Real-time data exchange anomaly detection method and device based on artificial intelligence

Abstract

The present application provides a real-time data exchange anomaly detection method and device based on artificial intelligence, which relates to the field of data exchange management and control technology, including: obtaining data exchange tasks, performing pairwise neighborhood decomposition according to data exchange links, extracting a first exchange sub-link according to multiple exchange sub-links, exchanging data to be exchanged in real time, performing multi-feature anomaly detection according to multiple channels of data exchange anomaly detection, performing exchange safety loss detection based on a data exchange safety loss detection channel, collating the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient, and obtaining a first sub-link exchange anomaly detection report. The present application can solve the technical problem in the prior art that the existing anomaly detection method cannot cover all aspects of data exchange, resulting in incomplete anomaly detection. Through multi-channel anomaly detection, the various features of data exchange can be covered, thereby improving the comprehensiveness and accuracy of anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of data exchange control technology, and in particular to a real-time data exchange anomaly detection method and device based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, data exchange has become a key link in many fields, especially in emerging technology fields such as cloud computing, big data and the Internet of Things, where the demand for real-time data exchange is growing. In existing data exchange systems, real-time monitoring is a core component, which usually includes basic functions such as data transmission, routing selection and error detection. However, most existing technologies have limitations in monitoring and cannot effectively handle large-scale data exchange, or lack sufficient monitoring capabilities in a multi-node, multi-link environment, resulting in delays, data loss or errors that may occur during data exchange. Cannot be detected and corrected in time. Many existing detection methods focus on specific abnormal features, while ignoring the multi-dimensional characteristics of data, and cannot cover all aspects of data exchange, resulting in the omission of abnormal situations, affecting the accuracy of anomaly detection, and increasing the possibility of false positives and false negatives.

[0003] In summary, the prior art has a technical problem that the anomaly detection is not comprehensive because the existing anomaly detection method cannot cover all aspects of data exchange. Summary of the invention

[0004] The purpose of this application is to provide a real-time data exchange anomaly detection method and device based on artificial intelligence, so as to solve the technical problem in the prior art that the existing anomaly detection method cannot cover all aspects of data exchange, resulting in incomplete anomaly detection.

[0005] In view of the above problems, the present application provides a real-time data exchange anomaly detection method and device based on artificial intelligence.

[0006] In a first aspect, the present application provides a real-time data exchange anomaly detection method based on artificial intelligence, which is implemented by a real-time data exchange anomaly detection device based on artificial intelligence, wherein the real-time data exchange anomaly detection method based on artificial intelligence includes: obtaining a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, and the data exchange link includes multiple data exchange nodes, each data exchange node corresponding to a device; performing pairwise neighborhood decomposition according to the data exchange link to obtain multiple exchange sub-links, and extracting a first exchange sub-link according to the multiple exchange sub-links; based on the first exchange sub-link, performing real-time exchange of the data to be exchanged to obtain a first real-time data exchange result and first sub-link exchange monitoring data; performing multi-feature anomaly detection on the first real-time data exchange result according to a data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result; based on a data exchange safety loss detection channel, performing exchange safety loss detection according to the first sub-link exchange monitoring data to obtain a first sub-link exchange safety loss detection coefficient; collating the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report.

[0007] In a second aspect, the present application also provides an artificial intelligence-based real-time data exchange anomaly detection device for executing the artificial intelligence-based real-time data exchange anomaly detection method as described in the first aspect, wherein the artificial intelligence-based real-time data exchange anomaly detection device includes: a data receiving module, the data receiving module is used to obtain a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, the data exchange link includes multiple data exchange nodes, and each data exchange node corresponds to a device; a link disassembly module, the link disassembly module is used to perform pairwise neighborhood disassembly according to the data exchange link to obtain multiple exchange sub-links, and extract a first exchange sub-link based on the multiple exchange sub-links; a real-time exchange module, the real-time exchange module is used based on The first exchange sub-link exchanges the data to be exchanged in real time to obtain a first real-time data exchange result and first sub-link exchange monitoring data; an anomaly detection module, the anomaly detection module is used to perform multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result; a safety loss detection module, the safety loss detection module is used to perform exchange safety loss detection according to the first sub-link exchange monitoring data based on the data exchange safety loss detection channel to obtain a first sub-link exchange safety loss detection coefficient; a report generation module, the report generation module is used to organize the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report.

[0008] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0009] By obtaining a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, the data exchange link includes multiple data exchange nodes, and each data exchange node corresponds to a device; performing two-by-two neighborhood decomposition according to the data exchange link to obtain multiple exchange sub-links, and extracting a first exchange sub-link according to the multiple exchange sub-links; based on the first exchange sub-link, performing real-time exchange of the data to be exchanged, obtaining a first real-time data exchange result and a first sub-link exchange monitoring data; performing multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel, obtaining a first data exchange anomaly detection result; based on the data exchange safety loss detection channel, performing exchange safety loss detection according to the first sub-link exchange monitoring data, obtaining a first sub-link exchange safety loss detection coefficient; collating the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient, obtaining a first sub-link exchange anomaly detection report. In other words, through multi-channel anomaly detection, multiple aspects of data exchange are covered, and the comprehensiveness and accuracy of anomaly detection are improved.

[0010] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented according to the contents of the specification, and in order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are specifically cited below. It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easy to understand through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions in the present application or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0012] Figure 1 This is a flowchart of the artificial intelligence-based real-time data exchange anomaly detection method of this application;

[0013] Figure 2 This is a structural diagram of the real-time data exchange anomaly detection device based on artificial intelligence in this application.

[0014] Explanation of the reference numerals: data receiving module 11 , link disassembly module 12 , real-time exchange module 13 , anomaly detection module 14 , safety loss detection module 15 , report generation module 16 . DETAILED DESCRIPTION

[0015] This application solves the technical problem that the existing anomaly detection methods cannot cover all aspects of data exchange, resulting in incomplete anomaly detection, by providing a real-time data exchange anomaly detection method and device based on artificial intelligence. Through multi-channel anomaly detection, multiple aspects of data exchange are covered, thus improving the comprehensiveness and accuracy of anomaly detection.

[0016] Below, the technical solutions in the present application will be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments of the present application. It should be understood that the present application is not limited to the example embodiments described herein. Based on the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. It should also be noted that, for the convenience of description, only the parts related to the present application are shown in the accompanying drawings, rather than all of them.

[0017] For example, please refer to the attached Figure 1 The present application provides a real-time data exchange anomaly detection method based on artificial intelligence, wherein the real-time data exchange anomaly detection method based on artificial intelligence is applied to a real-time data exchange anomaly detection device based on artificial intelligence, and the real-time data exchange anomaly detection method based on artificial intelligence specifically includes the following steps:

[0018] Step 1: Obtain a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, and the data exchange link includes a plurality of data exchange nodes, and each data exchange node corresponds to a device.

[0019] Specifically, by confirming the type of data to be exchanged, evaluating the size of the data to be exchanged, and determining the sensitivity of the data, the data exchange task is received, which includes two main parts: the data to be exchanged and the link for data exchange. The data to be exchanged refers to the data content that needs to be transmitted between different devices, while the data exchange link refers to the path of these data transmissions, defining the transmission route from the source device to the target device. The data exchange link consists of multiple data exchange nodes, each of which represents a device participating in the data exchange. Ensure that each data exchange node can correctly correspond to the device that actually participates in the data exchange, which can be a server, router, switch or other network device. For example, the data exchange link is: Computer 1 → Switch 1 → Switch 2 → Computer 2. Computer 1 is the starting point of data exchange, responsible for sending data, encapsulating data into network data packets, and setting the destination address to the IP address of Computer 2. Switch 1 is the first network device in the data exchange link, receiving data from Computer 1 and forwarding data to the next device (Switch 2) according to the destination address of the data (Computer 2). It can efficiently process and forward data packets. Switch 2 is the second network device in the link, receiving data packets from Switch 1 and forwarding data to the final destination (Computer 2). In some cases, Switch 2 also needs to perform additional network functions, such as data encryption or decryption. Computer 2 is the end point of data exchange, receiving data packets from Switch 2, and processing or storing data. Data exchange nodes enable data to be smoothly transmitted from one node to the next, ensuring the accuracy and integrity of data exchange tasks, and providing a reliable basis for subsequent analysis.

[0020] Step 2: performing pairwise neighborhood decomposition according to the data exchange link to obtain a plurality of exchange sub-links, and extracting a first exchange sub-link according to the plurality of exchange sub-links.

[0021] Specifically, the entire data exchange link is decomposed into a series of sub-links consisting of two adjacent nodes by performing pairwise neighborhood decomposition. For example, in the link "Computer 1 → Switch 1 → Switch 2 → Computer 2", it can be decomposed into three sub-links: "Computer 1 → Switch 1", "Switch 1 → Switch 2" and "Switch 2 → Computer 2". Among the multiple exchange sub-links decomposed, the first exchange sub-link is extracted, that is, sub-link 1: Computer 1 → Switch 1. The first exchange sub-link can be the first sub-link in the entire link, or it can be a sub-link selected according to specific criteria (such as priority, risk level, etc.). By decomposing, the complex data exchange link is decomposed into simpler, easier to manage and monitor sub-links. Each sub-link can be independently monitored and troubleshooted, thereby improving the reliability and efficiency of the entire data exchange process and facilitating the discovery of potential problems.

[0022] Step three: Based on the first exchange sub-link, the data to be exchanged is exchanged in real time to obtain a first real-time data exchange result and first sub-link exchange monitoring data.

[0023] Specifically, first, the data to be exchanged is encapsulated into a network data packet, which includes information such as the source IP address, the destination IP address, the port number, and the protocol type. Secondly, the first switching sub-link is used to exchange the data to be exchanged in real time. For example, computer 1 sends the encapsulated data packet to switch 1 through the network interface. Switch 1 receives the data packet from computer 1, checks the destination address of the data packet, and determines the next hop (switch 2) according to its forwarding table, and forwards the data packet to switch 2. In the process of data exchange, not only data transmission is performed, but also key data in the exchange process is monitored and recorded at the same time, such as the time of data transmission, the size of the data packet, the transmission rate, etc., to obtain the first sub-link exchange monitoring data. Finally, the first real-time data exchange result is obtained, including the data received by the target device and the time required for the data to be transmitted from the sender to the receiver. By performing real-time data exchange on a specific sub-link, the data transmission process can be more finely controlled and managed, and the efficiency and real-time performance of data exchange can be improved.

[0024] Step 4: Perform multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result.

[0025] Specifically, the data exchange anomaly detection multi-channel includes a data exchange packet loss rate detection channel, a data exchange precision loss detection channel, and a data exchange delay anomaly detection channel. More accurately identify abnormal behavior in data exchange. The first real-time data exchange result includes the first exchange received data and the first data exchange time. The data to be exchanged and the first exchange received data are input into the data exchange packet loss rate detection channel and the data exchange precision loss detection channel to obtain the packet loss rate and the degree of precision loss respectively. The first data exchange time is input into the data exchange delay anomaly detection channel to obtain the degree of delay anomaly. The results of the three anomaly detections are combined to obtain the first data exchange anomaly detection result, which includes the anomaly detection result based on multi-feature analysis. Through multi-feature anomaly detection, the data exchange process is comprehensively evaluated, potential anomalies are discovered in a timely manner, and the accuracy and reliability of anomaly detection are improved.

[0026] Step 5: Based on the data exchange safety loss detection channel, perform exchange safety loss detection according to the first sub-link exchange monitoring data to obtain the first sub-link exchange safety loss detection coefficient.

[0027] Specifically, anomaly detection is performed on the exchange monitoring data of the first sub-link to obtain anomaly identification results. The data exchange security loss detection channel includes T data exchange security loss detection models. The anomaly identification results are input into the data exchange security loss detection channel, and different models are used for monitoring. Each model obtains a loss monitoring coefficient. These detection coefficients are calculated by centralized values ​​to generate the first sub-link exchange security loss detection coefficient, which reflects the degree of security loss in the data exchange process. Through security loss detection, the security loss situation in the data exchange process is evaluated, potential security threats are discovered in a timely manner, and the security of data exchange is effectively protected.

[0028] Step 6: Arrange the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report.

[0029] Specifically, the first data exchange anomaly detection result refers to the anomaly identified during the data exchange process, including the first data exchange packet loss rate detection coefficient, the first data exchange accuracy loss detection coefficient, and the first data exchange delay anomaly detection coefficient. The first sub-link exchange safety loss detection coefficient refers to a quantitative indicator calculated based on the safety loss detection result during the data exchange process, which represents the degree of safety loss during the data exchange process. The first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient are integrated into a report, which includes the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient, and is used to comprehensively evaluate the data exchange situation of the sub-link. By comprehensively evaluating and understanding the data exchange situation of the sub-link, measures are taken to improve the efficiency and reliability of data exchange.

[0030] Further, step 4 of this application includes:

[0031] The first real-time data exchange result includes the first exchange received data and the first data exchange time; the data exchange anomaly detection multi-channel includes a data exchange packet loss rate detection channel, a data exchange precision loss detection channel and a data exchange delay anomaly detection channel; based on the data to be exchanged and the first exchange received data, according to the data exchange packet loss rate detection channel, a first data exchange packet loss rate detection coefficient is obtained; based on the data to be exchanged and the first exchange received data, according to the data exchange precision loss detection channel, a first data exchange precision loss detection coefficient is obtained; based on the first data exchange time, according to the data exchange delay anomaly detection channel, a first data exchange delay anomaly detection coefficient is obtained; the first data exchange packet loss rate detection coefficient, the first data exchange precision loss detection coefficient and the first data exchange delay anomaly detection coefficient are added to the first data exchange anomaly detection result.

[0032] Specifically, the first real-time data exchange result includes the first exchange received data and the first data exchange time. The first exchange received data refers to the data received by the target device during the data exchange process, including original data, data packets, files, etc., depending on the task requirements of the data exchange. The first data exchange time refers to the time required for data to be transmitted from the sender to the receiver, including the transmission time and processing time of the data. The data exchange anomaly detection multi-channel includes a data exchange packet loss rate detection channel, a data exchange precision loss detection channel, and a data exchange delay anomaly detection channel.

[0033] The data exchange packet loss rate detection channel is specifically used to detect the packet loss verification degree in the data exchange process. The packet loss rate refers to the ratio of the number of data packets lost in a certain period of time to the total number of data packets sent. Compare the data to be exchanged with the first exchange received data, that is, compare the sent data with the received data, and use the data exchange packet loss rate detection channel to analyze these data to obtain a quantitative evaluation result, that is, the first data exchange packet loss rate detection coefficient, which represents the degree of packet loss in the data exchange process. For example, calculate the total number of data packets sent by computer 1 and the number of data packets actually received by switch 1, compare the two, and calculate the packet loss rate.

[0034] The data exchange precision loss detection channel is used to detect the degree of precision loss of data during the exchange process, which is caused by data compression, transmission errors or other factors. The data to be exchanged is compared with the first exchange received data, that is, the sent data is compared with the received data, and the data exchange precision loss detection channel is used to determine whether the data has experienced precision loss during the exchange process, and a quantitative evaluation result is obtained. The first data exchange precision loss detection coefficient represents the degree of precision loss during the data exchange process. For example, the original data sent by computer 1 and the data actually received by switch 1 are compared to check the consistency of the data, and a coefficient is calculated based on the data comparison result to represent the degree of precision loss during the data exchange process.

[0035] The data exchange delay anomaly detection channel focuses on detecting the delay in the data exchange process. Delay anomalies indicate network delays, equipment performance issues, or other transmission issues. For example, the time taken for data to be sent from computer 1 to switch 1 is measured, and the actual delay is compared with the preset delay threshold to obtain a coefficient indicating whether the delay in the data exchange process is abnormal. The three key indicators, the first data exchange packet loss rate detection coefficient, the first data exchange precision loss detection coefficient, and the first data exchange delay anomaly detection coefficient, are integrated into the first data exchange anomaly detection result to obtain a comprehensive report containing multiple key indicators to comprehensively evaluate the anomalies in the data exchange process. The report should include the specific values ​​of the anomaly monitoring coefficient to understand the specific packet loss, precision loss, and delay anomaly, as well as the description and analysis of the anomalies, possible causes, and recommended solutions. By integrating multiple key indicators into the anomaly detection results, a comprehensive evaluation report is provided to fully understand the various anomalies in the data exchange process, timely discover and solve problems, and improve the efficiency and reliability of data exchange.

[0036] Furthermore, the present application also includes the following steps:

[0037] Based on the first exchange sub-link, a normal exchange time prediction is performed on the data to be exchanged to obtain a first predicted normal exchange time; a deviation analysis is performed based on the first predicted normal exchange time and the first data exchange time to obtain a first data exchange normal deviation time; the first data exchange normal deviation time is input into the data exchange delay anomaly detection channel to generate the first data exchange delay anomaly detection coefficient.

[0038] Specifically, the exchange records of the first exchange sublink are retrieved to find the historical records of normal exchange, including exchange data and exchange time. A set of time records of historical normal exchange that meets the similarity evaluation constraint of exchange data is selected from the historical records, and the average of these times is calculated to generate a first predicted normal exchange time. The first predicted normal exchange time and the first data exchange time are compared to calculate the deviation of the exchange time. Deviation analysis usually includes calculating indicators such as time difference and percentage deviation to quantify the difference between the prediction and the actual. According to the result of the deviation analysis, a quantitative indicator, namely the first data exchange normal deviation time, is obtained, which reflects the degree of deviation between the predicted time and the actual time. The first data exchange normal deviation time is input into the data exchange delay anomaly detection channel, and a delay threshold is pre-set to determine whether the deviation time exceeds the normal range. According to the deviation time and the preset threshold, the delay anomaly detection coefficient is calculated to indicate the degree of deviation between the actual exchange time and the predicted exchange time, and whether the abnormal standard is reached. Through prediction, analysis and detection, the efficiency and performance of data exchange are comprehensively evaluated, which provides strong support for timely discovery and resolution of problems in the data exchange process, so that the real-time data exchange anomaly detection method can more effectively protect the security of data exchange.

[0039] Furthermore, the present application also includes the following steps:

[0040] According to the first exchange sub-link, normal exchange record retrieval is performed to obtain multiple normal exchange record groups, wherein each normal exchange record group includes historical exchange data and historical normal exchange time; based on the data to be exchanged, exchange data similarity evaluation is performed on the multiple normal exchange record groups respectively to obtain multiple exchange data similarity evaluation coefficients; based on the exchange data similarity evaluation constraint, sample screening is performed on the multiple normal exchange record groups according to the multiple exchange data similarity evaluation coefficients to determine a screening exchange time record set that meets the exchange data similarity evaluation constraint; centralized value calculation is performed based on the screening exchange time record set to generate the first predicted normal exchange time.

[0041] Specifically, the records of normal exchange of the first exchange sub-link are retrieved, and the historical data exchange records related to the first exchange sub-link are searched to obtain multiple normal exchange record groups, each of which includes historical exchange data and historical normal exchange time. Historical exchange data refers to the data actually transmitted in the past data exchange, and historical normal exchange time refers to the time required for these data exchanges. The key features of the data to be exchanged, such as data size, type, structure, etc., are extracted, and the similarity between the data to be exchanged and the historical exchange data is calculated using a similarity comparison algorithm (such as cosine similarity, Euclidean distance, etc.). A similarity evaluation coefficient of exchange data is calculated for each normal exchange record group, which reflects the similarity between the data to be exchanged and the historical exchange data.

[0042] A similarity evaluation threshold is pre-set as a constraint for screening. Based on multiple exchange data similarity evaluation coefficients, multiple normal exchange record groups are screened to select the normal exchange record group that meets the similarity evaluation constraint and is the most similar to the data to be exchanged. A screening exchange time record set that meets the exchange data similarity evaluation constraint is determined, including historical normal exchange times that are similar to the current data exchange behavior. Centralized value calculation is performed on these exchange time records. Centralized value calculation usually refers to calculating the average value of these times, that is, the sum of all time records divided by the number of time records. Based on the results of the centralized value calculation, the first predicted normal exchange time is generated. This time is a predicted value, which represents the time required for normal data exchange under the current data exchange environment.

[0043] In a specific example, the data to be exchanged is a 10MB file, and the normal exchange record group shows that record group 1: 800 exchange tasks, the average exchange time is 800 milliseconds; record group 2: 700 exchange tasks, the average exchange time is 750 milliseconds; record group 3: 600 exchange tasks, the average exchange time is 700 milliseconds. Calculate the exchange data similarity evaluation coefficient of each record group: record group 1: 10 / 800=0.0125; record group 2: 10 / 750=0.0133; record group 3: 10 / 700=0.0143; set the similarity evaluation threshold to 0.0130, and filter out the record groups that meet the conditions: record group 2 and record group 3. Extract the historical normal exchange time from these two record groups: record group 2 is 750 milliseconds, and record group 3 is 700 milliseconds. Perform concentrated value calculation to generate the first predicted normal exchange time of 725 milliseconds. By effectively predicting the data to be exchanged based on historical normal exchange records, the accuracy and efficiency of anomaly detection are improved.

[0044] Furthermore, step five of this application includes:

[0045] Anomaly detection is performed based on the first sub-link exchange monitoring data to obtain the first sub-link exchange monitoring anomaly identification result; the data exchange safety loss detection channel includes T data exchange safety loss detection models, where T is a positive integer greater than 1; the first sub-link exchange monitoring anomaly identification result is input into the T data exchange safety loss detection models to obtain T data exchange safety loss detection coefficients; centralized value calculation is performed based on the T data exchange safety loss detection coefficients to generate the first sub-link exchange safety loss detection coefficient.

[0046] Specifically, the first sub-link exchange monitoring data refers to key data collected during the first sub-link data exchange process, such as data packet transmission time, data packet size, transmission rate, etc. These monitoring data are analyzed, and statistical analysis, pattern recognition or other algorithm processing are performed on the data to identify the existing abnormal conditions. The first sub-link exchange monitoring abnormality identification result is generated, which includes information such as the type and severity of the abnormality. The data exchange safety loss detection model is a model specifically used to evaluate the safety loss in the data exchange process. T data exchange safety loss detection models are selected to form a data exchange safety loss detection channel. These models are based on different algorithms and training data to improve the accuracy and robustness of anomaly detection. The first sub-link exchange monitoring abnormality identification result is input into T data exchange safety loss detection models. Each model uses different algorithms and strategies to evaluate security issues, and the corresponding data exchange safety loss detection coefficient is obtained, which represents the degree of safety loss in the data exchange process. The T data exchange safety loss detection coefficients are calculated by lumping values, and the average or sum of these coefficients is calculated to provide a comprehensive safety loss assessment, and the first sub-link exchange safety loss detection coefficient is obtained. For example, assume that there are 3 data exchange safety loss detection models, namely model A, model B and model C. Each model calculates the data exchange safety loss detection coefficients of 0.1, 0.2, and 0.15 based on the input data, and performs centralized value calculation, and the first sub-link exchange safety loss detection coefficient = 0.15. By integrating the evaluation of multiple models, the possible deviation of a single model can be reduced and the accuracy of security assessment can be improved.

[0047] Furthermore, the present application also includes the following steps:

[0048] Based on the first exchange sub-link, anomaly detection record retrieval is performed to obtain a first sub-link exchange monitoring record set and a first sub-link exchange monitoring anomaly identification record set; based on the first exchange sub-link, a global retrieval of links with the same characteristics is performed to determine multiple exchange sub-links with the same characteristics that satisfy link similarity constraints; based on the multiple exchange sub-links with the same characteristics, anomaly detection record retrieval is performed to obtain a first sub-link exchange monitoring record expansion set and a first sub-link exchange monitoring anomaly identification record expansion set; according to the first sub-link exchange monitoring record expansion set and the first sub-link exchange monitoring anomaly identification record expansion set, a first sub-link exchange monitoring anomaly identification model is trained; according to the first sub-link exchange monitoring record set and the first sub-link exchange monitoring anomaly identification record set, the first sub-link exchange monitoring anomaly identification model is incrementally learned to generate a first sub-link exchange monitoring anomaly identification channel; the first sub-link exchange monitoring data is input into the first sub-link exchange monitoring anomaly identification channel to generate the first sub-link exchange monitoring anomaly identification result.

[0049] Specifically, based on the information of the first switching sub-link, relevant anomaly detection records are retrieved, including all abnormal situations occurring on the sub-link, to obtain the first sub-link switching monitoring record set and the first sub-link switching monitoring anomaly identification record set. The first sub-link switching monitoring record set is a data set that includes all switching monitoring records on the sub-link, reflecting the behavior of the sub-link under normal circumstances. The first sub-link switching monitoring anomaly identification record set is a data set that includes all anomaly identification records on the sub-link, reflecting the behavior of the sub-link under abnormal circumstances, such as the type and severity of the anomaly. Based on the characteristics of the first switching sub-link, other switching sub-links with similar characteristics are retrieved globally, including geographic location, device type, network topology, device configuration, transmission protocol, etc.

[0050] Link similarity constraints define the characteristics of link similarity. The anomaly detection records of sub-links with the same characteristics are retrieved to expand the anomaly detection information of the first sub-link, and the first sub-link exchange monitoring record expansion set and the first sub-link exchange monitoring anomaly identification record expansion set are obtained. The first sub-link exchange monitoring record expansion set is an expanded data set that includes the exchange monitoring records of the first sub-link and multiple sub-links with the same characteristics. The first sub-link exchange monitoring anomaly identification record expansion set is an expanded data set that includes the first sub-link and multiple sub-links with the same characteristics. Train the anomaly identification model based on the first sub-link exchange monitoring record expansion set and the first sub-link exchange monitoring anomaly identification record expansion set, and select a suitable machine learning or deep learning algorithm to build the model, such as random forest, support vector machine (SVM), neural network, etc.

[0051] The model is incrementally learned using the first sub-link exchange monitoring record set and the first sub-link exchange monitoring anomaly identification record set. Incremental learning is a machine learning technique that allows the model to continuously learn and improve as new data arrives, rather than retraining from scratch. Through incremental learning, a dedicated channel, the first sub-link exchange monitoring anomaly identification channel, is generated for real-time monitoring and identification of anomalies in the first sub-link. The first sub-link exchange monitoring data is input into the first sub-link exchange monitoring anomaly identification channel to generate identification results about the anomalies of the first sub-link. The trained model can more accurately identify abnormal patterns, reduce false positives and false negatives, and once an anomaly is detected, respond quickly and take appropriate measures to solve the problem or mitigate its impact.

[0052] Furthermore, step six of this application includes:

[0053] Determine whether the exchange anomaly detection report of the first sub-link satisfies the exchange anomaly detection constraint; if the exchange anomaly detection report of the first sub-link does not satisfy the exchange anomaly detection constraint, generate a first sub-link exchange anomaly warning signal; if the exchange anomaly detection report of the first sub-link satisfies the exchange anomaly detection constraint, activate the second exchange sub-link according to the multiple exchange sub-links, and execute the data exchange task according to the second exchange sub-link.

[0054] Specifically, the exchange anomaly detection constraint is a preset set of standards or conditions used to determine whether the abnormal situation in the detection report reaches a certain severity or impact range. According to these constraint standards, it is determined whether the exchange anomaly detection report of the first sub-link meets the requirements of anomaly detection. If the exchange anomaly detection report of the first sub-link does not meet the exchange anomaly detection constraint, an early warning signal will be generated, which is a warning of potential abnormalities, reminding users or operators to pay attention to potential abnormalities. If it is satisfied, it means that the abnormal situation in the detection report has not reached the preset severity or impact range, so there is no need to take emergency measures immediately. Select the second exchange sub-link based on multiple exchange sub-links to continue the data exchange task originally performed on the first sub-link. By automatically switching to the backup sub-link, it is ensured that the data exchange task can continue when a problem occurs in the main link, thereby improving the reliability of the system.

[0055] In summary, the artificial intelligence-based real-time data exchange anomaly detection method provided by this application has the following technical effects:

[0056] By obtaining a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, the data exchange link includes multiple data exchange nodes, and each data exchange node corresponds to a device; performing two-by-two neighborhood decomposition according to the data exchange link to obtain multiple exchange sub-links, and extracting a first exchange sub-link according to the multiple exchange sub-links; based on the first exchange sub-link, performing real-time exchange of the data to be exchanged, obtaining a first real-time data exchange result and a first sub-link exchange monitoring data; performing multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel, obtaining a first data exchange anomaly detection result; based on the data exchange safety loss detection channel, performing exchange safety loss detection according to the first sub-link exchange monitoring data, obtaining a first sub-link exchange safety loss detection coefficient; collating the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient, obtaining a first sub-link exchange anomaly detection report. In other words, through multi-channel anomaly detection, multiple aspects of data exchange are covered, and the comprehensiveness and accuracy of anomaly detection are improved.

[0057] Embodiment 2, based on the same inventive concept as the real-time data exchange anomaly detection method based on artificial intelligence in the previous embodiment, the present application also provides a real-time data exchange anomaly detection device based on artificial intelligence, please refer to the attached Figure 2 , the real-time data exchange anomaly detection device based on artificial intelligence includes:

[0058] The data receiving module 11 is used to obtain a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, and the data exchange link includes multiple data exchange nodes, each of which corresponds to a device.

[0059] The link disassembling module 12 is used to perform pairwise neighborhood disassembly according to the data exchange link to obtain multiple exchange sub-links, and extract a first exchange sub-link according to the multiple exchange sub-links.

[0060] The real-time exchange module 13 is used to perform real-time exchange of the data to be exchanged based on the first exchange sub-link, and obtain a first real-time data exchange result and first sub-link exchange monitoring data.

[0061] The anomaly detection module 14 is used to perform multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result.

[0062] The safety loss detection module 15 is used to perform exchange safety loss detection based on the data exchange safety loss detection channel and the first sub-link exchange monitoring data to obtain the first sub-link exchange safety loss detection coefficient.

[0063] The report generating module 16 is used to sort out the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report.

[0064] Furthermore, the anomaly detection module 14 in the real-time data exchange anomaly detection device based on artificial intelligence is also used for:

[0065] The first real-time data exchange result includes the first exchange received data and the first data exchange time; the data exchange anomaly detection multi-channel includes a data exchange packet loss rate detection channel, a data exchange precision loss detection channel and a data exchange delay anomaly detection channel; based on the data to be exchanged and the first exchange received data, according to the data exchange packet loss rate detection channel, a first data exchange packet loss rate detection coefficient is obtained; based on the data to be exchanged and the first exchange received data, according to the data exchange precision loss detection channel, a first data exchange precision loss detection coefficient is obtained; based on the first data exchange time, according to the data exchange delay anomaly detection channel, a first data exchange delay anomaly detection coefficient is obtained; the first data exchange packet loss rate detection coefficient, the first data exchange precision loss detection coefficient and the first data exchange delay anomaly detection coefficient are added to the first data exchange anomaly detection result.

[0066] Furthermore, the artificial intelligence-based real-time data exchange anomaly detection device also includes an anomaly detection coefficient obtaining module, which is used to:

[0067] Based on the first exchange sub-link, a normal exchange time prediction is performed on the data to be exchanged to obtain a first predicted normal exchange time; a deviation analysis is performed based on the first predicted normal exchange time and the first data exchange time to obtain a first data exchange normal deviation time; the first data exchange normal deviation time is input into the data exchange delay anomaly detection channel to generate the first data exchange delay anomaly detection coefficient.

[0068] Furthermore, the real-time data exchange anomaly detection device based on artificial intelligence also includes a module for obtaining a normal exchange time, which is used to:

[0069] According to the first exchange sub-link, normal exchange record retrieval is performed to obtain multiple normal exchange record groups, wherein each normal exchange record group includes historical exchange data and historical normal exchange time; based on the data to be exchanged, exchange data similarity evaluation is performed on the multiple normal exchange record groups respectively to obtain multiple exchange data similarity evaluation coefficients; based on the exchange data similarity evaluation constraint, sample screening is performed on the multiple normal exchange record groups according to the multiple exchange data similarity evaluation coefficients to determine a screening exchange time record set that meets the exchange data similarity evaluation constraint; centralized value calculation is performed based on the screening exchange time record set to generate the first predicted normal exchange time.

[0070] Furthermore, the safety loss detection module 15 in the real-time data exchange anomaly detection device based on artificial intelligence is also used for:

[0071] Anomaly detection is performed based on the first sub-link exchange monitoring data to obtain the first sub-link exchange monitoring anomaly identification result; the data exchange safety loss detection channel includes T data exchange safety loss detection models, where T is a positive integer greater than 1; the first sub-link exchange monitoring anomaly identification result is input into the T data exchange safety loss detection models to obtain T data exchange safety loss detection coefficients; centralized value calculation is performed based on the T data exchange safety loss detection coefficients to generate the first sub-link exchange safety loss detection coefficient.

[0072] Furthermore, the safety loss detection module 15 in the real-time data exchange anomaly detection device based on artificial intelligence is also used for:

[0073] Based on the first exchange sub-link, anomaly detection record retrieval is performed to obtain a first sub-link exchange monitoring record set and a first sub-link exchange monitoring anomaly identification record set; based on the first exchange sub-link, a global retrieval of links with the same characteristics is performed to determine multiple exchange sub-links with the same characteristics that satisfy link similarity constraints; based on the multiple exchange sub-links with the same characteristics, anomaly detection record retrieval is performed to obtain a first sub-link exchange monitoring record expansion set and a first sub-link exchange monitoring anomaly identification record expansion set; according to the first sub-link exchange monitoring record expansion set and the first sub-link exchange monitoring anomaly identification record expansion set, a first sub-link exchange monitoring anomaly identification model is trained; according to the first sub-link exchange monitoring record set and the first sub-link exchange monitoring anomaly identification record set, the first sub-link exchange monitoring anomaly identification model is incrementally learned to generate a first sub-link exchange monitoring anomaly identification channel; the first sub-link exchange monitoring data is input into the first sub-link exchange monitoring anomaly identification channel to generate the first sub-link exchange monitoring anomaly identification result.

[0074] Furthermore, the report generation module 16 in the real-time data exchange anomaly detection device based on artificial intelligence is also used for:

[0075] Determine whether the exchange anomaly detection report of the first sub-link satisfies the exchange anomaly detection constraint; if the exchange anomaly detection report of the first sub-link does not satisfy the exchange anomaly detection constraint, generate a first sub-link exchange anomaly warning signal; if the exchange anomaly detection report of the first sub-link satisfies the exchange anomaly detection constraint, activate the second exchange sub-link according to the multiple exchange sub-links, and execute the data exchange task according to the second exchange sub-link.

[0076] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. Figure 1The artificial intelligence-based real-time data exchange anomaly detection method and specific examples in Example 1 are also applicable to the artificial intelligence-based real-time data exchange anomaly detection device in this embodiment. Through the above detailed description of the artificial intelligence-based real-time data exchange anomaly detection method, those skilled in the art can clearly know the artificial intelligence-based real-time data exchange anomaly detection device in this embodiment, so for the sake of brevity of the specification, it will not be described in detail here. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0077] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

[0078] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application belong to the scope of the present application and its equivalent technology, the present application is also intended to include these modifications and variations.

Claims

1. A real-time data exchange anomaly detection method based on artificial intelligence, characterized in that: include: Obtaining a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, the data exchange link includes a plurality of data exchange nodes, and each data exchange node corresponds to a device; Performing pairwise neighborhood decomposition according to the data exchange link to obtain a plurality of exchange sub-links, and extracting a first exchange sub-link according to the plurality of exchange sub-links; Based on the first exchange sub-link, the data to be exchanged is exchanged in real time to obtain a first real-time data exchange result and first sub-link exchange monitoring data; Performing multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result; Based on the data exchange safety loss detection channel, performing exchange safety loss detection according to the first sub-link exchange monitoring data, and obtaining the first sub-link exchange safety loss detection coefficient; Arrange the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report; Performing multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result includes: The first real-time data exchange result includes first exchange received data and first data exchange time; The data exchange anomaly detection multi-channel includes a data exchange packet loss rate detection channel, a data exchange precision loss detection channel and a data exchange delay anomaly detection channel; Based on the data to be exchanged and the first exchanged received data, and according to the data exchange packet loss rate detection channel, obtaining a first data exchange packet loss rate detection coefficient; Based on the data to be exchanged and the first exchanged received data, and according to the data exchange precision loss detection channel, obtaining a first data exchange precision loss detection coefficient; Based on the first data exchange time, and according to the data exchange delay anomaly detection channel, obtaining a first data exchange delay anomaly detection coefficient; adding the first data exchange packet loss rate detection coefficient, the first data exchange precision loss detection coefficient, and the first data exchange delay anomaly detection coefficient to the first data exchange anomaly detection result; Based on the first data exchange time and according to the data exchange delay anomaly detection channel, obtaining a first data exchange delay anomaly detection coefficient includes: Based on the first exchange sub-link, performing a normal exchange time prediction on the data to be exchanged to obtain a first predicted normal exchange time; Performing deviation analysis based on the first predicted normal exchange time and the first data exchange time to obtain a first data exchange normal deviation time; Inputting the first data exchange normal deviation time into the data exchange delay anomaly detection channel to generate the first data exchange delay anomaly detection coefficient; Based on the first exchange sub-link, performing a normal exchange time prediction on the data to be exchanged to obtain a first predicted normal exchange time includes: Retrieving normal exchange records according to the first exchange sub-link to obtain a plurality of normal exchange record groups, wherein each normal exchange record group includes historical exchange data and historical normal exchange time; Based on the data to be exchanged, respectively, performing exchange data similarity evaluation on the plurality of normal exchange record groups to obtain a plurality of exchange data similarity evaluation coefficients; Based on the exchange data similarity evaluation constraint, the plurality of normal exchange record groups are sampled and screened according to the plurality of exchange data similarity evaluation coefficients to determine a screening exchange time record set that satisfies the exchange data similarity evaluation constraint; A centralized value calculation is performed based on the filtered exchange time record set to generate the first predicted normal exchange time.

2. The method for detecting anomalies in real-time data exchange based on artificial intelligence according to claim 1, characterized in that: Based on the data exchange safety loss detection channel, performing exchange safety loss detection according to the first sub-link exchange monitoring data to obtain the first sub-link exchange safety loss detection coefficient includes: Perform anomaly detection according to the first sub-link exchange monitoring data to obtain a first sub-link exchange monitoring anomaly identification result; The data exchange safety loss detection channel includes T data exchange safety loss detection models, where T is a positive integer greater than 1; Inputting the first sub-link exchange monitoring abnormality identification result into the T data exchange safety loss detection models to obtain T data exchange safety loss detection coefficients; A centralized value calculation is performed based on the T data exchange safety loss detection coefficients to generate the first sub-link exchange safety loss detection coefficient.

3. The method for detecting anomalies in real-time data exchange based on artificial intelligence according to claim 2, characterized in that: Performing anomaly detection according to the first sub-link exchange monitoring data to obtain a first sub-link exchange monitoring anomaly identification result includes: Perform anomaly detection record retrieval based on the first exchange sub-link to obtain a first sub-link exchange monitoring record set and a first sub-link exchange monitoring anomaly identification record set; Performing a global search for links with the same characteristics based on the first exchange sub-link to determine multiple exchange sub-links with the same characteristics that satisfy link similarity constraints; Performing anomaly detection record retrieval based on the multiple exchange sub-links with the same characteristics to obtain a first sub-link exchange monitoring record expansion set and a first sub-link exchange monitoring anomaly identification record expansion set; Training a first sub-link exchange monitoring anomaly recognition model according to the first sub-link exchange monitoring record expansion set and the first sub-link exchange monitoring anomaly recognition record expansion set; Performing incremental learning on the first sub-link exchange monitoring anomaly identification model according to the first sub-link exchange monitoring record set and the first sub-link exchange monitoring anomaly identification record set to generate a first sub-link exchange monitoring anomaly identification channel; The first sub-link switching monitoring data is input into the first sub-link switching monitoring abnormality identification channel to generate the first sub-link switching monitoring abnormality identification result.

4. The method for detecting anomalies in real-time data exchange based on artificial intelligence according to claim 1, characterized in that: Arranging the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report also includes: Determining whether the first sub-link switching anomaly detection report satisfies the switching anomaly detection constraint; If the first sub-link switching anomaly detection report does not satisfy the switching anomaly detection constraint, generating a first sub-link switching anomaly warning signal; If the first sub-link switching anomaly detection report satisfies the switching anomaly detection constraint, a second switching sub-link is activated according to the multiple switching sub-links, and the data switching task is performed according to the second switching sub-link.

5. A real-time data exchange anomaly detection device based on artificial intelligence, characterized in that: The steps for implementing the method for detecting anomalies in real-time data exchange based on artificial intelligence according to any one of claims 1 to 4, wherein the device for detecting anomalies in real-time data exchange based on artificial intelligence comprises: A data receiving module, the data receiving module is used to obtain a data exchange task, wherein the data exchange task includes data to be exchanged and a data exchange link, the data exchange link includes a plurality of data exchange nodes, and each data exchange node corresponds to a device; A link disassembly module, the link disassembly module is used to perform pairwise neighborhood disassembly according to the data exchange link to obtain multiple exchange sub-links, and extract a first exchange sub-link according to the multiple exchange sub-links; A real-time exchange module, the real-time exchange module is used to exchange the data to be exchanged in real time based on the first exchange sub-link, and obtain a first real-time data exchange result and first sub-link exchange monitoring data; an anomaly detection module, the anomaly detection module being used to perform multi-feature anomaly detection on the first real-time data exchange result according to the data exchange anomaly detection multi-channel to obtain a first data exchange anomaly detection result; A safety loss detection module, the safety loss detection module is used to perform exchange safety loss detection based on the data exchange safety loss detection channel and the first sub-link exchange monitoring data to obtain a first sub-link exchange safety loss detection coefficient; A report generation module, wherein the report generation module is used to organize the first data exchange anomaly detection result and the first sub-link exchange safety loss detection coefficient to obtain a first sub-link exchange anomaly detection report.

Images