Network traffic anomaly detection method and system based on deep feature extraction

Abstract

The invention relates to a network traffic anomaly detection method and system based on deep feature extraction. The method comprises the following steps: collecting original network flow data; performing standardization processing on the original network traffic data to generate a primary traffic tensor sequence; performing depth feature extraction processing on the primary flow tensor sequence through a trained encoder to generate a spatial-temporal feature vector; performing data reconstruction processing on the spatial-temporal feature vector to obtain a reconstructed traffic tensor sequence; calculating a reconstruction error between the reconstructed flow tensor sequence and the primary flow tensor sequence; and based on the reconstruction error and a preset error threshold value, a flow anomaly detection result is generated. By adopting the method, the problems that a traditional method depends on expert knowledge, complex space-time dependence is difficult to capture and generalization ability is weak can be effectively solved, and automatic and high-precision anomaly detection of high-dimensional and nonlinear network flow data is realized.

Description

Technical Field

[0001] This invention belongs to the field of traffic anomaly detection technology, and in particular relates to a method and system for network traffic anomaly detection based on deep feature extraction. Background Technology

[0002] With the rapid development of big data and IoT technologies, the scale of data generated by various systems (such as industrial equipment, financial transactions, network traffic, and medical monitoring) is growing exponentially. This data contains a large number of normal behavioral patterns, but also harbors rare but seriously harmful anomalies. How to efficiently and accurately identify abnormal behavior in high-dimensional, unstructured, and dynamically changing data streams has become a key challenge for ensuring the security and reliability of current intelligent systems.

[0003] Traditional anomaly detection methods (such as those based on statistical models, distance metrics, or clustering) often suffer from weak generalization ability, overly strong assumptions about data distribution, and difficulty in capturing complex patterns when dealing with high-dimensional, nonlinear, and time-dependent data. In recent years, deep learning technology, with its powerful feature extraction and nonlinear modeling capabilities, has achieved remarkable results in fields such as image, speech, and natural language processing, and has also provided new solutions for anomaly detection.

[0004] However, existing deep learning-based anomaly detection methods still suffer from several inherent technical problems. First, they heavily rely on expert knowledge for feature engineering, making it difficult to adaptively capture the complex nonlinear features and deep patterns in high-dimensional traffic data. Second, these methods typically treat traffic data as isolated points or simple sequences, ignoring the complex spatial topological relationships between network entities (such as hosts and devices) and the dynamic temporal dependencies between traffic metrics, resulting in insufficient detection capabilities for spatiotemporally correlated coordinated attacks (such as low-rate DDoS attacks and lateral movement). Furthermore, in unsupervised or weakly supervised scenarios, due to the scarcity of anomaly samples, traditional methods struggle to learn features of unknown attack types, resulting in limited model generalization ability and often lacking interpretability in detection results, hindering security analysts from quickly pinpointing the root cause of problems. Summary of the Invention

[0005] Therefore, it is necessary to provide a network traffic anomaly detection method that can automatically extract deep features, effectively model spatiotemporal dependencies, and achieve high-precision and high-generalization anomaly detection under unsupervised settings, addressing the aforementioned technical problems.

[0006] Firstly, this application provides a network traffic anomaly detection method based on deep feature extraction, including:

[0007] Collect raw network traffic data; and standardize the raw network traffic data to generate a primary traffic tensor sequence;

[0008] The primary flow tensor sequence is processed by deep feature extraction using a trained encoder to generate a spatiotemporal feature vector.

[0009] Data reconstruction processing is performed on the spatiotemporal feature vectors to obtain the reconstructed flow tensor sequence;

[0010] Calculate the reconstruction error between the reconstructed flow tensor sequence and the initial flow tensor sequence; and generate flow anomaly detection results based on the reconstruction error and a preset error threshold.

[0011] Furthermore, the trained encoder performs deep feature extraction on the primary flow tensor sequence to generate a spatiotemporal feature vector, including:

[0012] The primary flow tensor sequence is sliced ​​according to time steps to obtain the node feature matrix of each time step; the node feature matrix is ​​a graph structure.

[0013] A multi-layer graph attention network is used to perform feature aggregation on the feature matrix of each node to generate a spatial feature matrix for each time step.

[0014] Each spatial feature matrix is ​​processed by forward temporal propagation through a gated recurrent unit to obtain the hidden state vector at each time step.

[0015] Arrange each hidden state vector according to time steps to generate a sequence of hidden state vectors;

[0016] Based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion of global context information to generate a spatiotemporal feature vector.

[0017] Furthermore, a multi-layer graph attention network is used to perform feature aggregation on the feature matrix of each node to generate a spatial feature matrix for each time step, including:

[0018] A linear transformation is performed on the feature matrix of each node to obtain the high-dimensional feature vector of each node; the node represents a specific entity.

[0019] Based on each high-dimensional feature vector, calculate the attention coefficient between the target node and its neighboring nodes;

[0020] Based on the attention coefficient, a weighted summation is performed on the high-dimensional feature vectors of all neighboring nodes to obtain a new feature vector for each node:

[0021]

[0022] in, For the new feature vector, For activation function, Attention coefficient Let i be the high-dimensional feature vector of the neighboring nodes, and j be the node identifiers. The set of all neighboring nodes;

[0023] Based on each new feature vector, a final new feature vector for each node is generated through multi-layer graph convolution processing.

[0024] All the final new feature vectors are combined in node order to generate the spatial feature matrix for each time step.

[0025] Furthermore, based on each high-dimensional feature vector, the attention coefficients between the target node and its neighboring nodes are calculated, including:

[0026] Based on each high-dimensional feature vector, the attention coefficient between the target node and its neighboring nodes is calculated using the following formula:

[0027]

[0028] in, Here, is the attention coefficient, 'a' is a learnable parameter, and '∥' represents vector concatenation. The high-dimensional feature vectors of the neighboring nodes, Let be the high-dimensional feature vector of the node, and LeakyReLU be the activation function. For normalization function, For transpose, i and j are node identifiers.

[0029] Furthermore, based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion of global contextual information to generate a spatiotemporal feature vector, including:

[0030] Different linear projection processes are applied to the hidden state vector sequence to obtain the query vector matrix, key vector matrix, and value vector matrix;

[0031] The query vector matrix, key vector matrix, and value vector matrix are partitioned along the feature dimension to obtain multiple spaces; the spaces include query vector submatrices, key vector submatrices, and value vector submatrices.

[0032] The self-attention output for each space is calculated using the following formula:

[0033]

[0034] in, For self-attention output, For normalization function, To query the vector submatrix, The key vector submatrix Let T be a value vector submatrix, and T be its transpose. The dimension of the key vector submatrix or query vector submatrix;

[0035] Concatenate all self-attention outputs to obtain a concatenation matrix;

[0036] Linear projection is performed on the concatenated matrix to generate spatiotemporal feature vectors.

[0037] Furthermore, the spatiotemporal feature vectors are subjected to data reconstruction processing to obtain the reconstructed flow tensor sequence, including:

[0038] Input the spatiotemporal feature vectors into the trained reconstructor and output the reconstructed flow tensor sequence;

[0039] The trained reconstructor is obtained through the following method:

[0040] The encoder and reconstructor are initialized to obtain the initialized encoder and reconstructor; the encoder and reconstructor are jointly optimized end-to-end; the encoder includes a multi-layer graph attention network, a gated recurrent unit, and a multi-head self-attention mechanism;

[0041] The initial flow tensor sequence generated from normal flow data is input into the initialized encoder to generate the initial spatiotemporal feature vector.

[0042] The initial spatiotemporal feature vector is input into the initialized reconstructor for dimensionality restoration to obtain the reconstructed node feature matrix sequence; the reconstructor consists of deconvolutional layers and / or fully connected layers;

[0043] Calculate the mean square error between the reconstructed node feature matrix sequence and the primary flow tensor sequence of normal flow data; and use the mean square error as the loss function.

[0044] The loss function is minimized through backpropagation until the preset convergence condition is met, then the iteration stops, and the updated encoder parameters and the updated reconstructor parameters are obtained.

[0045] Based on the updated encoder parameters and the updated reconstructor parameters, a trained encoder and a trained reconstructor are generated.

[0046] Furthermore, the raw network traffic data is standardized to generate a primary traffic tensor sequence, including:

[0047] The raw network traffic data is aggregated to obtain network flow records; network flow records are identified by source IP address, destination IP address, source port, destination port, and protocol.

[0048] Multidimensional feature extraction is performed on network stream records to obtain a feature vector for each stream record. The feature vector includes duration, number of data packets sent, number of data packets received, total number of bytes sent, total number of bytes received, and TCP flag distribution.

[0049] Based on a preset fixed time window and the feature vectors of the flow records by IP address, the feature matrix of each node with each IP address as the node is obtained by aggregation and statistical processing.

[0050] The node feature matrix is ​​standardized to generate a primary flow tensor sequence.

[0051] Secondly, this application also provides a network traffic anomaly detection system based on deep feature extraction, including:

[0052] The data acquisition module is used to collect raw network traffic data and standardize the raw network traffic data to generate a primary traffic tensor sequence.

[0053] The vector generation module is used to perform deep feature extraction on the primary flow tensor sequence through a trained encoder to generate spatiotemporal feature vectors.

[0054] The sequence generation module is used to reconstruct the spatiotemporal feature vectors to obtain the reconstructed flow tensor sequence.

[0055] The result generation module is used to calculate the reconstruction error between the reconstructed flow tensor sequence and the primary flow tensor sequence; and to generate flow anomaly detection results based on the reconstruction error and a preset error threshold.

[0056] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, the at least one program, the code set or instruction set is loaded and executed by the processor to implement any of the network traffic anomaly detection methods based on deep feature extraction described in the embodiments of this application.

[0057] Fourthly, this application also provides a computer-readable storage medium storing at least one piece of program code, which is loaded and executed by a processor to implement any of the network traffic anomaly detection methods based on deep feature extraction described in the embodiments of this application.

[0058] The aforementioned network traffic anomaly detection method and system based on deep feature extraction collects raw network traffic data and performs standardization processing to generate a primary traffic tensor sequence. A trained encoder is then used to perform deep feature extraction on the primary traffic tensor sequence to generate a spatiotemporal feature vector. This spatiotemporal feature vector is then reconstructed to obtain a reconstructed traffic tensor sequence. The reconstruction error between the reconstructed and primary traffic tensor sequences is calculated. Based on the reconstruction error and a preset error threshold, a traffic anomaly detection result is generated. This method effectively solves the problems of traditional methods relying on expert knowledge, difficulty capturing complex spatiotemporal dependencies, and weak generalization ability. It achieves automated and high-precision anomaly detection of high-dimensional, nonlinear network traffic data, demonstrating good detection performance for both known and unknown anomalies, thus improving the intelligence and reliability of network security protection. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart illustrating a network traffic anomaly detection method based on deep feature extraction in one embodiment;

[0061] Figure 2 This is a flowchart illustrating the steps of generating a spatiotemporal feature vector by performing deep feature extraction on a primary flow tensor sequence using a trained encoder in one embodiment.

[0062] Figure 3 This is a schematic diagram of a network traffic anomaly detection system based on deep feature extraction in one embodiment. Detailed Implementation

[0063] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0064] In one embodiment, a network traffic anomaly detection method based on deep feature extraction is provided. This embodiment illustrates the application of this method to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and implemented through the interaction between the terminal and the server. Figure 1 As shown, in this embodiment, the method includes the following steps:

[0065] Step S101: Collect raw network traffic data; and standardize the raw network traffic data to generate a primary traffic tensor sequence.

[0066] Standardization refers to eliminating differences through unified rules, so that data, processes, or products can be compared, reused, and controlled.

[0067] For example, raw network traffic data containing various network transmission units such as Ethernet frames, Internet Protocol (IP) packets, Transmission Control Protocol (TCP) segments, and User Datagram Protocol (UDP) datagrams is acquired, and the raw data is standardized to generate a primary traffic tensor sequence.

[0068] Step S102: The primary flow tensor sequence is processed by deep feature extraction using the trained encoder to generate a spatiotemporal feature vector.

[0069] Among them, the well-trained encoder refers to the core component that has been trained with fixed parameters and can accurately extract the spatiotemporal features of normal data. It is a feature extractor that learns and solidifies the spatiotemporal patterns of normal traffic and has the ability to model spatiotemporal dependencies. Deep feature extraction is the process of automatically mining high-level, abstract and discriminative information from data such as images, text, and audio based on deep learning models. It replaces the traditional method of manually designing features and allows the model to learn the essential patterns of the data autonomously.

[0070] For example, the trained encoder is invoked to perform deep feature extraction on the primary flow tensor sequence to generate a spatiotemporal feature vector.

[0071] Step S103: Perform data reconstruction processing on the spatiotemporal feature vector to obtain the reconstructed flow tensor sequence.

[0072] Data reconstruction processing refers to the process of using specific algorithms or models to reverse-map low-dimensional data / feature encoding, which has been compressed, reduced in dimensionality, or extracted for feature extraction, back to high-dimensional data with the same format and dimensionality as the original data, in order to restore the structure, information, or feature distribution of the original data.

[0073] For example, the generated spatiotemporal feature vector is input into a trained reconstructor to perform data reconstruction processing to obtain a reconstructed traffic tensor sequence. The trained reconstructor is a specific network structure with fixed parameters, used to reverse-engineer the low-dimensional spatiotemporal feature encoding into a reconstructed sequence with the same dimension as the original traffic data. It is a key component responsible for data reconstruction in the anomaly detection model.

[0074] Step S104: Calculate the reconstruction error between the reconstructed flow tensor sequence and the primary flow tensor sequence; and generate flow anomaly detection results based on the reconstruction error and a preset error threshold.

[0075] The reconstruction error can be quantified using metrics such as mean square error and mean absolute error. The mean square error is calculated by the sum of the squares of the differences between the corresponding elements, which can effectively reflect the degree of deviation between the reconstructed data and the original data. The preset error threshold is determined based on the error statistical characteristics of the normal traffic data during the training phase. By statistically analyzing the distribution characteristics of the reconstruction error of normal traffic, a critical value that can distinguish between normal and abnormal data is selected to ensure the rationality and generalization of the threshold.

[0076] For example, the reconstruction error between the reconstructed traffic tensor sequence and the primary traffic tensor sequence is calculated, and the calculated reconstruction error is compared with a preset error threshold. If the reconstruction error is less than or equal to the preset error threshold, it indicates that the data conforms to the normal traffic pattern learned by the encoder and the reconstructor, and is determined to be normal traffic. If the reconstruction error is greater than the threshold, it indicates that the data contains an unlearned abnormal pattern, and is determined to be abnormal traffic. The corresponding traffic anomaly detection result is then output.

[0077] In this embodiment, raw network traffic data is collected through standardized processing to generate a primary traffic tensor sequence. A trained encoder is used to accurately extract deep spatiotemporal features from the primary traffic tensor sequence, and a reconstructor is used to restore normal traffic patterns. The reconstruction error is calculated and compared with a preset error threshold to determine anomalies. This effectively solves the problems of traditional methods relying on expert knowledge, difficulty in capturing complex spatiotemporal dependencies, and weak generalization ability. It achieves automated and high-precision anomaly detection of high-dimensional, nonlinear network traffic data, and has good detection performance for both known and unknown anomalies, improving the intelligence and reliability of network security protection.

[0078] In one embodiment, such as Figure 2 As shown, the primary flow tensor sequence is processed by deep feature extraction using a trained encoder to generate a spatiotemporal feature vector, including:

[0079] Step S201: Slice the primary flow tensor sequence according to time steps to obtain the node feature matrix of each time step; the node feature matrix is ​​a graph structure.

[0080] The time step is based on a predefined fixed time window, with each time step corresponding to an independent time unit, ensuring that the sliced ​​data can reflect the stable state of the flow within a continuous time segment.

[0081] For example, the primary flow tensor sequence (time step × number of nodes × number of features) of the three-dimensional structure is decomposed into multiple two-dimensional node feature matrices along the time dimension, with each node feature matrix uniquely corresponding to a time step. This node feature matrix is ​​a graph structure. Nodes explicitly correspond to IP address entities in the network, and each node is bound to aggregate features within that time step, such as flow duration, uplink and downlink byte counts, etc.; edges implicitly represent communication relationships between nodes, such as packet interaction behavior between IPs. This graph structure design is used to accurately characterize the spatial topology relationships of network entities.

[0082] Step S202: The feature matrix of each node is aggregated using a multi-layer graph attention network to generate the spatial feature matrix for each time step.

[0083] Among them, the multi-layer graph attention network is an extended structure of the graph attention network (GAT). It solves the limitations of the basic GAT when processing complex graph data by stacking multiple layers. It is a deep graph neural network based on the attention mechanism. GAT adaptively learns the association weights between nodes through the attention mechanism, replacing the fixed weight allocation of traditional graph convolution, and can highlight neighbor nodes that contribute more to the traffic features. Feature aggregation processing refers to integrating multi-source / multi-dimensional features to fuse scattered and local feature information into more representative global or local aggregated features that better reflect the essence of the data.

[0084] For example, a multi-layer graph attention network is invoked to perform feature aggregation processing on the node feature matrix at each time step to generate a spatial feature matrix for each time step.

[0085] Step S203: Perform forward temporal propagation processing on each spatial feature matrix through a gated recurrent unit to obtain the hidden state vector at each time step.

[0086] Among them, the Gated Recurrent Unit (GRU) network is an important improved model of Recurrent Neural Network (RNN). It achieves selective memory and forgetting of time-series information through reset gates and update gates, solving the problem of difficulty in capturing long sequence dependencies caused by gradient vanishing / gradient explosion in traditional RNNs. Forward time-series propagation processing refers to the process of gradually passing information and calculating results from the input to the output in time-related data, which is commonly found in models that process time series data.

[0087] For example, the spatial feature matrices of each time step are sequentially input into the gated recurrent unit (GRU) in chronological order. The gates are updated to determine the fusion ratio between the hidden state of the previous time step and the current input features, thus deciding how much historical information to retain. The gates are then reset to determine whether to ignore the hidden state of the previous time step in order to update the candidate hidden states. Through the synergistic effect of the two gates, the GRU can dynamically capture the temporal dependencies of traffic data, such as the impact of traffic fluctuations in the previous time step on the current time step. The hidden state vector output at each time step fuses the spatial features and historical temporal information of that time step.

[0088] Step S204: Arrange each hidden state vector according to time steps to generate a hidden state vector sequence.

[0089] For example, the hidden state vectors at each time step are arranged in time step order to generate a hidden state vector sequence. That is, the hidden state vectors corresponding to the time steps generated earlier are listed first, and the hidden state vectors corresponding to the time steps generated later are listed last. Through sorting and recombination, the scattered individual hidden state vectors are integrated into a three-dimensional hidden state vector sequence (time step × vector dimension). This sequence contains the spatiotemporal fusion information of each time step, and the temporal arrangement explicitly reflects the sequential relationship of the time dimensions.

[0090] Step S205: Based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion processing of global context information to generate a spatiotemporal feature vector.

[0091] Among them, the multi-head self-attention mechanism refers to capturing temporal correlations of different dimensions through parallel computation of multiple independent attention heads, and then fusing the results to improve the comprehensiveness of features; the global context information weighted fusion processing refers to integrating all relevant information in the global scope and assigning different weights according to the importance of information, and finally integrating more comprehensive and representative features. The core is global coverage and weighted selection.

[0092] For example, based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion processing of global context information to generate a spatiotemporal feature vector.

[0093] In this embodiment, the primary traffic tensor sequence is sliced ​​by time step to obtain the node feature matrix for each time step; feature aggregation is performed on each node feature matrix to generate a spatial feature matrix; forward temporal propagation is performed on the spatial feature matrix to generate a hidden state vector sequence; and global fusion is performed through a multi-head self-attention mechanism to construct a deep feature extraction link of "precise spatial correlation extraction - dynamic temporal dependency capture - comprehensive global context fusion". This can significantly enhance the feature representation capability of complex network traffic, such as traffic containing coordinated attacks and dynamic temporal fluctuations, thereby improving the accuracy and generalization of anomaly detection.

[0094] In one embodiment, a multi-layer graph attention network is used to perform feature aggregation on the feature matrix of each node to generate a spatial feature matrix for each time step, including:

[0095] Step S301: Perform a linear transformation on the feature matrix of each node to obtain the high-dimensional feature vector of each node; the node represents a specific entity.

[0096] Linear transformation refers to a transformation operation that preserves the linearity of a vector or space, without changing the linear combination relationship of the vectors; a node represents a specific entity in the network, such as a device or server corresponding to an IP address.

[0097] For example, matrix multiplication and bias superposition are performed on the feature vectors of each node in the node feature matrix of each time step, which contain aggregate features such as stream duration and uplink / downlink byte count, to obtain a high-dimensional feature vector for each node. This high-dimensional feature vector has a uniform dimension.

[0098] Step S302: Based on each high-dimensional feature vector, calculate the attention coefficient between the target node and its neighboring nodes.

[0099] Among them, the target node is the core unit that serves as the object of analysis, processing, or monitoring in the current task, and is the key carrier of data flow or functional direction.

[0100] For example, based on the high-dimensional feature vector of each node, the attention coefficient between the target node and its neighboring nodes is calculated.

[0101] Step S303: Based on the attention coefficient, perform a weighted summation of the high-dimensional feature vectors of all neighboring nodes to obtain a new feature vector for each node.

[0102]

[0103] in, For the new feature vector, For activation function, Attention coefficient Let i be the high-dimensional feature vector of the neighboring nodes, and j be the node identifiers. It is the set of all neighboring nodes.

[0104] Among them, activation function The Sigmoid or ReLU function can usually be used to introduce non-linear transformations and increase the complexity of feature representation.

[0105] For example, weights are assigned to the high-dimensional feature vectors of the corresponding neighbor nodes based on the attention coefficients, then all weighted vectors are summed, and finally an activation function is applied. The summation result is subjected to a nonlinear transformation to generate a new feature vector that incorporates important information from neighboring nodes.

[0106] Step S304: Based on each new feature vector, generate the final new feature vector for each node through multi-layer graph convolution processing.

[0107] Among them, multi-layer graph convolution processing refers to gradually deepening the spatial correlation information of node features through multiple rounds of feature aggregation and transformation, filtering out noise interference in the data, and improving the abstract expression ability of features.

[0108] For example, based on the new feature vectors of each node, a final new feature vector for each node is generated through multi-layer graph convolution. The new feature vectors of the nodes obtained in the first round are used as input features for the next layer of graph convolution, and the process of "linear transformation - attention coefficient calculation - weighted summation - activation" is repeated. Each layer is equipped with independent learnable parameters such as weight matrix, bias vector, and attention parameters to ensure that each layer can capture spatial association patterns at different levels. As the number of graph convolution layers increases, the node features will gradually integrate the effective information of a wider range of neighboring nodes. The final generated new feature vector of the node contains the core features of the target node itself and integrates the key association information of multiple layers of neighboring nodes, thus possessing a more comprehensive spatial feature representation capability.

[0109] Step S305: Combine all the final new feature vectors in node order to generate the spatial feature matrix for each time step.

[0110] The node order is consistent with the node order in the initial node feature matrix. That is, the row index of the final new feature vector of each node in the spatial feature matrix corresponds exactly to the row index of the node in the original node feature matrix. This ensures a one-to-one correspondence between the node identifier and the feature information, and avoids the problem of node and feature misalignment in subsequent data processing.

[0111] For example, the final new feature vectors of the scattered individual nodes are stacked row by row to form a two-dimensional spatial feature matrix. The number of rows in the matrix is ​​equal to the number of nodes, and the number of columns is equal to the dimension of the final new feature vectors of the nodes. This spatial feature matrix fully preserves the deep spatial correlation features of all nodes within a single time step.

[0112] In this embodiment, a high-dimensional feature vector for each node is generated by performing a linear transformation on the feature matrix of each node. Based on each high-dimensional feature vector, the attention coefficient between the target node and its neighboring nodes is calculated. A new feature vector for each node is calculated based on the attention coefficient. The new feature vector is then deepened through multi-layer convolution processing. Finally, all the resulting new feature vectors are combined in node order to generate the spatial feature matrix for each time step. This effectively solves the problems of fixed weights and coarse correlation characterization in traditional spatial feature extraction, and accurately captures the complex spatial topological relationships between nodes in network traffic.

[0113] In one embodiment, based on each high-dimensional feature vector, the attention coefficient between the target node and its neighboring nodes is calculated, including:

[0114] Step S401: Based on each high-dimensional feature vector, calculate the attention coefficient between the target node and its neighboring nodes using the following formula:

[0115]

[0116] in, Here, is the attention coefficient, 'a' is a learnable parameter, and '∥' represents vector concatenation. The high-dimensional feature vectors of the neighboring nodes, Let be the high-dimensional feature vector of the node, and LeakyReLU be the activation function. For normalization function, For transpose, i and j are node identifiers.

[0117] For example, the high-dimensional feature vector of the target node is concatenated with the high-dimensional feature vectors of its neighbors. A linear transformation is then performed on the concatenated vector using a predefined learnable parameter vector, compressing it to a single dimension. The LeakyReLU activation function (Leaky Rectified Linear Unit) is introduced to perform non-linear processing on the linear transformation result. The processed value is then normalized using the Softmax normalization function to ensure that the sum of the attention coefficients of the target node to all its neighbors is 1. This achieves adaptive allocation of the importance of different neighbors, highlighting the information of neighbors that contribute more to the features of the target node.

[0118] In this embodiment, the attention coefficient between the target node and its neighboring nodes is calculated using a preset formula. This accurately captures the importance of differentiated associations between the target node and different neighboring nodes, effectively highlighting neighbor information that significantly contributes to the node's features and filtering out redundant interference.

[0119] In one embodiment, based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion of global context information to generate a spatiotemporal feature vector, including:

[0120] Step S501: Perform different linear projection processes on the hidden state vector sequence to obtain the query vector matrix, key vector matrix and value vector matrix.

[0121] Linear projection processing refers to mapping the hidden state vector sequence from the original dimension to the preset target dimension through matrix multiplication based on independent learnable parameters. The independent learnable parameters include three sets of independent weight matrices and bias vectors, which correspond to the projection calculation of the query vector matrix, key vector matrix and value vector matrix, respectively.

[0122] For example, based on independent learnable parameters, each vector in the hidden state vector sequence is multiplied by three sets of weight matrices and the corresponding bias is superimposed to obtain the query vector matrix Q, the key vector matrix K, and the value vector matrix V. Here, Q represents the feature requirement to be queried, K represents the feature identifier that can be matched, and V represents the feature content to be extracted.

[0123] Step S502 involves segmenting the query vector matrix, key vector matrix, and value vector matrix along the feature dimension to obtain multiple spaces; the spaces include query vector submatrices, key vector submatrices, and value vector submatrices.

[0124] The segmentation process strictly follows the principle of equal distribution of feature dimensions. That is, based on the preset number of attention heads, the feature dimensions of Q, K, and V are divided into several parts on an average basis. Each part corresponds to a space, and the feature dimensions of the Q, K, and V sub-matrices in each space are consistent. For example, if the feature dimension of Q is D and the number of attention heads is H, then the feature dimension of the Q sub-matrix in each space is D / H. This allows for the simultaneous capture of temporal correlations of different dimensions in the hidden state vector sequence through multiple parallel sub-spaces, such as short-term traffic fluctuations and long-term periodic patterns, avoiding the limitations of a single space in characterizing complex temporal features.

[0125] For example, the query vector matrix, key vector matrix, and value vector matrix are segmented along the feature dimension to obtain multiple independent spaces, each containing the corresponding query vector submatrix, key vector submatrix, and value vector submatrix.

[0126] Step S503: Calculate the self-attention output for each space using the following formula:

[0127]

[0128] in, For self-attention output, For normalization function, To query the vector submatrix, The key vector submatrix Let T be a value vector submatrix, and T be its transpose. The dimension of the key vector submatrix or query vector submatrix.

[0129] For example, the computation process is performed independently for each space, through and The multiplication operation measures the feature matching degree, and the weights are obtained by combining scaling and normalization, and then multiplied by... Multiplication extracts important features, and outputs the self-attention results for each space.

[0130] Step S504: Concatenate all self-attention outputs to obtain a concatenation matrix.

[0131] For example, the self-attention outputs of all spaces are concatenated according to their feature dimensions to obtain a concatenated matrix. The concatenation operation strictly follows the principle of spatial order consistency. This principle states that the self-attention outputs of spaces that completed computation earlier are listed first, followed by the self-attention outputs of spaces that completed computation later. Furthermore, during concatenation, only the feature dimensions are merged, while the time step dimension and node association dimension remain unchanged. For instance, if the dimension of each spatial self-attention output is (number of time steps × feature dimension / H), where H is the number of attention heads (i.e., the number of spaces), then the dimension of the concatenated matrix is ​​(number of time steps × feature dimension).

[0132] Step S505: Perform linear projection processing on the spliced ​​matrix to generate spatiotemporal feature vectors.

[0133] For example, a linear projection process is performed on the concatenated matrix to generate a spatiotemporal feature vector. This vector contains temporal dependency information of the hidden state vector sequence and integrates global contextual associations captured from multiple spaces to fully characterize the deep spatiotemporal features of network traffic.

[0134] In this embodiment, a query vector matrix, a key vector matrix, and a value vector matrix are generated by performing linear projection; each matrix is ​​segmented according to its feature dimensions to construct a multi-space; local correlations are extracted through self-attention calculation; the outputs of each attention are concatenated into a concatenated matrix to integrate multi-perspective information; and a unified feature vector is generated by performing linear projection on the concatenated matrix. This approach can adaptively mine complex long- and short-term temporal correlations in network traffic, significantly improving the accuracy of spatiotemporal feature vectors in representing global traffic patterns.

[0135] In one embodiment, the spatiotemporal feature vector is subjected to data reconstruction processing to obtain a reconstructed flow tensor sequence, including:

[0136] Step S601: Input the spatiotemporal feature vector into the trained reconstructor and output the reconstructed flow tensor sequence.

[0137] For example, the spatiotemporal feature vector is input into the trained reconstructor, which performs calculations to output the reconstructed flow tensor sequence.

[0138] The trained reconstructor is obtained through the following method:

[0139] Step S6011: Initialize the encoder and reconstructor to obtain the initialized encoder and reconstructor; the encoder and reconstructor are jointly optimized end-to-end; the encoder includes a multi-layer graph attention network, a gated recurrent unit and a multi-head self-attention mechanism.

[0140] End-to-end joint optimization refers to treating the encoder and reconstructor as a whole model and adjusting parameters synchronously through a unified loss function to avoid the poor parameter fit problem caused by traditional step-by-step training. The encoder's internal structure integrates a multi-layer graph attention network, a gated recurrent unit, and a multi-head self-attention mechanism, which are responsible for spatial feature aggregation, temporal dependency capture, and global context fusion, respectively. The reconstructor consists of deconvolutional layers and / or fully connected layers, which undertake the task of feature dimension recovery.

[0141] For example, the encoder and reconstructor are initialized to obtain initialized encoder and initialized reconstructor. During the initialization process, all learnable parameters of the encoder and reconstructor (such as weight matrix, bias vector, attention coefficient parameters) are assigned random initial values, and the parameter values ​​follow the principle of normal distribution or uniform distribution. The uniform distribution principle maximizes resource utilization efficiency or optimizes the degree of goal achievement through balanced allocation; the normal distribution principle follows the natural law that most data are concentrated near the mean, while a few data deviate from the mean.

[0142] Step S6012: Input the primary flow tensor sequence generated from normal flow data into the initialized encoder to generate the initial spatiotemporal feature vector.

[0143] Among them, normal traffic data is pre-collected network traffic data that has been labeled and confirmed to be free of anomalies. The primary traffic tensor sequence generated by it has been standardized and has a three-dimensional structured format of "time step-number of nodes-number of features", which can be directly adapted to the input requirements of the encoder.

[0144] For example, the initial traffic tensor sequence generated from normal traffic data is input into the initialized encoder, and the encoder performs deep feature extraction operations: although the parameters of the initialized encoder are not optimized, it already has complete feature extraction logic. First, node feature matrices are generated by slicing by time step, then spatial features are aggregated by GAT, temporal dependencies are captured by GRU, and finally global information is fused by multi-head self-attention to obtain the initial spatiotemporal feature vector.

[0145] Step S6013: Input the initial spatiotemporal feature vector into the initialized reconstructor for dimension restoration processing to obtain the reconstructed node feature matrix sequence; the reconstructor consists of deconvolutional layers and / or fully connected layers.

[0146] For example, the initial spatiotemporal feature vector is input into the initialized reconstructor, and dimension recovery processing is performed to obtain the reconstructed node feature matrix sequence. The dimension recovery logic of the reconstructor is the reverse process of the feature extraction logic of the encoder: first, the initial spatiotemporal feature vector is linearly transformed through a fully connected layer, gradually mapping the low-dimensional features to an intermediate dimension that matches the node feature matrix; if the reconstructor contains a deconvolution layer, the spatial dimension of the features is expanded through deconvolution operations, supplementing the correlation structure information between nodes, eliminating the spatial compression effect generated during feature extraction, and finally generating the reconstructed node feature matrix sequence. During the processing, the consistency of the reconstructed node feature matrix sequence output with the primary flow tensor sequence input to the encoder in terms of "time step-number of nodes-number of features" is strictly controlled to ensure that the reconstructed node feature matrix at each time step can be compared with the node feature matrix at the corresponding time step in the normal flow primary tensor.

[0147] Step S6014: Calculate the mean square error between the reconstructed node feature matrix sequence and the primary flow tensor sequence of normal flow data; and use the mean square error as the loss function.

[0148] The mean squared error reflects the model's reconstruction accuracy by quantifying the pixel-level differences between the reconstructed data and the real data. The calculation formula is the mean of the squares of the differences between corresponding elements in the reconstructed sequence and the real sequence.

[0149] For example, during the calculation, the system first iterates through all time steps, nodes, and feature dimensions of the reconstructed node feature matrix sequence and the primary flow tensor sequence, calculating and squaring the difference element by element. Then, it sums all the squared differences and finally divides by the total number of elements to obtain the mean squared error. This mean squared error directly reflects the degree of fit between the initialized encoder and reconstructor and the normal flow pattern: the larger the error value, the worse the fit between the model parameters and the normal flow characteristics; the smaller the error value, the stronger the model's reconstruction ability.

[0150] Step S6015: Minimize the loss function using the backpropagation algorithm until the preset convergence condition is met, stop the iteration, and obtain the updated encoder parameters and the updated reconstructor parameters.

[0151] Among them, the backpropagation algorithm refers to starting from the loss function, calculating the gradient of each learnable parameter with respect to the loss value in reverse, and then adjusting the parameters according to the gradient direction through the optimizer; the preset convergence conditions include the loss function value being stable in the range of minimum value for multiple consecutive rounds, the number of iterations reaching a preset upper limit, etc.; the optimizer is a type of tool, algorithm or program used to solve optimal problems, which finds a combination of variables that allows the objective function (such as cost, error and other indicators) to reach the extreme value (usually minimizing the minimum value such as error) under given constraints.

[0152] For example, the loss function is minimized using the backpropagation algorithm. During the iteration process, each round first obtains the loss value through forward propagation, then calculates the gradients of all parameters of the encoder (GAT weights, GRU gating parameters, self-attention projection parameters) and the reconstructor (fully connected weights, deconvolution kernel parameters) in reverse. Based on the magnitude and direction of the gradients, the parameters are adjusted according to a preset learning rate to reduce the loss value in the next iteration, until a preset convergence condition is met, at which point the iteration stops, resulting in updated encoder and reconstructor parameters. Here, forward propagation refers to starting from the input data and calculating the output of neurons layer by layer to ultimately obtain the model's prediction result.

[0153] Step S6016: Based on the updated encoder parameters and the updated reconstructor parameters, generate the trained encoder and the trained reconstructor.

[0154] For example, based on the updated encoder and reconstructor parameters, parameter values ​​are assigned to the initialized encoder and reconstructor respectively, generating a trained encoder and a trained reconstructor. After the parameter assignment is completed, the parameters of the encoder and reconstructor are solidified so that they do not change in the subsequent anomaly detection stage. The trained encoder has the ability to accurately extract deep spatiotemporal features of normal traffic, and the trained reconstructor is used to reconstruct normal traffic data with high accuracy from these features.

[0155] In this embodiment, a pre-trained reconstructor is used to reconstruct the spatiotemporal feature vectors, generating a reconstructed traffic tensor sequence. An end-to-end training chain is constructed through encoder and reconstructor initialization, normal data feature extraction, dimension restoration, loss calculation, backpropagation optimization, and parameter fixing. This approach efficiently captures the spatiotemporal patterns of normal traffic, solving the problems of poor adaptability during step-by-step training and low efficiency of manual parameter adjustment in traditional models, thus improving the accuracy of feature extraction and data reconstruction for normal traffic.

[0156] In one embodiment, the raw network traffic data is standardized to generate a primary traffic tensor sequence, including:

[0157] Step S701: Aggregate the original network traffic data to obtain network flow records; the network flow records are identified by the source IP address, destination IP address, source port, destination port, and protocol.

[0158] Among them, aggregation processing refers to merging data packets belonging to the same session to eliminate the fragmentation problem of single data packet analysis.

[0159] For example, the collected raw network traffic data is aggregated to generate network flow records uniquely identified by a 5-tuple. The 5-tuple specifically includes the source IP address, destination IP address, source port, destination port, and protocol type (such as Transmission Control Protocol). The destination IP address is the unique identifier of the final receiving target device of a data packet in network communication, used to ensure that data is accurately transmitted from the sending end (source device) to the designated receiving end (target device). For example, the raw network traffic data contains a large number of discrete data packets; direct analysis is redundant and fails to reflect the complete characteristics of a communication session. By parsing the 5-tuple information of each data packet, packets with completely identical 5-tuples are grouped into the same network flow record. Simultaneously, the start and end times of the flow are recorded, ensuring that each network flow record fully represents a continuous network communication process.

[0160] Step S702: Perform multi-dimensional feature extraction processing on the network stream records to obtain the feature vector of each stream record; the feature vector includes duration, number of data packets sent, number of data packets received, total number of bytes sent, total number of bytes received, and TCP flag distribution.

[0161] Among them, multidimensional feature extraction processing refers to filtering, transforming or constructing key features that are more representative and better reflect the essential laws of the data from the original data containing information of multiple dimensions; the flow duration is the time interval from the first data packet to the last data packet in the network flow, which directly reflects the communication duration of the session; the number of data packets sent and received, and the total number of bytes respectively quantify the communication frequency and data transmission volume of the flow, reflecting the scale characteristics of the traffic; the TCP flag distribution counts the number of occurrences of flags such as SYN (Synchronize Sequence Number, indicating connection request), ACK (Acknowledgment, indicating receipt, indicating acknowledgment response), and FIN (Finish, indicating connection closure) in the flow, reflecting the establishment, maintenance and closure status of the TCP connection.

[0162] For example, multidimensional feature extraction processing is performed on each network flow record. By traversing the data packet metadata in the network flow record, the specific values ​​of each feature are calculated one by one, and they are integrated into a feature vector containing key flow attributes.

[0163] Step S703: Based on the preset fixed time window and the feature vector of the IP address stream record, perform aggregation statistical processing to obtain the node feature matrix with each IP address as the node in each time window.

[0164] Among them, the fixed time window is a preset time unit used to divide continuous network flow records into discrete time segments, ensuring that the traffic data in each window has the stability of the time dimension and avoiding interference of cross-time period traffic fluctuations on feature statistics; the aggregation statistical processing is to "summarize and calculate statistics" on the scattered raw data, and extract the scattered information into a generalized and analyzable structured result, so as to quickly grasp the overall characteristics of the data or the specific dimension of the pattern.

[0165] For example, each IP address is treated as a node, and each node needs to aggregate the feature vectors of all flow records within the window that have that IP address as the source or destination IP. During aggregation statistics, numerical features such as the total number of bytes sent and the flow duration are calculated by summation or averaging, while count features such as the number of TCP flags are calculated by summation. The aggregation result of each IP address within the window is placed as a row, and the aggregation results of all IP addresses are arranged in node order to form a two-dimensional node feature matrix of "number of nodes × number of features", thus realizing the preliminary structuring of the three-dimensional association between traffic data and "time-node-feature".

[0166] Step S704: Standardize the node feature matrix to generate a primary flow tensor sequence.

[0167] Standardization can be achieved using the Z-score (also known as the standardized score) method, which is calculated as follows: x is the original feature value in the node feature matrix, μ is the mean of the feature in all normal traffic data in the training set, and σ is the standard deviation of the feature in all normal traffic data in the training set.

[0168] For example, the magnitudes of different features differ significantly. For instance, the flow duration is in seconds and the total number of bytes sent is in bytes. Directly using these features for analysis would lead to the large magnitude of the features dominating the calculation results. By traversing each feature dimension of the node feature matrix and applying the Z-score formula to transform each feature, and then arranging the standardized node feature matrices of all time windows in chronological order, a three-dimensional primary flow tensor sequence of "time step × number of nodes × number of features" is formed.

[0169] In this embodiment, network flow records are obtained by aggregating raw network traffic data; multi-dimensional feature extraction is performed on the network flow data to obtain feature vectors for each flow record; the feature vectors are aggregated and statistically processed according to a preset time window to generate a node feature matrix; and the node feature matrix is ​​standardized to obtain a primary traffic tensor sequence. This effectively solves the problems of data fragmentation, feature partiality, and magnitude interference in traditional preprocessing, and improves the adaptability and accuracy of identifying abnormal traffic in complex network environments.

[0170] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0171] Based on the same inventive concept, this application also provides a network traffic anomaly detection system based on deep feature extraction for implementing the network traffic anomaly detection method based on deep feature extraction described above. The solution provided by this system is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more embodiments of the network traffic anomaly detection system based on deep feature extraction provided below can be found in the limitations of the network traffic anomaly detection method based on deep feature extraction described above, and will not be repeated here.

[0172] In one exemplary embodiment, such as Figure 3 As shown, a network traffic anomaly detection system 300 based on deep feature extraction is provided, including:

[0173] The data acquisition module 301 is used to acquire raw network traffic data and perform standardization processing on the raw network traffic data to generate a primary traffic tensor sequence.

[0174] The vector generation module 302 is used to perform deep feature extraction processing on the primary flow tensor sequence through a trained encoder to generate spatiotemporal feature vectors.

[0175] The sequence generation module 303 is used to perform data reconstruction processing on the spatiotemporal feature vector to obtain the reconstructed flow tensor sequence.

[0176] The result generation module 304 is used to calculate the reconstruction error between the reconstructed flow tensor sequence and the primary flow tensor sequence; and to generate flow anomaly detection results based on the reconstruction error and a preset error threshold.

[0177] In one embodiment, the vector generation module 302 is further configured to:

[0178] The primary flow tensor sequence is sliced ​​according to time steps to obtain the node feature matrix of each time step; the node feature matrix is ​​a graph structure.

[0179] A multi-layer graph attention network is used to perform feature aggregation on the feature matrix of each node to generate a spatial feature matrix for each time step.

[0180] Each spatial feature matrix is ​​processed by forward temporal propagation through a gated recurrent unit to obtain the hidden state vector at each time step.

[0181] Arrange each hidden state vector according to time steps to generate a sequence of hidden state vectors;

[0182] Based on the hidden state vector sequence, a multi-head self-attention mechanism is used to perform weighted fusion of global context information to generate a spatiotemporal feature vector.

[0183] In one embodiment, the vector generation module 302 is further configured to:

[0184] A linear transformation is performed on the feature matrix of each node to obtain the high-dimensional feature vector of each node; the node represents a specific entity.

[0185] Based on each high-dimensional feature vector, calculate the attention coefficient between the target node and its neighboring nodes;

[0186] Based on the attention coefficient, a weighted summation is performed on the high-dimensional feature vectors of all neighboring nodes to obtain a new feature vector for each node:

[0187]

[0188] in, For the new feature vector, For activation function, Attention coefficient Let i be the high-dimensional feature vector of the neighboring nodes, and j be the node identifiers. The set of all neighboring nodes;

[0189] Based on each new feature vector, a final new feature vector for each node is generated through multi-layer graph convolution processing.

[0190] All the final new feature vectors are combined in node order to generate the spatial feature matrix for each time step.

[0191] In one embodiment, the vector generation module 302 is further configured to:

[0192] Based on each high-dimensional feature vector, the attention coefficient between the target node and its neighboring nodes is calculated using the following formula:

[0193]

[0194] in, Here, is the attention coefficient, 'a' is a learnable parameter, and '∥' represents vector concatenation. The high-dimensional feature vectors of the neighboring nodes, Let be the high-dimensional feature vector of the node, and LeakyReLU be the activation function. For normalization function, For transpose, i and j are node identifiers.

[0195] In one embodiment, the vector generation module 302 is further configured to:

[0196] Different linear projection processes are applied to the hidden state vector sequence to obtain the query vector matrix, key vector matrix, and value vector matrix;

[0197] The query vector matrix, key vector matrix, and value vector matrix are partitioned along the feature dimension to obtain multiple spaces; the spaces include query vector submatrices, key vector submatrices, and value vector submatrices.

[0198] The self-attention output for each space is calculated using the following formula:

[0199]

[0200] in, For self-attention output, For normalization function, To query the vector submatrix, The key vector submatrix Let T be a value vector submatrix, and T be its transpose. The dimension of the key vector submatrix or query vector submatrix;

[0201] Concatenate all self-attention outputs to obtain a concatenation matrix;

[0202] Linear projection is performed on the concatenated matrix to generate spatiotemporal feature vectors.

[0203] In one embodiment, the sequence generation module 303 is further configured to:

[0204] Input the spatiotemporal feature vectors into the trained reconstructor and output the reconstructed flow tensor sequence;

[0205] The trained reconstructor is obtained through the following method:

[0206] The encoder and reconstructor are initialized to obtain the initialized encoder and reconstructor; the encoder and reconstructor are jointly optimized end-to-end; the encoder includes a multi-layer graph attention network, a gated recurrent unit, and a multi-head self-attention mechanism;

[0207] The initial flow tensor sequence generated from normal flow data is input into the initialized encoder to generate the initial spatiotemporal feature vector.

[0208] The initial spatiotemporal feature vector is input into the initialized reconstructor for dimensionality restoration to obtain the reconstructed node feature matrix sequence; the reconstructor consists of deconvolutional layers and / or fully connected layers;

[0209] Calculate the mean square error between the reconstructed node feature matrix sequence and the primary flow tensor sequence of normal flow data; and use the mean square error as the loss function.

[0210] The loss function is minimized through backpropagation until the preset convergence condition is met, then the iteration stops, and the updated encoder parameters and the updated reconstructor parameters are obtained.

[0211] Based on the updated encoder parameters and the updated reconstructor parameters, a trained encoder and a trained reconstructor are generated.

[0212] In one embodiment, the data acquisition module 301 is further configured to:

[0213] The raw network traffic data is aggregated to obtain network flow records; network flow records are identified by source IP address, destination IP address, source port, destination port, and protocol.

[0214] Multidimensional feature extraction is performed on network stream records to obtain a feature vector for each stream record. The feature vector includes duration, number of data packets sent, number of data packets received, total number of bytes sent, total number of bytes received, and TCP flag distribution.

[0215] Based on a preset fixed time window and the feature vectors of the flow records by IP address, the feature matrix of each node with each IP address as the node is obtained by aggregation and statistical processing.

[0216] The node feature matrix is ​​standardized to generate a primary flow tensor sequence.

[0217] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the network traffic anomaly detection method based on deep feature extraction as described above.

[0218] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0219] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0220] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A network traffic anomaly detection method based on deep feature extraction, characterized in that, The method comprises: Collecting original network traffic data; and performing standardization processing on the original network traffic data to generate a primary traffic tensor sequence; Performing deep feature extraction processing on the primary traffic tensor sequence by using a trained encoder to generate a spatio-temporal feature vector; Performing data reconstruction processing on the spatio-temporal feature vector to obtain a reconstructed traffic tensor sequence; Calculating a reconstruction error of the reconstructed traffic tensor sequence and the primary traffic tensor sequence; and generating a traffic anomaly detection result based on the reconstruction error and a preset error threshold.

2. The method of claim 1, wherein, The deep feature extraction processing on the primary traffic tensor sequence by using the trained encoder to generate the spatio-temporal feature vector comprises: Slicing each time step of the primary traffic tensor sequence to obtain a node feature matrix of each time step; the node feature matrix is a graph structure; Performing feature aggregation processing on each node feature matrix by using a multi-layer graph attention network to generate a spatial feature matrix of each time step; Performing forward time series propagation processing on each spatial feature matrix by using a gated recurrent unit to obtain a hidden state vector of each time step; Arranging each hidden state vector according to time steps to generate a hidden state vector sequence; Performing global context information weighted fusion processing on the hidden state vector sequence by using a multi-head self-attention mechanism to generate a spatio-temporal feature vector.

3. The method of claim 2, wherein, The feature aggregation processing on each node feature matrix by using the multi-layer graph attention network to generate the spatial feature matrix of each time step comprises: Performing linear transformation processing on each node feature matrix to obtain a high-dimensional feature vector of each node; the node represents a specific entity; Based on each high-dimensional feature vector, calculating an attention coefficient between a target node and neighbor nodes of the target node; Based on the attention coefficient, performing weighted summation processing on the high-dimensional feature vectors of all neighbor nodes to obtain a new feature vector of each node: wherein, is a new feature vector, is an activation function, is an attention coefficient, is a high-dimensional feature vector of a neighbor node, i and j are node identifiers, is a set of all neighbor nodes; Based on each new feature vector, performing multi-layer graph convolution processing to generate a final new feature vector of each node; Combining all final new feature vectors according to node order to generate a spatial feature matrix of each time step.

4. The method of claim 3, wherein, The calculation of the attention coefficient between the target node and the neighbor nodes of the target node based on each high-dimensional feature vector comprises: Based on each high-dimensional feature vector, the attention coefficient between the target node and the neighbor nodes of the target node is calculated by the following formula: wherein, is an attention coefficient, a is a learnable parameter, and || denotes vector concatenation, is a high-dimensional feature vector of a neighbor node, is a high-dimensional feature vector of a node, and LeakyReLU is an activation function, is a normalization function, is a transpose, and i and j are node identifiers.

5. The method of claim 2, wherein, The global context information weighted fusion processing on the hidden state vector sequence by using the multi-head self-attention mechanism to generate the spatio-temporal feature vector comprises: Performing different linear projection processing on the hidden state vector sequence to obtain a query vector matrix, a key vector matrix and a value vector matrix; Performing feature dimension segmentation processing on the query vector matrix, the key vector matrix and the value vector matrix to obtain a plurality of spaces; the space comprises a query vector sub-matrix, a key vector sub-matrix and a value vector sub-matrix; The self-attention output of each space is calculated by the following formula: wherein, is a self-attention output, is a normalization function, is a query vector submatrix, is a key vector submatrix, is a value vector submatrix, T is a transpose, is a dimension of the key vector submatrix or the query vector submatrix. Splice all the self-attention outputs to obtain a spliced matrix; Perform linear projection processing on the spliced matrix to generate a spatio-temporal feature vector.

6. The method of claim 1, wherein, The data reconstruction processing on the spatio-temporal feature vector includes: Input the spatio-temporal feature vector into the trained reconstructor to output a reconstructed traffic tensor sequence; The trained reconstructor is obtained by the following method: Initialize the encoder and the reconstructor to obtain an initialized encoder and an initialized reconstructor; the encoder and the reconstructor are optimized end-to-end; the encoder includes a multi-layer graph attention network, a gated recurrent unit, and a multi-head self-attention mechanism; Input the primary traffic tensor sequence generated by the normal traffic data into the initialized encoder to generate an initial spatio-temporal feature vector; Input the initial spatio-temporal feature vector into the initialized reconstructor for dimension recovery processing to obtain a reconstructed node feature matrix sequence; the reconstructor is composed of a deconvolution layer and / or a fully connected layer; Calculate the mean square error between the reconstructed node feature matrix sequence and the primary traffic tensor sequence of the normal traffic data; and take the mean square error as a loss function; Minimize the loss function by a back propagation algorithm until a preset convergence condition is met, stop iteration, and obtain updated encoder parameters and updated reconstructor parameters; Generate the trained encoder and the trained reconstructor based on the updated encoder parameters and the updated reconstructor parameters.

7. The method of claim 1, wherein, The standardization processing on the original network traffic data to generate a primary traffic tensor sequence includes: Aggregate the original network traffic data to obtain network flow records; the network flow records are identified by source IP address, destination IP address, source port, destination port, and protocol; Perform multi-dimensional feature extraction processing on the network flow records to obtain a feature vector of each flow record; the feature vector includes duration, number of sent packets, number of received packets, total number of sent bytes, total number of received bytes, and TCP flag distribution; Based on a preset fixed time window and IP address, aggregate and statistically process the feature vectors of the flow records to obtain a node feature matrix with each IP address as a node within each time window; Perform standardization processing on the node feature matrix to generate a primary traffic tensor sequence.

8. A network traffic anomaly detection system based on deep feature extraction, characterized in that, The system includes: A data acquisition module for acquiring original network traffic data and performing standardization processing on the original network traffic data to generate a primary traffic tensor sequence; A vector generation module for performing deep feature extraction processing on the primary traffic tensor sequence by a trained encoder to generate a spatio-temporal feature vector; A sequence generation module for performing data reconstruction processing on the spatio-temporal feature vector to obtain a reconstructed traffic tensor sequence; A result generation module for calculating reconstruction error of the reconstructed traffic tensor sequence and the primary traffic tensor sequence, and generating a traffic anomaly detection result based on the reconstruction error and a preset error threshold. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 7.

Images