A communication anomaly detection method based on neural network

Abstract

The present invention discloses a communication anomaly detection method based on a neural network, which belongs to the field of communication technology. By adopting a neural network model to construct a communication anomaly detection model, and adopting a multi-strategy optimization algorithm to train the model parameters of the communication anomaly detection model, the trained communication anomaly detection model can be used to perform real-time detection of network security in the communication process, thereby realizing communication anomaly detection. The method has strong feature learning and pattern recognition capabilities, can effectively improve the accuracy of anomaly detection, can monitor network traffic in real time, promptly discover and warn of potential security risks, reduce false alarm rates, and reduce security operation and maintenance costs.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology, and in particular relates to a communication anomaly detection method based on a neural network. Background Art

[0002] With the rapid development of the Internet, network communications are gradually applied to various fields. In the process of network communications, illegal personnel often invade the network during the communication process, and security issues are becoming increasingly prominent. As an important means of network security protection, network traffic anomaly detection mainly relies on rule matching and statistical learning. However, these methods have problems such as poor detection effect and high false alarm rate when dealing with complex and changeable network attack methods. Summary of the invention

[0003] The present invention provides a communication anomaly detection method based on a neural network, which is used to solve the technical problems in the prior art that rule matching and statistical learning lead to poor detection effect and high false alarm rate.

[0004] A communication anomaly detection method based on a neural network, comprising:

[0005] Acquire network traffic characteristic data when network communication is abnormal and network traffic characteristic data when network communication is normal, and use the communication state of the network traffic characteristic data as its label data to obtain communication sample data;

[0006] A communication anomaly detection model is constructed by using a neural network model, and model parameters of the communication anomaly detection model are initialized multiple times to obtain multiple model parameter individuals to be optimized;

[0007] Based on the communication sample data, a multi-strategy optimization algorithm is used to optimize multiple individual model parameters to be optimized, and a final individual model parameter is determined;

[0008] After decoding the final model parameter individuals, the final model parameters are applied to the communication anomaly detection model to obtain the final communication anomaly detection model, and the final communication anomaly detection model is deployed on the monitoring platform;

[0009] The real-time network traffic characteristics corresponding to the target monitoring object are collected, and the final communication anomaly detection model on the monitoring platform is scheduled to detect the real-time network traffic characteristics to obtain the communication anomaly detection results.

[0010] In a possible implementation, using a neural network model to construct a communication anomaly detection model includes: using a convolutional neural network model to construct a communication anomaly detection model.

[0011] In a possible implementation, the model parameters of the communication anomaly detection model are initialized multiple times, including:

[0012] Determine the initial values ​​corresponding to the individual model parameters of the communication anomaly detection model as follows:

[0013]

[0014] in, Indicates i The initial values ​​corresponding to the individual model parameters d Dimension parameters, i =1,2,…,I, I represents the total number of I to be generated, d =1,2,…,D, where D represents the total dimension of the model parameters. Express satisfaction The smallest prime number of represents pi;

[0015] According to the initial values ​​corresponding to the model parameters, the model parameters are determined in the solution space as:

[0016]

[0017] in, Indicates i The model parameters d dimensional parameter, mod represents the remainder function, represents the upper limit of the d-th dimension parameter, Represents the lower limit of the d-th dimension parameter.

[0018] In a possible implementation, based on the communication sample data, a multi-strategy optimization algorithm is used to optimize a plurality of individual model parameters to be optimized to determine the final individual model parameters, including:

[0019] For each individual model parameter, apply the individual model parameter to the communication anomaly detection model, use the network traffic feature data in the communication sample data as the input of the communication anomaly detection model, use the label data corresponding to the network traffic feature data as the expected output of the communication anomaly detection model, and obtain the loss function value corresponding to the individual model parameter;

[0020] Determine the optimal parameter individual according to the loss function value corresponding to the model parameter individual;

[0021] For each model parameter individual, according to the optimal parameter individual, an adaptive dual information interactive search strategy is used to quickly search the model parameter individual to obtain the model parameter individual after the quick search;

[0022] For the model parameter individuals after the rapid search, according to the optimal parameter individuals, the cosine oscillation search strategy is used to search for the optimal position of the model parameter individuals, so as to obtain the model parameter individuals after the optimal position search;

[0023] For the model parameter individuals after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individuals to obtain the model parameter individuals after the reverse search;

[0024] For the model parameter individuals after the reverse search, the optimal parameter individuals are re-determined, and a greedy random search strategy is used to perform a global search on the re-determined optimal parameter individuals to obtain the optimal parameter individuals after the global search;

[0025] The adaptive dual information interaction search strategy, cosine oscillation search strategy, nonlinear reverse mapping search strategy and greedy random search strategy are repeatedly executed until the current optimization times reaches the maximum optimization times, and the optimal parameter individual is taken as the final model parameter individual.

[0026] In a possible implementation, the network traffic feature data in the communication sample data is used as the input of the communication anomaly detection model, and the label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model, and the loss function value corresponding to the individual model parameter is obtained, including:

[0027] Using network traffic feature data in the communication sample data as input to the communication anomaly detection model, and determining the actual output of the communication anomaly detection model;

[0028] The label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model. According to the actual output and expected output of the communication anomaly detection model, the cross entropy loss function value is determined to obtain the loss function value corresponding to the individual model parameter.

[0029] In a possible implementation, for each individual model parameter, a fast search is performed on the individual model parameter according to the optimal individual parameter and using an adaptive dual information interactive search strategy to obtain the individual model parameter after the fast search, including:

[0030] Determine the average position corresponding to all model parameter individuals and obtain the reference parameter individuals;

[0031] For each model parameter individual, the information between the optimal parameter individual and the model parameter individual is interacted to obtain a first information interaction item;

[0032] For each model parameter individual, the information between the reference parameter individual and the model parameter individual is interacted to obtain a second information interaction item;

[0033] According to the first information interaction item and the second information interaction item, the model parameter individuals are quickly searched to obtain the model parameter individuals after the quick search.

[0034] In a possible implementation, for the model parameter individuals after the rapid search, according to the optimal parameter individuals, the model parameter individuals are searched for the optimal position using a cosine oscillation search strategy to obtain the model parameter individuals after the optimal position search, including:

[0035] For the model parameter individual after the rapid search, determining the information difference item between the optimal parameter individual and the model parameter individual;

[0036] Performing cosine oscillation on the information difference term to obtain the information difference term after cosine oscillation;

[0037] For the model parameter individuals after the rapid search, the optimal position search is performed on the model parameter individuals according to the information difference item after the cosine oscillation to obtain the model parameter individuals after the optimal position search.

[0038] In a possible implementation, for the model parameter individuals after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individuals to obtain the model parameter individuals after the reverse search, including:

[0039] Based on the current optimization times, determine the nonlinear search coefficient;

[0040] For the individual model parameters after the optimal position search, based on the nonlinear search coefficient, each individual model parameter is perturbed to obtain the individual model parameter after the perturbation;

[0041] Based on the nonlinear search coefficient and in combination with the upper and lower limits of the model parameters of the communication anomaly detection model, a random disturbance term is determined;

[0042] According to the random disturbance term, a reverse search is performed on the individual model parameters after the disturbance to obtain the individual model parameters after the reverse search;

[0043] Determine whether the loss function value corresponding to the model parameter individual after the reverse search is reduced. If so, accept the reverse search, otherwise reject the reverse search.

[0044] In a possible implementation, a greedy random search strategy is used to perform a global search on the re-determined optimal parameter individual to obtain the optimal parameter individual after the global search, including:

[0045] For the re-determined optimal parameter individual, determine the random flight position corresponding to the optimal parameter individual;

[0046] Based on the random flight position, a random nonlinear search is performed on the re-determined optimal parameter individual to obtain the optimal parameter individual after the global search;

[0047] Determine whether the loss function value corresponding to the optimal parameter individual after the global search is reduced. If so, accept the global search, otherwise reject the global search.

[0048] In a possible implementation manner, after obtaining the communication anomaly detection result, the method further includes: when the communication anomaly detection result is abnormal, transmitting an abnormality warning to a device or system designated by a staff member.

[0049] The present invention provides a communication anomaly detection method based on a neural network. By adopting a neural network model to construct a communication anomaly detection model, and adopting a multi-strategy optimization algorithm to train the model parameters of the communication anomaly detection model, the trained communication anomaly detection model can be used to perform real-time detection of network security in the communication process, thereby realizing communication anomaly detection. The method has strong feature learning and pattern recognition capabilities, can effectively improve the accuracy of anomaly detection, can monitor network traffic in real time, promptly discover and warn of potential security risks, reduce false alarm rates, and reduce security operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0051] Figure 1 A flowchart of a communication anomaly detection method based on a neural network is provided in an embodiment of the present invention.

[0052] Figure 2 A flowchart of a multi-strategy optimization algorithm provided by an embodiment of the present invention.

[0053] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0054] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0055] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0056] like Figure 1 As shown, an embodiment of the present invention provides a communication anomaly detection method based on a neural network, comprising:

[0057] S101, obtaining network traffic characteristic data when network communication is abnormal and network traffic characteristic data when network communication is normal, and using the communication state of the network traffic characteristic data as its label data to obtain communication sample data;

[0058] In an embodiment of the present invention, the NSL-KDD dataset can be used as the communication sample data. The NSL-KDD dataset is one of the commonly used datasets in the field of network intrusion detection and is widely used to evaluate the performance of network security. The dataset contains TCP (Transmission Control Protocol) connection data for network intrusion detection, covering 42 different network traffic features, which include basic attributes related to the connection (such as duration, source IP (Internet Protocol) address, target IP address, source port, target port, etc.), and statistical information related to the connection service and traffic pattern (such as transport layer protocol, error type, data volume, etc.). At the same time, it covers different types of network connection data, including normal network connections and four types of malicious connections. These malicious connections are specifically divided into Denial of Service (DOS) attacks, User-to-Root (U2R) attacks, monitoring or exploration of the system (Probing), and remote user (Remote-to-Login, R2L) attacks.

[0059] S102, constructing a communication anomaly detection model using a neural network model, and initializing model parameters of the communication anomaly detection model multiple times to obtain multiple model parameter individuals to be optimized;

[0060] Optionally, a convolutional neural network, a long short-term memory neural network, or other neural networks can be used to construct a communication anomaly detection model. Each model parameter of the communication anomaly detection model has corresponding upper and lower limits, and can be randomly initialized within the upper and lower limits to obtain multiple model parameter individuals to be optimized.

[0061] S103, based on the communication sample data, a multi-strategy optimization algorithm is used to optimize a plurality of individual model parameters to be optimized, and a final individual model parameter is determined;

[0062] In the prior art, the hyperparameter optimization of the neural network is usually performed using the gradient descent method, but the gradient descent method is often prone to fall into the local optimum, resulting in poor optimization effect, and ultimately poor communication anomaly detection effect. Therefore, the embodiment of the present invention uses a multi-strategy optimization algorithm to optimize multiple individual model parameters to be optimized, so as to improve the data learning effect and ultimately improve the communication anomaly detection effect.

[0063] S104, after decoding the final model parameter individuals, applying them to the communication anomaly detection model to obtain the final communication anomaly detection model, and deploying the final communication anomaly detection model on the monitoring platform;

[0064] S105: Collect the real-time network traffic characteristics corresponding to the target monitoring object, and schedule the final communication anomaly detection model on the monitoring platform to detect the real-time network traffic characteristics to obtain the communication anomaly detection result.

[0065] The present invention provides a communication anomaly detection method based on a neural network. By adopting a neural network model to construct a communication anomaly detection model, and adopting a multi-strategy optimization algorithm to train the model parameters of the communication anomaly detection model, the trained communication anomaly detection model can be used to perform real-time detection of network security in the communication process, thereby realizing communication anomaly detection. The method has strong feature learning and pattern recognition capabilities, can effectively improve the accuracy of anomaly detection, can monitor network traffic in real time, promptly discover and warn of potential security risks, reduce false alarm rates, and reduce security operation and maintenance costs.

[0066] In a possible implementation, using a neural network model to construct a communication anomaly detection model includes: using a convolutional neural network model to construct a communication anomaly detection model.

[0067] In a possible implementation, the model parameters of the communication anomaly detection model are initialized multiple times, including:

[0068] Determine the initial values ​​corresponding to the individual model parameters of the communication anomaly detection model as follows:

[0069]

[0070] in, Indicates i The initial values ​​corresponding to the individual model parameters d Dimension parameters, i =1,2,…,I, where I represents the total number of model parameter individuals to be generated. d =1,2,…,D, where D represents the total dimension of the model parameters. Express satisfaction The smallest prime number of represents pi;

[0071] According to the initial values ​​corresponding to the model parameters, the model parameters are determined in the solution space as:

[0072]

[0073] in, Indicates i The model parameters d dimensional parameter, mod represents the remainder function, represents the upper limit of the d-th dimension parameter, Represents the lower limit of the d-th dimension parameter.

[0074] The initialization method provided by the embodiment of the present invention can make the distribution of individual model parameters in the solution space more uniform, thereby effectively improving the optimization speed of the algorithm.

[0075] The model parameters may be weights and thresholds. The model parameter individuals include all parameters to be trained. The parameters to be trained may be partial parameters of the neural network or all parameters.

[0076] like Figure 2 As shown, based on the communication sample data, a multi-strategy optimization algorithm is used to optimize multiple individual model parameters to be optimized, and the final individual model parameters are determined, including:

[0077] S201, for each individual model parameter, applying the individual model parameter to the communication anomaly detection model, and using the network traffic feature data in the communication sample data as the input of the communication anomaly detection model, using the label data corresponding to the network traffic feature data as the expected output of the communication anomaly detection model, and obtaining the loss function value corresponding to the individual model parameter;

[0078] S202, determining the optimal parameter individual according to the loss function value corresponding to the model parameter individual;

[0079] S203, for each model parameter individual, according to the optimal parameter individual, and using an adaptive dual information interactive search strategy, a fast search is performed on the model parameter individual to obtain a model parameter individual after the fast search;

[0080] S204, for the model parameter individuals after the rapid search, according to the optimal parameter individuals, and using the cosine oscillation search strategy, an optimal position search is performed on the model parameter individuals to obtain the model parameter individuals after the optimal position search;

[0081] S205, for the model parameter individual after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individual to obtain the model parameter individual after the reverse search;

[0082] S206, re-determine the optimal parameter individual for the model parameter individual after the reverse search, and use a greedy random search strategy to perform a global search on the re-determined optimal parameter individual to obtain the optimal parameter individual after the global search;

[0083] S207, repeatedly executing the adaptive dual information interaction search strategy, the cosine oscillation search strategy, the nonlinear reverse mapping search strategy and the greedy random search strategy until the current optimization times reaches the maximum optimization times, and taking the optimal parameter individual as the final model parameter individual.

[0084] In a possible implementation, the network traffic feature data in the communication sample data is used as the input of the communication anomaly detection model, and the label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model, and the loss function value corresponding to the individual model parameter is obtained, including:

[0085] Using network traffic feature data in the communication sample data as input to the communication anomaly detection model, and determining the actual output of the communication anomaly detection model;

[0086] The label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model. According to the actual output and expected output of the communication anomaly detection model, the cross entropy loss function value is determined to obtain the loss function value corresponding to the individual model parameter.

[0087] It is worth noting that in addition to using the cross entropy loss function value, other loss function values ​​can also be used to evaluate the quality of individual model parameters in the solution space.

[0088] In a possible implementation, for each individual model parameter, a fast search is performed on the individual model parameter according to the optimal individual parameter and using an adaptive dual information interactive search strategy to obtain the individual model parameter after the fast search, including:

[0089] Determine the average position corresponding to all model parameter individuals, and obtain the reference parameter individual:

[0090]

[0091] in, Indicates t During the optimization process i model parameter individuals, I represents the total number of all model parameter individuals, Indicates the reference number of individuals adopted;

[0092] For each model parameter individual, the information between the optimal parameter individual and the model parameter individual is exchanged, and the first information interaction term is obtained as:

[0093]

[0094]

[0095] in, represents the first information interaction item, represents the adaptive adjustment weight coefficient, Represents a random number between (0,1), represents the optimal parameter individual, T represents the preset maximum number of optimization times;

[0096] For each model parameter individual, the information between the reference parameter individual and the model parameter individual is exchanged, and the second information interaction term is obtained as:

[0097]

[0098] in, represents a second information interaction item;

[0099] According to the first information interaction item and the second information interaction item, the model parameter individual is quickly searched, and the model parameter individual obtained after the quick search is:

[0100]

[0101] in, Represents the model parameter individual after fast search .

[0102] The adaptive dual-information interactive search strategy provided by the embodiment of the present invention can not only realize the learning of the optimal position, but also learn the information of the entire population, thereby accelerating the optimization speed of the algorithm in the early stage of the algorithm and improving the optimization accuracy of the algorithm in the later stage of the algorithm.

[0103] In a possible implementation, for the model parameter individuals after the rapid search, according to the optimal parameter individuals, the model parameter individuals are searched for the optimal position using a cosine oscillation search strategy to obtain the model parameter individuals after the optimal position search, including:

[0104] For the model parameter individual after the rapid search, the information difference term between the optimal parameter individual and the model parameter individual is determined as: ;in, represents the model parameter individual after the jth fast search;

[0105] The information difference term is subjected to cosine oscillation, and the information difference term after cosine oscillation is obtained as follows: ;

[0106] in, Represents a random number between (0,1), represents pi, Represents a random number between (-1,1);

[0107] For the model parameter individuals after the rapid search, the optimal position search is performed on the model parameter individuals according to the information difference item after the cosine oscillation, and the model parameter individuals after the optimal position search are obtained as follows:

[0108]

[0109] in, Represents the model parameter individual after the optimal position search , i =1,2,…,I, where I represents the total number of model parameter individuals to be generated.

[0110] The cosine oscillation search strategy provided by the embodiment of the present invention can enable all model parameter individuals to perform oscillation searches around the optimal position, thereby effectively improving the search accuracy of the algorithm.

[0111] In a possible implementation, for the model parameter individuals after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individuals to obtain the model parameter individuals after the reverse search, including:

[0112] Based on the current optimization times, the nonlinear search coefficient is determined as:

[0113]

[0114] in, represents the nonlinear search coefficient;

[0115] For the individual model parameters after the optimal position search, each individual model parameter is perturbed based on the nonlinear search coefficient, and the individual model parameters after the perturbation are obtained as follows:

[0116]

[0117] in, represents the model parameter individual after the nth optimal position search, The individual model parameters after perturbation ;

[0118] Based on the nonlinear search coefficient and combined with the upper and lower limits of the model parameters of the communication anomaly detection model, the random disturbance term is determined as:

[0119]

[0120] in, represents a random number between (0,1), lb represents the lower limit individual composed of the lower limit of the model parameter, and ub represents the upper limit individual composed of the upper limit of the model parameter;

[0121] According to the random disturbance term, a reverse search is performed on the individual model parameters after the disturbance, and the individual model parameters after the reverse search are obtained as follows:

[0122]

[0123] in, Represents the model parameter individual after reverse search .

[0124] The nonlinear reverse mapping search strategy provided by the embodiment of the present invention can search in the opposite direction, so that more unfamiliar areas can be searched, which can effectively improve the traversal of the solution space and increase the possibility of finding the optimal solution.

[0125] Determine whether the loss function value corresponding to the model parameter individual after the reverse search is reduced. If so, accept the reverse search, otherwise reject the reverse search.

[0126] In a possible implementation, a greedy random search strategy is used to perform a global search on the re-determined optimal parameter individual to obtain the optimal parameter individual after the global search, including:

[0127] For the re-determined optimal parameter individual, the random flight position corresponding to the optimal parameter individual is determined as:

[0128]

[0129] in, represents a random flight position, represents a model parameter individual after a random reverse search, represents the random flight coefficient, u represents the first normal distribution random number, v represents the second normal distribution random number, represents a constant term;

[0130] Based on the random flight position, a random nonlinear search is performed on the re-determined optimal parameter individual, and the optimal parameter individual after the global search is obtained as follows:

[0131]

[0132] in, represents the optimal parameter individual after global search, Represents a random number between (0,1), Represents pi.

[0133] Determine whether the loss function value corresponding to the optimal parameter individual after the global search is reduced. If so, accept the global search, otherwise reject the global search.

[0134] The embodiment of the present invention can implement a jump-type search through a greedy random search strategy, thereby increasing the possibility of jumping out of a local optimal solution, and thus finding a global optimal solution.

[0135] In a possible implementation manner, after obtaining the communication anomaly detection result, the method further includes: when the communication anomaly detection result is abnormal, transmitting an abnormality warning to a device or system designated by a staff member.

[0136] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A communication anomaly detection method based on neural network, characterized in that: include: Acquire network traffic characteristic data when network communication is abnormal and network traffic characteristic data when network communication is normal, and use the communication state of the network traffic characteristic data as its label data to obtain communication sample data; A communication anomaly detection model is constructed by using a neural network model, and model parameters of the communication anomaly detection model are initialized multiple times to obtain multiple model parameter individuals to be optimized; Based on the communication sample data, a multi-strategy optimization algorithm is used to optimize multiple individual model parameters to be optimized, and a final individual model parameter is determined; After decoding the final model parameter individuals, the final model parameters are applied to the communication anomaly detection model to obtain the final communication anomaly detection model, and the final communication anomaly detection model is deployed on the monitoring platform; Collect the real-time network traffic characteristics corresponding to the target monitoring object, and schedule the final communication anomaly detection model on the monitoring platform to detect the real-time network traffic characteristics to obtain the communication anomaly detection results; A communication anomaly detection model is constructed by using a neural network model, including: constructing a communication anomaly detection model by using a convolutional neural network model; The model parameters of the communication anomaly detection model are initialized multiple times, including: Determine the initial values ​​corresponding to the individual model parameters of the communication anomaly detection model as follows: in, Indicates i The initial values ​​corresponding to the individual model parameters d Dimension parameters, i =1,2,…,I, I represents the total number of i to be generated, d =1,2,…,D, where D represents the total dimension of the model parameters. Express satisfaction The smallest prime number of represents pi; According to the initial values ​​corresponding to the model parameters, the model parameters are determined in the solution space as: in, Indicates i The model parameters d dimensional parameter, mod represents the remainder function, represents the upper limit of the d-th dimension parameter, Represents the lower limit of the d-th dimension parameter.

2. The method for detecting communication anomalies based on a neural network according to claim 1, characterized in that: Based on the communication sample data, a multi-strategy optimization algorithm is used to optimize multiple individual model parameters to be optimized, and the final individual model parameters are determined, including: For each individual model parameter, apply the individual model parameter to the communication anomaly detection model, use the network traffic feature data in the communication sample data as the input of the communication anomaly detection model, use the label data corresponding to the network traffic feature data as the expected output of the communication anomaly detection model, and obtain the loss function value corresponding to the individual model parameter; Determine the optimal parameter individual according to the loss function value corresponding to the model parameter individual; For each model parameter individual, according to the optimal parameter individual, an adaptive dual information interactive search strategy is used to quickly search the model parameter individual to obtain the model parameter individual after the quick search; For the model parameter individuals after the rapid search, according to the optimal parameter individuals, the cosine oscillation search strategy is used to search for the optimal position of the model parameter individuals, so as to obtain the model parameter individuals after the optimal position search; For the model parameter individuals after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individuals to obtain the model parameter individuals after the reverse search; For the model parameter individuals after the reverse search, the optimal parameter individuals are re-determined, and a greedy random search strategy is used to perform a global search on the re-determined optimal parameter individuals to obtain the optimal parameter individuals after the global search; The adaptive dual information interaction search strategy, cosine oscillation search strategy, nonlinear reverse mapping search strategy and greedy random search strategy are repeatedly executed until the current optimization times reaches the maximum optimization times, and the optimal parameter individual is taken as the final model parameter individual.

3. The method for detecting communication anomalies based on a neural network according to claim 2, characterized in that: The network traffic feature data in the communication sample data is used as the input of the communication anomaly detection model, and the label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model to obtain the loss function value corresponding to the individual model parameters, including: Using network traffic feature data in the communication sample data as input to the communication anomaly detection model, and determining the actual output of the communication anomaly detection model; The label data corresponding to the network traffic feature data is used as the expected output of the communication anomaly detection model. According to the actual output and expected output of the communication anomaly detection model, the cross entropy loss function value is determined to obtain the loss function value corresponding to the individual model parameter.

4. The method for detecting communication anomalies based on a neural network according to claim 3, characterized in that: For each model parameter individual, according to the optimal parameter individual, an adaptive dual information interactive search strategy is used to quickly search the model parameter individual, and the model parameter individual after the quick search is obtained, including: Determine the average position corresponding to all model parameter individuals and obtain the reference parameter individuals; For each model parameter individual, the information between the optimal parameter individual and the model parameter individual is interacted to obtain a first information interaction item; For each model parameter individual, the information between the reference parameter individual and the model parameter individual is interacted to obtain a second information interaction item; According to the first information interaction item and the second information interaction item, the model parameter individuals are quickly searched to obtain the model parameter individuals after the quick search.

5. The method for detecting communication anomalies based on a neural network according to claim 4, characterized in that: For the model parameter individuals after the rapid search, according to the optimal parameter individuals, the optimal position search is performed on the model parameter individuals using a cosine oscillation search strategy to obtain the model parameter individuals after the optimal position search, including: For the model parameter individual after the rapid search, determining the information difference item between the optimal parameter individual and the model parameter individual; Performing cosine oscillation on the information difference term to obtain the information difference term after cosine oscillation; For the model parameter individuals after the rapid search, the optimal position search is performed on the model parameter individuals according to the information difference item after the cosine oscillation to obtain the model parameter individuals after the optimal position search.

6. The method for detecting communication anomalies based on a neural network according to claim 5, characterized in that: For the model parameter individuals after the optimal position search, a nonlinear reverse mapping search strategy is used to perform a reverse search on the model parameter individuals to obtain the model parameter individuals after the reverse search, including: Based on the current optimization times, determine the nonlinear search coefficient; For the individual model parameters after the optimal position search, based on the nonlinear search coefficient, each individual model parameter is perturbed to obtain the individual model parameter after the perturbation; Based on the nonlinear search coefficient and in combination with the upper and lower limits of the model parameters of the communication anomaly detection model, a random disturbance term is determined; According to the random disturbance term, a reverse search is performed on the individual model parameters after the disturbance to obtain the individual model parameters after the reverse search; Determine whether the loss function value corresponding to the model parameter individual after the reverse search is reduced. If so, accept the reverse search, otherwise reject the reverse search.

7. The method for detecting communication anomalies based on a neural network according to claim 6, characterized in that: A greedy random search strategy is used to perform a global search on the re-determined optimal parameter individuals to obtain the optimal parameter individuals after the global search, including: For the re-determined optimal parameter individual, determine the random flight position corresponding to the optimal parameter individual; Based on the random flight position, a random nonlinear search is performed on the re-determined optimal parameter individual to obtain the optimal parameter individual after the global search; Determine whether the loss function value corresponding to the optimal parameter individual after the global search is reduced. If so, accept the global search, otherwise reject the global search.

8. The method for detecting communication anomalies based on a neural network according to claim 7, characterized in that: After obtaining the communication anomaly detection result, the method further includes: when the communication anomaly detection result is abnormal, transmitting an abnormality warning to a device or system designated by a staff member.

Images