5g / b5g power communication network traffic analysis method based on multi-time series data mining

Abstract

The present application relates to a kind of 5G / B5G power communication network traffic analysis method based on multi-time series data mining, specific method steps include: 1) 5G / B5G power communication network traffic characteristic analysis 2) establish 5G / B5G power communication network traffic model, select multi-time series data mining method to establish traffic model, describe the real situation of 5G / B5G communication network service based on power service.Different from the traditional sense of power communication traffic analysis, new division is carried out to 5G / B5G power communication traffic level, using multi-time series data mining algorithm, 5G / B5G power communication traffic is reasonably statistically described, multiple traffic characteristic time series are analyzed as a whole, produce effective abnormal network traffic characteristic association rules, accurately describe the security situation of entire 5G / B5G power communication network, power communication fault prediction, network design, traffic control, resource management and network design have very important application value.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of electric power communication, and relates to electric power communication network traffic analysis technology, in particular to a 5G / B5G electric power communication network traffic analysis method based on multi-time sequence data mining. BACKGROUND

[0002] 5G communication has developed more complex and diverse application scenarios on the basis of 4G communication. The enhanced mobile broadband scenario requires extremely high data transmission rates, the massive machine type communication scenario requires dense device interconnection, and the low latency and high reliability communication scenario requires extremely low delay and extremely high reliability. In an intelligent communication network, the access of a large number of secondary devices and the update demand of real-time data cause a large increase and complex changes in 5G electric power communication network traffic. How to plan the configuration of cables, the selection of routes, the allocation of bandwidth, how to reduce major losses caused by sudden situations, and how to effectively improve the speed and utilization rate of network operation, 5G electric power communication network traffic analysis and prediction technology plays a key role. Online real-time monitoring of network traffic flow direction, rapid scanning of the whole network, timely response to network anomalies or virus outbreaks, and providing real-time and accurate network traffic flow direction and traffic composition analysis for daily network maintenance, as well as providing data basis for decision support for future network optimization, network adjustment and network construction.

[0003] 5G / B5G electric power communication network traffic prediction is of great significance to network management. The statistical characteristics of 5G / B5G electric power communication network traffic have self-similarity, multi-fractal, periodicity, chaos and other characteristics. According to the traffic characteristics and parameter attributes of different services of 5G / B5G electric power communication network, a suitable traffic model that can accurately and effectively describe the characteristics of network traffic is established, which is of great significance and role to QoS, network performance management, etc.

[0004] The current 5G / B5G electric power communication network does not perform real-time monitoring on network traffic, and often when traffic anomalies occur, the network management personnel will start to solve the problems after receiving the warning notification from the network management system. This is a responsive behavior, that is, a problem first and then a processing method. Such a method may affect the normal operation of the network due to insufficient time for analysis and processing. If traffic overload can be predicted and problems can be analyzed and solved before traffic overload occurs, the availability of the network can be significantly improved. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art, and to provide a 5G / B5G electric power communication network traffic analysis and abnormal traffic identification method based on multi-time sequence data mining, which is of great significance to electric power communication fault prediction, network design, traffic control, resource management and network design.

[0006] The technical problem solved by this invention is achieved through the following technical solution:

[0007] A method for traffic analysis in 5G / B5G power communication networks based on multi-time series data mining is described below:

[0008] 1) 5G / B5G power communication network traffic characteristics analysis, including deterministic and chaotic analysis, self-similarity analysis, multifractal analysis, and establish a 5G / B5G power communication network traffic analysis hierarchy: consisting of three layers, from bottom to top, namely data packet layer, traffic layer and network layer, and analyze the traffic of data packet layer, traffic layer and network layer.

[0009] 2) Establish a 5G / B5G power communication network traffic model. Based on the power communication network traffic characteristic analysis in step 1), a multi-time series data mining method is selected to establish the traffic model, describing the actual situation of 5G / B5G communication network services based on power services. The specific steps are as follows:

[0010] Step 1: Calculate the entropy of the 5G / B5G power communication traffic-level characteristics collected in each time period. Entropy is a metric used to measure the dispersion or concentration of the captured distribution. Various anomalous traffic patterns will affect the distribution of one of the IP characteristics, such as:

[0011]

[0012] P(X=x i ) is event x i The probability of ∈X occurring is defined as the number of data packets divided by the total number of data packets within a given time interval. The data packets in each 5-minute interval are summarized by a set of aggregation characteristics. In 5G / B5G power communication networks, traffic is formally defined as a 5-tuple, including source address, destination address, source port, destination port, and protocol type. Six fields are obtained, including source address or source IP, represented as srcIP, destination address or destination IP, represented as dstIP, source port, represented as srcPort, destination port, represented as dstPort, number of bytes, and protocol type.

[0013] Step Two: Apply Principal Component Analysis (PCA) and the subspace method to entropy time series. PCA is used to separate 5G / B5G power communication traffic into normal and abnormal traffic. The subspace method is an effective way to separate normal and abnormal network traffic. Specifically, the 5G / B5G traffic data points are considered as an n-dimensional cloud. The first principal component, PC1, represents the direction point with the greatest change, and PC2 represents the direction point with the greatest change in the orthogonal direction of PC1. The above process ends when all principal data points are found. Here, n refers to the dimension of the data. Ensuring all principal components converge orthogonally forms an orthogonal basis is crucial. The data on the first axis shows the greatest change, while the data on the second axis shows less change than the first, and so on for other components. The subspace method uses the aforementioned PCA to define normal and abnormal subspaces, which are used to distinguish between normal 5G communication traffic and abnormal 5G / B5G communication traffic. For a given m, the normal subspace is from PC1 to PC2. m The space it traverses, the abnormal subspace, is similar to a PC. m To PC m+1 The space spanned by (m≤n);

[0014] Step 3: Apply time-frequency analysis methods, piecewise aggregation approximation, and symbolic aggregation approximation to abnormal time entropy sequences to locate abnormal traffic in 5G / B5G power communication. Specifically, this includes piecewise aggregation approximation, symbolic aggregation approximation, wavelet transform, and wavelet packet transform, and applies them to Choi-Williams distribution and pseudo-Wigner-Ville distribution.

[0015] Step 4: Apply association rule mining to the 5G / B5G power communication traffic symbol sequence, I = {i1, i2, ..., i k} is a set, T = {t1,t2} i+1 ,...,i n Let} be a set of transactions, and define Sup(X) as follows:

[0016]

[0017] Find all rules for X→Y with minimum support and confidence. Support is the probability that a transaction contains X∪Y, defined as Sup(X∪Y), and confidence is the conditional probability that a transaction contains both X and Y, expressed as Sup(X∪Y) / Sup(X).

[0018] Moreover, each packet in the data packet layer traffic analysis includes a timestamp, IP address or prefix, port number, protocol type, bytes, and content, IP header information includes IP address or protocol traffic, burst of packet flow, packet properties, TCP header information includes application traffic breakdown, TCP congestion and flow control, byte count and packet count per session, application header information includes URL, HTTP header, DNS query and response.

[0019] Moreover, the basic information of 5G / B5G power communication network traffic in the traffic layer traffic analysis includes source IP address, destination IP address, port number, message and byte number, start and end time.

[0020] Moreover, the full network layer traffic analysis combines traffic, topology, and state information, and the full network layer traffic analysis mainly refers to traffic matrix analysis.

[0021] Moreover, the segment aggregation approximation PAA is to represent the time series as a sequence of rectangular basis functions, a dimension reduction representation method, specifically,

[0022]

[0023] n is the length of the sequence, N is the number of PAA segments, is the average value of the i th segment.

[0024] Moreover, the symbolic aggregate approximation is to convert the time series into a discrete symbol sequence, after converting the time series data into PAA, SAX is applied to obtain a discrete symbol representation, since the normalized 5G / B5G communication traffic time series has a Gaussian distribution, the "breakpoint" that generates c equal size areas under the Gaussian distribution curve can be determined, once the breakpoint is obtained, the time series can be discretized into a symbol sequence, specifically, first obtain the PAA mode of the original time series, all PAA coefficients less than the minimum breakpoint are converted into symbol "a", all coefficients greater than or equal to the minimum breakpoint but less than the second smallest breakpoint are converted into symbol "b", that is, the subsequence P with length N can be represented as Let alpha i represent the i-th element in the alphabet, alpha1=a and alpha2=b, then the transformation from PAA approximation P appr to word is as follows:

[0025]

[0026] PAA representation is only an intermediate step to obtain SAX.

[0027] And the wavelet transform and wavelet packet transform refer to using wavelet transform to locate the anomaly of 5G / B5G communication network traffic, assuming that x(t)∈L 2 (R), ψ(t) is a basic wavelet function, is the displacement and scale expansion of the basic wavelet function, such as

[0028]

[0029] The discrete wavelet transform DW converts a discrete-time signal into a discrete wavelet representation, and the discrete wavelet transform converts an input sequence x0, x1,...x k into a high-pass wavelet coefficient sequence and a low-pass wavelet coefficient sequence, as shown in (5) and (6):

[0030]

[0031]

[0032] where s k (z) and t k (z) are wavelet filters, m is the filter length, and i=0,1,...[n / 2]-1,

[0033] The wavelet packet transform WPT is a method of time-frequency decomposition of a signal, and WPT has signal adaptive characteristics, which is applied to 5G / B5G power communication traffic analysis, and can effectively display the time-frequency characteristics of the signal, and WPT decomposition can be obtained through an orthogonal mirror filter, assuming that the signal y(t) is obtained

[0034]

[0035] The function set {y(t)} is called a wavelet packet, which is the result of the overall decomposition of all frequency bands of the original signal at different scales, and let k=n-2 j , then is the result of k-band decomposition at j scale, and WPT can be composed of multiple orthogonal bases, and the wavelet basis is a typical orthogonal basis, and in all combinations, the minimum entropy is a good basis, and the decomposition of a good basis can well reflect the time-frequency characteristics of the 5G traffic signal, indicating that the method is adaptive to the 5G power communication traffic signal.

[0036] Moreover, the Choi-Williams distribution is to reduce the disturbance component of the Chio-William distribution, and the purpose is to obtain the factor that minimizes the disturbance value, and Choi-Williams is proposed to solve this problem

[0037]

[0038] The Wigner-Ville distribution C(t, f) satisfies the edge condition and the shift property, but does not satisfy the weak and limited support property, and when sigma approaches infinity, the weak and limited support property is satisfied.

[0039] Moreover, the pseudo Wigner-Ville distribution can describe the global distribution of the 5G / B5G power communication traffic signal in a given time, and in addition, for a given frequency, it can also equally measure all frequencies higher or lower than the given frequency, that is, when obtaining the distribution shape at a certain time t, the characteristics of the 5G power communication traffic signal in its vicinity are mainly obtained, and then the cross terms of the multivariate signal are compressed by adding some windows and deleting non-local components, and finally the Wigner-Ville distribution is converted into a local distribution, the pseudo Wigner-Ville distribution describes the local behavior of the signal as follows, so as to mine the local characteristics of abnormal signals in 5G / B5G power communication, such as

[0040]

[0041] h(t) is a window function.

[0042] Unlike general association rule mining, time series association rule mining mainly focuses on the time of data points. Since each feature element has different values at each time, the association rule mining is applied to different values of different network traffic features within the same time interval. The mutation of different time series in the same time period usually has a certain base sequence association pattern. This rule lays the foundation for analyzing abnormal traffic of 5G power communication network. Through this method, different theme patterns of various abnormal behaviors in 5G power communication network can be obtained, and can be used for network traffic analysis.

[0043] The advantages and positive effects of the present application are:

[0044] The present application is designed scientifically and reasonably, and provides a 5G / B5G power communication network traffic analysis method based on multi-time series data mining, which is different from traditional power communication traffic. The 5G / B5G power communication traffic level is newly divided, and at the same time, a multi-time series data mining algorithm is used to reasonably statistically describe the 5G / B5G power communication traffic. A plurality of traffic feature time series are analyzed as a whole to generate effective abnormal network traffic feature association rules, accurately describe the security status of the entire 5G / B5G power communication network, and have very important application value for power communication fault prediction, network design, traffic control, resource management and network design. BRIEF DESCRIPTION OF DRAWINGS

[0045] Figure 1 A flowchart is established for the traffic model of the present application;

[0046] Figure 2 mapping PAA coefficients to SAX symbol plot for the present application;

[0047] Figure 3 multi-time series association rule plot for the present application;

[0048] Figure 4 application of wavelet transform to time entropy sequence plot for the present application;

[0049] Figure 5 application of Choi-Williams distribution to time entropy sequence plot for the present application;

[0050] Figure 6 application of pseudo Wigner-Ville distribution to time entropy sequence plot for the present application. DETAILED DESCRIPTION

[0051] The present application is further described in detail by specific embodiments below, which are only descriptive and not limiting, and cannot limit the protection scope of the present application.

[0052] The present application provides a 5G / B5G power communication network traffic analysis method based on multi-time series data mining, and the specific method steps are as follows:

[0053] 1) 5G / B5G power communication network traffic characteristic analysis

[0054] Deterministic and chaotic analysis: 5G power communication traffic has strong determinism, which is manifested as a large number of time-driven state monitoring and information collection services accounting for the main component of traffic (remote signaling, remote measurement, distributed energy / storage station monitoring, etc.), that is, the sending time and traffic size of the service are fixed. In addition to the main deterministic characteristics of 5G / B5G power communication traffic, there are also irregular traffic behaviors, i.e., chaotic traffic. It is mainly manifested in the uncertainty of transmission time and traffic size (but the traffic is obviously related at the previous and subsequent time).

[0055] Self-similarity analysis: Traffic statistical self-similarity refers to the similar fluctuation trend of traffic at different time scales. The discovery of self-similarity makes short correlation traffic models such as Poisson process and Markov process no longer able to reasonably explain network traffic phenomena.

[0056] Multi-fractal analysis: Actual network traffic not only shows single fractal characteristics of self-similarity, but also is a complex fractal process, i.e., multi-fractal characteristics. Multi-fractal process can accurately describe the burst characteristics of traffic at small time scales, and the multi-fractal characteristics in 5G power communication flow can be used to describe the complex multi-self-similarity presented by different business traffic.

[0057] 5G / B5G power communication network traffic analysis hierarchy: consists of three levels, from bottom to top, packet level, traffic level, and network-wide level.

[0058] Packet-level traffic analysis: each packet includes a timestamp, IP address or prefix, port number, protocol type, bytes, and content. IP header information includes IP address or protocol traffic, burst of packet flow, packet properties. TCP header information includes application traffic breakdown, TCP congestion and flow control, number of bytes and packets per session. Application header information includes URL, HTTP header, DNS query and response, etc.

[0059] Traffic level traffic analysis: the basic information of 5G power communication network traffic includes source IP address, destination IP address, port number, message and byte number, start and end time, etc.

[0060] Network-wide traffic analysis: network-wide traffic analysis combines traffic, topology, and state information. Network-wide traffic analysis mainly refers to traffic matrix analysis in this paper.

[0061] 2) Establish a 5G power communication network traffic model

[0062] As shown in Figure 1 Based on the above step 1) power communication network traffic characteristics analysis, the multi-time series data mining method is selected to establish the traffic model, which describes the real situation of 5G / B5G communication network based on power business.

[0063] The specific implementation method process steps are as follows:

[0064] Step one: calculate the entropy of the 5G / B5G power communication traffic level characteristics collected on each time period.

[0065] Each 5-minute packet is summarized by a set of aggregate characteristics. In the 5G power communication network, traffic is formally defined as a 5-tuple: source address, destination address, source port, destination port, and protocol type. We focus on 6 fields: source address (sometimes called source IP and denoted as srcIP), destination address (or destination IP, denoted as dstIP), source port (srcPort), destination port (dstPort), byte number, and protocol type.

[0066] Entropy is a measure that captures the dispersion or concentration of a distribution. Various abnormal traffic will affect the distribution of one of the IP features discussed, such as:

[0067]

[0068] P(X=x i ) is the probability of event x iThe probability of occurrence of ∈ X, for example, the probability of seeing IP 129.173.192.0 is defined as the number of packets using IP 129.173.192.0 divided by the total number of packets in a given time interval.

[0069] Step two: Apply principal component analysis and subspace method to entropy time series.

[0070] Subspace method is an effective method to separate normal and abnormal network traffic, and principal component analysis (PCA) is the main method to perform this function. Therefore, principal component analysis is used to separate 5G power communication traffic into normal traffic and abnormal traffic.

[0071] We regard 5G traffic data points as an n-dimensional cloud, and the first principal component PC1 is the direction point with the largest change. PC2 is the direction point with the largest change in the orthogonal direction of PC1. This process ends until all major data is found, and n refers to the dimension of the data. Ensure that all major components are orthogonal and converge, thereby forming an orthogonal basis. The data in the first number axis direction changes the most, while the data in the second axis changes less than the first, and so on for other components.

[0072] Subspace method uses the above principal component analysis to define normal subspace and abnormal subspace, i.e. to distinguish normal 5G communication traffic and abnormal 5G communication traffic. For some m, the normal subspace is PC1 to PC m The space spanned by PC m The space spanned by PC m+1 (m≤n).

[0073] Step three: Apply time-frequency analysis method, piecewise aggregate approximation and symbolic aggregate approximation to abnormal time entropy sequence to locate 5G power communication abnormal traffic.

[0074] (1) Piecewise aggregate approximation: The basic idea of piecewise aggregate approximation (PAA) is to represent a time series as a sequence of rectangular basis functions. It is essentially a dimensionality reduction representation method

[0075]

[0076] n is the length of the sequence, and N is the number of PAA segments. is the average value of the i th segment.

[0077] (2) Symbolic Aggregate Approximation: The basic idea of symbolic aggregate approximation is that it converts time series into discrete symbolic sequences. After converting time series data into PAA, we can apply SAX to obtain discrete symbolic representation. Since the normalized 5G communication traffic time series has a Gaussian distribution, we can determine the "breakpoints" that produce c equally sized regions under the Gaussian distribution curve. Once the breakpoints are obtained, we can discretize the time series into symbolic sequences. We first obtain the PAA way of the original time series. All PAA coefficients less than the smallest breakpoint are converted to the symbol "a", all coefficients greater than or equal to the smallest breakpoint but less than the second smallest breakpoint are converted to the symbol "b", and so on, as shown in Figure 2 The probabilities of the three symbols "a", "b", and "c" are approximately equal.

[0078] A subsequence P of length N can be represented as Let α i denote the i-th element in the alphabet, α1 = a and α2 = b. Then the transformation from the PAA approximation P appr to the word is given by

[0079]

[0080] PAA representation is just an intermediate step to obtain SAX.

[0081] (3) Wavelet Transform and Wavelet Packet Transform: Wavelet transform is used to locate the anomaly of 5G power communication network traffic, assuming that x(t) ∈ L 2 (R), ψ(t) is the basic wavelet function, is the shift and scale expansion of the basic wavelet function, as

[0082]

[0083] The basic idea of discrete wavelet transform (DWT) is to convert a discrete time signal into a discrete wavelet representation. Discrete wavelet transform converts the input sequence x0, x1,...x k into a high-pass wavelet coefficient sequence and a low-pass wavelet coefficient sequence (each of length 2n), as shown in (5) and (6):

[0084]

[0085]

[0086] where s k (z) and t k (z) are wavelet filters, m is the filter length, and i = 0, 1,...[n / 2]-1.

[0087] Wavelet packet transform (WPT) is a method of time-frequency decomposition of signals. WPT has signal adaptive characteristics, and when applied to 5G power communication traffic analysis, it can effectively display the time-frequency characteristics of the signal. WPT decomposition can be obtained through the orthogonal mirror filter. Assuming that the signal y(t), we can get

[0088]

[0089] The function set {y(t)} is called wavelet packet, which is the result of the overall decomposition of all frequency bands of the original signal at different scales. Let k = n-2 j is the result of k-band decomposition at j scale, WPT can be composed of a variety of orthogonal bases, and wavelet basis is a typical orthogonal basis. Among all combinations, the minimum entropy is a better basis. The decomposition of the good basis can well reflect the time-frequency characteristics of the 5G traffic signal, which shows that the method is adaptive to the 5G power communication traffic signal.

[0090] (4) Choi-Williams distribution: In order to reduce the disturbance component of Choi-Williams distribution, we should study the factors that make the disturbance value minimum. Choi-Williams is proposed to solve this problem

[0091]

[0092] Wigner-Ville distribution C(t,f) satisfies the edge condition and displacement characteristics, but does not satisfy the weak and limited support characteristics. When σ→∞, it satisfies the weak and limited support characteristics.

[0093] (5) Pseudo Wigner-Ville distribution: Wigner-Ville distribution can describe the global distribution of 5G power communication traffic signal in a given time. In addition, for a given frequency, it can also measure all frequencies higher or lower than the given frequency equally.

[0094] In fact, we cannot study all integrals between -∞ and +∞, but only integrals in a limited range. When studying the distribution shape at a certain time (t), we should study the characteristics of 5G power communication traffic signal near that time. In a sense, it is to compress the cross-term of the multivariate signal by adding some windows and deleting the non-local component. Finally, the Wigner-Ville distribution is converted into a local distribution. The pseudo Wigner-Ville distribution describes the local behavior of the signal as follows, which is convenient for mining the local characteristics of abnormal signals in 5G power communication, such as

[0095]

[0096] ​h(t) is a window function.

[0097] Step four: applying association rule mining to 5G power communication traffic symbol sequence.

[0098] I = {i1, i2,..., i k} is a set of items, T = {t1, t i+1 ..., i n} is a set of transactions, Sup(X) is defined as follows:

[0099]

[0100] We find all rules of X→Y with minimum support and confidence. Support is the probability of a transaction containing X∪Y, defined as Sup(X∪Y), and confidence is the conditional probability of a transaction containing X and Y, denoted as Sup(X∪Y) / Sup(X). Unlike general association rule mining, time series association rule mining mainly focuses on the time of data points, as shown in Figure 3 , which is a multi-time series association rule graph of the present application.

[0101] Since each feature element has different values at each time, we apply association rule mining to different values of different network traffic features within the same time interval. Mutations of different time series in the same time period usually have certain base sequence association patterns. This rule lays the foundation for us to analyze abnormal traffic of 5G power communication networks. Through this method, different topic patterns of various abnormal behaviors in 5G power communication networks can be obtained and used for network traffic analysis.

[0102] In order to analyze 5G power communication network traffic and locate abnormalities, we apply wavelet packet transform, Choi-Williams distribution and pseudo Wigner-Ville distribution methods to the simulation results of abnormal entropy time series as shown in Figure 4 , Figure 5 , Figure 6 .

[0103] Although the embodiments of the present application are disclosed for illustrative purposes, those skilled in the art can understand that various alternatives, changes and modifications are possible without departing from the spirit and scope of the present application and the appended claims, therefore, the scope of the present application is not limited to the disclosed content of the embodiments.

Claims

1. A method for analyzing traffic in 5G / B5G power communication networks based on multi-time series data mining, characterized by: The specific steps are as follows: 1) 5G / B5G power communication network traffic characteristics analysis, including deterministic and chaotic analysis, self-similarity analysis, multifractal analysis, and establish a 5G / B5G power communication network traffic analysis hierarchy: consisting of three layers, from bottom to top, namely data packet layer, traffic layer and network layer, and analyze the traffic of data packet layer, traffic layer and network layer. 2) Establish a 5G / B5G power communication network traffic model. Based on the power communication network traffic characteristic analysis in step 1), a multi-time series data mining method is selected to establish the traffic model, describing the actual situation of 5G / B5G communication network services based on power services. The specific steps are as follows: Step 1: Calculate the entropy of the 5G / B5G power communication traffic-level characteristics collected in each time period. Entropy is a metric used to measure the dispersion or concentration of the captured distribution. Various anomalous traffic patterns will affect the distribution of one of the IP characteristics. The formula is as follows: （1） It is an event The probability of occurrence is defined as the number of data packets divided by the total number of data packets within a given time interval. The data packets in each 5-minute interval are summarized by a set of aggregation characteristics. In 5G / B5G power communication networks, traffic is formally defined as a 5-tuple, including source address, destination address, source port, destination port, and protocol type. Six fields are obtained, including source address or source IP, represented as srcIP, destination address or destination IP, represented as dstIP, source port, represented as srcPort, destination port, represented as dstPort, number of bytes, and protocol type. Step Two: Apply Principal Component Analysis (PCA) and the Subspace Method to Entropy Time Series. PCA is used to separate 5G / B5G power communication traffic into normal and abnormal traffic. The subspace method is an effective way to separate normal and abnormal network traffic. Specifically, the 5G / B5G traffic data points are viewed as an n-dimensional cloud. The first principal component... It is the point of greatest change. Is standing The direction point with the greatest change in the orthogonal direction. The above process ends when all principal data are discovered. 'n' refers to the dimension of the data. Ensuring all principal components converge orthogonally forms an orthogonal basis. The data on the first axis shows the greatest change, while the data on the second axis shows less change than the first, and so on for other components. The subspace method uses the principal component analysis described above to define normal and abnormal subspaces, used to distinguish between normal 5G communication traffic and abnormal 5G / B5G communication traffic. For a preset positive integer m, 1 ≤ m ≤ n, the normal subspace is... arrive The space it traverses, the abnormal subspace is similar to arrive ( The space it spans; Step 3: Apply time-frequency analysis methods, piecewise aggregation approximation, and symbolic aggregation approximation to abnormal time entropy sequences to locate abnormal traffic in 5G / B5G power communication. Specifically, this includes piecewise aggregation approximation, symbolic aggregation approximation, wavelet transform, and wavelet packet transform, and applies them to Choi-Williams distribution and pseudo-Wigner-Ville distribution. Step 4: Apply association rule mining to 5G / B5G power communication traffic symbol sequences. It is a set, where k is the number of data points in the selected time series, and is a positive integer. It is a set of transactions, defined as follows: （10） Find all rules for X→Y with minimum support and confidence. Support is the sum of the values ​​of a transaction. The probability is defined as Confidence level is the conditional probability that a transaction includes both X and Y, expressed as... .

2. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: In the aforementioned packet layer traffic analysis, each packet includes a timestamp, IP address or prefix, port number, protocol type, bytes, and content. The IP header information includes the traffic of the IP address or protocol, the bursts of the packet flow, and packet attributes. The TCP header information includes the application's traffic segmentation, TCP congestion and flow control, the number of bytes and packets per session, and the application header information includes the URL, HTTP headers, DNS queries, and responses.

3. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The basic information of 5G / B5G power communication network traffic in the traffic layer traffic analysis includes source IP address, destination IP address, port number, packet and byte count, start and end time.

4. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The full network layer traffic analysis combines traffic, topology, and state information, and mainly refers to traffic matrix analysis.

5. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The aforementioned piecewise aggregation approximation (PAA) represents a time series as a sequence of rectangular basis functions, a dimensionality reduction representation method. Specifically, （2） n It is the length of the sequence. N It is the number of PAA segments. yes The average value of the segment.

6. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The aforementioned symbolic aggregation approximation converts the time series into a discrete symbolic sequence. After converting the time series data into a PAA (Packet Alignment), SAX (Symptom Alignment) is applied to obtain a discrete symbolic representation. Since the normalized 5G / B5G communication traffic time series has a Gaussian distribution, c equal-sized "breakpoints" can be identified under the Gaussian distribution curve. Once these breakpoints are obtained, the time series can be discretized into a symbolic sequence. Specifically, the PAA method of the originating time series is first obtained. All PAA coefficients smaller than the smallest breakpoint are converted to the symbol "a", and all coefficients greater than or equal to the smallest breakpoint but smaller than the second smallest breakpoint are converted to the symbol "b". That is, a subsequence P of length N can be represented as... ,let This represents the i-th element in the alphabet. and Then, we obtain the approximation from PAA. to words The transformation is as follows: （3）。 7. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The wavelet transform and wavelet packet transform mentioned above refer to using wavelet transform to locate anomalies in 5G / B5G communication network traffic, assuming... It is the basic wavelet function. The shift and scale expansion of the basic wavelet function are given by the following formulas: （4） Discrete wavelet transform (DW) converts discrete-time signals into discrete wavelet representations. The discrete wavelet transform transforms the input sequence... The coefficients are converted into a high-pass wavelet coefficient sequence and a low-pass wavelet coefficient sequence, as shown in (5) and (6): （5） （6） in and It is a wavelet filter, where m is the filter length. , Wavelet packet transform (WPT) is a method for time-frequency decomposition of signals. WPT possesses adaptive signal characteristics and can be applied to traffic analysis in 5G / B5G power communication, effectively displaying the time-frequency characteristics of signals. WPT decomposition can be obtained through orthogonal mirror filters. Assuming the signal... ,get （7） function set { This is called a wavelet packet, which is the result of decomposing the original signal across all frequency bands at different scales. ,but The result is the decomposition of the k-band on the j-scale. WPT can be composed of various orthogonal bases. Wavelet bases are typical orthogonal bases. Among all combinations, minimum entropy is the best base. The decomposition of good bases can well reflect the time-frequency characteristics of 5G traffic signals, indicating that the method is adaptive to 5G power communication traffic signals.

8. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The Choi-Williams distribution aims to reduce the perturbation components of the original Choi-Williams distribution, minimizing the perturbation values. The Choi-Williams distribution was proposed to address this problem, where σ is an adjustment parameter in the Gaussian kernel function, controlling the degree of perturbation suppression in the Choi-Williams distribution. （8） Wigner-Ville distribution It satisfies the edge conditions and displacement characteristics, but does not satisfy the weak and finite support characteristics, when At that time, it satisfies the weak and limited support characteristics.

9. The 5G / B5G power communication network traffic analysis method based on multi-time series data mining according to claim 1, characterized in that: The pseudo-Wigner-Ville distribution, within a given time period, can describe the global distribution of 5G / B5G power communication traffic signals. Furthermore, for a given frequency, it can equally measure all frequencies above or below that frequency. That is, when obtaining the distribution shape at a given time t, it primarily captures the characteristics of nearby 5G power communication traffic signals. Then, by adding windows and removing non-local components, it compresses the cross-terms of the multivariate signal, finally transforming the Wigner-Ville distribution into a local distribution. The pseudo-Wigner-Ville distribution describes the local behavior of the signal as follows, facilitating the discovery of local features of anomalous signals in 5G / B5G power communication: [Formula omitted]. （9） h(t) is a window function.

Images