Network traffic anomaly detection method and apparatus

Abstract

The application provides a network traffic anomaly detection method and device, and relates to the technical field of computers.The method comprises the following steps: obtaining target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data; inputting the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected; wherein the detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and a traffic anomaly label of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.The application can accurately obtain a network traffic anomaly detection result when the number of labeled samples is small.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and in particular, to a network traffic anomaly detection method and device. BACKGROUND

[0002] Anomaly detection on network traffic of a device helps to find potential faults in the network, ensure normal operation of the entire network, and improve operation and maintenance efficiency. Therefore, how to conveniently and accurately perform network traffic anomaly detection is an important issue to be solved in the industry at present.

[0003] In related technologies, a deep learning model is mainly used for network traffic anomaly detection, and the premise for the deep learning model to achieve good results is to have sufficient labeled samples for model training. However, in actual production, labeling network traffic data is very expensive, and it is difficult to obtain sufficient labels due to labeling time cost and economic cost, thereby causing network traffic anomaly detection to be difficult to achieve the expected goal and poor detection accuracy.

[0004] Therefore, it is urgent to propose a network traffic anomaly detection method and device to solve the above technical problems. SUMMARY

[0005] The present application provides a network traffic anomaly detection method and device to solve the problem that it is difficult to obtain sufficient labels in the prior art, which leads to poor detection accuracy of network traffic anomaly detection, and to accurately obtain network traffic anomaly detection results when there are few labeled samples.

[0006] The present application provides a network traffic anomaly detection method, comprising:

[0007] obtaining target network traffic data of a network device to be detected;

[0008] inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data;

[0009] inputting the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected;

[0010] The detection model is trained based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and a traffic anomaly label of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0011] According to the network traffic anomaly detection method provided by the application, the detection model is obtained by training based on the following steps:

[0012] The time domain features and frequency domain features of the first sample network traffic data are extracted to obtain the multi-domain statistical features;

[0013] The first sample network traffic data is input into the traffic feature encoding module to obtain the multi-domain hybrid features of the first sample network traffic data;

[0014] The multi-domain hybrid features of the first sample network traffic data are input into the adaptive multi-task prediction module to obtain the time domain feature prediction value of the first sample network traffic data and the frequency domain feature prediction value of the first sample network traffic data;

[0015] According to the time domain feature prediction value and the frequency domain feature prediction value of the first sample network traffic data, and the time domain feature extraction value and the frequency domain feature extraction value in the multi-domain statistical features of the first sample network traffic data, a target loss function is obtained;

[0016] Based on the target loss function, the adaptive multi-task prediction module and the traffic feature encoding module are jointly pre-trained to obtain a pre-trained traffic feature encoding module;

[0017] According to the second sample network traffic data and the traffic anomaly label of the second sample network traffic data, the pre-trained traffic feature encoding module and the initial detection network are jointly fine-tuned to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network;

[0018] According to the fine-tuned traffic feature encoding module, the feature extraction module is constructed, and according to the fine-tuned initial detection network, the traffic anomaly detection network is constructed.

[0019] According to the network traffic anomaly detection method provided by the application, the traffic feature encoding module includes a channel attention module, a spatial attention module and an encoder;

[0020] The first sample network traffic data is input into the traffic feature encoding module to obtain the multi-domain hybrid features of the first sample network traffic data, including:

[0021] The first sample network traffic data is input into the channel attention module to obtain channel attention weights;

[0022] The first sample network traffic data and the channel attention weights are fused to obtain first fusion features;

[0023] Input the first fusion feature into the spatial attention module to obtain a spatial attention weight;

[0024] Fuse the first fusion feature and the spatial attention weight to obtain a second fusion feature;

[0025] Input the second fusion feature into the encoder to obtain a multi-domain mixed feature of the first sample network traffic data.

[0026] According to the network traffic anomaly detection method provided by the application, the adaptive multi-task prediction module includes a time domain feature prediction head and a frequency domain feature prediction head;

[0027] The multi-domain mixed feature of the first sample network traffic data is input into the adaptive multi-task prediction module to obtain a time domain feature prediction value of the first sample network traffic data and a frequency domain feature prediction value of the first sample network traffic data, including:

[0028] The multi-domain mixed feature of the first sample network traffic data is input into the time domain feature prediction head to obtain a time domain feature prediction value of the first sample network traffic data;

[0029] The multi-domain mixed feature of the first sample network traffic data is input into the frequency domain feature prediction head to obtain a frequency domain feature prediction value of the first sample network traffic data.

[0030] According to the network traffic anomaly detection method provided by the application, the target loss function is obtained according to the time domain feature prediction value, the frequency domain feature prediction value of the first sample network traffic data, and the time domain feature extraction value and the frequency domain feature extraction value in the multi-domain statistical feature of the first sample network traffic data, including:

[0031] According to the deviation between the time domain feature prediction value and the time domain feature extraction value, a loss function value corresponding to the time domain feature prediction task is determined;

[0032] According to the deviation between the frequency domain feature prediction value and the frequency domain feature extraction value, a loss function value corresponding to the frequency domain feature prediction task is determined;

[0033] The loss function value corresponding to the time domain feature prediction task and the loss function value corresponding to the frequency domain feature prediction task are weighted and fused to obtain the target loss function.

[0034] According to the network traffic anomaly detection method provided by the application, the pre-trained traffic feature coding module and the initial detection network are jointly fine-tuned according to the second sample network traffic data and the traffic anomaly label of the second sample network traffic data, and a fine-tuned traffic feature coding module and a fine-tuned initial detection network are obtained.

[0035] The second sample network traffic data is input into the pre-trained traffic feature coding module, and the multi-domain mixed features of the second sample network traffic data are obtained.

[0036] The multi-domain mixed features of the second sample network traffic data are input into the initial detection network, and the traffic anomaly detection result of the second sample network traffic data is obtained.

[0037] The pre-trained traffic feature coding module and the initial detection network are jointly fine-tuned according to the cross-entropy loss function value between the traffic anomaly detection result of the second sample network traffic data and the traffic anomaly label, and a fine-tuned traffic feature coding module and a fine-tuned initial detection network are obtained.

[0038] The application further provides a network traffic anomaly detection device, comprising:

[0039] An acquisition unit is configured to acquire target network traffic data of a network device to be detected.

[0040] An extraction unit is configured to input the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data.

[0041] A detection unit is configured to input the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected.

[0042] The detection model is trained based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data.

[0043] The application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the network traffic anomaly detection method according to any one of the above embodiments when executing the program.

[0044] The application further provides a non-transitory computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement any one of the network traffic anomaly detection methods.

[0045] The application further provides a computer program product, which comprises a computer program, and the computer program is executed by a processor to implement any one of the network traffic anomaly detection methods.

[0046] The network traffic anomaly detection method and device provided by the application can achieve efficient and accurate network traffic multi-domain mixed feature and traffic anomaly detection by jointly training a detection model based on a large amount of unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and a small amount of labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data, so as to make the model parameters of the detection model converge under the small amount of labeled second sample network traffic data and the traffic anomaly labels of the second sample network traffic data, and effectively solve the problem that the detection cannot achieve the expected target and the detection accuracy is poor due to the lack of label samples, thereby achieving accurate network traffic anomaly detection results by training the model with only a small amount of labeled samples. BRIEF DESCRIPTION OF DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0048] Figure 1 is a flowchart of the network traffic anomaly detection method provided by the application

[0049] Figure 2 is a structural diagram of the network traffic anomaly detection framework provided by the application.

[0050] Figure 3 is a structural diagram of the network traffic anomaly detection device provided by the application.

[0051] Figure 4 is a structural diagram of the electronic device provided by the application. DETAILED DESCRIPTION

[0052] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in conjunction with the drawings in the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present application.

[0053] In the existing network, network devices such as BRAS (Broadband Remote Access Server) devices have uplink and downlink traffic indicators, which reflect the running status of the device to a certain extent. When a fault occurs in the network, it may cause abnormal network traffic of the device, such as uplink and downlink spikes or abnormal jitter. Abnormal detection of network traffic of network devices helps to find potential faults in the network, ensure normal operation of the entire network, and improve operation and maintenance efficiency.

[0054] Splitting network traffic indicators according to fine granularity (such as 5 minutes) and using a data-driven classification method to detect network traffic slices can effectively avoid the problem of network service quality degradation caused by traffic anomalies and ensure user experience. Therefore, the related art usually detects network traffic slices based on a data-driven classification method.

[0055] For example, some researchers propose to use long short-term memory networks and attention mechanisms to build network traffic data anomaly detection models to achieve network traffic anomaly detection; some researchers propose to use feature extraction networks and classification networks to train network traffic detection models to achieve network traffic anomaly detection; and some researchers propose to use non-greedy and teaching optimization algorithms to determine network traffic anomaly detection models based on K-fold cross-validation.

[0056] However, the above methods all use deep learning models to achieve network traffic anomaly detection, and the premise for deep learning models to achieve good results is to have sufficient labeled samples for model training. However, in actual production, labeling network traffic data is very expensive, and due to the labeling time cost and economic cost, it is difficult to obtain sufficient labels, which further leads to the difficulty of network traffic anomaly detection to achieve the expected goal and poor detection accuracy.

[0057] To solve the above problems, the embodiment provides a network traffic anomaly detection method. The method integrates prior knowledge of a network, and constructs an effective feature extractor for multi-domain mixed features based on unlabeled sample data in advance without sufficient labeled samples. Finally, through the guidance of the feature extractor, a detection model for network traffic anomaly-specific feature extraction and final anomaly detection can be obtained through the training of a small amount of labeled sample data. Based on the detection model, the network traffic anomaly detection results of each network device can be accurately obtained, so that the network traffic anomaly detection results of each network device can be accurately obtained with only a small amount of labeled sample data.

[0058] Figure 1 A flowchart of the network traffic anomaly detection method provided by the embodiment is shown in Figure 1. Figure 1 As shown in the figure, the method can be applied to network operation and maintenance, quality of service monitoring, etc. to realize anomaly detection of network traffic of network devices, help to find potential faults in the network, ensure normal operation of the entire network, and improve operation efficiency. Anomaly detection of network traffic can effectively avoid the problem of network service quality degradation caused by traffic anomaly, and ensure user experience.

[0059] The method comprises the following steps.

[0060] In step 110, target network traffic data of a network device to be detected is obtained.

[0061] Here, the network device to be detected is a network device for which network traffic anomaly detection is required.

[0062] Optionally, in the case where network traffic of a detection period of the network device to be detected needs to be detected, the network traffic data segment of the detection period can be obtained by using a sliding window method to cut the network traffic data sequence of the network device to be detected at a preset time period as a period; for example, network traffic data segments composed of n(l), l = 1, …, s can be cut at a period of 5 min, where s is the length of the cut data segment.

[0063] After obtaining the network traffic data segment of the detection period, a plurality of evaluation parameters for representing the network traffic state of the network device to be detected are selected according to each piece of data in the cut network traffic data segment, thereby obtaining target network traffic data containing a plurality of evaluation parameters. The evaluation parameters contained in the target network traffic data include but are not limited to port inflow rate, port outflow rate, inflow packet rate, outflow packet rate, and accordingly, the size of the target network traffic data is s x 4.

[0064] In step 120, the target network traffic data is input into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data.

[0065] The detection model is trained based on unmarked first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0066] It should be noted that the premise for deep learning to achieve good results is to have sufficient labels. When the labels are insufficient, the effect of deep learning is difficult to guarantee. To solve this problem, the method proposed in the embodiment of the application first pre-trains the multi-domain statistical features of a large number of unlabelled samples as prior knowledge, thereby fully mining the prior knowledge of the multi-domain mixed features representing network traffic anomalies in the unlabelled samples, to obtain a pre-trained traffic feature encoding module that can extract network traffic anomaly features; then, the pre-trained traffic feature encoding module and the initial detection network are fine-tuned and trained using a small number of labeled samples, to obtain a detection model that can accurately detect network traffic anomalies. In the entire process, only a small number of labeled samples are required to train the model, and a large number of labeled samples are not required to train the model, thereby avoiding the limitation of the workload and cost of data labeling, being more economical and efficient compared with traditional supervised methods, and being more capable of effectively improving the accuracy of network traffic anomaly detection results.

[0067] Optionally, before step 120 is performed, a detection model that can accurately extract network traffic anomaly features and detect traffic anomalies is pre-trained, and the detection model is trained based on the following steps:

[0068] A large number of unlabelled first sample network traffic data of sample network devices of different structures are obtained, and multi-domain statistical features of the unlabelled first sample network traffic data are extracted, to obtain multi-domain statistical features of the first sample network traffic data. The pre-trained traffic feature encoding module is obtained based on a large number of unlabelled first sample network traffic data and the multi-domain statistical features of the first sample network traffic data. The multi-domain statistical features at least include time domain features and frequency domain features, and can further include other domain features, such as time-frequency domain features.

[0069] A small number of labeled second sample network traffic data of sample network devices of different structures are obtained, and traffic anomaly labels labeled for the second sample network traffic data are used to fine-tune and train the pre-trained traffic feature encoding module and the initial detection network, and the feature extraction module of the detection model and the traffic anomaly detection network of the detection model are constructed based on the fine-tuned traffic feature encoding module and the fine-tuned initial detection network, thereby obtaining a detection model that can extract multi-domain mixed features and detect network traffic anomalies.

[0070] The first sample network traffic data without labels refers to sample network traffic data without traffic anomaly label marking; the second sample network traffic data with labels refers to sample network traffic data with traffic anomaly label marking. The number of the first sample network traffic data without labels is much larger than the number of the second sample network traffic data with labels.

[0071] Subsequently, after the detection model is trained, the target network traffic data of the network device to be detected obtained in step 110 can be input into the feature extraction module, so that the target network traffic data is subjected to fusion feature extraction of multi-domain statistical features by the feature extraction module, to obtain multi-domain mixed features that can represent network traffic anomaly states.

[0072] Compared with the prior art in which only a single domain, such as only time domain data or only frequency domain signals, is used for feature mining, there are defects that only analyzing time domain data will lose information of frequency components of data, which is not conducive to mining periodic features, and only analyzing frequency domain data will ignore time variation of signals. The embodiment can combine multi-domain data for feature mining through the feature extraction module trained by prior knowledge of multi-domain statistical features of the first sample network traffic data without labels, which can not only mine more mixed features that are helpful for network traffic anomaly detection, but also better adapt to different data distributions of different network structures through the neural network model, which is helpful to improve the generalization and adaptability of feature mining, and further improve the performance of network traffic anomaly detection.

[0073] In step 130, the multi-domain mixed features of the target network traffic data are input into a traffic anomaly detection network of the detection model, to obtain a traffic anomaly detection result of the network device to be detected.

[0074] Optionally, after the multi-domain mixed features of the target network traffic data are obtained, the multi-domain mixed features of the target network traffic data can be input into the traffic anomaly detection network, so that the traffic anomaly detection network performs traffic anomaly detection, and thus a traffic anomaly detection result of the network device to be detected in a to-be-predicted period is obtained. The traffic anomaly detection result is used to represent a traffic anomaly category or a traffic normal category, or the traffic anomaly can be further refined into multiple different types of traffic anomaly categories.

[0075] The method provided by the embodiment is jointly trained by a large amount of unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and a small amount of labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data, so that the model parameters of the detection model can converge under the small amount of labeled second sample network traffic data and the traffic anomaly labels of the second sample network traffic data, and the multi-domain mixed features of the network traffic and the traffic anomaly detection can be efficiently and accurately performed, the problem that the detection cannot reach the expected target and the detection accuracy is poor due to insufficient labeled samples is effectively solved, and therefore the network traffic anomaly detection result can be accurately obtained by only a small amount of labeled samples for model training.

[0076] In some embodiments, the specific training steps of the detection model include:

[0077] The time domain features and the frequency domain features of the first sample network traffic data are extracted to obtain the multi-domain statistical features.

[0078] The first sample network traffic data is input into a traffic feature encoding module to obtain the multi-domain mixed features of the first sample network traffic data.

[0079] The multi-domain mixed features of the first sample network traffic data are input into an adaptive multi-task prediction module to obtain time domain feature prediction values of the first sample network traffic data and frequency domain feature prediction values of the first sample network traffic data.

[0080] A target loss function is obtained according to the time domain feature prediction values and the frequency domain feature prediction values of the first sample network traffic data and time domain feature extraction values and frequency domain feature extraction values in the multi-domain statistical features of the first sample network traffic data.

[0081] The adaptive multi-task prediction module and the traffic feature encoding module are jointly pre-trained based on the target loss function to obtain a pre-trained traffic feature encoding module.

[0082] The pre-trained traffic feature encoding module and an initial detection network are jointly fine-tuned according to the second sample network traffic data and the traffic anomaly labels of the second sample network traffic data to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network.

[0083] The feature extraction module is constructed according to the fine-tuned traffic feature encoding module, and the traffic anomaly detection network is constructed according to the fine-tuned initial detection network.

[0084] Figure 2A structural schematic diagram of a network traffic anomaly detection framework provided by the present application; as Figure 2 As shown in the figure, the method is applied to a network traffic anomaly detection framework comprising a network traffic data collection module for performing port inflow rate, port outflow rate, inflow packet rate and outflow packet rate, a multi-domain statistical feature extraction module (hereinafter also referred to as a traffic data time-frequency domain feature extraction module), a traffic feature encoding module, an adaptive multi-task prediction module and an initial detection module (hereinafter also referred to as a traffic anomaly detection module).

[0085] Optionally, the detection model is obtained by training based on the following steps:

[0086] Firstly, the premise for deep learning to achieve good results is to have enough labels. When the labels are insufficient, the effect of deep learning is difficult to guarantee, and therefore a multi-domain statistical feature extraction module is designed to select time domain features and frequency domain features that can reflect the health status of network traffic as prior knowledge of the model. In this way, each sample in the data is injected with prior knowledge, thereby generating a set of unlabeled sample data pairs; therefore, the multi-domain statistical features can be obtained based on the following steps:

[0087] Table 1 Time domain features

[0088]

[0089] Based on the network traffic data collection module, the first sample network traffic data is collected: define any unlabeled sample network traffic data N in cloud network data T , use the sliding window method to extract data segments composed of n(l), l = 1, …, s from it with a preset time period as the period, where s is the length of the extracted data segment. Select port inflow rate, port outflow rate, inflow packet rate and outflow packet rate as evaluation parameters for each sample network traffic data to form the first sample network traffic data; therefore, the size of each first sample network traffic data is s x 4, so as to complete the fusion of indicators by taking multiple evaluation parameters as different channels of data.

[0090] Table 2 Frequency domain features

[0091]

[0092] Based on the multi-domain statistical feature extraction module, the time domain features of each dimension evaluation parameter in the first sample traffic data are extracted to obtain the time domain feature extraction value of the first sample traffic data; as shown in Table 1, the time domain features here include but are not limited to mean, maximum, minimum, standard deviation, root amplitude, skewness, margin factor and kurtosis factor.

[0093] Based on the multi-domain statistical feature extraction module, the evaluation parameters in each dimension of the first sample traffic data are converted from time domain data to frequency domain distribution f(l) through fast Fourier transform, and then frequency domain feature extraction is performed respectively to obtain the frequency domain feature extraction value of the first sample traffic data. As shown in Table 2, the frequency domain features include but are not limited to spectral mean, frequency variance, frequency skewness, frequency centroid, frequency bandwidth, frequency peak value, peak factor, frequency spectrum slope and frequency skewness.

[0094] In addition, in order to eliminate the influence of the difference between the dimensions on the model training, the prior knowledge extracted, i.e., the time domain feature extraction value and the frequency domain feature extraction value, can be normalized so that the feature extraction values in different domains are in the same dimension range, thereby improving the convergence and generalization ability of the model training.

[0095] Then, the first sample network traffic data is input into the traffic feature encoding module to perform multi-domain mixed feature extraction on the first sample network traffic data by the traffic feature encoding module to obtain the multi-domain mixed features of the first sample network traffic data.

[0096] The traffic feature encoding module herein can be a method of extracting predictable high-dimensional representations in network traffic data by fusing attention mechanisms. It can be constructed based on at least one attention mechanism and a CNN (Convolutional Neural Network). Accordingly, it can first obtain a feature map through an attention mechanism, and then encode the feature map through a convolutional neural network to learn high-dimensional representations with predictability, thereby reducing the demand for labeled samples in actual application scenarios, avoiding noise interference, and improving the accuracy of traffic anomaly detection.

[0097] Then, the multi-domain mixed features of the first sample network traffic data are input into the adaptive multi-task prediction module to process the high-dimensional multi-domain mixed features by the adaptive multi-task prediction module to predict time domain feature prediction values and frequency domain feature prediction values as close as possible to the prior knowledge, so as to ensure the detectability of the extracted features.

[0098] Then, the time domain feature prediction value and the frequency domain feature prediction value of the first sample network traffic data are combined with the time domain feature extraction value and the frequency domain feature extraction value in the multi-domain statistical features of the first sample network traffic data to construct a target loss function.

[0099] The target loss function can be constructed based on the deviation between the time domain feature prediction value and the time domain feature extraction value, and the deviation between the frequency domain feature prediction value and the frequency domain feature extraction value, and the target loss function of the multi-domain feature prediction task can be constructed; or the loss function of the time domain feature prediction task can be constructed based on the deviation between the time domain feature prediction value and the time domain feature extraction value, the loss function of the frequency domain feature prediction task can be constructed based on the deviation between the frequency domain feature prediction value and the frequency domain feature extraction value, and finally, the target loss function of the multi-domain feature prediction task can be constructed based on the loss function of the time domain feature prediction task and the loss function of the frequency domain feature prediction task. The present embodiment does not make specific limitations in this regard.

[0100] Then, based on the target loss function, the adaptive multi-task prediction module and the traffic feature encoding module are iteratively pre-trained until the model converges, and / or the maximum number of iterations is reached, and then the pre-training process is stopped.

[0101] During the pre-training process, the traffic feature encoding module with the best model performance in the iterative training is obtained as the pre-trained traffic feature encoding module. Here, the traffic feature encoding module with the best model performance in the iterative training is the traffic feature encoding module corresponding to the minimum loss function value in the iterative training.

[0102] After the traffic feature encoding module and the adaptive multi-task prediction module are pre-trained using the unlabeled first sample traffic detection data, a high-dimensional representation with predictability can be obtained through the pre-trained traffic feature encoding module. During the detection module construction process, the adaptive multi-task prediction module is discarded, and only the pre-trained traffic feature encoding module is retained to participate in the fine-tuning training of the detection module. The specific training steps include:

[0103] The pre-trained traffic feature encoding module and the initial detection network are iteratively fine-tuned jointly based on the second sample network traffic data and the traffic anomaly labels of the second sample network traffic data until the model converges, and / or the maximum number of iterations is reached, and then the fine-tuning training process is stopped.

[0104] During the fine-tuning training process, the traffic feature encoding module with the best model performance in the iterative training is obtained as the fine-tuned traffic feature encoding module, and the initial detection network with the best model performance in the iterative training is obtained as the fine-tuned initial detection network. Thus, based on the fine-tuned traffic feature encoding module, a feature extraction module of the detection model is constructed, and based on the fine-tuned initial detection network, a traffic anomaly detection network of the detection module is constructed.

[0105] The method provided in this embodiment not only utilizes prior knowledge of extracting time-domain and frequency-domain features from unlabeled samples for pre-training—an unsupervised learning approach that helps reduce the need for labeled samples and allows the model to be effectively trained even with limited data or high costs—making it more feasible than traditional traffic anomaly detection methods; but also uses a mixture of time-domain and frequency-domain features as the target of multi-task learning. By simultaneously training the model to extract time-domain and frequency-domain features, it can capture different information in network traffic. Time-domain features typically focus on the temporal changes in data, while frequency-domain features focus on the frequency components of data. Using these two types of features as the target of multi-task learning enables the model to more comprehensively understand traffic data. This integrated learning approach can improve the model's robustness and adaptability, and is particularly suitable for anomaly detection tasks in complex environments that encompass multiple network traffic features. Furthermore, the construction of the feature extraction module for the detection model through a traffic feature encoding module gives the constructed detection model high comprehensive evaluation and interpretability, effectively improving the performance of network traffic anomaly detection.

[0106] In some implementations, the traffic feature encoding module includes a channel attention module, a spatial attention module, and an encoder;

[0107] The step of inputting the first sample network traffic data into the traffic feature encoding module to obtain the multi-domain hybrid features of the first sample network traffic data includes:

[0108] The first sample network traffic data is input into the channel attention module to obtain the channel attention weights;

[0109] The first sample network traffic data and the channel attention weights are fused to obtain the first fused feature;

[0110] The first fusion feature is input into the spatial attention module to obtain the spatial attention weights;

[0111] The first fusion feature and the spatial attention weight are fused to obtain the second fusion feature;

[0112] The second fusion feature is input into the encoder to obtain the multi-domain fusion feature of the first sample network traffic data.

[0113] like Figure 2As shown, the traffic feature encoding module includes an attention mechanism module and an encoder; wherein the attention mechanism module can make the model pay more attention to important information, and can avoid the model from learning some noise information that is useless for traffic monitoring. Using the attention mechanism on the first sample network traffic data n(l), l = 1,...s can enhance the significant features of the network traffic. The attention mechanism module here includes a channel attention module and a spatial attention module.

[0114] Optionally, the channel attention module can learn multiple evaluation parameters to automatically obtain the importance of different evaluation parameters; therefore, the obtaining step of the first fused feature is specifically as follows:

[0115] The first sample network traffic data is input into the channel attention module, and the channel attention weight att_1 (l) can be obtained, and the specific calculation formula is as follows:

[0116] att_1 (l) = CAM1(n(l));

[0117] wherein CAM1(·) is a model function of the channel attention module;

[0118] The first sample network traffic data and the channel attention weight are fused, and the first fused feature f_1 (l) can be obtained, and the specific formula is as follows:

[0119]

[0120] wherein σ(·) is an activation function; is an element-level multiplication operation.

[0121] Optionally, due to the time sequence and trend of network traffic data, the key trends in the data are key factors for anomaly detection. Therefore, the spatial attention mechanism can be used to focus on these key trends, and at the same time, the detection process of the present embodiment has better interpretability; therefore, the obtaining step of the second fused feature is specifically as follows:

[0122] The first fused feature f_1 (l) is input into the spatial attention module, and the spatial attention weight att_2 (l) can be obtained, and the specific calculation formula is as follows:

[0123] att_2 (l) = CAM2(f_1 (l) );

[0124] wherein CAM2(·) is a model function of the spatial attention module;

[0125] The first fusion feature and the spatial attention weight are fused to obtain a second fusion feature f_2 (l) The specific calculation formula is as follows:

[0126]

[0127] Optionally, the encoder can be constructed based on a CNN; the main role of the component is to extract a high-dimensional representation of the predictability of the feature map; therefore, the step of obtaining the multi-domain hybrid feature includes:

[0128] The second fusion feature is input into the encoder for feature encoding to obtain a multi-domain hybrid feature of the first sample network traffic data, and the specific calculation formula is as follows:

[0129] z l =σ(W*f_2 (l) +b);

[0130] Wherein, z l is the multi-domain hybrid feature; W is a filter, and b is a bias term.

[0131] The method provided in the embodiment adopts multiple evaluation indexes such as the port inflow rate, the port outflow rate, the inflow packet rate and the outflow packet rate, and uses the channel attention mechanism and the spatial attention mechanism to comprehensively consider these indexes for overall abnormality detection. The comprehensive evaluation method improves the detection accuracy. In addition, the attention mechanism and prior knowledge are introduced into the model, which increases the explainability of the model, so that it can be applied to actual industrial scenes to assist operation and maintenance engineers to understand and explain the abnormality detection result, thereby effectively improving the detection accuracy, comprehensive evaluation performance and explainability.

[0132] In some embodiments, the adaptive multi-task prediction module includes a time domain feature prediction head and a frequency domain feature prediction head;

[0133] The multi-domain hybrid feature of the first sample network traffic data is input into the adaptive multi-task prediction module to obtain a time domain feature prediction value of the first sample network traffic data and a frequency domain feature prediction value of the first sample network traffic data, including:

[0134] The multi-domain hybrid feature of the first sample network traffic data is input into the time domain feature prediction head to obtain a time domain feature prediction value of the first sample network traffic data;

[0135] The multi-domain hybrid feature of the first sample network traffic data is input into the frequency domain feature prediction head to obtain a frequency domain feature prediction value of the first sample network traffic data.

[0136] Optionally, the multi-domain statistical feature extraction module has extracted 17 multi-domain statistical features based on prior knowledge, and the prior knowledge comes from different domains, so it is difficult to describe these features through a feature space. Therefore, the embodiment divides the time domain prior knowledge and the frequency domain prior knowledge into different tasks to construct an adaptive multi-task prediction network. In the adaptive multi-task prediction network, a corresponding prediction head is designed for different tasks; therefore, as shown in Figure 2 The adaptive multi-task prediction network includes a time domain feature prediction head and a frequency domain feature prediction head; correspondingly, the time domain feature prediction value and the frequency domain feature prediction value are obtained as follows:

[0137] The multi-domain mixed features of the first sample network traffic data are input into the time domain feature prediction head, and the time domain feature prediction head is used for time domain feature prediction to obtain the time domain feature prediction value of the first sample network traffic data.

[0138] The multi-domain mixed features of the first sample network traffic data are input into the frequency domain feature prediction head, and the frequency domain feature prediction head is used for frequency domain feature prediction to obtain the frequency domain feature prediction value of the first sample network traffic data.

[0139] The method provided by the embodiment adopts a multi-task learning framework, simultaneously takes the time domain features and the frequency domain features as pre-training targets, so that the model can simultaneously learn different tasks. Compared with a single task method, this enhances the generalization ability of the model, and further improves the accuracy of network traffic anomaly detection.

[0140] In some embodiments, according to the time domain feature prediction value, the frequency domain feature prediction value of the first sample network traffic data, and the time domain feature extraction value and the frequency domain feature extraction value in the multi-domain statistical features of the first sample network traffic data, a target loss function is obtained, including:

[0141] According to the deviation between the time domain feature prediction value and the time domain feature extraction value, a loss function value corresponding to the time domain feature prediction task is determined;

[0142] According to the deviation between the frequency domain feature prediction value and the frequency domain feature extraction value, a loss function value corresponding to the frequency domain feature prediction task is determined;

[0143] The loss function value corresponding to the time domain feature prediction task and the loss function value corresponding to the frequency domain feature prediction task are weighted and fused to obtain the target loss function.

[0144] Optionally, the target loss function is obtained as follows:

[0145] The deviation between the time domain feature prediction value and the time domain feature extraction value is calculated to construct a loss function value Loss corresponding to the time domain feature prediction task.t The specific calculation formula is as follows:

[0146]

[0147] q i is a feature extraction value; is a feature prediction value.

[0148] The deviation between the frequency domain feature prediction value and the frequency domain feature extraction value is calculated to construct the loss function value Loss f of the frequency domain feature prediction task. The specific calculation formula is as follows:

[0149]

[0150] Then, the loss function value corresponding to the time domain feature prediction task and the loss function value corresponding to the frequency domain feature prediction task are weighted and fused to construct a target loss function Loss q . The specific calculation formula is as follows:

[0151] Loss q = w1Loss t + w2Loss f ;

[0152] Wherein, w1 and w2 are the weight of the time domain feature prediction task and the weight of the frequency domain feature prediction task respectively. The weights of the two tasks are updated through gradient loss to ensure that each task can be fully trained. In each round of iteration of training, the gradient and task weight are recalculated to ensure the balance between different tasks.

[0153] The method provided in the embodiment jointly constructs the target loss function through the loss function value corresponding to the time domain feature prediction task and the loss function value corresponding to the frequency domain feature prediction task, and introduces a self-adaptive weight loss function, which helps to balance the importance of different tasks and ensures that each task is properly paid attention to and trained, thereby improving the performance, generalization ability and training effect of the model.

[0154] In some embodiments, the fine-tuning training of the pre-trained traffic feature encoding module and the initial detection network according to the second sample network traffic data and the traffic anomaly label of the second sample network traffic data to obtain the fine-tuned traffic feature encoding module and the fine-tuned initial detection network comprises:

[0155] The second sample network traffic data is input into the pre-trained traffic feature encoding module to obtain the multi-domain mixed features of the second sample network traffic data.

[0156] inputting the multi-domain mixed features of the second sample network traffic data into the initial detection network to obtain a traffic anomaly detection result of the second sample network traffic data;

[0157] According to a cross-entropy loss function value between the traffic anomaly detection result of the second sample network traffic data and the traffic anomaly label, the pre-trained traffic feature encoding module and the initial detection network are jointly fine-tuned to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network.

[0158] Optionally, the specific steps of fine-tuning include:

[0159] inputting the labeled second sample network traffic data into the pre-trained traffic feature encoding module to perform high-dimensional multi-domain mixed feature extraction by the pre-trained traffic feature encoding module to obtain multi-domain mixed features Z of the second sample network traffic data i , and then inputting the multi-domain mixed features Z i into the initial detection network to perform traffic anomaly detection based on the multi-domain mixed features Z i to obtain a traffic anomaly detection result of the second sample network traffic data The specific calculation formula is as follows:

[0160]

[0161] wherein, TADNBRB(.) is a model function of the initial detection network;

[0162] Finally, the entire model is fine-tuned by using a cross-entropy loss function value between the traffic anomaly detection result of the second sample network traffic data and the traffic anomaly label to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network, and then a detection model is constructed based on the fine-tuned traffic feature encoding module and the fine-tuned initial detection network.

[0163] wherein, the cross-entropy loss function value Loss Y is calculated according to the following formula:

[0164]

[0165] wherein, Y i is the traffic anomaly label.

[0166] The method provided in the embodiment can improve the accuracy of traffic anomaly detection, enhance the generalization ability of the model, and accelerate the convergence process of the model, thereby achieving better technical effects.

[0167] The network traffic anomaly detection device provided by the present application is described below. The network traffic anomaly detection device described below can be referred to in correspondence with the network traffic anomaly detection method described above.

[0168] Figure 3 A structural schematic diagram of the network traffic anomaly detection device provided by the present application is shown in FIG. 1. As shown in FIG. 1, the device comprises: Figure 3

[0169] The acquisition unit 310 is configured to acquire target network traffic data of a network device to be detected.

[0170] The extraction unit 320 is configured to input the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data.

[0171] The detection unit 330 is configured to input the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected.

[0172] The detection model is trained based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data. The number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0173] The device provided by the present application is jointly trained based on a large amount of unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and a small amount of labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data to obtain a detection model. The model parameters of the detection model can converge under a small amount of labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data, and the network traffic multi-domain mixed features and traffic anomaly detection can be efficiently and accurately performed. The problem of insufficient label samples leading to difficulty in achieving the expected target and poor detection accuracy is effectively solved. Therefore, only a small amount of labeled samples are required for model training, and the network traffic anomaly detection result can be accurately obtained.

[0174] Figure 4 An example of an entity structural schematic diagram of an electronic device is shown in FIG. 2. Figure 4 ​As shown, the electronic device can include a processor 410, a communications interface 420, a memory 430, and a communications bus 440, wherein the processor 410, the communications interface 420, and the memory 430 complete mutual communication through the communications bus 440. The processor 410 can invoke a logic instruction in the memory 430 to execute a network traffic anomaly detection method, which includes: obtaining target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data; inputting the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected; wherein the detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and a traffic anomaly label of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0175] In addition, the logic instruction in the memory 430 described above can be implemented in the form of a software functional unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0176] In another aspect, the present application also provides a computer program product comprising a computer program, which can be stored on a non-transitory computer-readable storage medium, and the computer program can be executed by a processor to enable a computer to perform the network traffic anomaly detection method provided by the above-mentioned methods, which comprises: obtaining target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain hybrid features of the target network traffic data; inputting the multi-domain hybrid features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected; wherein the detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0177] In another aspect, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, and the computer program can be executed by a processor to implement the network traffic anomaly detection method provided by the above-mentioned methods, which comprises: obtaining target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain hybrid features of the target network traffic data; inputting the multi-domain hybrid features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected; wherein the detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data; and the number of the first sample network traffic data is greater than the number of the second sample network traffic data.

[0178] The apparatus embodiments described above are merely illustrative, wherein the units shown as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the present embodiment scheme according to actual needs. Those skilled in the art can understand and implement it without creative labor.

[0179] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0180] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network traffic anomaly detection method, characterized by, The method comprises: obtaining target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data; inputting the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result of the network device to be detected; wherein the detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data; the number of the first sample network traffic data is greater than the number of the second sample network traffic data; the detection model is obtained by training based on the following steps: extracting time domain features and frequency domain features from the first sample network traffic data to obtain the multi-domain statistical features; inputting the first sample network traffic data into a traffic feature encoding module to obtain multi-domain mixed features of the first sample network traffic data; inputting the multi-domain mixed features of the first sample network traffic data into an adaptive multi-task prediction module to obtain time domain feature prediction values of the first sample network traffic data and frequency domain feature prediction values of the first sample network traffic data; obtaining a target loss function according to the time domain feature prediction values, the frequency domain feature prediction values, and the time domain feature extraction values and the frequency domain feature extraction values in the multi-domain statistical features of the first sample network traffic data; based on the target loss function, jointly pre-training the adaptive multi-task prediction module and the traffic feature encoding module to obtain a pre-trained traffic feature encoding module; according to the second sample network traffic data and the traffic anomaly labels of the second sample network traffic data, jointly fine-tuning the pre-trained traffic feature encoding module and an initial detection network to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network; constructing the feature extraction module according to the fine-tuned traffic feature encoding module, and constructing the traffic anomaly detection network according to the fine-tuned initial detection network.

2. The network traffic anomaly detection method of claim 1, wherein, The traffic feature encoding module comprises a channel attention module, a spatial attention module, and an encoder; the inputting of the first sample network traffic data into the traffic feature encoding module to obtain the multi-domain mixed features of the first sample network traffic data comprises: inputting the first sample network traffic data into the channel attention module to obtain channel attention weights; fusing the first sample network traffic data and the channel attention weights to obtain first fused features; inputting the first fused features into the spatial attention module to obtain spatial attention weights; fusing the first fused features and the spatial attention weights to obtain second fused features; inputting the second fused features into the encoder to obtain the multi-domain mixed features of the first sample network traffic data.

3. The network traffic anomaly detection method of claim 1, wherein, The adaptive multi-task prediction module includes a time-domain feature prediction head and a frequency-domain feature prediction head; The step of inputting the multi-domain hybrid features of the first sample network traffic data into the adaptive multi-task prediction module to obtain the temporal feature prediction value and the frequency domain feature prediction value of the first sample network traffic data includes: The multi-domain hybrid features of the first sample network traffic data are input into the temporal feature prediction head to obtain the temporal feature prediction value of the first sample network traffic data. The multi-domain hybrid features of the first sample network traffic data are input into the frequency domain feature prediction head to obtain the frequency domain feature prediction value of the first sample network traffic data.

4. The network traffic anomaly detection method of any of claims 1-3, wherein, The step of obtaining the target loss function based on the predicted time-domain and frequency-domain features of the first sample network traffic data, and the extracted time-domain and frequency-domain features from the multi-domain statistical features of the first sample network traffic data, includes: The loss function value corresponding to the time-domain feature prediction task is determined based on the deviation between the predicted time-domain feature value and the extracted time-domain feature value. The loss function value corresponding to the frequency domain feature prediction task is determined based on the deviation between the frequency domain feature prediction value and the frequency domain feature extraction value. The target loss function is obtained by weighted fusion of the loss function values ​​corresponding to the time-domain feature prediction task and the frequency-domain feature prediction task.

5. The network traffic anomaly detection method of any of claims 1-3, wherein, The step of jointly fine-tuning the pre-trained traffic feature encoding module and the initial detection network based on the second sample network traffic data and the traffic anomaly labels of the second sample network traffic data to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network includes: The second sample network traffic data is input into the pre-trained traffic feature encoding module to obtain the multi-domain hybrid features of the second sample network traffic data; The multi-domain hybrid features of the second sample network traffic data are input into the initial detection network to obtain the traffic anomaly detection result of the second sample network traffic data. Based on the traffic anomaly detection results of the second sample network traffic data and the cross-entropy loss function value between the traffic anomaly labels, the pre-trained traffic feature encoding module and the initial detection network are jointly fine-tuned to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network.

6. A network traffic anomaly detection apparatus characterized by comprising: include: The acquisition unit is used to acquire target network traffic data of the network device under test. An extraction unit is used to input the target network traffic data into the feature extraction module of the detection model to obtain the multi-domain hybrid features of the target network traffic data; The detection unit is used to input the multi-domain hybrid features of the target network traffic data into the traffic anomaly detection network of the detection model to obtain the traffic anomaly detection result of the network device to be detected. The detection model is obtained by training based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and labeled second sample network traffic data and traffic anomaly labels of the second sample network traffic data; the number of the first sample network traffic data is greater than the number of the second sample network traffic data; The detection model is obtained by training based on the following steps: The first sample network traffic data is subjected to time-domain feature and frequency-domain feature extraction to obtain the multi-domain statistical features; The first sample network traffic data is input into a traffic feature encoding module to obtain multi-domain hybrid features of the first sample network traffic data; The multi-domain hybrid features of the first sample network traffic data are input into an adaptive multi-task prediction module to obtain time-domain feature prediction values of the first sample network traffic data and frequency-domain feature prediction values of the first sample network traffic data; A target loss function is obtained according to the time-domain feature prediction values, the frequency-domain feature prediction values, and time-domain feature extraction values and frequency-domain feature extraction values in the multi-domain statistical features of the first sample network traffic data; The adaptive multi-task prediction module and the traffic feature encoding module are jointly pre-trained based on the target loss function to obtain a pre-trained traffic feature encoding module; The pre-trained traffic feature encoding module and an initial detection network are jointly fine-tuned according to the second sample network traffic data and the traffic anomaly labels of the second sample network traffic data to obtain a fine-tuned traffic feature encoding module and a fine-tuned initial detection network; The feature extraction module is constructed according to the fine-tuned traffic feature encoding module, and the traffic anomaly detection network is constructed according to the fine-tuned initial detection network.

7. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the program to implement the network traffic anomaly detection method of any one of claims 1-5.

8. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the network traffic anomaly detection method of any one of claims 1-5.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the network traffic anomaly detection method of any one of claims 1-5.

Images