Network traffic anomaly detection and identification method based on artificial intelligence

Abstract

The invention discloses a network traffic anomaly detection and identification method based on artificial intelligence, and the method comprises the following steps: obtaining original network traffic data, carrying out the preprocessing, and carrying out the fusion construction of a multi-layer traffic language field tensor; behavior semantic modeling and path structure coding are carried out; constructing a behavior event sequence tensor, inputting the behavior event sequence tensor into the improved RetNet model, and outputting a behavior drift response vector; performing deviation analysis on the behavior drift response vector and the target behavior intention trajectory tensor, and constructing an abnormal evolution graph of abnormal growth and propagation; performing type classification and causal analysis according to the abnormal evolution graph, and outputting an abnormal type label and a causal path set; constructing a minimum disturbance sample, and performing comparative reasoning to generate an abnormal credibility change interval and an anti-robust score; and updating the abnormal knowledge graph and executing incremental updating. According to the invention, high-precision, interpretable and robust anomaly detection and classification analysis in a complex network environment can be realized.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence technology, and in particular to a method for detecting and identifying network traffic anomalies based on artificial intelligence. Background Technology

[0002] With the rapid development of network infrastructure and the continuous expansion of data communication scale, the network environment exhibits complex characteristics of high throughput, high frequency fluctuations, and multi-protocol concurrency. Especially in high-value scenarios such as industrial control, financial services, the Internet of Things, and critical infrastructure, the detection and identification of abnormal network behavior has become a core task for ensuring system security and business continuity. Existing network traffic anomaly detection technologies are mainly based on statistical models, machine learning classifiers, or deep learning feature extraction structures, relying on traffic fields, connection behavior, or feature distributions within a fixed time window for classification and judgment. However, in practical applications, they generally suffer from the following problems:

[0003] Current methods mostly perform single-granularity field parsing or packet-level feature extraction on network traffic, lacking the ability to jointly model protocol-level semantics, communication path topology, and byte sequence context. This results in insufficient dimensions for describing anomalous behavior and difficulty in capturing cross-layer attack intent and pattern drift. Existing models mostly use traditional sequence modeling structures such as RNNs or Transformers, which suffer from memory decay or structural drift when facing long-term windows and concurrent time-series traffic from multiple communication links, failing to maintain the consistency and traceability of key behavioral trajectories. Mainstream detection systems only output anomaly labels or simple probability scores, lacking structured modeling and causal reasoning capabilities for anomaly evolution paths, making it difficult to support link-level tracing, root cause localization, and response strategy optimization for complex attacks. In terms of anomaly verification and model robustness evaluation, existing technologies usually rely on manual annotation or static test sets, lacking automated comparative reasoning mechanisms and reliable measurement standards, making model performance susceptible to adversarial examples and exhibiting weak generalization ability. System-level updates mostly rely on static retraining or fixed rule configurations, lacking incrementally updatable knowledge feedback mechanisms, making it difficult to adapt to dynamic behavioral evolution and new anomaly patterns in changing network environments.

[0004] Therefore, how to provide a method for detecting and identifying network traffic anomalies based on artificial intelligence is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose an artificial intelligence-based method for detecting and identifying network traffic anomalies. This invention integrates traffic language modeling, behavioral intent construction, and behavioral drift perception technologies. It performs temporal dependency modeling based on an improved RetNet model, constructs an anomaly evolution graph, and establishes an anomaly knowledge graph by combining causal paths and adversarial evaluation. Through full-link semantic construction and linkage update mechanism, it achieves highly robust identification and dynamic adaptation of network anomalies, and has the advantages of high perception accuracy, strong interpretability, and excellent model adaptability.

[0006] A method for detecting and identifying network traffic anomalies based on artificial intelligence according to an embodiment of the present invention includes the following steps:

[0007] The raw network traffic data is acquired, preprocessed to generate multi-granularity semantic units, and fused to construct a multi-layer traffic language field tensor.

[0008] Using the multi-layer traffic language field tensor as input, we perform behavioral semantic modeling and path structure encoding to generate the target behavior intent trajectory tensor.

[0009] A behavior event sequence tensor is constructed based on a multi-layer flow language field tensor. The behavior event sequence tensor is then input into an improved RetNet model to perform cross-temporal behavior dependency modeling and pattern preservation computation, and outputs a behavior drift response vector.

[0010] By comparing and analyzing the behavior drift response vector with the target behavior intention trajectory tensor, behavior segments with deviations exceeding a preset threshold are identified, and an abnormal evolution map is constructed by combining time sequence and communication path information.

[0011] Using the anomaly evolution graph as input, the system performs type classification and causal analysis based on the semantic relationships and topological structure between nodes, and outputs anomaly type labels and corresponding causal path sets.

[0012] Select representative anomalous nodes indicated by the anomalous type label, construct the minimum perturbation sample, compare and reason with the original sample to generate the anomalous credibility change range and adversarial robustness score.

[0013] The behavior drift response vector, anomaly type label, causal path set, anomaly credibility change range and adversarial robustness score are jointly written into the anomaly knowledge graph. The behavior semantic construction process, RetNet model parameters and type classification rules are adjusted based on the graph incremental update mechanism.

[0014] Optionally, the step of acquiring raw network traffic data, preprocessing it to generate multi-granularity semantic units, and fusing them to construct a multi-layer traffic language field tensor specifically includes:

[0015] Collect a complete set of data packets arranged in timestamp order as raw network traffic data. Each data packet includes a link layer frame header, IP address field, port number, protocol type, timestamp, and payload content.

[0016] The raw network traffic data is preprocessed, including protocol field parsing, payload segmentation and communication path classification, to construct multi-granularity semantic units;

[0017] The protocol field parsing extracts field content according to the protocol hierarchy, in the order of link layer, network layer, transport layer and application layer, and organizes the extraction results into a structured field table in the "field-value" format to generate a protocol-level representation;

[0018] The payload segmentation targets the application layer payload data of each data packet and uses a set window sliding method to perform byte segmentation. The resulting byte fragments are concatenated into a continuous byte sequence in their original order to generate a byte-level representation.

[0019] The communication path classification generates communication path identifiers based on the combination of five-tuple fields. Data packets with the same communication path identifier are grouped into the same path set, and a context behavior sequence is constructed in chronological order to generate a topology context representation.

[0020] The protocol-level representation, byte-level representation, and topology context representation are aligned using the packet timestamp as the primary index in a three-channel manner, and placeholder vectors are filled for missing items to ensure timing consistency.

[0021] The protocol-level representation, byte-level representation, and topological context representation are stacked in a preset order to construct a three-dimensional representation structure with semantic hierarchy, generating a multi-layered traffic language field tensor.

[0022] Optionally, the step of taking the multi-layer traffic language field tensor as input, performing behavioral semantic modeling and path structure encoding, and generating the target behavioral intent trajectory tensor specifically includes:

[0023] The multi-layer flow language field tensor is windowed along the time axis and divided into several behavior segments of a set length.

[0024] Three feature information is extracted for each behavioral segment, including time location embedding, communication rhythm encoding, and protocol path structure;

[0025] The three feature information are concatenated to form a unified behavioral semantic representation sequence, which is then input into a temporal modeling network for contextual modeling to extract high-dimensional trajectory representations of behavioral segments.

[0026] The high-dimensional trajectory representation sequences of all behavioral fragments are spliced ​​together in chronological order to construct a complete target behavioral intent trajectory tensor.

[0027] Optionally, the improved RetNet model specifically includes:

[0028] Align the multi-layer traffic language field tensor and the target behavior intent trajectory tensor one by one according to time steps, and in each time step, concatenate the byte-level representation, protocol-level representation, topology context representation and intent trajectory representation according to the set channel order to form a behavior event sequence tensor;

[0029] The behavioral event sequence tensor is input into the improved RetNet model, which consists of a kernel-preserving layer, a residual memory path layer, and a rhythm-aware gating layer in sequence.

[0030] The kernel layer performs a structure-preserving convolution operation on the behavior event sequence tensor in the time direction. It uses a convolution kernel with exponentially decaying weights to accumulate the current time step and the historical time steps. The weights of the convolution kernel decrease according to the time step difference, generating a context state vector with historical memory.

[0031] The residual memory path layer processes the context state vector and the behavior event sequence tensor in parallel over time steps. One path uses a fully connected layer to perform a linear mapping operation, while the other path uses the ReLU activation function to perform a nonlinear mapping operation, resulting in two sets of feature vectors. The two sets of feature vectors are then weighted and summed according to a preset residual fusion coefficient to obtain the residual enhanced features.

[0032] The rhythm-aware gating layer constructs a rhythm feature vector for each time step, generates a gating control value by performing two fully connected linear mappings and one sigmoid function compression activation operation on the rhythm feature vector, and performs element-wise multiplication between the gating control value and the residual enhancement feature to obtain a rhythm-weighted behavioral state representation.

[0033] The rhythm-weighted behavioral state representations of all time steps are combined in their original time order to form a behavioral drift response vector;

[0034] The continuity of the behavior drift response vector is determined. When the deviation of several consecutive time steps reaches the set drift threshold, the corresponding time steps are aggregated into anomaly candidate nodes. The order and path association between the anomaly candidate nodes are connected by the communication path identifier to generate an anomaly evolution map.

[0035] Optionally, the step of comparing and analyzing the behavior drift response vector with the target behavior intent trajectory tensor to identify behavior segments whose deviation exceeds a preset threshold, and constructing an anomaly evolution map by combining time sequence and communication path information, specifically includes:

[0036] The difference values ​​of the feature vectors at the same location in the behavior drift response vector and the target behavior intention trajectory tensor are calculated in units of time steps to generate a sequence of difference mapping vectors representing the degree of behavior deviation.

[0037] A sliding window analysis is performed on the difference mapping vector sequence, and regions where the difference value exceeds a preset deviation threshold in multiple consecutive time steps are selected as abnormal segments.

[0038] Each time step set that is determined to be an abnormal segment is constructed as an abnormal behavior node, and the corresponding source address, destination address, source port, and destination port are extracted as path identifiers. Abnormal behavior nodes with the same path identifier and continuous time are grouped into the same communication link segment.

[0039] Within each communication link segment, time evolution edges are established according to the chronological order. Between different communication link segments, path dependency edges are established based on the cross-reuse of the source or destination ends between communication paths. All abnormal behavior nodes and edge sets are integrated into an abnormal evolution graph.

[0040] Optionally, the step of taking the anomaly evolution graph as input, performing type classification and causal analysis based on the semantic relationships and topological structure between nodes, and outputting anomaly type labels and corresponding causal path sets specifically includes:

[0041] For each anomalous behavior node in the anomalous evolution graph, node attributes are extracted, and the nodes are initially aggregated using the center matching clustering method.

[0042] An anomaly type label mapping table is established based on the aggregated node groups, and each node is assigned to the anomaly type category with the highest similarity score.

[0043] Identify the set of path origins in the anomalous evolution map;

[0044] Starting from each starting node, a directed traversal is performed along the time evolution edges and path dependency edges in the anomaly evolution graph to construct a path sequence for all reachable nodes;

[0045] All path sequences are filtered, and paths whose length exceeds the minimum propagation depth threshold and contain cross-communication paths are retained to form a causal path candidate set;

[0046] Perform pattern compression on each path in the causal path candidate set;

[0047] Based on the trend of behavioral drift response values ​​of nodes in the compressed path, a propagation confidence weight is assigned to each path to form a set of causal paths.

[0048] Optionally, the step of selecting representative anomalous nodes indicated by the anomaly type label, constructing a minimum perturbation sample, comparing and reasoning with the original sample, and generating anomaly confidence variation range and adversarial robustness score specifically includes:

[0049] Based on the anomaly type label and the causal path set, the expression of each causal path is analyzed, and nodes with drift response values ​​higher than a set threshold are selected as candidate nodes for perturbation locations, generating a perturbation sample set.

[0050] The abnormal behavior nodes and corresponding perturbation samples in the causal path expression are respectively input into the improved RetNet model. The output anomaly type label and behavior drift response value are compared to generate the confidence difference before and after the perturbation. The range of response amplitude change caused by the perturbation is calculated as the anomaly confidence change range.

[0051] Based on the degree of change in the response of the perturbation sample, the influence of the original abnormal behavior node on the judgment result of the improved RetNet model is evaluated. Stability labels are assigned according to whether the perturbation changes the original classification result, and the proportion of anomaly types that remain consistent under multiple perturbation strategies is calculated to form an adversarial robustness score.

[0052] Optionally, the step of jointly writing the behavior drift response vector, anomaly type label, causal path set, anomaly confidence change range, and adversarial robustness score into the anomaly knowledge graph, and adjusting the behavior semantic construction process, improved RetNet model parameters, and type classification rules based on the graph incremental update mechanism, specifically includes:

[0053] The behavioral drift response vector, anomaly type label, causal path set, anomaly credibility variation range, and adversarial robustness score are organized into structured data and written into an anomaly knowledge graph.

[0054] The graph incremental update mechanism is invoked to identify newly added or changed abnormal nodes and path structures in the abnormal knowledge graph, and update regions are established based on structural differences and timestamp order.

[0055] The communication order, behavior rhythm and path expression of nodes in the updated area are reconstructed, the behavior semantic construction process is adjusted, and a new semantic fragment sequence is generated by using a sliding window and dynamic fragment fusion method.

[0056] Based on the change range of behavior drift response vectors in the anomaly knowledge graph, the cross-attention weights of the improved RetNet model are updated using residual alignment.

[0057] For nodes with changing anomaly type labels in the anomaly knowledge graph, a type re-judgment operation is performed. By combining the intensity of the behavior drift response vector with the coverage of the anomaly credibility change range, the anomaly type classification rules are optimized, and the linkage adjustment based on the feedback of the anomaly knowledge graph is completed.

[0058] The beneficial effects of this invention are:

[0059] This invention introduces innovative mechanisms in multi-layer semantic modeling, temporal construction, causal analysis, and model evolution, solving problems such as single granularity, weak context, lack of interpretability, and poor adaptability in existing network traffic anomaly detection methods. First, by constructing multi-granularity semantic units and fusing them to generate a multi-layer traffic language field tensor, and unifying the encoding protocol fields, byte sequences, and communication path structures, the model's ability to express complex traffic features is significantly improved, enhancing its ability to identify hidden, cross-path anomalies. Second, by employing behavioral semantic modeling and target behavior intent trajectory construction, and introducing communication rhythm and path structure features, anomaly judgment is upgraded from static field detection to dynamic behavior recognition, better adapting to the needs of progressive anomaly behavior recognition.

[0060] In terms of temporal modeling, this invention innovatively introduces an improved RetNet model, integrating kernel function preservation, residual memory paths, and rhythm-aware gating structures. This maintains long-term dependencies while possessing rhythmic stability in concurrent scenarios, significantly outperforming traditional RNN or Transformer structures and making it suitable for high-concurrency, long-sequence network environments. By comparing and analyzing behavioral drift response vectors and intent trajectories, anomaly evolution maps are constructed and causal path analysis is performed, achieving an interpretable transition from "abnormal results" to "abnormal processes" and "root cause mechanisms." Furthermore, comparative inference is performed using minimum perturbation samples to generate credibility variation ranges and adversarial robustness scores, effectively improving the model's stability and security in attack avoidance and adversarial scenarios.

[0061] By writing anomalous information into an anomaly knowledge graph and introducing an incremental update mechanism to adjust the behavior construction process, RetNet model parameters, and classification rules, the anomaly detection system achieves adaptive evolution and long-term effective operation. This invention has significant innovations in multidimensional modeling, structural analysis, and continuous updating, enabling high-confidence, robust, and interpretable anomaly detection capabilities in complex network environments. Attached Figure Description

[0062] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0063] Figure 1 This is a flowchart of a network traffic anomaly detection and identification method based on artificial intelligence proposed in this invention;

[0064] Figure 2 This is a schematic diagram of a network traffic anomaly detection and identification method based on artificial intelligence proposed in this invention;

[0065] Figure 3 This is a framework diagram of the improved RetNet model in the artificial intelligence-based network traffic anomaly detection and identification method proposed in this invention. Detailed Implementation

[0066] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0067] refer to Figure 1-3 A method for detecting and identifying network traffic anomalies based on artificial intelligence, comprising the following steps:

[0068] The raw network traffic data is acquired, preprocessed to generate multi-granularity semantic units, and fused to construct a multi-layer traffic language field tensor.

[0069] Using the multi-layer traffic language field tensor as input, we perform behavioral semantic modeling and path structure encoding to generate the target behavior intent trajectory tensor.

[0070] A behavior event sequence tensor is constructed based on a multi-layer flow language field tensor. The behavior event sequence tensor is then input into an improved RetNet model to perform cross-temporal behavior dependency modeling and pattern preservation computation, and outputs a behavior drift response vector.

[0071] By comparing and analyzing the behavior drift response vector with the target behavior intention trajectory tensor, behavior segments with deviations exceeding a preset threshold are identified, and an abnormal evolution map is constructed by combining time sequence and communication path information.

[0072] Using the anomaly evolution graph as input, the system performs type classification and causal analysis based on the semantic relationships and topological structure between nodes, and outputs anomaly type labels and corresponding causal path sets.

[0073] Select representative anomalous nodes indicated by the anomalous type label, construct the minimum perturbation sample, compare and reason with the original sample to generate the anomalous credibility change range and adversarial robustness score.

[0074] The behavior drift response vector, anomaly type label, causal path set, anomaly credibility change range and adversarial robustness score are jointly written into the anomaly knowledge graph. The behavior semantic construction process, RetNet model parameters and type classification rules are adjusted based on the graph incremental update mechanism.

[0075] In this embodiment, the steps of acquiring raw network traffic data, preprocessing it to generate multi-granularity semantic units, and fusing them to construct a multi-layer traffic language field tensor specifically include:

[0076] Collect a complete set of data packets arranged in timestamp order as raw network traffic data. Each data packet includes a link layer frame header, IP address field, port number, protocol type, timestamp, and payload content.

[0077] The raw network traffic data is preprocessed, including protocol field parsing, payload segmentation and communication path classification, to construct multi-granularity semantic units;

[0078] The protocol field parsing extracts field content according to the protocol layer structure in the order of link layer, network layer, transport layer and application layer. The field content includes source address, destination address, source port, destination port, protocol name, timestamp and data length. The extraction results are organized into a structured field table in the "field-value" format to generate a protocol-level representation.

[0079] The payload segmentation targets the application layer payload data of each data packet and uses a set window sliding method to perform byte segmentation. The resulting byte fragments are concatenated into a continuous byte sequence in their original order to generate a byte-level representation.

[0080] The communication path classification is based on the combination of five-tuple fields to generate communication path identifiers. The five-tuple includes source address, destination address, source port, destination port and protocol name. Data packets with the same communication path identifier are grouped into the same path set, and a context behavior sequence is constructed in chronological order to generate a topology context representation.

[0081] The protocol-level representation, byte-level representation, and topology context representation are aligned using the packet timestamp as the primary index in a three-channel manner, and placeholder vectors are filled for missing items to ensure timing consistency.

[0082] The protocol-level representation, byte-level representation, and topological context representation are stacked in a preset order to construct a three-dimensional representation structure with semantic hierarchy, generating a multi-layered traffic language field tensor.

[0083] In this embodiment, the step of taking the multi-layer traffic language field tensor as input, performing behavioral semantic modeling and path structure encoding, and generating the target behavioral intent trajectory tensor specifically includes:

[0084] The multi-layer flow language field tensor is windowed along the time axis and divided into several behavior segments of a set length.

[0085] Three feature information is extracted for each behavior segment, including time position embedding, communication rhythm encoding, and protocol path structure. The time position embedding refers to calculating the relative time position of each time step in the behavior segment based on the timestamp corresponding to each time step, and mapping the time difference value to a position offset vector to characterize the arrangement characteristics of the behavior in the time series. The communication rhythm encoding refers to extracting the time difference sequence and transmission rate information based on the time interval, direction change, and port alternation of consecutive data packets in the segment, and constructing a rhythm vector that reflects the rhythm change of the behavior. The protocol path structure refers to constructing a set of point-to-point transmission paths based on the source address, destination address, source port, and destination port fields extracted from the protocol-level representation, and constructing a local protocol path graph based on the path hop count limit.

[0086] The three feature information are concatenated to form a unified behavioral semantic representation sequence, which is then input into a temporal modeling network for contextual modeling. The temporal modeling network is a deep semantic modeling structure built based on a residual gating mechanism to extract high-dimensional trajectory representations of behavioral fragments.

[0087] The high-dimensional trajectory representation sequences of all behavioral fragments are spliced ​​together in chronological order to construct a complete target behavioral intent trajectory tensor. The tensor maintains the same time step as the multi-layer traffic language field tensor and includes the intent layer output channel.

[0088] In this embodiment, the improved RetNet model specifically includes:

[0089] Align the multi-layer traffic language field tensor and the target behavior intent trajectory tensor one by one according to time steps, and in each time step, concatenate the byte-level representation, protocol-level representation, topology context representation and intent trajectory representation according to the set channel order to form a behavior event sequence tensor;

[0090] The behavioral event sequence tensor is input into the improved RetNet model, which consists of a kernel-preserving layer, a residual memory path layer, and a rhythm-aware gating layer in sequence.

[0091] The kernel layer performs a structure-preserving convolution operation on the behavior event sequence tensor in the time direction. It uses a convolution kernel with exponentially decaying weights to accumulate the current time step and the historical time steps. The weights of the convolution kernel decrease according to the time step difference, generating a context state vector with historical memory.

[0092] The residual memory path layer processes the context state vector and the behavior event sequence tensor in parallel over time steps. One path uses a fully connected layer to perform a linear mapping operation, while the other path uses the ReLU activation function to perform a non-linear mapping operation, resulting in two sets of feature vectors. The two sets of feature vectors are then weighted and summed according to a preset residual fusion coefficient to obtain residual enhanced features, which are used to maintain the input structural information and improve the correlation ability across semantic features.

[0093] The rhythm-aware gating layer constructs a rhythm feature vector for each time step. The rhythm feature vector consists of the time interval between adjacent data packets, communication direction change flags, and port switching sequences. The rhythm feature vector is processed through two fully connected linear mappings and one sigmoid function compression activation operation to generate a gating control value. The gating control value is then multiplied element-wise with the residual enhancement feature to obtain a rhythm-weighted behavior state representation.

[0094] The rhythm-weighted behavioral state representations of all time steps are combined in their original time order to form a behavioral drift response vector. This behavioral drift response vector is used to measure the degree of deviation between the behavioral event sequence and the target behavioral intention trajectory tensor in terms of temporal sequence, path, and protocol structure.

[0095] The continuity of the behavior drift response vector is determined. When the deviation of several consecutive time steps reaches a set drift threshold, the corresponding time steps are aggregated into anomaly candidate nodes. The order and path association between the anomaly candidate nodes are connected by the communication path identifier to generate an anomaly evolution map. The nodes of the anomaly evolution map represent behavior segments with high drift characteristics, and the edges represent the evolution relationship of the behavior anomaly in time and path.

[0096] In this embodiment, the step of comparing and analyzing the behavior drift response vector with the target behavior intent trajectory tensor to identify behavior segments whose deviation exceeds a preset threshold, and constructing an anomaly evolution map by combining time sequence and communication path information, specifically includes:

[0097] The difference values ​​of the feature vectors at the same location in the behavior drift response vector and the target behavior intention trajectory tensor are calculated in units of time steps to generate a sequence of difference mapping vectors representing the degree of behavior deviation.

[0098] The difference value calculation adopts the difference analysis method based on vector distance metric, which calculates the element-wise difference between each state representation in the behavior drift response vector and the intention trajectory vector at the corresponding time step, and generates the difference value by adding the normalized weighted absolute values, which is used to quantify the degree of deviation between the current behavior state and the target intention.

[0099] A sliding window analysis is performed on the difference mapping vector sequence, and regions where the difference value exceeds a preset deviation threshold in multiple consecutive time steps are selected as abnormal segments. The preset deviation threshold is an empirical upper limit obtained based on the statistical distribution of normal behavior deviations in training samples, and is used to define high deviation behavior regions.

[0100] Each time step set that is determined to be an abnormal segment is constructed as an abnormal behavior node, and the corresponding source address, destination address, source port, and destination port are extracted as path identifiers. Abnormal behavior nodes with the same path identifier and continuous time are grouped into the same communication link segment.

[0101] Within each communication link segment, temporal evolution edges are established according to the chronological order to represent the sequential expansion trend of abnormal behavior in the same path. Between different communication link segments, path dependency edges are established based on the cross-reuse of the source or destination ends between communication paths to represent the cross-path association of abnormal propagation. All abnormal behavior nodes and edge sets are integrated into an abnormal evolution graph. In the abnormal evolution graph, nodes represent behavior segments with deviations exceeding the threshold, and edges represent abnormal diffusion paths under the time series and path structure. The communication link segments constitute structural clustering regions in the abnormal evolution graph, improving the coherence of evolution paths and structural separability in the abnormal evolution graph.

[0102] In this embodiment, the step of taking the anomaly evolution graph as input, performing type classification and causal analysis based on the semantic relationships and topological structure between nodes, and outputting anomaly type labels and corresponding causal path sets specifically includes:

[0103] For each anomalous behavior node in the anomalous evolution graph, node attributes are extracted, including protocol field features, communication path identifiers, byte pattern features and corresponding behavior drift response values ​​of the behavior fragments. The nodes are then initially aggregated using the center matching clustering method, which calculates the attribute similarity score between the current node and the prototype based on the type prototype in the historical known anomalous samples.

[0104] An anomaly type label mapping table is established based on the aggregated node groups. Each node is assigned to the anomaly type category with the highest similarity score. The anomaly type labels include data injection, frequency scanning, connection anomaly, and transmission spoofing. Each label consists of at least one set of prototype attributes and behavioral trajectory features.

[0105] In the anomalous evolution graph, a set of path starting points is determined. The set of path starting points consists of nodes in the anomalous evolution graph with zero incoming edges, representing independent initiation behaviors that are not triggered by anomalous evolution.

[0106] Starting from each starting node, a directed traversal is performed along the time evolution edge and path dependency edge in the anomaly evolution graph to construct a path sequence for all reachable nodes. The path sequence records the propagation order and protocol jump relationship between each behavior node.

[0107] All path sequences are filtered, and paths whose length exceeds the minimum propagation depth threshold and contain cross-communication paths are retained to form a causal path candidate set;

[0108] For each path in the causal path candidate set, a pattern compression operation is performed. The pattern compression operation refers to identifying and merging the repeated protocol segment combinations, communication path patterns or field sequences in the path sequence as behavioral fragments, marking the continuous homogeneous structures as unified fragments, and pruning or replacing the structurally redundant segments in the path, so that the path maintains the complete propagation chain while reducing structural and semantic redundancy, and retaining key jump behavior nodes and communication transfer points.

[0109] Based on the trend of behavioral drift response values ​​of nodes in the compressed path, a propagation confidence weight is assigned to each path to form a set of causal paths.

[0110] In this embodiment, the step of selecting representative anomalous nodes indicated by the anomaly type label, constructing a minimum perturbation sample, comparing and reasoning with the original sample, and generating anomaly confidence variation range and adversarial robustness score specifically includes:

[0111] Based on the anomaly type label and the causal path set, the expression of each causal path is analyzed, and nodes with drift response values ​​higher than a set threshold are selected as candidate nodes for perturbation locations, generating a perturbation sample set.

[0112] The perturbation sample set is constructed by performing field modification operations on the data segments corresponding to the candidate nodes, including protocol field replacement, byte segment rearrangement and context port swapping, performing path compression operations by deleting some communication hops to construct a shortened path sequence, and performing rhythm perturbation operations by adjusting the time interval to change the distribution of behavioral rhythm.

[0113] The abnormal behavior nodes and corresponding perturbation samples in the causal path expression are respectively input into the improved RetNet model. The output anomaly type label and behavior drift response value are compared to generate the confidence difference before and after the perturbation. The range of response amplitude change caused by the perturbation is calculated as the anomaly confidence change range.

[0114] Based on the degree of change in the response of the perturbation sample, the influence of the original abnormal behavior node on the judgment result of the improved RetNet model is evaluated. Stability labels are assigned according to whether the perturbation changes the original classification result, and the proportion of anomaly types that remain consistent under multiple perturbation strategies is calculated to form an adversarial robustness score.

[0115] In this embodiment, the step of jointly writing the behavior drift response vector, anomaly type label, causal path set, anomaly confidence change range, and adversarial robustness score into the anomaly knowledge graph, and adjusting the behavior semantic construction process, improved RetNet model parameters, and type classification rules based on the graph incremental update mechanism, specifically includes:

[0116] The behavioral drift response vector, anomaly type label, causal path set, anomaly credibility variation range, and adversarial robustness score are organized into structured data and written into an anomaly knowledge graph.

[0117] The graph incremental update mechanism is invoked to identify newly added or changed abnormal nodes and path structures in the abnormal knowledge graph, and update regions are established based on structural differences and timestamp order.

[0118] The communication order, behavior rhythm and path expression of nodes in the updated area are reconstructed, the behavior semantic construction process is adjusted, and a new semantic fragment sequence is generated by using a sliding window and dynamic fragment fusion method.

[0119] Based on the change range of behavior drift response vector in the anomaly knowledge graph, the cross-attention weights of the improved RetNet model are updated using the residual alignment method. The residual alignment method refers to calculating the gating layer weight update direction by taking the difference between the original label probability distribution and the perturbed prediction offset as a guide.

[0120] For nodes with changing anomaly type labels in the anomaly knowledge graph, a type re-judgment operation is performed. By combining the intensity of the behavior drift response vector with the coverage of the anomaly credibility change range, the anomaly type classification rules are optimized, and the linkage adjustment based on the feedback of the anomaly knowledge graph is completed.

[0121] Example 1:

[0122] To verify the feasibility of this invention in practice, it was applied to an industrial internet security monitoring platform. Real-time traffic data from 42 network terminal collection nodes across three manufacturing enterprise parks (A, B, and C) under the platform were selected to construct a network traffic anomaly detection system based on behavioral semantic construction and an improved RetNet model. The test period covered a calendar month, and the data included daily office work, production scheduling, remote access, and sudden abnormal behaviors. During the test, known attacks and false alarms were manually recorded for comparative analysis of the model's detection performance.

[0123] In the application process, the network data of the three parks are first parsed at the protocol level and decomposed into payloads to generate multi-granularity semantic units. Based on this, a multi-layer traffic language field tensor with three channels aligned—protocol-level representation, byte-level representation, and topological context representation—is constructed. This tensor is then input into an improved RetNet model with a unified temporal sequence to generate a target behavior intent trajectory tensor and behavior drift response vector. This leads to the establishment of anomaly evolution graphs and causal path sets, ultimately updating the anomaly knowledge graph and detection parameters. Table 1 below shows a partial statistical analysis of the original network data from Park A from 10:00 to 11:00 on a certain day.

[0124] Table 1 Distribution of Raw Network Traffic Data

[0125] Time period Number of data packets Number of communication paths percentage of abnormal paths Application layer protocol percentage (HTTP / FTP / MODBUS) 10:00-10:10 81,254 185 2.10% 60.5% / 21.3% / 18.2% 10:10-10:20 76,048 178 1.90% 58.6% / 24.1% / 17.3% 10:20-10:30 84,612 192 2.40% 59.9% / 20.8% / 19.3% 10:30-10:40 90,101 203 3.00% 61.0% / 19.5% / 19.5% 10:40-10:50 95,688 212 3.50% 62.2% / 18.0% / 19.8% 10:50-11:00 100,475 218 4.10% 63.0% / 17.5% / 19.5%

[0126] After parsing the protocol fields and identifying the path from the raw data, a protocol-level structure table and communication link groups are constructed, and byte sliding segmentation is performed on the payload. After three-channel synchronization, a standard tensor structure is formed and input into the behavior modeling process.

[0127] In the behavioral semantic modeling stage, behavioral segments are constructed for each communication path in 10-second windows, and time location embeddings, communication rhythm encoding, and protocol path graph structures are extracted. After contextual modeling of the temporal behavioral segments by a deep gating network, a target behavioral intent trajectory tensor is constructed.

[0128] In the behavior dependency modeling stage, the behavior event sequence tensor is processed in the improved RetNet model through a kernel-preserving layer, a residual memory path layer, and a rhythm-aware gating layer. The resulting rhythm-weighted behavior states are then concatenated into a behavior drift response vector, quantifying the intensity of behavior deviation. Table 2 below shows the anomaly detection output statistics:

[0129] Table 2 Comparison of Detection Results and Manual Labeling

[0130] Time period Number of abnormal nodes identified by the model Manually confirm the number of abnormal nodes accuracy underreporting rate False alarm rate 10:00-10:10 14 13 92.80% 0.00% 7.20% 10:10-10:20 12 12 100% 0.00% 0.00% 10:20-10:30 17 15 88.20% 0.00% 11.80% 10:30-10:40 23 21 91.30% 0.00% 8.70% 10:40-10:50 26 24 92.30% 0.00% 7.70% 10:50-11:00 31 28 90.30% 0.00% 9.70%

[0131] As shown in Table 2, this invention achieves an extremely low false negative rate and outperforms traditional rule-based matching or isolated forest algorithms in terms of false positive control. The average accuracy exceeds 91%, and the model demonstrates a keen ability to identify sudden connection anomalies and path spoofing behaviors.

[0132] In the anomaly evolution map construction phase, path clustering and hop count analysis were used to reconstruct the temporal evolution trajectory of the attack chain. For example, a burst of connections to an FTP port was detected at 10:44, which was reconstructed into three anomaly paths: "port reuse—path hopping—protocol change." These paths exhibited high drift segments in the causal path set and were ultimately assigned high confidence weights for classification and perturbation assessment. Table 3 below shows the statistics of typical anomaly behavior paths and perturbation assessments:

[0133] Table 3. Evaluation Results of Typical Anomaly Path Countermeasures

[0134] Abnormal path number Original confidence interval Perturbation confidence interval Type stability Anti-robust rating P-FTP-003 [0.84,0.93] [0.71,0.89] Keep 0.87 P-MOD-011 [0.78,0.88] [0.56,0.82] change 0.62 P-HTTP-019 [0.91,0.97] [0.86,0.95] Keep 0.92

[0135] As can be seen from the perturbation robustness evaluation results in Table 3, the model can still maintain high recognition stability under perturbation environment. In particular, in the two paths P-FTP-003 and P-HTTP-019, the type retention rate reached 100%, and the robustness score exceeded 0.85, demonstrating the model's ability to resist multiple types of perturbations in the actual industrial environment.

[0136] During system operation, the anomaly knowledge graph was incrementally updated, and the behavior construction process was adjusted back. A comparison of the model parameters before and after the adjustment revealed that the model's accuracy in identifying MODBUS protocol-masked anomalies improved from 84.3% to 91.7%, with the adjustment of type classification rules showing a significant improvement in handling less common anomalies.

[0137] This embodiment effectively verifies the effectiveness of the multi-layer traffic language field tensor construction method, the improved RetNet model, and the causal path analysis mechanism proposed in this invention. It exhibits high accuracy, strong robustness, and updability in real industrial network environments, significantly improving the comprehensiveness and systematic nature of abnormal behavior identification, and providing technical support for network security early warning and forensic analysis in complex scenarios.

[0138] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for detecting and identifying network traffic anomalies based on artificial intelligence, characterized in that, Includes the following steps: The raw network traffic data is acquired, preprocessed to generate multi-granularity semantic units, and fused to construct a multi-layer traffic language field tensor. Using the multi-layer traffic language field tensor as input, we perform behavioral semantic modeling and path structure encoding to generate the target behavior intent trajectory tensor. A behavior event sequence tensor is constructed based on a multi-layer flow language field tensor. The behavior event sequence tensor is then input into an improved RetNet model to perform cross-temporal behavior dependency modeling and pattern preservation computation, and outputs a behavior drift response vector. By comparing and analyzing the behavior drift response vector with the target behavior intention trajectory tensor, behavior segments with deviations exceeding a preset threshold are identified, and an abnormal evolution map is constructed by combining time sequence and communication path information. Using the anomaly evolution graph as input, the system performs type classification and causal analysis based on the semantic relationships and topological structure between nodes, and outputs anomaly type labels and corresponding causal path sets. Select representative anomalous nodes indicated by the anomalous type label, construct the minimum perturbation sample, compare and reason with the original sample to generate the anomalous credibility change range and adversarial robustness score. The behavior drift response vector, anomaly type label, causal path set, anomaly credibility change range and adversarial robustness score are jointly written into the anomaly knowledge graph. The behavior semantic construction process, RetNet model parameters and type classification rules are adjusted based on the graph incremental update mechanism.

2. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The process of acquiring raw network traffic data, preprocessing it to generate multi-granularity semantic units, and fusing them to construct a multi-layer traffic language field tensor specifically includes: Collect a complete set of data packets arranged in timestamp order as raw network traffic data. Each data packet includes a link layer frame header, IP address field, port number, protocol type, timestamp, and payload content. The raw network traffic data is preprocessed, including protocol field parsing, payload segmentation and communication path classification, to construct multi-granularity semantic units; The protocol field parsing extracts field content according to the protocol layer structure in the order of link layer, network layer, transport layer and application layer, and organizes the extraction results into a structured field table in "field-value" format to generate a protocol-level representation; The payload segmentation targets the application layer payload data of each data packet and uses a set window sliding method to perform byte segmentation. The resulting byte fragments are concatenated into a continuous byte sequence in their original order to generate a byte-level representation. The communication path classification generates communication path identifiers based on the combination of five-tuple fields. Data packets with the same communication path identifier are grouped into the same path set, and a context behavior sequence is constructed in chronological order to generate a topology context representation. The protocol-level representation, byte-level representation, and topology context representation are aligned using the packet timestamp as the primary index in a three-channel manner, and placeholder vectors are filled for missing items to ensure timing consistency. The protocol-level representation, byte-level representation, and topological context representation are stacked in a preset order to construct a three-dimensional representation structure with semantic hierarchy, generating a multi-layered traffic language field tensor.

3. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The step of taking a multi-layer traffic language field tensor as input, performing behavioral semantic modeling and path structure encoding, and generating a target behavioral intent trajectory tensor specifically includes: The multi-layer flow language field tensor is windowed along the time axis and divided into several behavior segments of a set length. Three feature information is extracted for each behavioral segment, including time location embedding, communication rhythm encoding, and protocol path structure; The three feature information are concatenated to form a unified behavioral semantic representation sequence, which is then input into a temporal modeling network for contextual modeling to extract high-dimensional trajectory representations of behavioral segments. The high-dimensional trajectory representation sequences of all behavioral fragments are spliced ​​together in chronological order to construct a complete target behavioral intent trajectory tensor.

4. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The improved RetNet model specifically includes: Align the multi-layer traffic language field tensor and the target behavior intent trajectory tensor one by one according to time steps, and in each time step, concatenate the byte-level representation, protocol-level representation, topology context representation and intent trajectory representation according to the set channel order to form a behavior event sequence tensor; The behavioral event sequence tensor is input into the improved RetNet model, which consists of a kernel-preserving layer, a residual memory path layer, and a rhythm-aware gating layer in sequence. The kernel layer performs a structure-preserving convolution operation on the behavior event sequence tensor in the time direction. It uses a convolution kernel with exponentially decaying weights to accumulate the current time step and the historical time steps. The weights of the convolution kernel decrease according to the time step difference, generating a context state vector with historical memory. The residual memory path layer processes the context state vector and the behavior event sequence tensor in parallel over time steps. One path uses a fully connected layer to perform a linear mapping operation, while the other path uses the ReLU activation function to perform a nonlinear mapping operation, resulting in two sets of feature vectors. The two sets of feature vectors are then weighted and summed according to a preset residual fusion coefficient to obtain the residual enhanced features. The rhythm-aware gating layer constructs a rhythm feature vector for each time step, generates a gating control value by performing two fully connected linear mappings and one sigmoid function compression activation operation on the rhythm feature vector, and performs element-wise multiplication between the gating control value and the residual enhancement feature to obtain a rhythm-weighted behavioral state representation. The rhythm-weighted behavioral state representations of all time steps are combined in their original time order to form a behavioral drift response vector; The continuity of the behavior drift response vector is determined. When the deviation of several consecutive time steps reaches the set drift threshold, the corresponding time steps are aggregated into anomaly candidate nodes. The order and path association between the anomaly candidate nodes are connected by the communication path identifier to generate an anomaly evolution map.

5. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The step of comparing and analyzing the behavior drift response vector with the target behavior intent trajectory tensor to identify behavior segments whose deviation exceeds a preset threshold, and constructing an anomaly evolution map by combining time sequence and communication path information, specifically includes: The difference values ​​of the feature vectors at the same location in the behavior drift response vector and the target behavior intention trajectory tensor are calculated in units of time steps to generate a sequence of difference mapping vectors representing the degree of behavior deviation. A sliding window analysis is performed on the difference mapping vector sequence, and regions where the difference value exceeds a preset deviation threshold in multiple consecutive time steps are selected as abnormal segments. Each time step set that is determined to be an abnormal segment is constructed as an abnormal behavior node, and the corresponding source address, destination address, source port, and destination port are extracted as path identifiers. Abnormal behavior nodes with the same path identifier and continuous time are grouped into the same communication link segment. Within each communication link segment, time evolution edges are established according to the chronological order. Between different communication link segments, path dependency edges are established based on the cross-reuse of the source or destination ends between communication paths. All abnormal behavior nodes and edge sets are integrated into an abnormal evolution graph.

6. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The process involves taking an anomaly evolution graph as input, classifying and analyzing its types based on semantic relationships and topological structure between nodes, and outputting anomaly type labels and corresponding causal path sets. Specifically, this includes: For each anomalous behavior node in the anomalous evolution graph, node attributes are extracted, and the nodes are initially aggregated using the center matching clustering method. An anomaly type label mapping table is established based on the aggregated node groups, and each node is assigned to the anomaly type category with the highest similarity score. Identify the set of path origins in the anomalous evolution map; Starting from each starting node, a directed traversal is performed along the time evolution edges and path dependency edges in the anomaly evolution graph to construct a path sequence for all reachable nodes; All path sequences are filtered, and paths whose length exceeds the minimum propagation depth threshold and contain cross-communication paths are retained to form a causal path candidate set; Perform pattern compression on each path in the causal path candidate set; Based on the trend of behavioral drift response values ​​of nodes in the compressed path, a propagation confidence weight is assigned to each path to form a set of causal paths.

7. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The process of selecting representative anomalous nodes indicated by anomaly type labels, constructing minimal perturbation samples, comparing and reasoning with the original samples, and generating anomaly confidence variation ranges and adversarial robustness scores specifically includes: Based on the anomaly type label and the causal path set, the expression of each causal path is analyzed, and nodes with drift response values ​​higher than a set threshold are selected as candidate nodes for perturbation locations, generating a perturbation sample set. The abnormal behavior nodes and corresponding perturbation samples in the causal path expression are respectively input into the improved RetNet model. The output anomaly type label and behavior drift response value are compared to generate the confidence difference before and after the perturbation. The range of response amplitude change caused by the perturbation is calculated as the anomaly confidence change range. Based on the degree of change in the response of the perturbation sample, the influence of the original abnormal behavior node on the judgment result of the improved RetNet model is evaluated. Stability labels are assigned according to whether the perturbation changes the original classification result, and the proportion of anomaly types that remain consistent under multiple perturbation strategies is calculated to form an adversarial robustness score.

8. The method for detecting and identifying network traffic anomalies based on artificial intelligence according to claim 1, characterized in that, The process of writing behavioral drift response vectors, anomaly type labels, causal path sets, anomaly credibility change ranges, and adversarial robustness scores into an anomaly knowledge graph, and adjusting the behavioral semantic construction process, improved RetNet model parameters, and type classification rules based on the graph's incremental update mechanism, specifically includes: The behavioral drift response vector, anomaly type label, causal path set, anomaly credibility variation range, and adversarial robustness score are organized into structured data and written into an anomaly knowledge graph. The graph incremental update mechanism is invoked to identify newly added or changed abnormal nodes and path structures in the abnormal knowledge graph, and update regions are established based on structural differences and timestamp order. The communication order, behavior rhythm and path expression of nodes in the updated area are reconstructed, the behavior semantic construction process is adjusted, and a new semantic fragment sequence is generated by using a sliding window and dynamic fragment fusion method. Based on the change range of behavior drift response vectors in the anomaly knowledge graph, the cross-attention weights of the improved RetNet model are updated using residual alignment. For nodes with changing anomaly type labels in the anomaly knowledge graph, a type re-judgment operation is performed. By combining the intensity of the behavior drift response vector with the coverage of the anomaly credibility change range, the anomaly type classification rules are optimized, and the linkage adjustment based on the feedback of the anomaly knowledge graph is completed.

Images