An unsupervised anomaly detection method, apparatus, medium and device

Abstract

The application discloses a kind of unsupervised anomaly detection method, device, medium and equipment, unknown category network traffic text data is acquired, unknown category network traffic text data is input to the unsupervised anomaly detection model based on double-layer attention mechanism and variational autoencoder that is trained in advance, and abnormal text data is output by the unsupervised anomaly detection model based on double-layer attention mechanism and variational autoencoder;Unsupervised anomaly detection model based on double-layer attention mechanism and variational autoencoder includes input layer, input attention layer, convolutional neural network layer, variational autoencoder, output layer connected linearly in turn;Variational autoencoder includes encoder, feature attention layer and decoder connected linearly in turn.The advantages are: on the basis of variational autoencoder, double-layer attention mechanism is added, global and local information can be considered, and more important sequence is adaptively selected, so that long-term dependence of network traffic can be better captured.

Description

Technical Field

[0001] This invention relates to an unsupervised anomaly detection method, apparatus, medium, and equipment, belonging to the field of data processing technology. Background Technology

[0002] With the development and popularization of network technology, the internet has become an indispensable part of people's daily lives and work. While the development of the internet has brought many conveniences, it has also brought many security problems. Among these, network attacks and abnormal network traffic are two major aspects of network security issues. A network attack refers to malicious attacks against computers, servers, applications, or network infrastructure, while abnormal network traffic refers to traffic patterns that do not conform to normal network traffic patterns.

[0003] Network traffic anomaly detection refers to the technology of detecting and identifying traffic that does not conform to normal traffic patterns in network traffic, and then processing and managing it. The main purpose of network traffic anomaly detection is to protect network security and stability, prevent abnormal behavior in the network, and ensure the effective utilization of network resources. In a network, traffic anomalies may be caused by network attacks, system failures, equipment malfunctions, sudden increases in traffic, etc. If they are not detected and handled in a timely manner, they will have a significant impact on the normal operation of the network. Therefore, network traffic anomaly detection technology has become an important research direction in the field of network security.

[0004] Over the years, many researchers have used machine learning techniques to detect anomalies in network traffic. Statistical methods involve constructing statistical models by extracting statistical features from large amounts of historical data. Sequences in the data that do not match the statistical model are often identified as anomalies. This method is very simple, but its low accuracy makes it unsuitable for anomaly detection. Probabilistic methods have proposed Hidden Markov Models and Bayesian Networks. These methods assume that normal observations follow a specific probability density distribution and use likelihood as a measure of anomaly detection; however, parameter estimation in these methods is often very complex. In the literature on approximation, the k-Nearest Neighbor (KNN) algorithm and the Local Outlier Factor (LOF) have been proposed. However, this method is relatively simple and does not consider the inherent temporal correlation of time-series data. Therefore, this method is not suitable for high-dimensional data. Currently, deep learning methods are widely used for anomaly detection in network traffic due to their excellent ability to handle nonlinearities in network traffic correlation and their superior learning capabilities. Deep learning-based algorithms mainly include Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, and attention mechanisms. However, these deep learning methods require large amounts of labeled data for model training, but network traffic often lacks labels, and manually labeling datasets is time-consuming and expensive. Therefore, designing a method model that does not heavily rely on labeled data is crucial.

[0005] Current problems with existing technologies include: traditional deep learning anomaly detection methods are usually based on supervised learning, which often requires a large amount of labeled data for training. This data needs to be labeled by professionals, thus requiring a lot of time and cost; since supervised learning is trained on labeled datasets, it is easily affected by the training data and may overfit, resulting in weak generalization ability of the model on unknown data; many current network traffic anomaly detection methods ignore the unique temporal correlation, spatial characteristics, and relationships between data points in network traffic, which leads to low detection accuracy. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide an unsupervised anomaly detection method, device, medium and equipment that can automatically, efficiently and accurately detect network traffic anomalies.

[0007] To address the aforementioned technical problems, this invention provides an unsupervised anomaly detection method, comprising:

[0008] Obtain network traffic text data of unknown category, input the network traffic text data of unknown category into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, and output anomaly text data through the unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder.

[0009] The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence.

[0010] Furthermore, before inputting the unknown category network traffic text data into the pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, the unknown category network traffic text data is sequentially subjected to data cleaning, resampling, numericalization, and normalization to obtain normalized unknown category network traffic text data.

[0011] Furthermore, the output of abnormal text data through the unsupervised anomaly detection model based on the two-layer attention mechanism and variational autoencoder includes:

[0012] The normalized network traffic text data of unknown categories input through the input layer is weighted using the input attention layer to obtain weighted network traffic text data;

[0013] The weighted network traffic text data is input into the convolutional neural network layer for calculation to extract the spatial characteristics of network traffic text data of unknown categories.

[0014] The encoder is used to perform dimensionality reduction processing on the spatial characteristics of the unknown category of network traffic text data, and the temporal correlation of the spatial characteristics of the unknown category of network traffic text data is extracted simultaneously.

[0015] The time correlation obtained from dimensionality reduction is weighted using a feature attention layer to obtain the filtered data after secondary weighting.

[0016] The filtered data is input into the decoder for decoding, and the decoded data is output through the output layer. The reconstruction error is calculated on the decoded data, and the reconstruction error is considered as abnormal text data if it is greater than a preset threshold.

[0017] Furthermore, the training process of the unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes:

[0018] Collect various types of network traffic data samples, including normal network traffic data samples under normal network conditions and abnormal network traffic data samples under various preset abnormal types.

[0019] The collected network traffic data samples of various types are cleaned, resampled, quantified, and normalized to obtain a network traffic dataset.

[0020] The network traffic dataset is divided into a training set and a test set.

[0021] Construct an unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder;

[0022] The initial parameters and hyperparameters of the two-layer unsupervised anomaly detection model based on attention mechanism and variational autoencoder are set to obtain the constructed unsupervised anomaly detection model.

[0023] The training set data is input into the built unsupervised anomaly detection model for training, and the anomaly detection accuracy of the built unsupervised anomaly detection model is tested using the validation set. The optimal parameters of the built unsupervised anomaly detection model are obtained, and the trained unsupervised anomaly detection model based on the two-layer attention mechanism and variational autoencoder is obtained based on the optimal parameters.

[0024] Furthermore, the convolution operation process of the convolutional neural network layer is represented as follows:

[0025]

[0026] Among them, C ij l This represents the result of the convolution operation in the l-th convolutional layer, where l is the number of convolutional layers, i is the index of the feature value, and j is the index of the feature map. This represents the kernel weight of the m-th filter in the previous convolutional layer. b represents the network data flow of the (i+m-1)th convolutional layer in the previous convolutional layer. j l-1 σ represents the bias of the j-th feature map in the previous convolutional layer, M represents the size of the filter in the convolutional layer, and σ is the activation function.

[0027] Furthermore, the computation process of the two-layer attention mechanism is expressed as follows:

[0028]

[0029]

[0030]

[0031] in, and These are learnable network parameters, where k represents the current node. This represents the attention score e of the current k-th node. t The weights α are obtained by normalizing the weights α based on the current input and the current hidden layer state using the SoftMax function. t e k This represents the attention score calculated at node k, where t represents the time step. Let x represent the weighted time series, x = {x1, x2, ..., x...} t} represents the network data traffic in the text data X, where x is the network traffic. t Let t be the t-th data item in the network data traffic.

[0032] Furthermore, the weighted time series The process of inputting into a variational autoencoder with a Bi-GRU-based architecture for computation can be represented as follows:

[0033]

[0034]

[0035]

[0036]

[0037] Among them, Z t To update the gate, r t To reset the door, W z and W r Let σ be the weight matrix, and σ be the sigmoid activation function. represents the past time, r represents the reset gate information, and W represents the learnable network parameters;

[0038] The cost function in the variational autoencoder for:

[0039]

[0040] Among them, L rec (θ) is the mean square error loss function, D KL Denotes divergence, It means based on the given sample x i and network parameters The posterior distribution of the latent variable z is calculated, and p(z) represents the prior distribution.

[0041] An unsupervised anomaly detection device includes:

[0042] The acquisition module is used to acquire network traffic text data of unknown categories;

[0043] The model processing module is used to input the unknown category of network traffic text data into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, and output anomaly text data through the unsupervised anomaly detection model based on the two-layer attention mechanism and a variational autoencoder.

[0044] The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence.

[0045] A computer-readable storage medium storing one or more programs, said one or more programs including instructions that, when executed by a computing device, cause the computing device to perform any of the methods described.

[0046] A computer device, comprising,

[0047] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for performing any of the methods described.

[0048] The beneficial effects achieved by this invention are as follows:

[0049] 1. A variational autoencoder composed of a bidirectional-gated recurrent unit (Bi-GRU) is used to collect the relationship characteristics between the data before and after, and a convolutional neural network is added to the model to extract the spatial features of network traffic, which improves the detection accuracy compared with traditional network traffic anomaly detection methods.

[0050] 2. This invention incorporates a dual attention mechanism on top of the variational autoencoder, which can consider both global and local information and adaptively select the more important sequences. This facilitates better capture of the long-term dependencies in network traffic.

[0051] 3. Because this invention can be trained without any labeled data, it offers great flexibility and can detect even the smallest anomalies. Furthermore, this invention is suitable for processing high-dimensional data and can effectively handle complex relationships between data points. Attached Figure Description

[0052] Figure 1The diagram shows the structure of an anomaly detection model based on a two-layer attention mechanism and a variational autoencoder.

[0053] Figure 2 Here is a diagram of the GRU architecture;

[0054] Figure 3 Diagram of the Bi-GRU structure;

[0055] Figure 4 This is a structural diagram of the attention mechanism. Detailed Implementation

[0056] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0057] This invention discloses an unsupervised anomaly detection method, comprising: acquiring network traffic text data of unknown category, inputting the network traffic text data of unknown category into a pre-trained unsupervised anomaly detection model based on attention mechanism and variational autoencoder, and outputting anomaly text data through the unsupervised anomaly detection model based on two-layer attention mechanism and variational autoencoder.

[0058] like Figure 1 As shown, the unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence.

[0059] The process of obtaining the trained unsupervised anomaly detection model based on attention mechanism and variational autoencoder includes:

[0060] Step 1: Data Acquisition.

[0061] 1.1 Collect network traffic data samples of different types, including normal network traffic data under normal network conditions and abnormal network traffic data under various preset abnormal types.

[0062] Step 2: Data preprocessing.

[0063] 2.1 Each network traffic data sample is preprocessed, including data cleaning, numericalization, resampling and normalization, and finally a preprocessed network traffic dataset is constructed.

[0064] Step 3: Data preparation.

[0065] 3.1 The dataset is divided into a training set, a test set, and a validation set, with a ratio of 3:1:1.

[0066] Step 4: Model initialization.

[0067] 4.1 An unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder is built, and the parameters in the model are randomly initialized.

[0068] 4.2 First, we will process the data X = {x1, x2, ..., x...} i ,x t As input to a convolutional neural network, the convolutional layer can extract the spatial characteristics of the data by calculating the convolution of the input data using convolution kernels or filters. The convolution operation process is as follows:

[0069]

[0070] Among them, C ij l This represents the result of the convolution operation in the l-th convolutional layer, where l is the number of convolutional layers, i is the index of the feature value, and j is the index of the feature map. This represents the kernel weight of the m-th filter in the previous convolutional layer. b represents the network data flow of the (i+m-1)th convolutional layer in the previous convolutional layer. j l-1 σ represents the bias of the j-th feature map in the previous convolutional layer, M represents the size of the filter in the convolutional layer, and σ is the activation function.

[0071] 4.3 such as Figure 4 As shown, we incorporate attention mechanisms at both the input stage and the decoder stage of the variational autoencoder. The first stage selects the primary stimulus features, and the second stage decodes the stimuli using classification information. This two-layer attention mechanism can select the relevant driving order, enhancing the long-term dependencies of network traffic. It can simultaneously process global and local information and capture the dependencies between different sequences. The computation process can be defined as follows:

[0072]

[0073]

[0074]

[0075] in, and These are learnable network parameters, where k represents the current node. This represents the attention score e of the current k-th node. t The weights α are obtained by normalizing the weights α based on the current input and the current hidden layer state using the SoftMax function. t e kThis represents the attention score calculated at node k, where t represents the time step. Let x represent the weighted time series, x = {x1, x2, ..., x...} t} represents the network data traffic in the text data X, where x is the network traffic. t Let t be the t-th data item in the network data traffic.

[0076] 4.4 such as Figure 3 As shown, we input the weighted data from step 4.3 into a variational autoencoder based on a Bi-GRU architecture. This includes a forward GRU and a backward GRU, relative to... Figure 2 As shown, compared to a regular GRU, a Bi-GRU can capture the relationships and highly complex correlations between different time series over a long period. Its calculation process is as follows:

[0077]

[0078]

[0079]

[0080]

[0081] Where Z is t Update gate, r t To reset the door, W z and W r Let be the weight matrix, and σ be the sigmoid activation function. Unlike LSTM, GRU has no input gate; it combines the input gate and forget gate into a single update gate. The update gate helps the model decide how much past information to pass to the future. The reset gate primarily determines how much past information needs to be forgotten. These gates and the consistent data flow are known as CEC (Constant Error Carrousel). It keeps each unit stable, preventing gradient explosion or vanishing gradients.

[0082] The encoder maps the input data to the mean and variance in the latent space, then randomly samples a sample from the latent distribution. The decoder then maps this sample back to the original data space. The cost function is as follows:

[0083]

[0084] Among them, L rec (θ) represents the mean squared error loss function. KL Denotes the (Kullback-Leibler) divergence. It means based on the given sample x i and network parameters The posterior distribution of the latent variable z is calculated, and p(z) represents the prior distribution. Cost function. The cost function is composed of the difference between the reconstruction error and the prior distribution of the latent variables, and we need to minimize this cost function. By differentiating the cost function, we can use the backpropagation algorithm to train the variational autoencoder, update the network parameters, and minimize the cost function.

[0085] Step 5: Model training.

[0086] 5.1 Set the model-related hyperparameters: set the number of training cycles (Epoch) to 50, the batch size to 256, and use the Adam optimizer and Mean Squared Error Loss function during training.

[0087] 5.2 Input the training set data into the built model for training, and use the validation set to test the anomaly detection accuracy of the model. The main purpose of the validation set is to observe whether the model will have overfitting or underfitting problems. Finally, obtain the optimal parameters of the model.

[0088] 5.3 After training, retain the model parameters and input them into the test set for testing. At this point, the model can automatically classify text data of unknown categories.

[0089] Accordingly, the present invention also provides an unsupervised anomaly detection device, comprising:

[0090] The acquisition module is used to acquire network traffic text data of unknown categories;

[0091] The model processing module is used to input the unknown category of network traffic text data into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, and output anomaly text data through the unsupervised anomaly detection model based on the two-layer attention mechanism and a variational autoencoder.

[0092] The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence.

[0093] Accordingly, the present invention also provides a computer-readable storage medium for storing one or more programs, said one or more programs including instructions that, when executed by a computing device, cause the computing device to perform any of the methods described.

[0094] Accordingly, the present invention also provides a computer device, comprising,

[0095] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include instructions for performing any of the methods described.

[0096] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0098] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0099] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0100] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An unsupervised anomaly detection method, characterized in that, include: Obtain network traffic text data of unknown category, input the network traffic text data of unknown category into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, and output anomaly text data through the unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder. The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence. The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder outputs abnormal text data, including: The normalized network traffic text data of unknown categories input through the input layer is weighted using the input attention layer to obtain weighted network traffic text data; The weighted network traffic text data is input into the convolutional neural network layer for calculation to extract the spatial characteristics of network traffic text data of unknown categories. The encoder is used to perform dimensionality reduction processing on the spatial characteristics of the unknown category of network traffic text data, and the temporal correlation of the spatial characteristics of the unknown category of network traffic text data is extracted simultaneously. The time correlation obtained from dimensionality reduction is weighted using a feature attention layer to obtain the filtered data after secondary weighting. The filtered data is input into the decoder for decoding, and the decoded data is output through the output layer. The reconstruction error is calculated on the decoded data, and the reconstruction error is regarded as abnormal text data if it is greater than a preset threshold. The computational process of the two-layer attention mechanism is expressed as follows: ； ； ； in, and These are learnable network parameters, where k represents the current node. This represents the attention score of the current k-th node. e t The weights are obtained by normalizing the weights based on the current input and the current hidden layer state using the SoftMax function. α t , e k This represents the attention score calculated at node k. t Indicates the time step. This represents the weighted time series. For network traffic text data X Network data traffic in x t The first in network data traffic t One data volume; The weighted time series The process of inputting into a variational autoencoder with a Bi-GRU-based architecture for computation can be represented as follows: ； ； ； ； in, Z t To update the door, r t To reset the door, W z and W r This is the weight matrix. σ It is the sigmoid activation function. Indicates past time. r This indicates information about resetting the door. W These are learnable network parameters; The cost function in the variational autoencoder for: ； in, L rec ( θ ) is the mean squared error loss function. D KL Denotes divergence, Indicates based on the given sample x i and network parameters φ Calculated latent variables z The posterior distribution, p ( z ) represents the prior distribution.

2. The unsupervised anomaly detection method according to claim 1, characterized in that, Before inputting the unknown category of network traffic text data into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, the unknown category of network traffic text data is sequentially cleaned, resampled, quantified, and normalized to obtain normalized unknown category of network traffic text data.

3. The unsupervised anomaly detection method according to claim 1, characterized in that, The training process of the unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes: Collect various types of network traffic data samples, including normal network traffic data samples under normal network conditions and abnormal network traffic data samples under various preset abnormal types. The collected network traffic data samples of various types are cleaned, resampled, quantified, and normalized to obtain a network traffic dataset. The network traffic dataset is divided into a training set and a test set. Construct an unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder; The initial parameters and hyperparameters of the unsupervised anomaly detection model based on the two-layer attention mechanism and variational autoencoder are set to obtain the constructed unsupervised anomaly detection model. The training set data is input into the built unsupervised anomaly detection model for training, and the anomaly detection accuracy of the built unsupervised anomaly detection model is tested using the validation set. The optimal parameters of the built unsupervised anomaly detection model are obtained, and the trained unsupervised anomaly detection model based on the two-layer attention mechanism and variational autoencoder is obtained based on the optimal parameters.

4. The unsupervised anomaly detection method according to claim 1, characterized in that, The convolution operation process of the convolutional neural network layer is represented as follows: ； in, For the first l The result of the convolution operation of the convolutional layer. l The number of convolutional layers. i For the index of the eigenvalue, j For the index of the feature map, Represented as the first convolutional layer in the previous convolutional layer m The convolution kernel weights of each filter, Indicates the first convolutional layer in the previous convolutional layer. i + m -1 network data traffic, Indicates the first convolutional layer in the previous convolutional layer. j The bias of each feature map M This indicates the size of the filter in the convolutional layer.

5. An unsupervised anomaly detection device, characterized in that, include: The acquisition module is used to acquire network traffic text data of unknown categories; The model processing module is used to input the unknown category of network traffic text data into a pre-trained unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder, and output anomaly text data through the unsupervised anomaly detection model based on the two-layer attention mechanism and a variational autoencoder. The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder includes an input layer, an input attention layer, a convolutional neural network layer, a variational autoencoder, and an output layer connected in sequence; the variational autoencoder includes an encoder, a feature attention layer, and a decoder connected in sequence. The unsupervised anomaly detection model based on a two-layer attention mechanism and a variational autoencoder outputs abnormal text data, including: The normalized network traffic text data of unknown categories input through the input layer is weighted using the input attention layer to obtain weighted network traffic text data; The weighted network traffic text data is input into the convolutional neural network layer for calculation to extract the spatial characteristics of network traffic text data of unknown categories. The encoder is used to perform dimensionality reduction processing on the spatial characteristics of the unknown category of network traffic text data, and the temporal correlation of the spatial characteristics of the unknown category of network traffic text data is extracted simultaneously. The time correlation obtained from dimensionality reduction is weighted using a feature attention layer to obtain the filtered data after secondary weighting. The filtered data is input into the decoder for decoding, and the decoded data is output through the output layer. The reconstruction error is calculated on the decoded data, and the reconstruction error is regarded as abnormal text data if it is greater than a preset threshold. The computational process of the two-layer attention mechanism is expressed as follows: ； ； ； in, and These are learnable network parameters, where k represents the current node. This represents the attention score of the current k-th node. e t The weights are obtained by normalizing the weights based on the current input and the current hidden layer state using the SoftMax function. α t , e k This represents the attention score calculated at node k. t Indicates the time step. This represents the weighted time series. For network traffic text data X Network data traffic in x t The first in network data traffic t One data volume; The weighted time series The process of inputting into a variational autoencoder with a Bi-GRU-based architecture for computation can be represented as follows: ； ； ； ； in, Z t To update the door, r t To reset the door, W z and W r This is the weight matrix. σ It is the sigmoid activation function. Indicates past time. r This indicates information about resetting the door. W These are learnable network parameters; The cost function in the variational autoencoder for: ； in, L rec ( θ ) is the mean squared error loss function. D KL Denotes divergence, Indicates based on the given sample x i and network parameters φ Calculated latent variables z The posterior distribution, p ( z ) represents the prior distribution.

6. A computer-readable storage medium for storing one or more programs, characterized in that, The one or more programs include instructions that, when executed by a computing device, cause the computing device to perform any of the methods according to claims 1 to 4.

7. A computer device, characterized in that, include, One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for performing any of the methods according to claims 1 to 4.

Images