Communication network data anomaly identification method, system and medium

Abstract

The present application relates to the field of communication data processing technology, and specifically discloses a communication network data anomaly identification method, system and medium, which uses artificial intelligence technology based on deep learning to monitor and analyze the flow data packets of the communication network interface, capture the flow statistical characteristics of the communication network at each time point, and intelligently judge whether the network data is abnormal based on the flow statistical characteristics of the communication network. In this way, potential problems in the network can be discovered in time and corresponding measures can be taken to prevent and repair them, providing strong guarantees for the safe, stable and efficient operation of the communication network.

Description

Technical Field

[0001] The present application relates to the field of communication data processing technology, and more specifically, to a communication network data anomaly identification method, system and medium. Background Art

[0002] With the rapid development of information technology, communication networks have become one of the important infrastructures of modern society, carrying a large amount of data transmission and processing tasks. However, with the expansion of network scale and the increase of complexity, the problem of data anomalies in communication networks has become increasingly prominent. For example, network attacks, equipment failures, configuration errors, etc. may cause data anomalies, which in turn affect the stability, security and availability of the network. Therefore, communication network data anomaly identification is an important link to ensure the safe, stable and efficient operation of the network.

[0003] In communication networks, traffic data packets are a basic component of network operation. By monitoring and analyzing traffic data packets, key network operation information can be obtained. However, traditional rule-based anomaly detection technologies often have problems such as low accuracy, poor real-time performance, and weak adaptability, and cannot cope well with the complexity and variability of network traffic data. Therefore, an optimized communication network data anomaly identification method, system, and medium are expected. Summary of the invention

[0004] In order to solve the above technical problems, this application is proposed. The embodiments of the present application provide a communication network data anomaly identification method, system and medium, which use artificial intelligence technology based on deep learning to monitor and analyze the traffic data packets of the communication network interface, capture the traffic statistical characteristics of the communication network at each time point, and based on the traffic statistical characteristics of the communication network, intelligently judge whether the network data is abnormal. In this way, potential problems in the network can be discovered in time and corresponding measures can be taken to prevent and repair them, providing strong guarantees for the safe, stable and efficient operation of the communication network.

[0005] Accordingly, according to one aspect of the present application, a method for identifying abnormal communication network data is provided, which includes:

[0006] Obtaining a time series of traffic packets passing through a communication network interface within a predetermined time period;

[0007] Extracting the flow statistical features of each flow data packet in the time series of the flow data packets to obtain a sequence of flow statistical features;

[0008] Performing multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive representation feature vector;

[0009] Based on the multi-dimensional network data state comprehensive characterization feature vector, determine whether the network data is abnormal.

[0010] In the above-mentioned communication network data anomaly identification method, the traffic statistical features include traffic size, traffic rate, traffic direction, packet length, packet time interval, protocol type, source IP address, destination IP address, source port number and destination port number.

[0011] In the above-mentioned communication network data anomaly identification method, a multi-scale context association analysis is performed on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive characterization feature vector, including: the traffic statistical features of each traffic data packet in the sequence of traffic statistical features are respectively passed through an embedding encoder based on a fully connected layer to obtain a sequence of traffic statistical feature embedded coding feature vectors; short-term dependency feature extraction is performed on the sequence of traffic statistical feature embedded coding feature vectors to obtain a first-scale traffic statistical feature context association feature vector; long-term dependency feature extraction is performed on the sequence of traffic statistical feature embedded coding feature vectors to obtain a second-scale traffic statistical feature context association feature vector; the first-scale traffic statistical feature context association feature vector and the second-scale traffic statistical feature context association feature vector are fused to obtain the multi-dimensional network data state comprehensive characterization feature vector.

[0012] In the above-mentioned communication network data anomaly identification method, short-term dependency feature extraction is performed on the sequence of traffic statistical feature embedded coding feature vectors to obtain a first-scale traffic statistical feature context-associated feature vector, including: passing the sequence of traffic statistical feature embedded coding feature vectors through a first context-associated encoder based on an RNN model to obtain the first-scale traffic statistical feature context-associated feature vector.

[0013] In the above-mentioned communication network data anomaly identification method, long-term dependency feature extraction is performed on the sequence of traffic statistical feature embedded coding feature vectors to obtain a second-scale traffic statistical feature context-associated feature vector, including: passing the sequence of traffic statistical feature embedded coding feature vectors through a second context-associated encoder based on a Bi-LSMT model to obtain a second-scale traffic statistical feature context-associated feature vector.

[0014] In the above-mentioned communication network data anomaly identification method, the identification result is determined based on the multi-dimensional network data state comprehensive characterization feature vector, including: optimizing the multi-dimensional network data state comprehensive characterization feature vector to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector; passing the optimized multi-dimensional network data state comprehensive characterization feature vector through a classifier-based network data state identifier to obtain the identification result, and the identification result is used to indicate whether there is an anomaly in the network data.

[0015] In the above-mentioned communication network data anomaly identification method, the multi-dimensional network data state comprehensive characterization feature vector is optimized to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector, including: performing classification data recognition optimization based on label position sensitivity on the first scale traffic statistical feature context association feature vector and the second scale traffic statistical feature context association feature vector to obtain a correction feature vector; calculating the position point multiplication between the correction feature vector and the multi-dimensional network data state comprehensive characterization feature vector to obtain the optimized multi-dimensional network data state comprehensive characterization feature vector.

[0016] In the above-mentioned communication network data anomaly identification method, the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector are subjected to classification data identification optimization based on label position sensitivity to obtain a correction feature vector, including: calculating the position mean vector between the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector; calculating the mean and variance of the feature set composed of all eigenvalues ​​of the position mean vector; and calculating the position of the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector. The mean of the eigenvalues ​​is used as the exponent of the natural constant to calculate the exponential function value with the natural constant as the base to obtain a first exponential function value; the inverse of the variance of the feature set is used as the exponent of the natural constant to calculate the exponential function value with the natural constant as the base and then subtract one to obtain an exponential adjustment difference; the first exponential function value is divided by the exponential adjustment difference and then subtracted from the mean of the feature set, and the calculated difference is activated by a ReLU function to obtain a first activation value; the absolute value of the first activation value is taken and then activated by a Selu function to obtain a second activation value; the second activation value is multiplied by the first exponential function value to obtain the eigenvalue of the predetermined position of the corrected feature vector.

[0017] According to another aspect of the present application, a communication network data anomaly identification system is provided, comprising:

[0018] A flow data monitoring module, used to obtain a time series of flow data packets passing through the communication network interface within a predetermined time period;

[0019] A flow statistics feature extraction module, used to extract the flow statistics feature of each flow data packet in the time series of the flow data packets to obtain a sequence of flow statistics features;

[0020] A multi-scale context association analysis module, used to perform multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive representation feature vector;

[0021] The network data anomaly identification module is used to determine whether the network data is abnormal based on the multi-dimensional network data state comprehensive characterization feature vector.

[0022] According to another aspect of the present application, a medium is provided, on which a communication network data anomaly identification program is stored, and when the communication network data anomaly identification program is executed by a processor, the communication network data anomaly identification method as described above is implemented.

[0023] Compared with the prior art, the communication network data anomaly identification method, system and medium provided by the present application use artificial intelligence technology based on deep learning to monitor and analyze the traffic data packets of the communication network interface, capture the traffic statistical characteristics of the communication network at each time point, and intelligently judge whether the network data is abnormal based on the traffic statistical characteristics of the communication network. In this way, potential problems in the network can be discovered in time and corresponding measures can be taken to prevent and repair them, providing strong guarantees for the safe, stable and efficient operation of the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0025] Figure 1 The present invention is a flowchart of a method for identifying abnormal communication network data according to an embodiment of the present application.

[0026] Figure 2 Schematic diagram of the architecture of a method for identifying anomalies in communication network data according to an embodiment of the present application.

[0027] Figure 3 The present invention is a flowchart of performing multi-scale context association analysis on the sequence of traffic statistical features in the communication network data anomaly identification method according to an embodiment of the present application to obtain a multi-dimensional network data state comprehensive representation feature vector.

[0028] Figure 4 This is a flowchart of determining an identification result based on the multi-dimensional network data state comprehensive characterization feature vector in the communication network data anomaly identification method according to an embodiment of the present application.

[0029] Figure 5 4 is a block diagram of a communication network data anomaly identification system according to an embodiment of the present application. DETAILED DESCRIPTION

[0030] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0031] Exemplary Methods

[0032] As mentioned in the above background technology, in a communication network, traffic data packets are a basic component of network operation, and key network operation information can be obtained by monitoring and analyzing traffic data packets. However, traditional rule-based anomaly detection technologies often have problems such as low accuracy, poor real-time performance, and weak adaptability, and cannot cope well with the complexity and variability of network traffic data. In response to the above technical problems, the technical concept of the present application is to use artificial intelligence technology based on deep learning to monitor and analyze the traffic data packets of the communication network interface, capture the traffic statistical characteristics of the communication network at each time point, and based on the traffic statistical characteristics of the communication network The time-series context association information, intelligently judge whether there is anomaly in the network data. In this way, potential problems in the network can be discovered in a timely manner and corresponding measures can be taken to prevent and repair them, providing a strong guarantee for the safe, stable and efficient operation of the communication network.

[0033] Figure 1 The present invention is a flowchart of a method for identifying abnormal communication network data according to an embodiment of the present application. Figure 2 FIG. 1 is a schematic diagram of the architecture of a method for identifying abnormal communication network data according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to the communication network data anomaly identification method of the embodiment of the present application, the steps include: S110, obtaining the time series of traffic data packets passing through the communication network interface within a predetermined time period; S120, extracting the traffic statistical features of each traffic data packet in the time series of the traffic data packets to obtain a sequence of traffic statistical features; S130, performing multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive characterization feature vector; S140, determining whether the network data has an anomaly based on the multi-dimensional network data state comprehensive characterization feature vector.

[0034] In the above communication network data anomaly identification method, the step S110 obtains the time series of the flow data packets passing through the communication network interface within a predetermined time period. It should be understood that the flow data packet is the basic unit transmitted in the communication network. By capturing and recording the flow data packets continuously generated and transmitted in the communication network within a specific time period, the flow change situation and data flow characteristics of the communication network within the time period can be obtained. By analyzing the law of data flow, the flow change situation of the network can be deeply understood, so as to timely discover abnormal data flow and solve potential network problems in a timely manner.

[0035] In the above communication network data anomaly identification method, the step S120 extracts the traffic statistical features of each traffic data packet in the time series of the traffic data packet to obtain a sequence of traffic statistical features. In a specific example of the present application, the traffic statistical features include traffic size, traffic rate, traffic direction, packet length, packet time interval, protocol type, source IP address, target IP address, source port number and target port number. It should be understood that network traffic features such as traffic size, traffic rate, traffic direction, packet length, packet time interval, protocol type, source IP address, target IP address, source port number and target port number have important reference value for network traffic analysis. Specifically, traffic size is an important indicator for measuring network load, which helps to determine whether the network is congested; traffic rate reflects the real-time changes in network traffic, which helps to identify network attacks (such as DDoS attacks) or abnormal traffic; traffic direction can reveal the transmission path of network traffic, which helps to identify abnormal data transmission; packet length reflects the data distribution of network traffic, which helps to identify different types of application traffic (such as short TCP control packets and large data volume file transfer packets); packet time interval reflects the time distribution of network traffic, which helps to identify network delays, jitters and other problems. Protocol type, source IP address, destination IP address, source port number, and destination port number can reveal the source and destination of network traffic, helping to identify potential network attacks or abnormal behaviors. By extracting these traffic statistics, we can comprehensively and meticulously describe the state and changes of network traffic, gain an in-depth understanding of the behavior patterns, performance status, and security status of network traffic, and provide rich feature information for abnormal identification of network data.

[0036] In the above-mentioned communication network data anomaly identification method, the step S130 performs a multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive characterization feature vector. It should be understood that, considering the complexity and dynamics of communication network traffic, single-scale traffic statistical features are often difficult to fully and accurately describe the true state of network data. Therefore, in the technical solution of the present application, a multi-scale context association analysis method is proposed, which performs association analysis on traffic statistical features at different time scales to more deeply reveal the inherent laws and potential problems of network data.

[0037] Figure 3 The present invention is a flowchart of performing multi-scale context association analysis on the sequence of traffic statistical features in the communication network data anomaly identification method according to an embodiment of the present application to obtain a multi-dimensional network data state comprehensive characterization feature vector. Figure 3 As shown, the step S130 includes: S131, respectively passing the traffic statistical features of each traffic data packet in the sequence of traffic statistical features through an embedding encoder based on a fully connected layer to obtain a sequence of traffic statistical feature embedded coding feature vectors; S132, performing short-term dependency feature extraction on the sequence of traffic statistical feature embedded coding feature vectors to obtain a first-scale traffic statistical feature context-associated feature vector; S133, performing long-term dependency feature extraction on the sequence of traffic statistical feature embedded coding feature vectors to obtain a second-scale traffic statistical feature context-associated feature vector; S134, fusing the first-scale traffic statistical feature context-associated feature vector and the second-scale traffic statistical feature context-associated feature vector to obtain the multi-dimensional network data state comprehensive representation feature vector.

[0038] Specifically, in step S131, the traffic statistical features of each traffic data packet in the sequence of traffic statistical features are respectively passed through an embedding encoder based on a fully connected layer to obtain a sequence of traffic statistical feature embedded coding feature vectors. It should be understood that, considering that the traffic statistical features are usually high-dimensional and sparse, directly using them for context association analysis processing may lead to problems such as high computational complexity, long training time, and overfitting. Therefore, in order to improve the effectiveness and utilization of features, in the technical solution of the present application, an embedding encoder based on a fully connected layer is further used to embed the traffic statistical features of each traffic data packet in the sequence of traffic statistical features, so as to map the high-dimensional and sparse traffic statistical features into low-dimensional and dense embedded coding feature vectors. Specifically, the embedding encoder based on the fully connected layer can effectively capture the association and dependency between the traffic statistical features of the traffic data packets, thereby capturing complex network behavior patterns, which can not only reduce the dimension and sparsity of the features and reduce the amount of calculation, but also better retain the association and dependency between the original features, and provide strong support for the subsequent temporal context association analysis between each traffic data packet.

[0039] Specifically, the step S132 performs short-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector to obtain a first-scale traffic statistical feature context-associated feature vector. In a specific example of the present application, the encoding method for performing short-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector is to pass the sequence of the traffic statistical feature embedded coding feature vector through a first context-associated encoder based on an RNN model to obtain the first-scale traffic statistical feature context-associated feature vector. It should be understood that since the changes in network traffic usually have a certain short-term dependency, that is, there is an obvious correlation between the traffic data at adjacent time points. Therefore, in the technical solution of the present application, in order to capture the short-term dependency characteristics of each traffic data packet in the time dimension, a first context-associated encoder based on an RNN model is used to perform short-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector. Those skilled in the art should be aware that, due to the characteristics of its internal loop structure, the RNN model captures the short-term time dependencies of the traffic statistical features embedded in the sequence of encoded feature vectors through recurrent connections, fully understands and utilizes the temporal context information of the traffic data, and describes the state and behavior patterns of network traffic in the short term in detail, reflecting the short-term dynamic change characteristics of network traffic, and providing an effective basis for subsequent anomaly identification.

[0040] Specifically, the step S133 performs long-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector to obtain a second-scale traffic statistical feature context-associated feature vector. In a specific example of the present application, the encoding method for performing long-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector is to pass the sequence of the traffic statistical feature embedded coding feature vector through a second context-associated encoder based on the Bi-LSMT model to obtain a second-scale traffic statistical feature context-associated feature vector. It should be understood that in addition to short-term dependencies, changes in network traffic also have certain long-term dependencies, that is, there may also be associations and dependencies between traffic data at time points that are far apart. Therefore, in the technical solution of the present application, a second context-associated encoder based on the Bi-LSMT model is further used to perform long-term dependency feature extraction on the sequence of the traffic statistical feature embedded coding feature vector. Specifically, compared with the RNN model, the Bi-LSMT model has a stronger ability to capture long-term dependencies. Through its bidirectional LSTM structure, it can simultaneously capture the forward and backward contextual information of traffic data. This means that the Bi-LSTM can simultaneously consider the impact of historical traffic data and future traffic data on current data, and more comprehensively understand the context of the data flow, thereby effectively revealing the long-term change patterns of traffic data, providing different perspectives and levels of understanding of traffic data, and further improving the accuracy of anomaly identification.

[0041] Specifically, the step S134 fuses the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector to obtain the multi-dimensional network data state comprehensive characterization feature vector. It should be understood that the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector extracted by the RNN model and the Bi-LSTM model respectively represent the network traffic context information on different time scales, and each has its own emphasis on the characterization of the network data state. Therefore, by fusing the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector, the advantages of both can be fully utilized to form complementarity, obtain richer and more detailed comprehensive characterization features, more comprehensively describe the state of network data, and provide richer and more accurate information for subsequent anomaly identification. In addition, through multi-scale feature fusion processing, the model's dependence on single-scale features can be reduced, and the robustness of the model can be improved.

[0042] In the above communication network data anomaly identification method, the step S140 determines whether the network data is abnormal based on the multi-dimensional network data state comprehensive characterization feature vector. Figure 4This is a flow chart of determining the recognition result based on the multi-dimensional network data state comprehensive characterization feature vector in the communication network data anomaly recognition method according to an embodiment of the present application. Figure 4 As shown, the step S140 includes: S141, optimizing the multi-dimensional network data state comprehensive characterization feature vector to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector; S142, passing the optimized multi-dimensional network data state comprehensive characterization feature vector through a classifier-based network data state identifier to obtain the identification result, and the identification result is used to indicate whether there is an abnormality in the network data.

[0043] Specifically, the step S141 optimizes the multi-dimensional network data state comprehensive characterization feature vector to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector. In particular, in the technical solution of the present application, on the one hand, considering that the first-scale feature vector focuses on capturing short-term patterns and trends of traffic statistical characteristics, while the second-scale feature vector may focus more on long-term patterns and periodic changes. The feature vectors of these two scales provide complementary information within different time ranges. Position complementary information refers to the unique information contained in each of the feature vectors of different scales. For example, the first-scale feature vector based on RNN may be better at capturing traffic changes in real time or in a short period of time, while the second-scale feature vector based on Bi-LSMT may be better at capturing traffic patterns spanning longer time periods. Using the position complementary information of different feature sets can provide a more comprehensive perspective, thereby more accurately identifying abnormal behavior in network traffic. On the other hand, considering that in actual network traffic data, the number of packets of normal traffic may be far more than the number of packets of abnormal traffic, resulting in uneven label distribution. This unevenness may cause the model to tend to predict the majority class (normal traffic) while ignoring the minority class (abnormal traffic). Considering the problem of uneven label distribution can improve the generalization ability of the model for different types of traffic, ensuring that the model can give reasonable recognition results when facing various network conditions. Based on this, in the technical solution of the present application, the first scale traffic statistical feature context-related feature vector and the second scale traffic statistical feature context-related feature vector are optimized for classified data recognition based on label position sensitivity to obtain a corrected feature vector; then the position point multiplication between the corrected feature vector and the multi-dimensional network data state comprehensive representation feature vector is calculated to obtain the optimized multi-dimensional network data state comprehensive representation feature vector, thereby improving the feature representation accuracy and robustness of the multi-dimensional network data state comprehensive representation feature vector, and improving the accuracy of data anomaly recognition.

[0044] Specifically, the first scale flow statistical feature context-associated feature vector and the second scale flow statistical feature context-associated feature vector are subjected to classification data recognition optimization based on label position sensitivity to obtain a correction feature vector, including: calculating the position mean vector between the first scale flow statistical feature context-associated feature vector and the second scale flow statistical feature context-associated feature vector; calculating the mean and variance of a feature set composed of all eigenvalues ​​of the position mean vector; taking the mean of the eigenvalues ​​of the predetermined positions of the first scale flow statistical feature context-associated feature vector and the second scale flow statistical feature context-associated feature vector as the mean. An exponential function value with the natural constant as the base is calculated as the exponent of the natural constant to obtain a first exponential function value; an exponential function value with the natural constant as the base is calculated using the opposite number of the variance of the feature set as the exponent of the natural constant and then subtracting one to obtain an exponential adjustment difference; the first exponential function value is divided by the exponential adjustment difference and then subtracted from the mean of the feature set, and the calculated difference is activated by a ReLU function to obtain a first activation value; the absolute value of the first activation value is taken and then activated by a Selu function to obtain a second activation value; the second activation value is multiplied by the first exponential function value to obtain a eigenvalue of a predetermined position of the corrected eigenvector.

[0045] More specifically, the first scale flow statistical feature context-associated feature vector and the second scale flow statistical feature context-associated feature vector are optimized for classified data recognition based on label position sensitivity to obtain a correction feature vector, including: the first scale flow statistical feature context-associated feature vector and the second scale flow statistical feature context-associated feature vector are optimized for classified data recognition based on label position sensitivity using the following optimization formula, wherein the optimization formula is: ;in, The first scale traffic statistical feature context associated feature vector is represented by The eigenvalues ​​at the positions, The second scale traffic statistical feature context associated feature vector is represented by The eigenvalues ​​at the positions, and is the mean and variance of a feature set consisting of all feature values ​​of the position mean vector between the first scale traffic statistical feature context associated feature vector and the second scale traffic statistical feature context associated feature vector, represents the linear rectification function, represents the Selu activation function, represents the first The feature value at each position.

[0046] Here, the first-scale traffic statistical feature context-associated feature vector and the second-scale traffic statistical feature context-associated feature vector are optimized for classification data recognition based on label position sensitivity. By stacking different feature vectors and considering their distribution in the feature space, the model can better understand and process unseen data and enhance the generalization ability of the model. At the same time, the sensitivity of label position enables the model to more accurately identify and classify data points, especially in cases with obvious boundaries or groups, thereby improving the classification accuracy. Moreover, the classification data recognition optimization based on label position sensitivity can optimize the feature representation of the data, making similar data points closer in the feature space and different data points more dispersed, thereby facilitating the decision-making of the classifier.

[0047] Specifically, in step S142, the optimized multi-dimensional network data state comprehensive characterization feature vector is passed through a classifier-based network data state identifier to obtain the identification result, and the identification result is used to indicate whether the network data is abnormal. It should be understood that a classifier is a model used in the field of machine learning to divide input data into different categories. In network data anomaly identification, the classifier can use training data to learn how to distinguish between normal and abnormal network data states. In this way, the multi-dimensional network data state comprehensive characterization feature vector is input into the trained classifier, and the classifier can classify and map the optimized multi-dimensional network data state comprehensive characterization feature vector based on the classification rules learned during the training process to obtain the identification result of the network data state, which is used to indicate whether the network data is abnormal. In this way, the accuracy of network data anomaly identification is effectively improved, which helps to timely discover and deal with network attacks, failures and other problems, and ensure the security and stability of the network.

[0048] In summary, the communication network data anomaly identification method according to the embodiment of the present application is explained, which uses artificial intelligence technology based on deep learning to monitor and analyze the traffic data packets of the communication network interface, captures the traffic statistical characteristics of the communication network at each time point, and based on the traffic statistical characteristics of the communication network, intelligently judges whether the network data is abnormal. In this way, potential problems in the network can be discovered in time and corresponding measures can be taken to prevent and repair them, providing strong guarantees for the safe, stable and efficient operation of the communication network.

[0049] Exemplary Systems

[0050] Figure 5 FIG. 1 is a block diagram of a communication network data anomaly identification system according to an embodiment of the present application. Figure 5As shown, according to the communication network data anomaly identification system 100 of the embodiment of the present application, it includes: a traffic data monitoring module 110, which is used to obtain the time series of traffic data packets passing through the communication network interface within a predetermined time period; a traffic statistical feature extraction module 120, which is used to extract the traffic statistical features of each traffic data packet in the time series of the traffic data packet to obtain a sequence of traffic statistical features; a multi-scale context association analysis module 130, which is used to perform multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive characterization feature vector; a network data anomaly identification module 140, which is used to determine whether the network data has an anomaly based on the multi-dimensional network data state comprehensive characterization feature vector.

[0051] Here, those skilled in the art can understand that the specific operations of each step in the above communication network data anomaly identification system have been referred to above. Figures 1 to 4 The description of the communication network data anomaly identification method has been described in detail, and therefore, its repeated description will be omitted.

[0052] Exemplary computer program products and computer-readable storage media

[0053] In addition to the above-mentioned methods and systems, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps of the communication network data anomaly identification method according to various embodiments of the present application described in the above-mentioned "Exemplary Method" section of this specification.

[0054] The computer program product may be written in any combination of one or more programming languages ​​to write program codes for performing the operations of the embodiments of the present application, including object-oriented programming languages, such as Java, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user computing device, as an independent software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0055] In addition, an embodiment of the present application may also be a computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the processor executes the steps of the communication network data anomaly identification method according to various embodiments of the present application described in the above "Exemplary Method" section of this specification.

[0056] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0057] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0058] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed devices, systems and methods can be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the module division is only a logical function division, and there may be other division methods in actual implementation. The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0059] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0060] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0061] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0062] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A method for identifying abnormal communication network data, characterized in that: include: Obtaining a time series of traffic packets passing through a communication network interface within a predetermined time period; Extracting the flow statistical features of each flow data packet in the time series of the flow data packets to obtain a sequence of flow statistical features; Performing multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive representation feature vector; Determining whether the network data is abnormal based on the multi-dimensional network data state comprehensive characterization feature vector; Among them, performing multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive representation feature vector includes: The flow statistical features of each flow data packet in the sequence of flow statistical features are respectively passed through an embedding encoder based on a fully connected layer to obtain a sequence of flow statistical feature embedding encoding feature vectors; Performing short-term dependency feature extraction on the sequence of the traffic statistical feature embedding encoding feature vectors to obtain a first-scale traffic statistical feature context association feature vector; Performing long-term dependency feature extraction on the sequence of the traffic statistical feature embedding encoding feature vectors to obtain a second-scale traffic statistical feature context association feature vector; Fusing the first scale traffic statistical feature context-related feature vector and the second scale traffic statistical feature context-related feature vector to obtain the multi-dimensional network data state comprehensive representation feature vector; Wherein, determining the recognition result based on the multi-dimensional network data state comprehensive characterization feature vector includes: Optimizing the multi-dimensional network data state comprehensive characterization feature vector to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector; The optimized multi-dimensional network data state comprehensive characterization feature vector is passed through a classifier-based network data state identifier to obtain the identification result, and the identification result is used to indicate whether the network data is abnormal; The step of optimizing the multi-dimensional network data state comprehensive characterization feature vector to obtain an optimized multi-dimensional network data state comprehensive characterization feature vector includes: Performing classification data recognition optimization based on label position sensitivity on the first scale flow statistical feature context association feature vector and the second scale flow statistical feature context association feature vector to obtain a correction feature vector; Calculate the position point multiplication between the correction feature vector and the multi-dimensional network data state comprehensive characterization feature vector to obtain the optimized multi-dimensional network data state comprehensive characterization feature vector; The step of performing classification data recognition optimization based on label position sensitivity on the first scale flow statistical feature context association feature vector and the second scale flow statistical feature context association feature vector to obtain a correction feature vector includes: Calculating a position-based mean vector between the first-scale traffic statistical feature context-associated feature vector and the second-scale traffic statistical feature context-associated feature vector; Calculate the mean and variance of a feature set consisting of all eigenvalues ​​of the position-wise mean vector; Using the mean of the feature values ​​of the predetermined positions of the first scale traffic statistical feature context-associated feature vector and the second scale traffic statistical feature context-associated feature vector as the exponent of the natural constant, an exponential function value with the natural constant as the base is calculated to obtain a first exponential function value; Using the inverse of the variance of the feature set as the exponent of the natural constant, calculating an exponential function value with the natural constant as the base and then subtracting one to obtain an exponential adjustment difference; Dividing the first exponential function value by the exponential adjustment difference value and then subtracting the mean value of the feature set, and activating the calculated difference value through a ReLU function to obtain a first activation value; Taking the absolute value of the first activation value and then activating it through the Selu function to obtain a second activation value; The second activation value is multiplied by the first exponential function value to obtain a feature value at a predetermined position of the corrected feature vector.

2. The method for identifying abnormal communication network data according to claim 1, characterized in that: The traffic statistics characteristics include traffic size, traffic rate, traffic direction, packet length, packet time interval, protocol type, source IP address, destination IP address, source port number and destination port number.

3. The communication network data anomaly identification method according to claim 2, characterized in that: Performing short-term dependency feature extraction on the sequence of the traffic statistical feature embedding encoding feature vectors to obtain a first-scale traffic statistical feature context association feature vector, including: The sequence of the traffic statistical feature embedded encoding feature vectors is passed through a first context-associated encoder based on an RNN model to obtain the first-scale traffic statistical feature context-associated feature vector.

4. The method for identifying abnormal communication network data according to claim 3, characterized in that: The long-term dependency feature extraction is performed on the sequence of the traffic statistical feature embedding encoding feature vector to obtain a second-scale traffic statistical feature context association feature vector, including: The sequence of the traffic statistical feature embedded in the encoded feature vector is passed through a second context-associated encoder based on the Bi-LSMT model to obtain a second-scale traffic statistical feature context-associated feature vector.

5. A communication network data anomaly identification system, using the communication network data anomaly identification method according to claim 1, characterized in that: include: A flow data monitoring module, used to obtain a time series of flow data packets passing through the communication network interface within a predetermined time period; A flow statistics feature extraction module, used to extract the flow statistics feature of each flow data packet in the time series of the flow data packets to obtain a sequence of flow statistics features; A multi-scale context association analysis module, used to perform multi-scale context association analysis on the sequence of traffic statistical features to obtain a multi-dimensional network data state comprehensive representation feature vector; The network data anomaly identification module is used to determine whether the network data is abnormal based on the multi-dimensional network data state comprehensive characterization feature vector.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a communication network data anomaly identification program, and when the communication network data anomaly identification program is executed by a processor, the communication network data anomaly identification method according to any one of claims 1 to 4 is implemented.

Images