses the data volume to 30% of the original size using the LZ4 algorithm, with a compression time of <5ms / GB. The dynamic scheduling module 103 uses the formula Adjust the sampling frequency, where C current is the current CPU load, C max is the threshold.

[0079] In the present invention, the feature extraction and processing unit 200 includes a feature extraction module 201, a standardization module 202, and a dimensionality reduction and denoising module 203, wherein: the feature extraction module 201 is used to extract key information of time series features, statistical features and protocol features from the original traffic data by using sliding window and Fourier transform technology; the standardization module 202 is used to normalize the extracted features, unify the data scale, and eliminate the dimensionality effect; the dimensionality reduction and denoising module 203 is used to reduce the data dimension by using principal component analysis and t-SNE algorithms, remove redundant information, and use wavelet transform and median filtering technology to filter noise data.

[0080] In this embodiment, it should be noted that the feature extraction module 201 extracts multi-dimensional features from the original data, which are normalized by the standardization module 202 , and then the dimensionality reduction and denoising module 203 completes data simplification and noise filtering.

[0081] In addition, it should be noted that the sliding window size was set to 5 minutes, 12-dimensional statistical features such as the mean number of packets and entropy within the window were extracted, and the three main frequency domain components were extracted using Fourier transform. Z-score standardization was used to unify the feature scale.

[0082] In the present invention, the intelligent anomaly detection unit 300 includes a multimodal fusion module 301, a lightweight modeling module 302, and an anomaly identification module 303, wherein: the multimodal fusion module 301: integrates network traffic features, device status data and user behavior data, and forms a multi-dimensional data representation through tensor fusion and feature splicing technology; the specific operations are as follows: A1: Time series normalization: network traffic features Perform Z-score standardization to generate the first eigenvector

[0083]

[0084] in, and are the mean and standard deviation of the dimension respectively, ∈ is the smoothing parameter to prevent the denominator from being zero; A2: Sliding window statistics: for device status data Apply a sliding window of size w to generate the second eigenvector

[0085] F2[t]=[mean(X device [tw:t]),std(X device [tw:t]),…]

[0086] Among them, mean and std are the mean and standard deviation statistics within the window respectively, D3 is the statistical feature dimension; A3: Weighted fusion of attention mechanism: weight α is calculated through the multi-head attention mechanismt , F1 and F2 are combined to obtain a joint representation

[0087]

[0088] Among them, Q, K, V are linear transformation functions, and Softmax is a normalization function; A4: Graph Embedding Algorithm: Map user behavior data to a graph structure G = (V, E), and generate the third eigenvector through the graph neural network

[0089]

[0090] Among them, N(v) is the neighbor set of node v, c v,u is a normalization constant, W is a learnable weight matrix, and σ is an activation function; A5: Tensor concatenation and aggregation: the joint representation H and the third eigenvector F3 are combined through a tensor product operation to generate a multi-dimensional data representation

[0091]

[0092] in, Denotes the Kronecker product, D6 = D4 × D5. Lightweight Modeling Module 302: Based on the lightweight neural network architecture of MobileNet and TinyML, combined with model pruning and quantization techniques, an efficient anomaly detection model is constructed. The specific operations are as follows: B1: Reconstructing the MobileNet backbone network using depthwise separable convolutions reduces the number of parameters by over 70%. B2: Iterative weight pruning based on gradient magnitude preserves key connections while reducing the model size to 30% of its original size. B3: 8-bit fixed-point quantization is implemented for model weights and 4-bit dynamic quantization is used for activation values, balancing accuracy and inference speed. B4: Using the TFLite conversion tool, a lightweight inference engine is generated that can run on ARM Cortex-M series chips. Anomaly Identification Module 303: Using the trained model, real-time analysis of fused data is performed to identify abnormal behaviors such as DDoS attacks, virus propagation, and bandwidth abuse, and to locate the anomaly source and affected area.

[0093] In this embodiment, it should be noted that: the multimodal fusion module 301 realizes the efficient fusion and representation of multi-source data, the optimized deep learning model is constructed through the lightweight modeling module 302, and finally the anomaly recognition module 303 completes real-time threat detection and positioning.

[0094] In addition, it should be noted that tensor fusion uses Tucker decomposition, the core tensor dimensions are set to [8,8,8], and the total dimension after feature concatenation is 64. After pruning, the number of model parameters is reduced from 4.2M to 1.1M, and 8-bit quantization reduces the model size from 16.8MB to 4.2MB. The inference latency on a Raspberry Pi 4B is less than 50ms.

[0095] The specific formula in the abnormality identification module 303 is:

[0096] ①Multi-dimensional anomaly scoring function: S(x) = α·f DDoS (x)+β·f Virus (x)+γ·f BW_Abuse (x), where x is the output multi-dimensional fusion feature vector, f DDoS is the output of the DDoS attack detection sub-model, f Virus is the output of the virus transmission detection sub-model, f BW_Abuse Output of the bandwidth abuse detection sub-model, α, β, γ: are trainable weights (default α = 0.5, β = 0.3, γ = 0.2);

[0097] Judgment rules: T is the dynamic threshold (default 0.85);

[0098] ② Abnormal source location:

[0099] Tracing back based on attention weight: Among them, Q i is the query vector of the target IP, K j / V j is the key-value pair vector of the source IP, and Attention is the multi-head attention weight matrix;

[0100] Assessment of affected areas: Among them, N(i) is the topological neighbor set of the abnormal IP, and Degree(k) is the connectivity of node k.

[0101] In the present invention, the fault prediction and health management assessment unit 400 includes an interpretable AI module 401, a hybrid modeling module 402, and a health assessment module 403, wherein: the interpretable AI module 401 is used to use the SHAP and LIME algorithms to provide a visual and understandable feature importance explanation for the fault prediction results and health assessment conclusions; the hybrid modeling module 402 is used to combine the time series prediction model based on LSTM and Transformer with the physical model based on the network topology aging equation to make high-precision predictions of network equipment failures and performance degradations; the specific operations are as follows: C1: The network topology aging equation The LSTM loss function is added as a regularization term, where R is the device reliability and S is the stress factor. C2: Time series data is input into the Transformer encoder, and physical state variables are input into the physical equation solver. C3: The output weights of the data model and the physical model are dynamically adjusted through the gating mechanism:

[0102] y final =g·y data +(1-g)·y physics ,g=σ(W[h data ||h physics ])

[0103] Among them, y data is the LSTM hidden state, h physics The output of the physical simulation is provided by C4, which uses a Kalman filter to modify the physical simulation parameters in real time to minimize prediction errors. Health Assessment Module 403 is used to construct a network health scoring system, integrating indicators such as device health, link stability, and security threat level to generate an overall network health status report, which is then visualized in the form of heat maps and topology diagrams.

[0104] In this embodiment, it should be noted that the explainable AI module 401 provides a transparent decision-making basis, realizes dual prediction of data-driven and physical laws through the hybrid modeling module 402, and finally generates a visual health report by the health assessment module 403.

[0105] In addition, it should be noted that the LSTM model input window is 10 time steps, the aging coefficient α in the physical equation is 0.02, and the initial weight of the gating mechanism is Health score specific formula: S = w1S device +w2S link +w3S security , where S device is the device health, S link is the link reliability, S security The security threat level is represented by weights w1 = 0.5, w2 = 0.3, and w3 = 0.2. Visualization: The network topology is overlaid with a thermal layer. Red nodes indicate a health score < 60, yellow nodes indicate a score between 60 and 80, and green nodes indicate a score > 80.

[0106] In the present invention, the decision response unit 500 includes a policy generation module 501, an SDN / NFV execution module 502, and a hierarchical response module 503, wherein: the policy generation module 501 is used to optimize the response strategy through a reinforcement learning algorithm based on the results of intelligent anomaly detection and fault prediction, or to quickly match the corresponding disposal plan based on a preset rule engine; the SDN / NFV execution module 502 is used to dynamically adjust the network traffic path and bandwidth allocation with the help of a software-defined network controller, and to deploy the security functions of virtual firewalls and intrusion detection systems on demand using network function virtualization technology; the hierarchical response module 503 is used to classify anomalies and faults into different levels according to their severity, and trigger differentiated response measures such as automatic blocking, traffic limiting, and manual intervention to balance disposal efficiency and risk.

[0107] In this embodiment, it should be noted that the policy generation module 501 intelligently formulates a response plan, the SDN / NFV execution module 502 implements dynamic regulation of network resources, and finally the hierarchical response module 503 implements precise differentiated handling.

[0108] In addition, it should be noted that the specific formula of the reward function of the reinforcement learning algorithm based on the DQN algorithm is: Among them, r is the final reward value, t response is the actual response time, t max is the maximum allowed response time threshold, N false_positive The number of false positives.

[0109] Differentiated responses are triggered based on risk level thresholds: Level 1 response (risk level ≥ 80): Traffic is automatically blocked, triggering a work order to notify operations personnel; Level 2 response (50 ≤ risk level < 80): Traffic is redirected to a sandbox environment for threat analysis, with a 50% speed limit; Level 3 response (risk level < 50): Alarm logs are generated for regular review by administrators.

[0110] In the present invention, the model continuous optimization unit 600 includes an online learning module 601, an anti-forgetting module 602, and an active learning module 603, wherein: the online learning module 601 is used to update the model parameters in real time when new data is generated by adopting incremental learning and federated learning technologies; the anti-forgetting module 602 is used to use elastic weight consolidation and knowledge distillation methods to retain historical learning results during the model update process; the active learning module 603 is based on the strategies of uncertainty sampling and density peak sampling to screen the most valuable samples from massive unlabeled data and guide manual labeling.

[0111] In this embodiment, it should be noted that the online learning module 601 realizes the real-time evolution of the model, the anti-forgetting module 602 ensures the continuous accumulation of knowledge, and finally the active learning module 603 optimizes the allocation of annotation resources.

[0112] In addition, it should be noted that federated learning uses the FedAvg algorithm, selects 5 edge nodes to participate in aggregation in each round, local training epoch = 3, and learning rate = 0.01.

[0113] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0114] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. The network traffic anomaly intelligent monitoring system integrating artificial intelligence is characterized by: The system comprises a data acquisition unit (100), a feature extraction and processing unit (200), an intelligent anomaly detection unit (300), a fault prediction and health management assessment unit (400), a decision response unit (500), and a model continuous optimization unit (600), wherein: The data collection unit (100) is responsible for collecting original multi-source traffic data from the network; The feature extraction and processing unit (200) is used to extract key features for anomaly detection and perform standardization, dimensionality reduction and denoising processing; The intelligent anomaly detection unit (300) is used to identify abnormal behaviors and potential threats in traffic through multimodal intelligent fusion and lightweight adaptive modeling; The fault prediction and health management assessment unit (400) is based on explainable AI technology and hybrid modeling methods to achieve high-precision fault prediction and health status visual assessment, and output explainable decision-making basis; The decision response unit (500) generates a dynamic response strategy based on reinforcement learning or a rule engine, and implements automated closed-loop processing through SDN / NFV technology; The model continuous optimization unit (600) is used to continuously update model parameters through online learning and feedback mechanism to avoid catastrophic forgetting.

2. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 1 is characterized in that: The data collection unit (100) comprises a traffic collection module (101), an edge pre-processing module (102), and a dynamic scheduling module (103), wherein: The flow collection module (101) is used to collect multi-source data such as original flow data packets, flow statistics and log files from the network by means of switch port mirroring NetFlow / sFlow / SNMP protocols; The edge pre-processing module (102) is used to perform preliminary filtering and compression on the collected data at the network edge node to eliminate duplicate data; The dynamic scheduling module (103) dynamically adjusts the data collection frequency and sampling depth based on network load and device performance indicators.

3. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 1 is characterized in that: The feature extraction and processing unit (200) comprises a feature extraction module (201), a standardization module (202), and a dimensionality reduction and denoising module (203), wherein: The feature extraction module (201) is used to extract key information of time series features, statistical features and protocol features from the original traffic data by using sliding window and Fourier transform technology; The standardization module (202) is used to normalize the extracted features, unify the data scale, and eliminate the dimension effect; The dimensionality reduction and denoising module (203) is used to reduce the data dimension by using principal component analysis and t-SNE algorithms, remove redundant information, and filter the noise data by using wavelet transform and median filtering techniques.

4. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 1 is characterized in that: The intelligent anomaly detection unit (300) includes a multimodal fusion module (301), a lightweight modeling module (302), and an anomaly identification module (303), wherein: The multimodal fusion module (301) integrates network traffic characteristics, device status data and user behavior data, and forms a multi-dimensional data representation through tensor fusion and feature splicing technology; The lightweight modeling module (302) is based on the lightweight neural network architecture of MobileNet and TinyML, combined with model pruning and quantization technology to build an efficient anomaly detection model; The anomaly identification module (303) uses the trained model to perform real-time analysis on the fused data, identifies abnormal behaviors such as DDoS attacks, virus propagation, and bandwidth abuse, and locates the anomaly source and the affected range.

5. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 4 is characterized in that: The multimodal fusion module (301) integrates network traffic features, device status data, and user behavior data, and forms a multi-dimensional data representation through the technology of tensor fusion and feature splicing. The specific operations are as follows: A1: Time series normalization: network traffic characteristics Perform Z-score standardization to generate the first eigenvector in, and are the mean and standard deviation of the dimension respectively, ∈ is the smoothing parameter to prevent the denominator from being zero; A2: Sliding window statistics: device status data Apply a sliding window of size w to generate the second eigenvector F2[t]=[mean(X device [t-w:t]),std(X device [t-w:t]),…] Among them, mean and std are the mean and standard deviation statistics within the window respectively, and D3 is the statistical feature latitude; A3: Weighted fusion of attention mechanism: Calculate weight α through multi-head attention mechanism t , F1 and F2 are combined to obtain a joint representation Among them, Q, K, V are linear transformation functions, and Softmax is a normalization function; A4: Graph Embedding Algorithm: Map user behavior data into a graph structure G = (V, E) and generate the third eigenvector through a graph neural network Among them, N(v) is the neighbor set of node v, c v,u is a normalization constant, W is a learnable weight matrix, and σ is an activation function; A5: Tensor concatenation and aggregation: The joint representation H and the third eigenvector F3 are combined through tensor product operations to generate a multi-dimensional data representation. in, represents the Kronecker product, D6 = D4 × D5.

6. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 4 is characterized in that: The lightweight modeling module (302) is based on the lightweight neural network architecture of MobileNet and TinyML, combined with model pruning and quantization technology to build an efficient anomaly detection model. The specific operations are as follows: B1: Reconstruct the MobileNet backbone network using depthwise separable convolution, reducing the number of parameters by more than 70%; B2: Iterative weight pruning based on gradient magnitude, which compresses the model size to 30% of its original size while retaining key connections; B3: Implement 8-bit fixed-point quantization on model weights and 4-bit dynamic quantization on activation values ​​to balance accuracy and inference speed; B4: Generate a lightweight inference engine that can run on ARM Cortex-M series chips through the TFLite conversion tool.

7. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 1 is characterized in that: The fault prediction and health management assessment unit (400) comprises an explainable AI module (401), a hybrid modeling module (402), and a health assessment module (403), wherein: The explainable AI module (401) is used to use SHAP and LIME algorithms to provide visual and understandable feature importance explanations for fault prediction results and health assessment conclusions; The hybrid modeling module (402) is used to combine the time series prediction model based on LSTM and Transformer with the physical model based on the network topology aging equation to make high-precision predictions on network equipment failures and performance degradation; The health assessment module (403) is used to construct a network health scoring system, integrate the indicators of device health, link stability, and security threat level, generate a network overall health status report, and visualize it in the form of a heat map and a topology map.

8. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 7 is characterized in that: The hybrid modeling module (402) combines the time series prediction model based on LSTM and Transformer with the physical model based on physical equations to perform high-precision prediction of network equipment failures and performance degradation. The specific operations are as follows: C1: Network topology aging equation As a regularization term, the LSTM loss function is added, where R is the device reliability and S is the stress factor; C2: Time series data is input into the Transformer encoder, and physical state variables are input into the physical equation solver; C3: Dynamically adjust the output weights of the data model and the physical model through a gating mechanism: y final =g·y data +(1-g)·y physics ,g=σ(W[h data ||h physics ]) Among them, y data is the LSTM hidden state, h physics Output for physical simulation; C4: Based on the Kalman filter, the physical simulation parameters are corrected in real time to minimize the prediction error.

9. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 7 is characterized in that: The decision response unit (500) includes a policy generation module (501), an SDN / NFV execution module (502), and a hierarchical response module (503), wherein: The strategy generation module (501) is used to optimize the response strategy through a reinforcement learning algorithm based on the results of intelligent anomaly detection and fault prediction, or quickly match the corresponding disposal plan based on a preset rule engine; The SDN / NFV execution module (502) is used to dynamically adjust network traffic paths and bandwidth allocation with the help of a software-defined network controller, and to deploy security functions of virtual firewalls and intrusion detection systems on demand using network function virtualization technology; The hierarchical response module (503) is used to classify abnormalities and faults into different levels according to their severity, and trigger differentiated response measures such as automatic blocking, flow limiting, and manual intervention, so as to balance the handling efficiency and risk.

10. The network traffic anomaly intelligent monitoring system integrating artificial intelligence according to claim 1 is characterized in that: The model continuous optimization unit (600) includes an online learning module (601), an anti-forgetting module (602), and an active learning module (603), wherein: The online learning module (601) is used to update model parameters in real time when new data is generated by adopting incremental learning and federated learning techniques; The anti-forgetting module (602) is used to retain historical learning results during the model update process by using elastic weight consolidation and knowledge distillation methods; The active learning module (603) selects the most valuable samples from massive unlabeled data based on the strategies of uncertainty sampling and density peak sampling, and guides manual labeling.

Images