A computer network data traffic monitoring system and method

Abstract

The application relates to the technical field of network monitoring, in particular to a computer network data flow monitoring system and method, which comprises a data stream collection module, a protocol layer analysis module, a time sequence feature extraction module, a loss compensation reconstruction module and a monitoring result output module.In the application, protocol fields are extracted and change time points are marked in data stream collection, a continuous difference track is formed, a cross-layer synchronization index is generated by calculating the interval and the sequence of adjacent fields, the cross-layer relationship is quantified in a dynamic process, a quantile regression is adopted in feature processing to unify the numerical interval, the comparability under different time scales is ensured, an abnormal section can be quickly identified when the cross-layer synchronization is broken, potential patterns are deduced by combining the feature values before and after the anomaly, loss information is reconstructed in a probabilistic manner, the result has both anomaly recognition accuracy and flow monitoring integrity, and the network management efficiency and safety are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network monitoring, in particular to a computer network data flow monitoring system and method. BACKGROUND

[0002] The technical field of network monitoring involves identifying, collecting, counting and analyzing data flow transmitted in a computer network. The core tasks of this technical field include capturing data packets to extract source and destination address information, classifying data streams to distinguish the flow characteristics of different communication protocols, recording traffic to understand the use of network resources, and identifying abnormal traffic for security management and troubleshooting. This field as a whole covers the systematic technical basis of network data acquisition, data feature extraction, and traffic statistical analysis.

[0003] Among them, the traditional computer network data flow monitoring system refers to deploying special collection equipment at network nodes to capture transmitted data packets, using protocol analysis rules to analyze the captured data packets layer by layer to obtain the basic attributes of communication, combining pre-set classification rules to distinguish and count different types of network traffic, and relying on storage recording means to save traffic information for subsequent analysis.

[0004] Traditional flow monitoring relies on data packet capture and static attribute analysis, which is difficult to reveal the dynamic evolution between fields in the case of rapid communication changes, resulting in a lack of cross-layer dependency, making it difficult to accurately perceive when the anomaly is in a short period or the cross-layer synchronization is destroyed. The storage information is biased towards static recording and lacks dynamic sequence supplementation, making the monitoring result prone to information gaps, causing abnormal positioning delay and data segment loss, and more likely to occur in complex scenarios. Flow anomalies are covered up or missed. SUMMARY

[0005] In order to solve the technical problem that traditional flow monitoring relies on data packet capture and static attribute analysis, which is difficult to reveal the dynamic evolution between fields in the case of rapid communication changes, resulting in a lack of cross-layer dependency, making it difficult to accurately perceive when the anomaly is in a short period or the cross-layer synchronization is destroyed. The storage information is biased towards static recording and lacks dynamic sequence supplementation, making the monitoring result prone to information gaps, causing abnormal positioning delay and data segment loss, and more likely to occur in complex scenarios. Flow anomalies are covered up or missed, the present application embodiment provides a computer network data flow monitoring system and method. The technical solution is as follows:

[0006] On the one hand, a computer network data flow monitoring system is provided, which comprises:

[0007] A data stream acquisition module acquires real-time data packet flow through a network interface, acquires protocol layer field and timestamp information, detects field differences between consecutive sampling points, records change time points, generates a flow field change record table, and delivers the table to a protocol layer analysis module;

[0008] A protocol layer analysis module receives the flow field change record table, calculates adjacent protocol layer field change time intervals, detects field change sequence, accumulates a ratio of synchronization state number to total comparison number, generates a protocol synchronization metric value, and delivers the value to a time sequence feature extraction module;

[0009] A time sequence feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps to a uniform numerical interval through quantile regression algorithm, detects cross-layer synchronization continuity recognition abnormal sections, records feature values before and after the abnormal sections, generates a flow anomaly monitoring result, and delivers the result to a loss compensation reconstruction module;

[0010] A loss compensation reconstruction module receives the flow anomaly monitoring result, determines a calculation interval according to the feature values before and after the abnormal sections, calculates an intersection with a protocol standard field, evaluates flow mode consistency using a Markov chain Monte Carlo algorithm, generates complete flow monitoring data, and delivers the data to a monitoring result output module.

[0011] As a further scheme of the application, the flow field change record table includes change type, time distribution, and influence range, the protocol synchronization metric value includes interval distribution, sequence consistency, and synchronization ratio, the flow anomaly monitoring result includes abnormal section position, continuity index, and offset degree, and the complete flow monitoring data includes calculation interval range, field intersection result, and consistency evaluation value.

[0012] As a further scheme of the application, the data stream acquisition module includes:

[0013] A data stream receiving submodule acquires real-time data packet flow through a network interface, analyzes data packet structure and extracts protocol layer field content, matches and stores fields and data packet timestamps one by one, calls a buffer area to sequentially write field sequences and mark sampling positions, and generates field time sequence values;

[0014] A field difference detection submodule, based on the field time sequence values, calls field values and timestamp content in adjacent sampling points, compares adjacent field values one by one and detects difference amplitude, calculates interval duration according to field difference results and adjacent timestamps, and obtains a field difference time point set;

[0015] The change record generation sub-module generates a flow field change record table by calling field value change positions and corresponding time information according to the field difference time point set, linearly arranging the field value change positions and the corresponding time information in chronological order, establishing an index table, and adding a change amplitude mark to multiple records in the index table.

[0016] As a further scheme of the present application, the protocol layer analysis module comprises:

[0017] The field sequence acquisition sub-module analyzes the flow field change record table, detects field changes in a transmission link, extracts time labels and change marks, arranges and fits an event sequence, calls the event sequence to integrate changes of fields at different levels, and obtains a protocol layer field change time sequence.

[0018] The protocol field calculation sub-module performs a difference operation on time labels of adjacent protocol layer fields based on the protocol layer field change time sequence, establishes a time interval matrix, calls interval values to perform sequential comparison and record sorting, and generates a field change order.

[0019] The synchronization metric generation sub-module calls the field change order and the time interval matrix, compares the order of protocol layer fields and the time interval values, calculates a synchronization state cumulative number and performs a ratio operation on the total comparison number, and generates a protocol synchronization metric value.

[0020] As a further scheme of the present application, the time sequence feature extraction module comprises:

[0021] The time sequence data acquisition sub-module obtains the protocol synchronization metric value as input data, sets a fixed-length sliding time window for segmentation, arranges each segment of the synchronization metric value in chronological order into a continuous sequence, and generates a time sequence feature value.

[0022] The quantile mapping sub-module extracts a median of each time segment data vector as a distribution position parameter based on the time sequence feature value, inputs the parameter into a quantile regression algorithm, and performs a difference comparison with a preset quantile reference value, calculates a normalized mapping according to a difference comparison result, and arranges the normalized mapping to obtain a normalized interval sequence.

[0023] The cross-layer anomaly detection sub-module calculates a difference value between adjacent time segments according to the normalized interval sequence, compares the difference value with a preset difference threshold, determines a difference value exceeding the threshold as an abnormal interval and records a mark index, simultaneously extracts adjacent numerical features before and after the abnormal interval, and generates a flow anomaly monitoring result.

[0024] As a further scheme of the present application, the defect compensation reconstruction module comprises:

[0025] The feature section extrapolation submodule obtains the abnormal section data in the traffic anomaly monitoring result, performs differential calculation on the feature values before and after the abnormal section, and interpolates and completes the missing part, calls the boundary point to determine the extension range, and generates the extrapolation interval range value;

[0026] The field intersection calculation submodule calls the protocol standard field set based on the extrapolation interval range value, compares the interval range data field with the protocol standard field in the same index dimension, establishes a field coincidence record according to the value overlap, integrates the intersection coefficient set, and obtains the protocol field intersection coefficient;

[0027] The traffic pattern evaluation submodule calculates the transition probability distribution sequence by using the Markov chain Monte Carlo algorithm according to the protocol field intersection coefficient, performs random sampling and records the results, extracts the stable trend, and calculates the consistency degree of the initial traffic pattern corresponding to the real-time data packet traffic, and obtains the complete traffic monitoring data.

[0028] As a further scheme of the application, the extrapolation interval range value is an interval data set obtained based on the differential calculation of the feature values before and after the abnormal section, the interpolation completion of the missing part, and the extension of the boundary point;

[0029] The protocol field intersection coefficient is a set of field coincidence records established according to the value overlap after the comparison of the extrapolation interval range value and the protocol standard field set in the same index dimension.

[0030] As a further scheme of the application, the monitoring result output module receives the complete traffic monitoring data, compares the difference degree of the abnormal area and the normal mode based on the original data statistics, analyzes the protocol boundary position information, extracts the traffic feature data, arranges the protocol boundary and the feature according to time, and generates a structured monitoring result;

[0031] The structured monitoring result includes the difference degree, the boundary position information, and the time feature.

[0032] As a further scheme of the application, the monitoring result output module includes:

[0033] The sequence difference measurement submodule obtains the complete traffic monitoring data, arranges the data packets in the time sequence, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal mode distribution value based on the original data statistics, and generates the difference measurement value;

[0034] The protocol boundary positioning submodule analyzes the data packets arranged in the time sequence based on the difference measurement value, detects the field length change rule and numbers to establish a time index, compares the continuous field interval with the division reference interval value, and obtains a protocol boundary index table;

[0035] The feature sequence construction submodule extracts boundary section traffic feature numerical values according to the protocol boundary index table, pairs and arranges the feature numerical values with time stamps, and integrates the feature numerical values into a unified structure according to section order, to obtain a structured monitoring result.

[0036] In another aspect, a computer network data traffic monitoring method is executed based on the above computer network data traffic monitoring system, and includes the following steps:

[0037] S1: Collect real-time data packet traffic through a network interface, obtain protocol layer field information and timestamp data, detect protocol field changes between adjacent sampling points, record field change time and change amplitude, and generate a traffic field change record table;

[0038] S2: Calculate protocol layer field change time difference values based on the traffic field change record table, sort and analyze the field change sequence, detect the field change sequence, accumulate the ratio of the number of synchronization states to the total number of comparisons, and generate a protocol synchronization metric value;

[0039] S3: Call the protocol synchronization metric value to set a time window length parameter, standardize the numerical values to a unified interval through quantile regression algorithm mapping, detect cross-protocol layer synchronization continuity breakpoints, identify abnormal period start and end positions, record abnormal section boundary feature values, and generate a traffic anomaly monitoring result;

[0040] S4: Determine the data reconstruction range according to the abnormal section boundary feature values in the traffic anomaly monitoring result, calculate the overlap between the reconstruction interval and the standard protocol field, input the traffic mode parameters into the Markov chain Monte Carlo algorithm for consistency evaluation, and generate complete traffic monitoring data;

[0041] S5: Receive the complete traffic monitoring data, compare the difference between the abnormal area and the normal mode, analyze the protocol boundary position information, extract the traffic feature data, arrange the protocol boundaries and features according to time, and generate a structured monitoring result.

[0042] The technical scheme provided by the embodiment of the application has at least the following beneficial effects:

[0043] In data stream collection, protocol fields are extracted and change time points are marked, a continuous difference trajectory is formed, a cross-layer synchronization index is generated by calculating the interval and sequence of adjacent fields, the cross-layer relationship is quantified in a dynamic process, a quantile regression is used in feature processing to unify the numerical value interval, ensuring comparability at different time scales, and when cross-layer synchronization is broken, an abnormal section can be quickly identified, and potential patterns are deduced by combining feature values before and after the abnormal section, so that missing information is reconstructed in a probabilistic manner, and the result has both abnormal identification accuracy and traffic monitoring integrity. BRIEF DESCRIPTION OF DRAWINGS

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a system schematic diagram of the present invention;

[0046] Figure 2 This is a schematic diagram of the system framework of the present invention;

[0047] Figure 3 This is a flowchart of the data stream acquisition module in this invention;

[0048] Figure 4 This is a flowchart of the protocol layer parsing module in this invention;

[0049] Figure 5 This is a flowchart of the temporal feature extraction module in this invention;

[0050] Figure 6 This is a flowchart of the defect compensation and reconstruction module in this invention;

[0051] Figure 7 This is a flowchart of the monitoring result output module in this invention;

[0052] Figure 8 This is a flowchart of the method of the present invention. Detailed Implementation

[0053] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0054] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0055] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0056] In the embodiments of the present application, sometimes the subscript such as W1 may be written in the form of non-subscript such as W1, and the meanings expressed thereby are consistent when the difference is not emphasized.

[0057] In order to make the technical problems, technical solutions and advantages to be solved by the present application more clear, the following will be described in detail in combination with the drawings and specific embodiments.

[0058] The embodiments of the present application provide a computer network data flow monitoring system, as shown in the computer network data flow monitoring system schematic diagram, the system comprises: Figures 1-2 The computer network data flow monitoring system schematic diagram, the system comprises:

[0059] The data flow acquisition module acquires real-time data packet flow through a network interface, acquires protocol layer field and timestamp information, detects field difference between continuous sampling points, records change time points, generates a flow field change record table, and delivers the flow field change record table to the protocol layer analysis module.

[0060] The protocol layer analysis module receives the flow field change record table, calculates adjacent protocol layer field change time interval, detects field change sequence, accumulates the ratio of the number of synchronization states to the total number of comparisons, generates a protocol synchronization metric value, and delivers the protocol synchronization metric value to the time sequence feature extraction module.

[0061] The time sequence feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps to a unified numerical interval through a quantile regression algorithm, detects cross-layer synchronization continuity to identify abnormal sections, records feature values before and after the abnormal sections, generates a flow anomaly monitoring result, and delivers the flow anomaly monitoring result to the loss compensation reconstruction module.

[0062] The loss compensation reconstruction module receives the flow anomaly monitoring result, determines a calculation interval according to the feature values before and after the abnormal sections, calculates an intersection with a protocol standard field, evaluates flow pattern consistency using a Markov chain Monte Carlo algorithm, generates complete flow monitoring data, and delivers the complete flow monitoring data to the monitoring result output module.

[0063] The monitoring result output module receives the complete flow monitoring data, compares the difference degree of the abnormal area and the normal mode based on the original data statistics, analyzes protocol boundary position information, extracts flow feature data, arranges the protocol boundaries and features according to time, and generates a structured monitoring result.

[0064] The flow field change record table includes change type, time distribution and influence range, the protocol synchronization metric value includes interval distribution, sequence consistency and synchronization ratio, the flow anomaly monitoring result includes abnormal section position, continuity index and offset degree, the complete flow monitoring data includes calculation interval range, field intersection result and consistency evaluation value, and the structured monitoring result includes difference degree, boundary position information and time feature.

[0065] In particular, as shown in Figure 2 、 3 , the data stream acquisition module includes:

[0066] a data stream receiving submodule, which acquires real-time data packet flow through a network interface, parses the data packet structure and extracts the protocol layer field content, matches and stores the fields and the timestamps of the data packets piece by piece, calls the cache area to sequentially write the field sequence and mark the sampling positions, and generates the field time sequence values;

[0067] The data stream receiving submodule acquires real-time data packet flow through the physical network interface eth0 located at the mirror port of the network switch, specifically, continuously listens to and copies the data packet copies passing through the port, for the first data packet received, the system records its arrival timestamp as 1789532401.153256 seconds, parses the Ethernet frame header, identifies that the type field is 0x0800, indicating that the upper layer is the IP protocol, then parses the IP protocol header, extracts the source IP address as "192.168.1.50", the destination IP address as "210.45.118.90", the protocol field as 6, indicating that the transport layer is the TCP protocol, continues to parse the TCP protocol header, extracts the source port number as 58010, the destination port number as 443, and the TCP sequence number 2534910731, and simultaneously calculates the data packet length as 60 bytes, then matches the extracted field content, "192.168.1.50", "210.45.118.90", 58010, 443, 2534910731, and 60, with the timestamp 1789532401.153256 of the data packet, constructs a structured record {timestamp: 1789532401.153256, source IP: "192.168.1.50", destination IP: "210.45.118.90", source port: 58010, destination port: 443, sequence number: 2534910731, length: 60}, which is sent to a ring buffer area with a fixed size of 4096 records, and is sequentially written to the index position 0. Since the sampling interval of the system is set to 100, that is, every 99 data packets select the 100th as the sampling point, therefore the sampling position of this record is marked as 0, and the subsequent data packets will be sequentially written to positions 1, 2, 3, etc., until the 100th data packet arrives, with a timestamp of 1789532401.298871 and a length of 1514 bytes, the record of this data packet is written to the index position 99 of the buffer area and is marked as the sampling position 1. The process continues to fill the buffer area, forming the field sequence fragment shown in Table 1. Finally, the record set marked with the sampling position in the buffer area is extracted to generate the field time sequence values.

[0068] Table 1: Field sequence fragment example table

[0069]

[0070] As shown in Table 1, which lists part of the packet field information captured and parsed within a period of time, including the timestamp accurate to microseconds, the IP addresses and ports of the communication parties, and the payload length of the packet.

[0071] The field difference detection submodule, based on the field time series values, calls the field values and timestamp contents in adjacent sampling points, compares the adjacent field values item by item and detects the difference amplitude, calculates the interval duration according to the field difference result and the adjacent timestamps, and obtains the field difference time point set;

[0072] The field difference detection submodule, based on the record set of the marked sampling positions in the cache area, first calls the first pair of adjacent sampling points from the set, that is, the records of sampling position 0 and sampling position 1. The content of record 0 is {timestamp: 1789532401.153256, source IP: "192.168.1.50", length: 60}, and the content of record 1 is {timestamp: 1789532401.298871, source IP: "210.45.118.90", length: 1514}. Then, the field values in the two records are compared item by item. The source IP address field is compared, and it is found that "192.168.1.50" is not the same as "210.45.118.90", which is determined to have a difference. The length field is compared, and the absolute difference between the two values is calculated, that is, the difference amplitude is bytes. Then, according to the difference results of the two fields, the timestamps 1789532401.153256 and 1789532401.298871 of the two records are extracted, and the interval duration between them is calculated. The calculation process is seconds. Since at least one field is detected to have a difference, the system integrates the timestamp 1789532401.298871 of the second sampling point, the field names "source IP" and "length" that have a difference, the difference amplitude 1454, and the interval duration 0.145615 seconds into a piece of difference information. Subsequently, the next pair of adjacent sampling points, that is, the records of sampling position 1 and sampling position 2, are called, and the above comparison and calculation process is repeated until all adjacent sampling point pairs are traversed. Finally, the recorded difference information is summarized to obtain the field difference time point set.

[0073] The change record generation submodule, according to the field difference time point set, calls the field value change positions and corresponding time information, linearly arranges them in chronological order and establishes an index table, adds a change amplitude mark to the multiple records in the index table, and generates a flow field change record table;

[0074] The change record generation submodule, according to the set of {time point: 1789532401.298871, field: "length", amplitude: 1454}, {time point: 1789532401.601234, field: "length", amplitude: 1206}, {time point: 1789532401.456789, field: "source IP", amplitude: N / A}, first calls the field value change position in each piece of difference information, that is, the sampling point index where the change occurs and the corresponding time information, that is, the timestamp of the sampling point, then linearly arranges the difference information in strict accordance with the timestamp value from small to large, the order after the arrangement is the record of time point 1789532401.298871, followed by the record of 1789532401.456789, and finally the record of 1789532401.601234, and an index table starting from 0 is established for this ordered list, wherein index 0 corresponds to the first change record, index 1 corresponds to the second, and so on. Next, the index table is attached to each record involving value change. The amplitude mark is determined by the interval set in advance, which refers to the historical traffic data of the network in the normal running state within a week. Specifically, the mean and standard deviation of the packet length difference value between adjacent sampling points are calculated, the mean is 150 bytes, and the standard deviation is 450 bytes. The threshold of "high" change amplitude is set to the mean plus twice the standard deviation, that is bytes, and the interval of "lower" change amplitude is set to less than the mean, that is, 0 to 150 bytes. For the record of index 0, the change amplitude is 1454 bytes, the comparison is performed, and the determination result is true, so the "high" amplitude mark is attached. For the record of index 2, the change amplitude is 1206 bytes, the comparison is performed, and the determination result is true, so the "high" amplitude mark is also attached. After the marking is completed, the final flow field change record table is generated.

[0075] Specifically, as shown in Figure 2 , 4 , the protocol layer analysis module includes:

[0076] The field sequence acquisition submodule analyzes the flow field change record table, detects the change of the field in the transmission link, extracts the time label and change identifier, arranges and fits the event sequence, calls the event sequence to integrate the changes of fields at different levels, and obtains the protocol layer field change time sequence.

[0077] The field sequence acquisition submodule first parses the flow field change record table item by item. The table contains items such as {time point: 1789532401.298871, field: "length", amplitude mark: "high"} and {time point: 1789532401.456789, field: "source IP", amplitude mark: N / A}. The system detects that the fields that change in the transmission link are "length" and "source IP". Then, the time tag 1789532401.298871 seconds and the field name "length" as a change identifier are extracted from the first record, and the time tag 1789532401.456789 seconds and the change identifier "source IP" are extracted from the second record. The subsequent records are processed in this way. The extracted time tags and change identifiers are then paired to form an event tuple sequence, such as (1789532401.298871, "length"), (1789532401.456789, "source IP"), and (1789532401.601234, "length"). The event tuples are arranged in strict order from small to large according to the numerical value of the time tag to fit the initial event sequence. Then, the system calls the event sequence, integrates the changes of fields at different levels according to the preset field-protocol layer mapping rule. The rule maps fields such as "source IP", "destination IP", and "length" to the network layer and maps fields such as "source port" and "destination port" to the transport layer. For example, for the event (1789532401.456789, "source IP"), the system determines that "source IP" belongs to the network layer according to the mapping rule, and integrates the event into (1789532401.456789, "source IP", "network layer"). For another fictitious event (1789532401.554321, "destination port"), it is integrated into (1789532401.554321, "destination port", "transport layer"). Through the mapping and integration operation on each event in the initial event sequence, the protocol layer field change time sequence is obtained.

[0078] The protocol field calculation submodule performs difference operation on the time tags of adjacent protocol layer fields based on the protocol layer field change time sequence, establishes a time interval matrix, calls the interval value for sequential comparison and records the order, and generates the field change order.

[0079] Protocol field calculation submodule, based on sequence event A is (1789532401.456789, "source IP", "network layer"), followed by event B is (1789532401.554321, "destination port", "transport layer"), followed by event C is (1789532401.601234, "source IP", "network layer"), the system first difference operation of time tag of adjacent protocol layer field change event, calculate the time interval between event B and event A is second, which represents the time from the network layer "source IP" field change to the transport layer "destination port" field change, similarly, calculate the time interval between event C and event B is second, next, according to the operation result, establish a time interval matrix, as shown in table 2, the row and column of the matrix represent different protocol layers, and the element in the matrix stores the specific time interval value list from the protocol layer change represented by the row to the protocol layer change represented by the column, for example, 0.097532 second is stored in the cell of "network layer" row and "transport layer" column intersection in the matrix, 0.046913 second is stored in the cell of "transport layer" row and "network layer" column, this process will continue to traverse the entire time sequence, and fill in the matrix, then, the system calls the interval value in the matrix for sequential comparison, for each pair of adjacent events, such as event A and event B, the system records the change order, that is, "network layer" before "transport layer" change, and records this order pair ("network layer", "transport layer"), by processing the entire event sequence in turn, the field change order is generated.

[0080] Table 2: protocol layer change time interval matrix example table

[0081]

[0082] As shown in table 2, the matrix records the continuous time interval of field change between different protocol layers monitored, for example, it takes 0.097532 second from the network layer field change to the next transport layer field change.

[0083] Synchronization metric generation submodule, call field change order and time interval matrix, compare the order of protocol layer field and time interval value, calculate the number of synchronization state accumulation and rate operation with the total number of comparison, generate protocol synchronization metric value;

[0084] The synchronization measurement generation submodule calls the field change order, such as the sequence [("Network Layer", "Transport Layer"), ("Transport Layer", "Network Layer")], and a time interval matrix containing specific interval values. The system first sets a time interval threshold for synchronization determination. This threshold is set with reference to the original interval data recorded in the time interval matrix. The specific calculation process is as follows: extract the interval values ​​from the matrix, such as 0.097532 seconds, 0.046913 seconds, and 0.144445 seconds, and calculate the average value. The time interval is calculated to be seconds, and its standard deviation is 0.040251 seconds. The synchronization time threshold is then set accordingly. Set to the mean plus 0.5 times the standard deviation, i.e. Next, the system compares the order of the protocol layer fields with the time interval values, iterating through each sequence pair in the field change order. For the first sequence pair ("network layer", "transport layer"), the system retrieves the corresponding first interval value of 0.097532 seconds from the time interval matrix and performs a judgment. If the result is true, this state is determined to be a "synchronization state," and the synchronization state count counter changes from 0 to 1. Then, the second sequence pair ("transport layer," "network layer") is processed, the corresponding interval value of 0.046913 seconds is retrieved, and a judgment is performed. The result is true, which is also considered a "synchronization state". The synchronization state count counter changes from 1 to 2. After traversing the sequence pairs, the final synchronization state count of 2 is compared with the total number of comparisons of 2. The calculation process is as follows: Generate protocol synchronization metrics.

[0085] Specifically, such as Figure 2 , 5 As shown, the time-series feature extraction module includes:

[0086] The time-series data acquisition submodule obtains the protocol synchronization metric value as input data, sets a fixed-length sliding time window to segment the data, arranges each segment of synchronization metric value into a continuous sequence according to time order, and generates time-series feature values.

[0087] The time series data collection submodule calls the protocol synchronization metric value, which is a time-varying scalar, and the system continuously receives the metric value, for example, the sequence received in the next ten time units is [1.0, 0.8, 0.9, 0.2, 0.3, 0.85, 0.95, 1.0, 0.7, 0.75], then a sliding time window with a fixed length of 5 is set, and a sliding unit with a step length of 1 is set. The setting of the window length of 5 is based on the fact that the short burst behavior of network traffic shows complete fluctuation characteristics in 5 sampling periods, and the setting of the step length of 1 is to capture the subtlest changes between consecutive windows. Then, the sliding window is applied to the input metric value sequence for segmentation. The first segmentation operation covers the first to fifth data points of the sequence, and extracts the first data segment [1.0, 0.8, 0.9, 0.2, 0.3]. Then, the window slides forward by one step unit, covering the second to sixth data points of the sequence, and extracting the second data segment [0.8, 0.9, 0.2, 0.3, 0.85]. The sliding and segmentation process continues until the window slides to the end of the input sequence. For example, the third data segment is [0.9, 0.2, 0.3, 0.85, 0.95], the fourth data segment is [0.2, 0.3, 0.85, 0.95, 1.0], the fifth data segment is [0.3, 0.85, 0.95, 1.0, 0.7], and the sixth data segment is [0.85, 0.95, 1.0, 0.7, 0.75]. After the segmentation operation is completed, each segmented data segment, that is, the five synchronization metric values in each segment, is strictly arranged in the time order in the original sequence to form a set composed of multiple continuous sequences. This set is the generated time series feature value.

[0088] The quantile mapping submodule extracts the median of each time period data vector as a distribution position parameter based on the time series feature value, inputs the parameter into the quantile regression algorithm, and compares the difference with the preset quantile reference value. The normalized mapping is calculated and arranged according to the difference comparison result to obtain a normalized interval sequence.

[0089] The quantile mapping submodule first extracts the distribution position parameter from each time period data vector, and selects the median as the parameter. For the first vector [1.0, 0.8, 0.9, 0.2, 0.3], the sorted sequence is [0.2, 0.3, 0.8, 0.9, 1.0], and the median is 0.8. For the second vector [0.8, 0.9, 0.2, 0.3, 0.85], the sorted sequence is [0.2, 0.3, 0.8, 0.85, 0.9], and the median is 0.8. For the third vector [0.9, 0.2, 0.3, 0.85, 0.95], the sorted sequence is [0.2, 0.3, 0.85, 0.9, 0.95], and the median is 0.85. For the fourth vector [0.2, 0.3, 0.85, 0.95, 1.0], the sorted sequence is [0.2, 0.3, 0.85, 0.95, 1.0], and the median is 0.85. Then, the calculated median sequence [0.8, 0.8, 0.85, 0.85] is compared with a preset quantile reference value. The reference value is set by referring to the median set of 10,000 data vectors collected during the continuous 24-hour normal operation of the system, and the mean of the set is calculated as 0.9. Then, the difference values are calculated as follows: the first difference value is , the second difference value is , the third difference value is , and the fourth difference value is . Subsequently, the normalized mapping is calculated according to the difference comparison results. The normalized mapping is obtained by dividing the difference value by the maximum absolute difference value 0.5 in the historical data. The first normalized mapping value is , the second normalized mapping value is , the third normalized mapping value is , and the fourth normalized mapping value is . Finally, the normalized mapping values are arranged in the order of their corresponding time periods to obtain the normalized interval sequence.

[0090] The cross-layer anomaly detection submodule calculates the difference values of adjacent time periods according to the normalized interval sequence and compares them with a preset difference threshold. The difference values that exceed the threshold are determined as abnormal intervals and recorded with a marker index. Meanwhile, the adjacent numerical features before and after the abnormal interval are extracted and aggregated to generate the traffic anomaly monitoring result.

[0091] The cross-layer anomaly detection submodule, according to a longer normalized interval sequence, for example, [-0.2, -0.2, -0.1, -0.1, 0.3, -0.8, -0.7, 0.1], first calculates the difference value between adjacent time periods, that is, the absolute difference value of the adjacent two values in the sequence, the first difference value is , the second is , the third is , the fourth is , the fifth is , the sixth is , the seventh is , and the difference value sequence [0.0, 0.1, 0.0, 0.4, 1.1, 0.1, 0.8] is obtained, then the difference value is compared with a preset difference threshold, which is set by referring to the value at the 98th percentile of the difference value arranged from large to small under the original normal operation state, and is set to 0.6, then the difference values are compared one by one, and the difference values greater than the threshold 0.6 are determined as abnormal intervals, the difference value 1.1 is greater than 0.6, which is determined as an abnormal interval, and its index in the difference value sequence is 4, corresponding to the value pair (0.3, -0.8) in the original normalized interval sequence with index 4 and 5, so the index 5 is recorded, the difference value 0.8 is greater than 0.6, which is determined as an abnormal interval, and its index is 6, corresponding to the value pair (-0.7, 0.1) in the original sequence with index 6 and 7, and the index 7 is recorded, at the same time, the system extracts the adjacent numerical features before and after each abnormal interval for aggregation, for the abnormal point with index 5, the value is -0.8, the previous value is 0.3, and the next value is -0.7, for the abnormal point with index 7, the value is 0.1, the previous value is -0.7, and the next value is not recorded due to the end of the sequence, the information is aggregated and arranged to generate the flow anomaly monitoring result shown in Table 3.

[0092] Table 3: Flow anomaly monitoring result table

[0093]

[0094] As shown in Table 3, the table records the detected flow anomaly events, wherein the "abnormal index" refers to the position of the abnormal point in the normalized interval sequence, and the "difference amplitude" quantifies the degree of change of the time point compared with the previous time point.

[0095] Specifically, as shown in Figure 2 , 6 , the defect compensation reconstruction module comprises:

[0096] The feature section extrapolation submodule obtains the abnormal section data in the traffic anomaly monitoring result, performs difference calculation on the feature values before and after the abnormal section, and interpolates and completes the missing part, calls the boundary point to determine the extension range, and generates the extrapolation interval range value;

[0097] The feature section extrapolation submodule obtains the abnormal section data in the traffic anomaly monitoring result table, for example, the abnormal record with index 5, which contains the abnormal time point normalized value -0.8, the previous time point value 0.3, and the next time point value -0.7. The system performs difference calculation on the feature values before and after the abnormal section, calculates the difference value between the abnormal point and the previous point as , and calculates the difference value between the abnormal point and the next point as If there is a missing situation that the next time point value is N / A, for example, the abnormal record with index 7, the system uses the linear interpolation method to complete, which is to call the previous two continuous and non-abnormal normalized values of the abnormal point, assuming that they are -0.7 and 0.1, calculate the slope , and calculate a virtual next point value as to complete the data completion. Subsequently, the system calls the abnormal point and its adjacent points before and after it as boundary points to determine the extension range of the extrapolation. The determination rule of the extension range is to trace back 2 index positions from the index of the abnormal point, and extend 2 index positions backward, to form a complete feature section. For the abnormality with index 5, the original sequence is [...-0.1, 0.3, -0.8, -0.7, 0.1...], and the extension range covers index 3 to index 7, and the value sequence contained is [-0.1, 0.3, -0.8, -0.7, 0.1]. This sequence is regarded as a complete abnormal event value image. Finally, the value sequence extended by the abnormal point is collected to generate the extrapolation interval range value.

[0098] The field intersection calculation submodule calls the protocol standard field set based on the extrapolation interval range value, compares the interval range data field and the protocol standard field in the same index dimension, establishes the field intersection record according to the value overlap, and integrates it into the intersection coefficient set to obtain the protocol field intersection coefficient.

[0099] The field intersection calculation submodule, based on an abnormal event sequence of length 5 [-0.1, 0.3, -0.8, -0.7, 0.1], calls a standard mode from a preset protocol standard field set, which stores a typical normalized interval sequence of known network attacks or abnormal behaviors, as shown in Table 4, then the system compares the captured abnormal event sequence with each standard sequence in the protocol standard field set one by one in the same index dimension, for example, [-0.1, 0.3, -0.8, -0.7, 0.1] is compared with the standard sequence [0.0, 0.4, -0.9, -0.6, 0.2] of "DDoS attack mode A", and during the comparison process, the system establishes a field overlap record according to the value overlap, and the judgment standard for value overlap is a preset overlap tolerance threshold, which is set by calculating the standard deviation of the normalized interval sequence under the original normal flow, and the set value is 0.15, the specific comparison process is to calculate the absolute difference value of the values at the corresponding index positions of the two sequences, the difference value at the first position is , which is less than 0.15, and it is determined that it is overlapped, and the overlap is recorded once, the difference value at the second position is , which is less than 0.15, and the overlap is recorded again, the difference value at the third position is , which is less than 0.15, and the overlap is recorded, the difference value at the fourth position is , which is less than 0.15, and the overlap is recorded, and the difference value at the fifth position is , which is less than 0.15, and the overlap is recorded, after the comparison with "DDoS attack mode A" is completed, the system performs ratio operation on the overlap record number 5 and the sequence total length 5, and obtains the intersection coefficient as , similarly, after comparing it with the "port scanning mode B" sequence, it is assumed that the intersection coefficient is 0.2, and the calculated coefficients are integrated into an intersection coefficient set to obtain the protocol field intersection coefficient.

[0100] Table 4: Protocol standard field mode example table

[0101]

[0102] As shown in Table 4, the table lists some preset traffic patterns and their corresponding ideal normalized interval sequences for comparison.

[0103] The traffic pattern evaluation submodule calculates the transition probability distribution sequence using the Markov chain Monte Carlo algorithm according to the protocol field intersection coefficient, performs random sampling and records the results, extracts the stable trend and calculates the consistency of the initial traffic pattern corresponding to the real-time data packet flow, and obtains the complete traffic monitoring data;

[0104] The flow pattern evaluation submodule first takes the coefficient value as the initial weight of different states according to the protocol field intersection coefficient, such as {DDoS attack mode A: 1.0, port scanning mode B: 0.2, normal browsing mode C: 0.1}, and performs normalization processing to calculate the initial probability distribution, and the total weight is The initial probability of mode A is The initial probability of mode B is The initial probability of mode C is Then, the system performs a random sampling process containing 10000 iterations, in each iteration, the system generates a random number between 0 and 1, and compares the random number with the cumulative probability interval, the first interval is greater than or equal to 0 and less than 0.769, the second interval is greater than or equal to 0.769 and less than 0.923, and the third interval is [0.923, 1.0], if the random number is 0.543, it falls in the first interval, the system records that "DDoS attack mode A" is drawn once, if the random number is 0.810, it records that "port scanning mode B" is drawn once, after completing all 10000 samplings, the system counts the frequency of the recorded results, for example, the frequency of mode A is 7701 times, mode B is 1535 times, and mode C is 764 times, this frequency distribution is regarded as a stable trend, finally, the system extracts the trend with the highest frequency, that is, mode A, and calculates its frequency as the consistency degree of input flow pattern, integrates the result with the corresponding mode name to obtain complete flow monitoring data.

[0105] Specifically, as shown in Figure 2 , 7 , the monitoring result output module includes:

[0106] The sequence difference measurement submodule obtains the complete flow monitoring data, arranges the data packets under the collection time sequence, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal mode distribution value obtained based on the original data, and generates the difference measurement value.

[0107] The sequence difference measurement submodule obtains the complete flow monitoring data, which indicates that the current flow mode is "DDoS attack mode A" and is associated with the original data packet collection time sequence of the abnormal period, the system first arranges the data packets under the time sequence and calculates the field length distribution value from it, specifically, the length field of the data packet in the sequence is extracted to obtain a length value set, for example , , , , , , , } bytes, calculate the mean of the set. bytes, standard deviation is Next, the system calculates a sequence consistency metric, which involves statistically analyzing the diversity of source IP addresses in the sequence and identifying any discrepancies. There are two different source IP addresses, while the destination IP address has only one. The source-to-destination IP ratio is calculated as follows: Then, the system will compare the distribution values ​​calculated in the abnormal area with the preset distribution values ​​in "Normal Browsing Mode C". The distribution values ​​in this normal mode are predetermined by statistical analysis of a week's worth of normal network traffic, and their average field length is [value missing]. bytes, standard deviation is bytes, source-destination IP ratio is Finally, the system generates a difference metric by weighted summation of the normalized differences of the above parameters. The weight coefficients are set based on the parameters' ability to distinguish abnormal patterns, with the length mean and standard deviation both weighted at a certain value. The weight of the IP ratio is set to The normalized difference of the mean length is calculated as The normalized difference of the standard deviation is The normalized difference in IP ratio is The final difference measure is calculated as follows: .

[0108] The protocol boundary location submodule analyzes the data packets arranged in time series based on the difference metric value, detects the field length change pattern and establishes a time index by numbering, calculates the interval of continuous fields and compares it with the division benchmark interval value to obtain the protocol boundary index table.

[0109] Protocol boundary positioning submodule, based on The difference metric is used to analyze data packets arranged in a time series. First, it detects the changing patterns in field lengths within the series, revealing that data packet lengths exhibit a pattern of variation within {... , } bytes and { , The phenomenon of alternating occurrences within these two ranges of bytes will cause the system to classify bytes shorter than a certain length as less than a certain length. Bytes of data packets are marked as type (Small package), length greater than The byte is marked as type (Large packet), and create a time index with a timestamp for each packet in the sequence, for example, packet The timestamp is , type data packets the timestamp of the data packet is , the type is , the timestamp of the data packet is , the type is , the timestamp of the data packet is , the type is , then the system calculates the interval between the continuous fields, i.e. the time interval when the type changes from to and from to , the interval of the first is:

[0110] seconds;

[0111] the interval of the first is:

[0112] seconds;

[0113] and so on, then the calculated interval is compared with a preset dividing reference interval value, which is set by referring to the heartbeat or short polling period of common application layer protocols, and is set as seconds, the system judges that because , the timestamp is marked as a protocol boundary point, because , the timestamp is also marked as a protocol boundary point, by traversing the entire time sequence, a protocol boundary index table recording the timestamps of the protocol boundary points is finally obtained.

[0114] The feature sequence construction submodule extracts the boundary section traffic feature values according to the protocol boundary index table, arranges the feature values and timestamps in pairs, and integrates them into a unified structure according to the section order to obtain a structured monitoring result.

[0115] The feature sequence construction submodule, according to the protocol boundary index table recording the timestamps of the boundary points and , first divides the original data packet sequence into multiple boundary sections according to the boundary points, the first section is the data packet before the timestamp , the second section is the data packet between the timestamps and , then the traffic feature values are extracted from each boundary section, for the first section, assuming that it only contains one data packet with a length of bytes, the average packet length is bytes, and the total traffic is bytes, the average packet length is , and the total traffic is bytes. For the second segment, assuming it contains a packet with a length of bytes, the average packet length is bytes, the total traffic is , and the number of packets is . Then the extracted feature values are paired with the start timestamp of the segment to form a feature vector, such as the feature vector of the first segment {start timestamp: , average packet length: , total traffic: , number of packets: } and the feature vector of the second segment {start timestamp: , average packet length: , total traffic: , number of packets: }. Finally, the feature vectors generated by the boundary segments are integrated in strict chronological order to form a unified structure, as shown in Table 5, and the table is obtained as the structured monitoring result.

[0116] Table 5: Structured monitoring result table

[0117]

[0118] As shown in Table 5, the table converts the original, continuous packet stream into structured data containing statistical features according to protocol boundary segmentation, with each row representing a traffic segment with independent statistical properties.

[0119] Referring to Figure 8 , the computer network data traffic monitoring method is based on the above computer network data traffic monitoring system and includes the following steps:

[0120] S1: Collect real-time packet traffic through a network interface, obtain protocol layer field information and timestamp data, detect protocol field changes between adjacent sampling points, record the field change time and change amplitude, and generate a traffic field change record table;

[0121] S2: Calculate the field change time difference between protocol layers based on the traffic field change record table, sort and analyze the field change sequence, detect the sequence of field changes, accumulate the ratio of the number of synchronization states to the total number of comparisons, and generate a protocol synchronization metric value;

[0122] S3: Call the protocol synchronization metric value to set the time window length parameter, standardize the value to a unified interval through quantile regression algorithm mapping, detect the synchronization continuity breakpoint across protocol layers, identify the start and end positions of abnormal periods, record the boundary feature values before and after the abnormal segment, and generate a traffic anomaly monitoring result;

[0123] S4: determining a data reconstruction range according to the abnormal section boundary characteristic value in the flow anomaly monitoring result, calculating the overlapping part of the reconstruction interval and the standard protocol field, inputting the flow mode parameter into the Markov chain Monte Carlo algorithm for consistency evaluation, and generating complete flow monitoring data;

[0124] S5: receiving the complete flow monitoring data, comparing the difference degree of the abnormal area and the normal mode, analyzing the protocol boundary position information, extracting the flow characteristic data, arranging the protocol boundary and the characteristics according to time, and generating a structured monitoring result.

[0125] The above is only a specific embodiment of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A computer network data traffic monitoring system, characterized in that, The system includes: The data stream acquisition module acquires real-time data packet traffic through the network interface, collects protocol layer fields and timestamp information, detects field differences between consecutive sampling points, records the time points of change, generates a traffic field change record table, and transmits it to the protocol layer parsing module. The protocol layer parsing module receives the traffic field change record table, calculates the time interval between changes in adjacent protocol layer fields, detects the order of field changes, accumulates the ratio of the number of synchronization states to the total number of comparisons, generates a protocol synchronization metric, and transmits it to the time series feature extraction module. The timing feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps it to a unified numerical range through a quantile regression algorithm, detects cross-layer synchronization continuity to identify abnormal segments, records feature values ​​before and after the abnormal segment, generates traffic anomaly monitoring results, and transmits them to the defect compensation and reconstruction module. The defect compensation and reconstruction module receives the traffic anomaly monitoring results, determines the estimation interval based on the feature values ​​before and after the anomaly segment, calculates the intersection with the protocol standard fields, uses the Markov chain Monte Carlo algorithm to evaluate the consistency of the traffic pattern, generates complete traffic monitoring data, and transmits it to the monitoring result output module.

2. The computer network data traffic monitoring system according to claim 1, characterized in that, The traffic field change record table includes change type, time distribution and impact range; the protocol synchronization metric includes interval distribution, sequence consistency and synchronization ratio; the traffic anomaly monitoring results include abnormal segment location, continuity index and offset degree; and the complete traffic monitoring data includes estimated interval range, field intersection results and consistency evaluation value.

3. The computer network data traffic monitoring system according to claim 1, characterized in that, The data stream acquisition module includes: The data stream receiving submodule obtains real-time data packet traffic through the network interface, parses the data packet structure and extracts the protocol layer field content, matches and stores the fields with the timestamps of the data packets one by one, calls the buffer to write the field sequence sequentially and marks the sampling position, and generates the field time series value; The field difference detection submodule, based on the field time series value, calls the field values ​​and timestamps in adjacent sampling points, compares the adjacent field values ​​one by one and detects the difference magnitude, and calculates the interval duration based on the field difference results and adjacent timestamps to obtain the field difference time point set. The change record generation submodule, based on the set of time points of field differences, calls the position of field value change and the corresponding time information, arranges them linearly in chronological order and creates an index table, adds change magnitude markers to multiple records in the index table, and generates a flow field change record table.

4. The computer network data traffic monitoring system according to claim 1, characterized in that, The protocol layer parsing module includes: The field sequence acquisition submodule parses the traffic field change record table, detects the changes of fields in the transmission link, extracts time stamps and change identifiers, arranges and fits the event sequence, and calls the event sequence to integrate the changes of fields at different levels to obtain the protocol layer field change time sequence. The protocol field calculation submodule performs difference calculations on the time tags of adjacent protocol layer fields based on the time series of changes in the protocol layer fields, establishes a time interval matrix, calls the interval values ​​for sequential comparison and records the sorting, and generates the field change order. The synchronization metric generation submodule calls the field change order and time interval matrix, compares the order of fields in the protocol layer with the time interval values, calculates the cumulative number of synchronization states and performs a ratio operation with the total number of comparisons to generate the protocol synchronization metric value.

5. The computer network data traffic monitoring system according to claim 1, characterized in that, The temporal feature extraction module includes: The time-series data acquisition submodule obtains the protocol synchronization metric value as input data, sets a fixed-length sliding time window to segment the data, arranges each segment of synchronization metric value into a continuous sequence according to time order, and generates time-series feature values. The quantile mapping submodule extracts the median of the data vector for each time period as the distribution location parameter based on the time series feature value. The parameter is input into the quantile regression algorithm and compared with the preset quantile benchmark value. The normalized mapping is calculated and arranged according to the difference comparison result to obtain the normalized interval sequence. The cross-layer anomaly detection submodule calculates the difference value between adjacent time periods based on the normalized interval sequence and compares it with a preset difference threshold. The difference value exceeding the threshold is determined as an abnormal interval and recorded as a marker index. At the same time, the adjacent numerical features before and after the abnormal interval are extracted and aggregated to generate traffic anomaly monitoring results.

6. The computer network data traffic monitoring system according to claim 1, characterized in that, The defect compensation and reconstruction module includes: The feature segment estimation submodule obtains abnormal segment data from the traffic anomaly monitoring results, performs differential calculation on the feature values ​​before and after the abnormal segment and interpolates and fills in the missing parts, calls the boundary points to determine the extension range, and generates the estimation interval range value. The field intersection calculation submodule calls the protocol standard field set based on the calculated interval range value, compares the interval range data field with the protocol standard field in the same index dimension, establishes overlapping field records based on numerical overlap and integrates them into an intersection coefficient set to obtain the protocol field intersection coefficient; The traffic pattern evaluation submodule calculates the transition probability distribution sequence using the Markov chain Monte Carlo algorithm based on the intersection coefficient of the protocol fields, performs random sampling and records the results, extracts stable trends and calculates the consistency of the initial traffic pattern corresponding to the real-time data packet traffic, and obtains complete traffic monitoring data.

7. The computer network data traffic monitoring system according to claim 6, characterized in that, The estimated interval range value is a set of interval data obtained by calculating the difference of feature values ​​before and after the abnormal segment, interpolating and filling in the missing parts, and combining the boundary point extension. The intersection coefficient of the protocol fields is the set of overlapping records established by comparing the calculated interval range value with the protocol standard field set in the same index dimension.

8. The computer network data traffic monitoring system according to claim 1, characterized in that, The monitoring result output module receives the complete traffic monitoring data, compares the degree of difference between abnormal areas and normal patterns obtained based on the statistics of the original data, parses the protocol boundary location information, extracts traffic feature data, arranges the protocol boundaries and features by time, and generates structured monitoring results. The structured monitoring results include the degree of difference, boundary location information, and temporal characteristics.

9. The computer network data traffic monitoring system according to claim 8, characterized in that, The monitoring result output module includes: The sequence difference measurement submodule acquires the complete traffic monitoring data, arranges the data packets in the collection time series, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal pattern distribution value obtained based on the original data statistics, and generates the difference measurement value. The protocol boundary positioning submodule analyzes the data packets arranged in time series based on the difference metric value, detects the field length change pattern and establishes a time index by numbering, calculates the interval between consecutive fields and compares it with the division benchmark interval value to obtain the protocol boundary index table. The feature sequence construction submodule extracts the boundary segment traffic feature values ​​according to the protocol boundary index table, pairs and arranges the feature values ​​with timestamps, and integrates them into a unified structure according to the segment order to obtain structured monitoring results.

10. A method for monitoring computer network data traffic, characterized in that, The computer network data traffic monitoring system according to any one of claims 1-9 comprises the following steps: S1: Collect real-time data packet traffic through the network interface, obtain protocol layer field information and timestamp data, detect changes in protocol fields between adjacent sampling points, record the time and magnitude of field changes, and generate a traffic field change record table. S2: Calculate the time difference of field changes between protocol layers based on the traffic field change record table, sort and analyze the field change sequence, detect the order of field changes, accumulate the number of synchronization states to the total number of comparisons, and generate a protocol synchronization metric. S3: Call the protocol synchronization metric value to set the time window length parameter, map the value to a unified interval through quantile regression algorithm, detect cross-protocol layer synchronization continuity breakpoints, identify the start and end positions of abnormal time periods, record the boundary feature values ​​before and after the abnormal section, and generate traffic anomaly monitoring results. S4: Determine the data reconstruction range based on the boundary feature value of the abnormal section in the traffic anomaly monitoring results, calculate the overlapping part between the reconstruction interval and the standard protocol field, input the traffic pattern parameters into the Markov chain Monte Carlo algorithm for consistency evaluation, and generate complete traffic monitoring data. S5: Receive the complete traffic monitoring data, compare the degree of difference between abnormal areas and normal modes, parse the protocol boundary location information, extract traffic feature data, arrange the protocol boundaries and features by time, and generate structured monitoring results.

Images