Network traffic anomaly monitoring method and device based on BiLSTM-Att network

Abstract

The embodiment of the present application provides a network traffic anomaly monitoring method and device based on a BiLSTM-Att network, the method comprising: obtaining network traffic time series data, system resource usage data and service call topology data, using a sliding time window method to construct a multimodal time series feature matrix, calculating the importance score of each feature in a traffic feature subset, a resource feature subset and a service feature subset through an information gain algorithm, screening the most discriminative features based on a score threshold to construct a fused feature subset; inputting the fused feature subset into a set bidirectional long short-term memory-attention network, performing multi-level analysis on the target features, using a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results, and generating a detection report including anomaly levels, anomaly types and anomaly causes; the present application can effectively improve the efficiency and accuracy of network traffic anomaly monitoring based on a BiLSTM-Att network.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and specifically to a method and device for monitoring network traffic anomaly based on a BiLSTM-Att network. Background Art

[0002] In the current complex network environment, network traffic anomaly detection has become a key task for network security and performance monitoring. Anomaly detection methods based on deep learning, especially those combining BiLSTM and attention mechanism, have shown unique advantages in processing complex time series data.

[0003] Currently, network traffic anomaly detection faces several major challenges. The first is the diversity and complexity of data. Network traffic data not only contains traffic information, but also involves multiple dimensions such as system resource usage and service call relationships. There are complex interrelationships between these data, and traditional single-dimensional analysis methods are difficult to fully grasp the anomaly characteristics.

[0004] Secondly, the real-time requirement is high. Abnormal situations in the network environment often require a quick response, and delayed detection may lead to serious consequences. This requires the detection system to have high processing efficiency while ensuring accuracy. At the same time, the detection system also needs to be able to adapt to the dynamic changes in the network environment and adjust the detection strategy in a timely manner.

[0005] With the continuous advancement of technology, the network traffic anomaly detection method based on BiLSTM-Attention will continue to develop and improve, providing more reliable technical support for network security and performance monitoring. This requires researchers to continue to work hard in algorithm optimization, engineering implementation, and practical application to promote technological innovation in this field. Summary of the invention

[0006] In view of the problems in the prior art, the present application provides a method and device for network traffic anomaly monitoring based on a BiLSTM-Att network, which can effectively improve the efficiency and accuracy of network traffic anomaly monitoring based on a BiLSTM-Att network.

[0007] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0008] In a first aspect, the present application provides a network traffic anomaly monitoring method based on a BiLSTM-Att network, comprising:

[0009] Obtain network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0010] The fused feature subset is input into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information;

[0011] A multi-level analysis is performed on the target features, and statistical indicators are calculated based on the traffic size, number of requests and response time characteristics in the traffic feature subset to identify abnormal intervals. The abnormal intervals are accurately located and classified by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset. A confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

[0012] Furthermore, the sliding time window method is used to construct a multimodal time series feature matrix, and the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset is calculated by the information gain algorithm, including:

[0013] Set the sliding window size to N time steps, the window sliding step to 1, perform time series sampling on the traffic feature subset, resource feature subset, and service feature subset in each time window, arrange the sampled data in chronological order to form a feature sequence, normalize the feature sequence to eliminate the dimension effect, and reconstruct the processed feature sequence into an M×N dimensional time series feature matrix, where M is the number of feature dimensions and N is the number of time steps;

[0014] The mutual information value of the features in the time series feature matrix is ​​calculated according to the information gain algorithm, and the information entropy and conditional entropy between each feature and the category label are calculated. The difference between the information entropy and the conditional entropy is used as the importance score of the feature. The score is normalized to obtain the standardized importance weight, and the importance threshold λ is set. Features with weights greater than λ are retained to construct a fusion feature subset with significant discriminative ability.

[0015] Furthermore, the fusion feature subset is input into a set bidirectional long short-term memory-attention network, and the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset, and the service feature subset through an input gating unit, including:

[0016] The fused feature subset is mapped to the D-dimensional hidden space to form an input feature vector. The feature vector is extracted through two sub-networks, forward propagation and back propagation. Each sub-network contains multiple recurrent neural network units. Each unit is controlled by a gating mechanism to transfer information. The input gate controls the inflow of input information at the current moment, the forgetting gate controls the degree of forgetting of historical information, and the output gate controls the output ratio of the unit state to the outside. The gated information is nonlinearly transformed to obtain the memory state at the current moment.

[0017] The traffic feature subset, resource feature subset and service feature subset are respectively subjected to feature importance learning through independent input gating units, and the correlation degree between the current feature and the historical state is calculated. The correlation value is mapped to the interval of 0-1 using the sigmoid function to obtain the input gating signal. The information inflow ratio of different feature subsets is controlled according to the size of the gating signal, and the input feature information is selectively filtered and importance learned to retain the effective feature information that contributes highly to the anomaly detection task.

[0018] Furthermore, the selectively retaining historical state information through the forget gating unit and controlling the output ratio of the feature through the output gating unit includes:

[0019] The input feature of the current moment is concatenated with the hidden state vector of the previous moment to form the input of the forget gate. The input is linearly transformed through the weight matrix and passed through the sigmoid function to obtain the forget gate signal. The forget gate signal is element-by-element multiplied with the unit state of the previous moment to control the retention ratio of historical information. The retained historical information and the new information filtered by the input gate at the current moment are weightedly combined to obtain the updated unit state.

[0020] The output gating signal is calculated using the input features and hidden layer states at the current moment, and the output gating signal is combined with the updated unit state to obtain the output vector. The unit state is nonlinearly transformed through the tanh activation function to compress the value to the range of -1 to 1, and the output gating signal is element-wise multiplied with the transformed unit state to obtain the hidden layer output at the current moment, so as to adaptively adjust the output ratio of different feature dimensions.

[0021] Furthermore, the input fusion feature subset is subjected to forward and reverse feature extraction simultaneously, the extracted bidirectional features are spliced ​​and fused, the importance weights of different time steps and different feature dimensions are adaptively calculated using the attention mechanism, and the importance weights are weightedly combined with the spliced ​​and fused features to obtain target features with temporal context information, including:

[0022] The fused feature subset is input into the forward long short-term memory network in time series order to extract the time series features from front to back, and the feature subset is input into the reverse long short-term memory network in reverse order to extract the time series features from back to front. The hidden state sequences of the forward network and the reverse network are concatenated to form a feature matrix containing bidirectional context information. The concatenated feature matrix is ​​converted into a unified feature space through a linear mapping layer to obtain a bidirectional fusion feature.

[0023] The self-attention mechanism is used to calculate the correlation scores between features at different time steps in the bidirectional fusion feature matrix. The correlation scores are normalized by the softmax function to obtain the attention weights. The time dimension of the feature matrix is ​​weighted and summed based on the attention weights to obtain the temporal context vector. The context vector is nonlinearly transformed and residually connected with the original features to obtain the target feature representation containing global dependencies.

[0024] Furthermore, the calculation of statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset identifies the abnormal interval, and the accurate positioning and classification of the abnormal interval is performed in combination with the CPU utilization, memory occupancy, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency and error rate characteristics in the service feature subset, including:

[0025] The sliding mean and standard deviation of the traffic size, number of requests and response time characteristics in the target features are calculated as statistical baselines. The Z-score standardization method is used to calculate the degree of deviation between the current observation value and the baseline. The deviation threshold α is set, and the time period in which the deviation values ​​of multiple consecutive time points exceed the threshold α is marked as a candidate abnormal interval. The dynamic time warping algorithm is applied to the candidate abnormal interval to calculate the similarity with the historical normal mode. The false alarm interval is filtered out based on the similarity threshold β to obtain the final abnormal interval;

[0026] In the determined abnormal range, the CPU utilization, memory usage, network bandwidth, service dependency, call frequency and error rate features are extracted to construct an abnormal feature vector. The feature vector is input into the pre-trained multi-layer perceptron classifier to calculate the probability distribution of the abnormal type. The root cause characteristics of the abnormality are identified according to the contribution of the features of each dimension. The hierarchical clustering method is used to automatically group the abnormal patterns to obtain the abnormal category label. The severity of the abnormality is determined based on the degree of abnormality and the scope of impact.

[0027] Furthermore, the multi-view decision fusion method based on confidence is used to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause, including:

[0028] Calculate the confidence score S1 for the detection results based on traffic characteristics, the confidence score S2 for the detection results based on resource characteristics, and the confidence score S3 for the detection results based on service characteristics. The three confidence scores are fused by weighted average method to obtain a comprehensive confidence score. Perform secondary verification and correction on the detection results with confidence lower than the threshold γ, and update the type label and severity of the abnormal event according to the corrected detection results.

[0029] The time point, type, degree and scope of impact of anomaly detection are extracted as structured data, and the detected anomaly features are ranked by importance to obtain the attribution results of the anomaly causes. The multi-dimensional anomaly indicators are mapped to a predefined grading system to determine the final anomaly level. The key information and detailed analysis results of the abnormal event are written into the detection report document according to the report template specifications for output and archiving.

[0030] In a second aspect, the present application provides a network traffic anomaly monitoring device based on a BiLSTM-Att network, comprising:

[0031] A data processing module is used to obtain network traffic time series data, system resource usage data and service call topology data, extract traffic size, request quantity and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0032] A feature processing module, used for inputting the fused feature subset into a set bidirectional long short-term memory-attention network, wherein the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through an input gating unit, selectively retains historical state information through a forgetting gating unit, controls the output ratio of features through an output gating unit, performs forward and reverse feature extraction on the input fused feature subset simultaneously, splices and fuses the extracted bidirectional features, uses an attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain target features with temporal context information;

[0033] The feature analysis module is used to perform multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormal level, abnormal type and abnormal cause.

[0034] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network are implemented.

[0035] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network.

[0036] In a fifth aspect, the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network.

[0037] It can be seen from the above technical scheme that the present application provides a network traffic anomaly monitoring method and device based on a BiLSTM-Att network. By acquiring network traffic time series data, system resource usage data and service call topology data, a sliding time window method is used to construct a multimodal time series feature matrix, and the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset is calculated by the information gain algorithm. The most discriminative features are selected based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, a multi-level analysis of the target features is performed, and a confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is one of the flow charts of the network traffic anomaly monitoring method based on the BiLSTM-Att network in the embodiment of the present application;

[0040] Figure 2 This is a second flow chart of a method for monitoring network traffic anomaly based on a BiLSTM-Att network in an embodiment of the present application;

[0041] Figure 3 This is a flow chart of the third method for monitoring network traffic anomaly based on the BiLSTM-Att network in an embodiment of the present application;

[0042] Figure 4 This is a fourth flow chart of a method for monitoring network traffic anomaly based on a BiLSTM-Att network in an embodiment of the present application;

[0043] Figure 5 This is a flowchart of a method for monitoring network traffic anomaly based on a BiLSTM-Att network in an embodiment of the present application;

[0044] Figure 6 This is a sixth flow chart of a method for monitoring network traffic anomaly based on a BiLSTM-Att network in an embodiment of the present application;

[0045] Figure 7FIG7 is a flow chart of a method for monitoring network traffic anomaly based on a BiLSTM-Att network in an embodiment of the present application;

[0046] Figure 8 It is a structural diagram of a network traffic anomaly monitoring device based on a BiLSTM-Att network in an embodiment of the present application;

[0047] Fig. 9 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application.

[0048] Reference numerals:

[0049] Electronic device 9600, central processing unit 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0052] In view of the problems existing in the prior art, the present application provides a network traffic anomaly monitoring method and device based on a BiLSTM-Att network. By acquiring network traffic time series data, system resource usage data and service call topology data, a sliding time window method is used to construct a multimodal time series feature matrix, and the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset is calculated by the information gain algorithm. The most discriminative features are selected based on the score threshold to construct a fused feature subset; the fused feature subset is input into a set bidirectional long short-term memory-attention network, a multi-level analysis is performed on the target features, and a confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results, and a detection report including anomaly level, anomaly type and anomaly cause is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0053] In order to effectively improve the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network, the present application provides an embodiment of a network traffic anomaly monitoring method based on the BiLSTM-Att network, see Figure 1 The network traffic anomaly monitoring method based on BiLSTM-Att network specifically includes the following contents:

[0054] Step S101: Acquire network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0055] Optionally, in this embodiment, this step describes in detail the complete process of multi-source heterogeneous data collection, feature extraction and feature selection, and constructs a feature subset with strong discriminative ability through multimodal data fusion and feature engineering technology.

[0056] During the data collection process, the system monitors three types of data sources at the same time: network traffic data is captured by network probes in real time, and the original information such as packet size and timestamp is recorded; system resource data is collected regularly by the system monitoring agent to collect the resource usage of hosts and containers; service call data is recorded by the distributed tracking system to record the call relationship and performance indicators between services. The collection process adopts an asynchronous method to avoid affecting system performance.

[0057] For network traffic data, the system extracts three key features: the traffic size feature is obtained by calculating the amount of data transmitted per unit time, the request quantity feature counts the frequency of HTTP requests, and the response time feature records the delay distribution of request processing. The feature extraction process includes preprocessing steps such as data cleaning, outlier processing, and time alignment.

[0058] The extraction of system resource features revolves around three dimensions: computing, storage, and network. CPU utilization reflects processor usage, including the usage ratio of user state and kernel state; memory usage monitors the usage of physical memory and virtual memory; network bandwidth features include statistics of inbound and outbound traffic. These features can reflect system load.

[0059] Service call features describe system behavior from the microservice architecture level: service dependency calculates the in-degree and out-degree of nodes by building a service call graph; call frequency counts the interaction density between services; and error rate records the proportion of failed calls. These features help identify service anomalies.

[0060] The sliding time window method is used to process time series data. The window size is dynamically adjusted according to the characteristics of the data. A larger window can capture long-term trends, and a smaller window can detect sudden changes. The data in the window is arranged in chronological order to construct a multimodal time series feature matrix.

[0061] The information gain algorithm is applied in the feature selection stage to calculate the mutual information value between each feature and the abnormal label. The algorithm is based on the information entropy theory and calculates the contribution of the feature to the category prediction. The importance score of the feature is converted to a uniform scale through normalization, and a threshold is set to select high-value features.

[0062] The fused feature subset finally constructed has strong discriminative ability, low redundancy between features, and rich information. This step solves technical problems such as difficulty in integrating heterogeneous data, insufficient feature extraction, and inaccurate feature selection.

[0063] The technical effects achieved include: the real-time and integrity of data collection are guaranteed; the feature extraction process is automated, and the feature expression is richer; the feature selection results are highly interpretable; and the discriminative ability of the fused feature subset is significantly improved. The system has good scalability and is easy to integrate new data sources and features.

[0064] Step S102: input the fused feature subset into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information;

[0065] Optionally, in this embodiment, this step describes the feature learning process based on the BiLSTM-Att network, and realizes the deep representation learning of time series features through bidirectional feature extraction and attention mechanism. The network structure makes full use of the context information of the sequence data and enhances the model's ability to capture time series patterns.

[0066] In the feature input stage, the fused feature subset is first converted into a form suitable for network processing through dimension mapping. The BiLSTM network contains two sub-networks, forward and reverse, which process sequence information from front to back and from back to front respectively. The network in each direction contains multiple LSTM units, which control the flow of information through a gating mechanism.

[0067] The core of the LSTM unit is three gating structures: the input gate is responsible for controlling the input ratio of new information. It maps the calculated gating signal to the range of 0-1 through the sigmoid function. A larger gating value indicates that the current input information is more important. The forget gate determines how much historical information to retain. It adaptively adjusts the retention ratio of historical information by calculating the correlation between the current input and the historical state. The output gate controls the output strength of the cell state to the outside. It calculates the output ratio based on the input and state at the current moment.

[0068] During the feature extraction process, the forward network processes the sequence in chronological order to capture the dependency from the past to the present; the reverse network processes the sequence in reverse order to extract contextual information from the future to the present. The results of the bidirectional feature extraction are fused through the splicing operation to obtain a feature representation containing complete contextual information.

[0069] The attention mechanism works after feature fusion, and it calculates the correlation scores between features at different time steps. The specific process is to map the feature sequence to the query and key value space, calculate the similarity score through dot product operation, and then obtain the attention weight through softmax normalization. The attention weight reflects the importance of features at different time steps to the current prediction.

[0070] Finally, the attention weights are weighted and combined with the features to obtain the target features that incorporate global context information. This process can adaptively focus on important time steps and feature dimensions and improve the effectiveness of feature representation.

[0071] This step solves the problems of traditional time series feature extraction methods: the inability to effectively utilize the long-term dependencies of the sequence; the difficulty in distinguishing the importance of different time steps and features; and the limited feature representation capability. The deep feature learning of the BiLSTM-Att network significantly improves the feature representation capability.

[0072] The technical effects are reflected in: the feature learning process is end-to-end trainable; bidirectional feature extraction makes full use of context information; the attention mechanism realizes adaptive weighting of features; the obtained target features have stronger expressiveness and discriminability. Experiments show that the performance of this method in anomaly detection tasks is better than traditional methods.

[0073] Step S103: Perform a multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

[0074] Optionally, in this embodiment, this step describes a complete process of multi-level anomaly analysis and decision fusion, and achieves accurate identification and classification of anomalies through in-depth analysis of target features. The method adopts a multi-dimensional feature collaborative analysis strategy to improve the accuracy and interpretability of anomaly detection.

[0075] In the abnormal interval identification stage, the system first performs statistical analysis on traffic characteristics. For traffic size characteristics, the moving average and standard deviation are calculated to build a dynamic threshold to detect abnormal fluctuations; for request quantity characteristics, seasonal decomposition methods are used to identify deviations from periodic patterns; for response time characteristics, quantile statistics are used to characterize changes in delay distribution. Through the combination of these statistical indicators, the system can preliminarily mark suspicious abnormal intervals.

[0076] During the anomaly location process, the system deeply analyzes resource characteristics and service characteristics. A sudden increase in CPU utilization may indicate a compute-intensive anomaly, a continuous increase in memory usage may indicate a memory leak, and network bandwidth saturation may indicate network congestion. At the same time, service-level characteristics provide the health status of the microservice system: changes in service dependencies reflect anomalies in the system architecture, drastic changes in call frequency indicate an imbalance in service load, and an increase in error rate reveals a decline in service quality.

[0077] The anomaly classification stage uses collaborative analysis of multi-dimensional features. The system combines the performance of different feature subsets to build an anomaly feature pattern library and determines the anomaly type through pattern matching. For example, high CPU utilization with a large number of requests usually indicates excessive load, while high error rates accompanied by changes in service dependencies may indicate service failures. The classification process takes into account the correlation and causal relationship between features.

[0078] The decision fusion stage uses a confidence-based multi-view method. Each feature view independently gives anomaly judgment and confidence score, and the system assigns weights to different views based on historical accuracy. The final anomaly judgment is obtained through weighted voting, which can balance the contribution of different features and improve the reliability of decision-making.

[0079] During the generation of the detection report, the system comprehensively considers the severity, impact scope and duration of the anomaly to determine the anomaly level. The determination of the anomaly type is based on a predefined anomaly pattern library, and the inference of the cause of the anomaly is achieved through causal analysis methods. The report also contains relevant feature change trends and key indicators to provide decision support for operation and maintenance personnel.

[0080] This step solves many technical problems in anomaly detection: inconsistent anomaly determination standards, insufficient feature association analysis, poor interpretability of detection results, etc. Through multi-level analysis and decision fusion, the accuracy and reliability of anomaly detection are significantly improved.

[0081] The technical effects are as follows: the false alarm rate and missed alarm rate of anomaly detection are significantly reduced; the accuracy of anomaly location is improved; the detection results are well interpretable; and the detection report provides strong support for fault diagnosis. This method has demonstrated excellent performance and practical value in practical applications.

[0082] From the above description, it can be seen that the network traffic anomaly monitoring method based on the BiLSTM-Att network provided in the embodiment of the present application can obtain network traffic time series data, system resource usage data and service call topology data, and use the sliding time window method to construct a multimodal time series feature matrix. The importance score of each feature in the traffic feature subset, resource feature subset and service feature subset is calculated by the information gain algorithm, and the most discriminative features are selected based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, and the target features are analyzed at multiple levels. The detection results are comprehensively evaluated using a multi-perspective decision fusion method based on confidence, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0083] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 2 , and can also include the following:

[0084] Step S201: Set the sliding window size to N time steps, the window sliding step to 1, perform time series sampling on the traffic feature subset, resource feature subset and service feature subset in each time window, arrange the sampled data in chronological order to form a feature sequence, normalize the feature sequence to eliminate the dimension effect, and reconstruct the processed feature sequence into a time series feature matrix of M×N dimensions, where M is the number of feature dimensions and N is the number of time steps;

[0085] Step S202: Calculate the mutual information value of the features in the time series feature matrix according to the information gain algorithm, calculate the information entropy and conditional entropy between each feature and the category label, take the difference between the information entropy and the conditional entropy as the importance score of the feature, normalize the score to obtain the standardized importance weight, set the importance threshold λ, retain the features with weights greater than λ to construct a fusion feature subset with significant discriminative ability.

[0086] Optionally, in this embodiment, these two steps describe in detail the construction process of the time series feature matrix and the feature selection method based on information gain, realizing the time series feature extraction and optimization of multi-source heterogeneous data. This method effectively improves the expressiveness and discriminability of features through sliding windows and feature selection technology.

[0087] In step S201, the system first determines the parameter configuration of the sliding window. The window size N determines the time span of the time series feature. A larger N value helps capture long-term trends, but increases the computational complexity. The window sliding step is set to 1 to ensure the continuity and integrity of feature extraction. During the time series sampling process, the system uniformly samples each feature subset within the time window to ensure the time series integrity of the data.

[0088] The construction of feature sequences uses time alignment technology to ensure that features from different sources are synchronized in the time dimension. Normalization uses the minimum-maximum standardization or Z-score standardization method to map features of different dimensions to a unified numerical range. This step eliminates the scale differences between features, making subsequent analysis more fair and accurate.

[0089] During the reconstruction of the feature matrix, the system converts the feature sequence into an M×N dimensional matrix. Each row of the matrix represents a feature dimension, and each column corresponds to a time step. This structure facilitates subsequent feature analysis and pattern recognition. The matrix construction process also includes data preprocessing steps such as missing value processing and outlier smoothing.

[0090] In step S202, the system implements feature selection based on information gain. The information gain algorithm is based on information theory and evaluates the importance of features by calculating their contribution to category prediction. For each feature, the system calculates the mutual information value between it and the category label, and this process involves the calculation of information entropy and conditional entropy.

[0091] Information entropy reflects the uncertainty of category distribution, and conditional entropy measures the uncertainty of category distribution under the condition of known feature values. The difference between the two is the information gain, which represents the contribution of the feature to reducing category uncertainty. During the calculation process, the system uses discretization to process continuous features and divides the feature values ​​into multiple intervals through equal frequency or equal width binning technology.

[0092] The normalization of importance scores uses the min-max method to map the scores of all features to the interval [0,1]. The setting of the threshold λ requires a trade-off between feature selection performance and computational efficiency. A larger λ value will retain fewer but more important features. The fused feature subset finally constructed has a strong discriminative ability, and the number of features is effectively controlled.

[0093] These two steps solve many problems in traditional feature engineering: insufficient temporal feature extraction, unclear feature selection criteria, high feature redundancy, etc. Through the systematic feature construction and selection process, the quality of features is significantly improved.

[0094] The technical effects include: the time series feature matrix has a reasonable structure, which is convenient for subsequent analysis; the feature selection process has a good theoretical basis; the selected features have strong discriminability; and the computational efficiency is guaranteed. This method provides high-quality feature input for subsequent anomaly detection.

[0095] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 3 , and can also include the following:

[0096] Step S301: Map the fused feature subset to the D-dimensional hidden space to form an input feature vector, and extract features from the feature vector through two sub-networks, namely, forward propagation and back propagation. Each sub-network contains multiple recurrent neural network units, and each unit is controlled by a gating mechanism to transfer information. The input gate is used to control the inflow of input information at the current moment, the forgetting gate controls the degree of forgetting of historical information, and the output gate controls the output ratio of the unit state to the outside. The gated information is nonlinearly transformed to obtain the memory state at the current moment.

[0097] Step S302: The traffic feature subset, resource feature subset and service feature subset are respectively subjected to feature importance learning through independent input gating units, the correlation degree between the current feature and the historical state is calculated, and the correlation value is mapped to the 0-1 interval using the sigmoid function to obtain the input gating signal. The information inflow ratio of different feature subsets is controlled according to the size of the gating signal, and the input feature information is selectively filtered and importance learned to retain the effective feature information that contributes highly to the anomaly detection task.

[0098] Optionally, in this embodiment, these two steps describe in detail the feature learning process based on the bidirectional LSTM network and the adaptive learning mechanism of feature importance. The method realizes deep representation learning and selective information transfer of temporal features through the gating mechanism and bidirectional feature extraction.

[0099] In step S301, the system first maps the fused feature subset to the D-dimensional hidden space through linear transformation. This dimensional conversion process can be regarded as the initialization representation of the feature. The mapping is implemented using the weight matrix and bias vector, and the parameters are optimized by the back propagation algorithm. The converted feature vector is used as the input of the bidirectional network for parallel feature extraction.

[0100] The bidirectional network structure contains two sub-networks, the forward and reverse sub-networks, which process the time series information from the past to the present and from the future to the present respectively. Each sub-network is composed of multiple LSTM units to form a deep network structure. The core of the LSTM unit is the gating mechanism, which includes three components: input gate, forget gate and output gate. Each gate is a neural network layer that receives the current input and the hidden state of the previous moment as input.

[0101] The working process of the gating mechanism is as follows: the input gate determines how much new information can flow into the memory unit, and it generates a gating signal by calculating the correlation between the current input and the historical state; the forget gate controls the degree of retention of historical information, and a larger gating value means more historical information is retained; the output gate adjusts the output strength of the memory unit state to the outside. All gating signals are mapped to the 0-1 interval through the sigmoid function to achieve soft gating.

[0102] Step S302 focuses on the learning process of feature importance. The system configures independent input gating units for the three feature subsets. This design allows the network to adopt different information transmission strategies for different types of features. Each input gating unit calculates the correlation between the feature and the historical state and generates a corresponding gating signal.

[0103] The calculation of correlation takes into account multiple factors: the time series change trend of the feature, the similarity with the historical state, the abnormality of the feature value, etc. The calculation result is normalized by the sigmoid function to obtain a gating signal between 0 and 1. A larger gating signal indicates that the feature is more important for the prediction at the current moment, and more information should be allowed to flow in.

[0104] Feature importance learning is a dynamic adaptive process. The network continuously adjusts the parameters of the gating unit through back propagation, so that the gating signal can accurately reflect the importance of the feature. This adaptive learning mechanism can automatically adjust the weight of the feature according to different scenarios and improve the flexibility of the model.

[0105] These two steps solve many problems existing in traditional feature learning methods: insufficient feature representation, inadequate temporal dependency modeling, and difficulty in quantifying feature importance. The effect of feature learning is significantly improved through a carefully designed network structure and learning mechanism.

[0106] The technical effects include: feature representation has rich temporal semantics; the gating mechanism realizes intelligent information selection; the learning process of feature importance is explainable; and the model has good generalization ability. This method provides high-quality feature representation for anomaly detection and improves the accuracy and reliability of detection.

[0107] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 4 , and can also include the following:

[0108] Step S401: The input feature at the current moment is concatenated with the hidden state vector at the previous moment to form the input of the forget gate, the input is linearly transformed through the weight matrix and passed through the sigmoid function to obtain the forget gate signal, the forget gate signal is element-by-element multiplied with the unit state at the previous moment to control the retention ratio of historical information, and the retained historical information and the new information filtered by the input gate at the current moment are weightedly combined to obtain the updated unit state;

[0109] Step S402: Calculate the output gating signal using the input features and hidden layer state at the current moment, combine the output gating signal with the updated unit state to obtain the output vector, perform nonlinear transformation on the unit state through the tanh activation function to compress the value to the range of -1 to 1, and perform element-by-element multiplication of the output gating signal and the transformed unit state to obtain the hidden layer output at the current moment, so as to adaptively adjust the output ratio of different feature dimensions.

[0110] Optionally, in this embodiment, these two steps describe in detail the working mechanism of the forget gate and the output gate in the LSTM unit, as well as the complete process of state update and output generation. The method realizes selective memory and adaptive output control of timing information through sophisticated gating operations and state update strategies.

[0111] In step S401, the system first constructs the input vector of the forget gate. The input features at the current moment and the hidden layer state at the previous moment are combined through a splicing operation to form complete input information. This design enables the forget gate to consider the influence of the current input and the historical state at the same time. The spliced ​​vector is linearly transformed by the weight matrix, which is a learnable parameter optimized through the training process.

[0112] The generation of the forget gating signal uses the sigmoid activation function to map the result of the linear transformation to the interval 0-1. This soft gating mechanism allows the network to have greater flexibility in retaining historical information. The gating signal is element-wise multiplied with the cell state at the previous moment to achieve selective forgetting. The result of the multiplication operation determines how much historical information will be retained to the current moment.

[0113] During the state update process, the system performs a weighted combination of the historical information filtered by the forget gate and the new information processed by the input gate at the current moment. The combination uses an addition operation, allowing the new and old information to be integrated according to their respective importance. This update mechanism ensures the continuity of historical information and allows the timely injection of new information.

[0114] In step S402, the system constructs an output gating mechanism. The input of the output gate also includes the current features and hidden layer states, and generates an output gating signal through a similar weight transformation and sigmoid activation process. This signal determines the proportion of the unit state output to the outside, achieving fine control of the output information.

[0115] The unit state is transformed nonlinearly by the tanh activation function, which compresses the state value to the range of -1 to 1, making the output more stable. The transformed state is multiplied element by element with the output gating signal to obtain the final hidden layer output. This design allows the network to adopt different output strategies for different feature dimensions.

[0116] Output generation is an adaptive process, and the value of the gating signal is dynamically adjusted according to the input features and the current task. This adaptive mechanism enables the network to selectively output important information according to different scenarios and improve the effectiveness of feature representation.

[0117] These two steps solve multiple problems in traditional recurrent neural networks: long-term dependencies are difficult to model, gradients disappear, information selection is inflexible, etc. Through carefully designed gating mechanisms and state update strategies, the performance of the network is significantly improved.

[0118] The technical effects include: historical information is effectively retained; the fusion of new and old information is more reasonable; output control is more precise; and feature representation is more effective. This method provides strong technical support for time series feature learning and improves the model's expressiveness and prediction accuracy. These improvements enable the model to perform well when processing long sequence data, especially in scenarios that require long-term memory.

[0119] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 5 , and can also include the following:

[0120] Step S501: Input the fused feature subset into the forward long short-term memory network in time series order to extract the time series features from front to back, and input the feature subset into the reverse long short-term memory network in reverse order to extract the time series features from back to front, perform a splicing operation on the hidden layer state sequences of the forward network and the reverse network to form a feature matrix containing bidirectional context information, and convert the spliced ​​feature matrix into a unified feature space through a linear mapping layer to obtain a bidirectional fused feature;

[0121] Step S502: Use the self-attention mechanism to calculate the correlation scores between features at different time steps in the bidirectional fusion feature matrix, normalize the correlation scores through the softmax function to obtain the attention weights, perform weighted summation on the time dimension of the feature matrix based on the attention weights to obtain the temporal context vector, perform nonlinear transformation and residual connection on the context vector and the original features to obtain the target feature representation containing global dependencies.

[0122] Optionally, in this embodiment, these two steps describe in detail the feature extraction process of the bidirectional LSTM network and the temporal dependency modeling method based on the self-attention mechanism. The method achieves comprehensive capture of temporal features and effective modeling of long-range dependencies through bidirectional feature extraction and attention weighting.

[0123] In step S501, the system adopts a bidirectional parallel feature extraction strategy. The forward LSTM network processes the feature sequence in chronological order to capture the temporal dependency from the past to the present; the reverse LSTM network processes the reverse sequence to extract contextual information from the future to the present. This bidirectional structure enables the feature representation of each time step to fully utilize the information of the entire sequence.

[0124] During the feature extraction process, the LSTM networks in two directions run independently and generate hidden state sequences respectively. The hidden state of each time step contains the accumulated information in that direction. The multi-layer structure of the network allows for layer-by-layer abstraction, from low-level local features to high-level semantic features, to form a hierarchical feature representation.

[0125] The fusion of bidirectional features uses a concatenation operation to connect the hidden states of the forward and reverse networks in the feature dimension. The concatenated feature matrix contains complete bidirectional context information. In order to make the feature representation more compact and unified, the system converts the concatenated features into a unified feature space through a learnable linear mapping layer.

[0126] Step S502 focuses on implementing temporal dependency modeling based on self-attention. The self-attention mechanism first calculates the correlation between any two time-step features in the feature matrix. The calculation process includes converting the features into three representations: query, key, and value, and obtaining the correlation score through the inner product of the query and the key.

[0127] The relevance scores are normalized by the softmax function and converted into attention weights. The weight values ​​reflect the importance relationship between features at different time steps. Larger weights indicate that the features at the corresponding time step are more important for the current prediction. This soft attention mechanism allows the model to adaptively select relevant information.

[0128] The generation of the temporal context vector adopts a weighted summation method. The system uses the attention weight to weight the feature matrix in the time dimension to obtain a contextual representation that integrates global temporal information. This process can be regarded as a selective summary of historical information.

[0129] The final feature fusion process includes nonlinear transformation and residual connection. Nonlinear transformation is implemented through multi-layer perceptron, which increases the expressive power of feature representation; residual connection retains the original feature information and prevents information loss during transmission. This design ensures the richness of features and maintains the stability of calculation.

[0130] These two steps solve many problems in traditional time series feature extraction: incomplete capture of time series dependencies, difficulty in modeling long-range dependencies, limited feature representation capabilities, etc. The combination of bidirectional feature extraction and attention mechanism significantly improves the effect of feature learning.

[0131] The technical effects include: the feature representation contains the complete temporal context; the long-range dependency is effectively modeled; the feature learning process is interpretable; and the model has strong feature extraction capabilities. This method provides high-quality feature representation for subsequent anomaly detection tasks and improves the accuracy and reliability of detection. In particular, it shows obvious advantages when processing long sequences and complex temporal patterns.

[0132] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 6 , and can also include the following:

[0133] Step S601: Calculate the sliding mean and standard deviation of the traffic size, number of requests and response time features in the target features as the statistical baseline, use the Z-score standardization method to calculate the deviation degree between the current observation value and the baseline, set the deviation threshold α, mark the time period in which the deviation values ​​of multiple consecutive time points exceed the threshold α as the candidate abnormal interval, apply the dynamic time warping algorithm to the candidate abnormal interval to calculate the similarity with the historical normal mode, filter out the false alarm interval based on the similarity threshold β to obtain the final abnormal interval;

[0134] Step S602: Extract CPU utilization, memory usage, network bandwidth, service dependency, call frequency and error rate features within the determined abnormal interval to construct an abnormal feature vector, input the feature vector into a pre-trained multi-layer perceptron classifier to calculate the probability distribution of the abnormal type, identify the root cause of the abnormality according to the contribution of each dimensional feature, use a hierarchical clustering method to automatically group the abnormal patterns to obtain abnormal category labels, and determine the severity of the abnormality based on the degree of abnormality and the scope of impact.

[0135] Optionally, in this embodiment, these two steps describe in detail an anomaly detection and root cause analysis method based on multi-dimensional features. The method achieves accurate identification and automatic classification of anomalies through the combination of statistical modeling and machine learning technology.

[0136] Step S601 first establishes a statistical baseline for time series data. The system uses a sliding window method to calculate the mean and standard deviation of key indicators, and the window size is determined according to the periodic characteristics of the data. This dynamic baseline can adapt to the natural fluctuations of indicators and provide a more accurate reference standard.

[0137] Z-score standardization converts observations into standard scores, quantifying the degree to which data points deviate from the baseline. The standardization process takes into account the dimensional differences of different indicators, allowing multidimensional features to be compared on a unified scale. The setting of the deviation threshold α is based on business needs and historical experience. A larger α value will increase the accuracy of detection but may reduce sensitivity.

[0138] The candidate abnormal interval is determined by a continuous judgment strategy. The system requires that the deviation values ​​at multiple consecutive time points exceed the threshold α. This design can reduce false alarms caused by instantaneous fluctuations. The determined time window length needs to balance the timeliness and stability of detection.

[0139] The dynamic time warping algorithm is used to evaluate the similarity between candidate intervals and historical normal patterns. The algorithm calculates the minimum distance between sequences through nonlinear time alignment and can handle the expansion and contraction of time scales. The introduction of the similarity threshold β further filters out false positive intervals that are similar to normal patterns.

[0140] Step S602 focuses on the classification and root cause analysis of the anomaly. The system extracts multi-dimensional resource and service features from the determined anomaly interval and constructs a complete anomaly feature vector. The feature selection covers key indicators at the system, network, and service levels, providing a comprehensive anomaly description.

[0141] The pre-trained multi-layer perceptron classifier receives the feature vector as input and outputs the probability distribution of the anomaly type. The classifier is trained using historical annotated data and the network parameters are optimized through back propagation. The probability distribution reflects the probability of the anomaly belonging to each category.

[0142] Root cause analysis is based on feature contribution calculation. The system uses gradient-based methods or attention weights to analyze the impact of each feature on anomaly determination. Features with high contribution are identified as potential root causes. This method provides explanatory information about the occurrence of anomalies.

[0143] Hierarchical clustering methods automatically group abnormal patterns. The clustering process takes into account the similarity of feature vectors and builds a hierarchy of abnormal categories through bottom-up merging. This unsupervised learning method can discover natural groupings in the data and adapt to emerging abnormal patterns.

[0144] The severity level is determined by taking into account multiple factors. The degree of abnormality is quantified by the size of the deviation value, and the scope of impact is based on the number and importance of the affected services. The level classification adopts a multi-level standard to facilitate operation and maintenance personnel to quickly determine the processing priority.

[0145] These two steps solve many problems in traditional anomaly detection methods: high false alarm rate, difficulty in determining the root cause, inaccurate classification, etc. Through multi-level analysis and verification mechanisms, the reliability of detection is significantly improved.

[0146] The technical effects include: more accurate anomaly detection; clearer root cause analysis; more reasonable anomaly classification; and more scientific processing decisions. This method provides strong technical support for system operation and maintenance, and improves the efficiency of problem diagnosis and processing. It shows significant advantages, especially when dealing with anomalies in complex systems.

[0147] In one embodiment of the network traffic anomaly monitoring method based on the BiLSTM-Att network of the present application, see Figure 7 , and can also include the following:

[0148] Step S701: Calculate the confidence score S1 for the detection result based on traffic characteristics, calculate the confidence score S2 for the detection result based on resource characteristics, and calculate the confidence score S3 for the detection result based on service characteristics. The three confidence scores are integrated by weighted average method to obtain a comprehensive confidence score. Perform secondary verification and correction on the detection results with confidence lower than the threshold γ, and update the type label and severity of the abnormal event according to the corrected detection results.

[0149] Step S702: extract information such as the time point of anomaly detection, anomaly type, degree of anomaly and scope of impact as structured data, sort the detected anomaly features by importance to obtain the attribution result of the anomaly cause, map the multi-dimensional anomaly indicators to a predefined grading system to determine the final anomaly level, and write the key information and detailed analysis results of the anomaly event into the detection report document according to the report template specification for output and archiving.

[0150] Optionally, in this embodiment, these two steps describe in detail the multi-dimensional fusion and report generation process of the anomaly detection results. The method achieves reliability improvement and standardized output of the anomaly detection results through multi-feature confidence fusion and standardized report generation.

[0151] Step S701 first establishes a confidence evaluation system for multi-dimensional features. The confidence S1 of traffic features is calculated based on the matching degree and deviation persistence of the time series pattern; the confidence S2 of resource features considers the relevance of resource use and the degree of threshold overrun; the confidence S3 of service features combines the service quality indicators and the degree of abnormality of the dependency. This multi-dimensional confidence evaluation makes full use of information from different feature domains.

[0152] Confidence fusion uses a weighted average method, and the weight setting reflects the importance of different features in abnormal judgment. The weight can be determined through historical data analysis or expert experience, or it can be dynamically adjusted through machine learning methods. The fusion process takes into account the mutual verification effect between features and improves the reliability of judgment.

[0153] For detection results with a confidence level lower than the threshold γ, the system starts a secondary verification mechanism. The verification process includes multiple steps such as expanding feature dimensions, extending observation windows, and comparing historical patterns. Through multi-angle verification, the system can effectively identify and filter false positive cases.

[0154] The correction of test results is based on the findings of the verification process. The system adjusts the abnormality type judgment and severity assessment according to the new evidence to ensure the accuracy of the final result. The correction process adopts a gradual strategy to avoid drastic changes in judgment due to a single factor.

[0155] Step S702 focuses on achieving standardized output of detection results. The system first converts the key information of the abnormal event into a structured data format. The information extraction process follows the predefined data model to ensure data consistency and queryability.

[0156] The importance ranking of abnormal features adopts a contribution-based method. The system calculates the influence of each feature on the final judgment and obtains the relative importance of the feature through normalization. The ranking result intuitively shows the primary and secondary relationship of the abnormal causes.

[0157] The establishment of the grading system takes into account multiple dimensions. The system maps abnormal indicators to a unified scoring standard, which contains multiple levels, each with clear definitions and judgment conditions. This standardized scoring method facilitates cross-system comparison and management.

[0158] Report generation follows predefined template specifications. The template design includes multiple parts such as event summary, detailed analysis, impact assessment and recommended measures. The report content should not only present key information concisely, but also provide sufficient technical details to support decision-making.

[0159] Output documents are archived in a standardized format. The archiving process includes steps such as document naming, format conversion, and metadata addition to ensure document traceability and easy retrieval. Standardized archiving management provides a basis for subsequent analysis and optimization.

[0160] These two steps solve many problems in traditional anomaly detection: unreliable detection results, difficult to interpret analysis results, inconsistent report formats, etc. Through standardized process design, the practicality of anomaly detection has been significantly improved.

[0161] The technical effects include: more reliable detection results; more transparent analysis process; more standardized report output; and more effective decision support. This method provides a complete solution for the implementation of anomaly detection systems and improves the efficiency and quality of operation and maintenance management. It shows significant practical value, especially in the monitoring of large-scale systems.

[0162] In order to effectively improve the efficiency and accuracy of network traffic anomaly monitoring based on BiLSTM-Att network, the present application provides an embodiment of a network traffic anomaly monitoring device based on BiLSTM-Att network for implementing all or part of the content of the network traffic anomaly monitoring method based on BiLSTM-Att network, see Figure 8 The network traffic anomaly monitoring device based on the BiLSTM-Att network specifically includes the following contents:

[0163] The data processing module 10 is used to obtain network traffic time series data, system resource usage data and service call topology data, extract traffic size, request quantity and response time characteristics from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy and network bandwidth characteristics from the system resource usage data to form a resource feature subset, extract service dependency, call frequency and error rate characteristics from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0164] The feature processing module 20 is used to input the fused feature subset into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target feature with temporal context information;

[0165] The feature analysis module 30 is used to perform multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time features in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals based on the CPU utilization, memory usage, network bandwidth features in the resource feature subset and the service dependency, call frequency, and error rate features in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormal level, abnormal type and abnormal cause.

[0166] From the above description, it can be seen that the network traffic anomaly monitoring device based on the BiLSTM-Att network provided in the embodiment of the present application can obtain network traffic time series data, system resource usage data and service call topology data, and use the sliding time window method to construct a multimodal time series feature matrix. The importance score of each feature in the traffic feature subset, resource feature subset and service feature subset is calculated by the information gain algorithm, and the most discriminative features are selected based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, and the target features are analyzed at multiple levels. The detection results are comprehensively evaluated using a multi-perspective decision fusion method based on confidence, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0167] From the hardware level, in order to effectively improve the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network, the present application provides an embodiment of an electronic device for implementing all or part of the content of the network traffic anomaly monitoring method based on the BiLSTM-Att network, and the electronic device specifically includes the following content:

[0168] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between the network traffic anomaly monitoring device based on BiLSTM-Att network and related devices such as core business system, user terminal and related database; the logic controller can be a desktop computer, tablet computer and mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the network traffic anomaly monitoring method based on BiLSTM-Att network and the embodiment of the network traffic anomaly monitoring device based on BiLSTM-Att network in the embodiment, and the contents thereof are incorporated herein, and the repeated parts are not repeated.

[0169] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0170] In practical applications, part of the network traffic anomaly monitoring method based on the BiLSTM-Att network can be executed on the electronic device side as described above, or all operations can be completed in the client device. Specifically, it can be selected according to the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0171] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0172] Fig. 9 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig. 9 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig. 9is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0173] In one embodiment, the network traffic anomaly monitoring method function based on the BiLSTM-Att network can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following control:

[0174] Step S101: Acquire network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0175] Step S102: input the fused feature subset into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information;

[0176] Step S103: Perform a multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

[0177] From the above description, it can be seen that the electronic device provided in the embodiment of the present application obtains network traffic time series data, system resource usage data and service call topology data, adopts a sliding time window method to construct a multimodal time series feature matrix, calculates the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through the information gain algorithm, and selects the most discriminative features based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, a multi-level analysis of the target features is performed, and a confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0178] In another embodiment, the network traffic anomaly monitoring device based on the BiLSTM-Att network can be configured separately from the central processing unit 9100. For example, the network traffic anomaly monitoring device based on the BiLSTM-Att network can be configured as a chip connected to the central processing unit 9100, and the function of the network traffic anomaly monitoring method based on the BiLSTM-Att network can be realized through the control of the central processing unit.

[0179] like Fig. 9 As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig. 9 In addition, the electronic device 9600 may also include Fig. 9 For components not shown, reference may be made to the prior art.

[0180] like Fig. 9 As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0181] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0182] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0183] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0184] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0185] The communication module 9110 is a transmitter / receiver that sends and receives signals via the antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0186] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the local machine through the microphone 9132, and the sound stored on the local machine can be played through the speaker 9131.

[0187] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the network traffic anomaly monitoring method based on a BiLSTM-Att network in the above embodiment, where the execution subject is a server or a client. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all the steps of the network traffic anomaly monitoring method based on a BiLSTM-Att network in the above embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0188] Step S101: Acquire network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0189] Step S102: input the fused feature subset into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information;

[0190] Step S103: Perform a multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

[0191] From the above description, it can be seen that the computer-readable storage medium provided in the embodiment of the present application obtains network traffic time series data, system resource usage data and service call topology data, adopts a sliding time window method to construct a multimodal time series feature matrix, calculates the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through the information gain algorithm, and selects the most discriminative features based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, a multi-level analysis of the target features is performed, and a confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0192] The embodiments of the present application also provide a computer program product capable of implementing all the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network in the above embodiment, where the execution subject is a server or a client. When the computer program / instruction is executed by a processor, the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network are implemented. For example, the computer program / instruction implements the following steps:

[0193] Step S101: Acquire network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset;

[0194] Step S102: input the fused feature subset into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information;

[0195] Step S103: Perform a multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

[0196] From the above description, it can be seen that the computer program product provided in the embodiment of the present application obtains network traffic time series data, system resource usage data and service call topology data, adopts a sliding time window method to construct a multimodal time series feature matrix, calculates the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through the information gain algorithm, and selects the most discriminative features based on the score threshold to construct a fused feature subset; the fused feature subset is input into the set bidirectional long short-term memory-attention network, a multi-level analysis of the target features is performed, and a confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results, and a detection report containing anomaly levels, anomaly types and anomaly causes is generated, thereby effectively improving the efficiency and accuracy of network traffic anomaly monitoring based on the BiLSTM-Att network.

[0197] It should be understood by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0198] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0199] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0200] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0201] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network traffic anomaly monitoring method based on BiLSTM-Att network, characterized in that: The method comprises: Obtain network traffic time series data, system resource usage data, and service call topology data, extract traffic size, request quantity, and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy, and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency, and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset; The fused feature subset is input into a set bidirectional long short-term memory-attention network, the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through the input gating unit, selectively retains the historical state information through the forgetting gating unit, controls the output ratio of the feature through the output gating unit, performs forward and reverse feature extraction on the input fused feature subset at the same time, splices and fuses the extracted bidirectional features, uses the attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain the target features with temporal context information; A multi-level analysis is performed on the target features, and statistical indicators are calculated based on the traffic size, number of requests and response time characteristics in the traffic feature subset to identify abnormal intervals. The abnormal intervals are accurately located and classified by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset. A confidence-based multi-perspective decision fusion method is used to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause.

2. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The sliding time window method is used to construct a multimodal time series feature matrix, and the importance score of each feature in the traffic feature subset, resource feature subset, and service feature subset is calculated by the information gain algorithm, including: Set the sliding window size to N time steps, the window sliding step to 1, perform time series sampling on the traffic feature subset, resource feature subset, and service feature subset in each time window, arrange the sampled data in chronological order to form a feature sequence, normalize the feature sequence to eliminate the dimension effect, and reconstruct the processed feature sequence into an M×N dimensional time series feature matrix, where M is the number of feature dimensions and N is the number of time steps; The mutual information value of the features in the time series feature matrix is ​​calculated according to the information gain algorithm, and the information entropy and conditional entropy between each feature and the category label are calculated. The difference between the information entropy and the conditional entropy is used as the importance score of the feature. The score is normalized to obtain the standardized importance weight, and the importance threshold λ is set. Features with weights greater than λ are retained to construct a fusion feature subset with significant discriminative ability.

3. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The step of inputting the fused feature subset into a set bidirectional long short-term memory-attention network, wherein the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset, and the service feature subset through an input gating unit, including: The fused feature subset is mapped to the D-dimensional hidden space to form an input feature vector. The feature vector is extracted through two sub-networks, forward propagation and back propagation. Each sub-network contains multiple recurrent neural network units. Each unit is controlled by a gating mechanism to transfer information. The input gate controls the inflow of input information at the current moment, the forgetting gate controls the degree of forgetting of historical information, and the output gate controls the output ratio of the unit state to the outside. The gated information is nonlinearly transformed to obtain the memory state at the current moment. The traffic feature subset, resource feature subset and service feature subset are respectively subjected to feature importance learning through independent input gating units, and the correlation degree between the current feature and the historical state is calculated. The correlation value is mapped to the interval of 0-1 using the sigmoid function to obtain the input gating signal. The information inflow ratio of different feature subsets is controlled according to the size of the gating signal, and the input feature information is selectively filtered and importance learned to retain the effective feature information that contributes highly to the anomaly detection task.

4. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The selective retention of historical state information by the forget gate unit and the control of the output ratio of the feature by the output gate unit include: The input feature of the current moment is concatenated with the hidden state vector of the previous moment to form the input of the forget gate. The input is linearly transformed through the weight matrix and passed through the sigmoid function to obtain the forget gate signal. The forget gate signal is element-by-element multiplied with the unit state of the previous moment to control the retention ratio of historical information. The retained historical information and the new information filtered by the input gate at the current moment are weightedly combined to obtain the updated unit state. The output gating signal is calculated using the input features and hidden layer states at the current moment, and the output gating signal is combined with the updated unit state to obtain the output vector. The unit state is nonlinearly transformed through the tanh activation function to compress the value to the range of -1 to 1, and the output gating signal is element-wise multiplied with the transformed unit state to obtain the hidden layer output at the current moment, so as to adaptively adjust the output ratio of different feature dimensions.

5. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The input fusion feature subset is subjected to forward and reverse feature extraction at the same time, the extracted bidirectional features are spliced ​​and fused, the importance weights of different time steps and different feature dimensions are adaptively calculated using the attention mechanism, and the importance weights are weightedly combined with the spliced ​​and fused features to obtain target features with temporal context information, including: The fused feature subset is input into the forward long short-term memory network in time series order to extract the time series features from front to back, and the feature subset is input into the reverse long short-term memory network in reverse order to extract the time series features from back to front. The hidden state sequences of the forward network and the reverse network are concatenated to form a feature matrix containing bidirectional context information. The concatenated feature matrix is ​​converted into a unified feature space through a linear mapping layer to obtain a bidirectional fusion feature. The self-attention mechanism is used to calculate the correlation scores between features at different time steps in the bidirectional fusion feature matrix. The correlation scores are normalized by the softmax function to obtain the attention weights. The time dimension of the feature matrix is ​​weighted and summed based on the attention weights to obtain the temporal context vector. The context vector is nonlinearly transformed and residually connected with the original features to obtain the target feature representation containing global dependencies.

6. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The method calculates statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, and combines the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset to accurately locate and classify the abnormal intervals, including: The sliding mean and standard deviation of the traffic size, number of requests and response time characteristics in the target features are calculated as statistical baselines. The Z-score standardization method is used to calculate the degree of deviation between the current observation value and the baseline. The deviation threshold α is set, and the time period in which the deviation values ​​of multiple consecutive time points exceed the threshold α is marked as a candidate abnormal interval. The dynamic time warping algorithm is applied to the candidate abnormal interval to calculate the similarity with the historical normal mode. The false alarm interval is filtered out based on the similarity threshold β to obtain the final abnormal interval; In the determined abnormal range, the CPU utilization, memory usage, network bandwidth, service dependency, call frequency and error rate features are extracted to construct an abnormal feature vector. The feature vector is input into the pre-trained multi-layer perceptron classifier to calculate the probability distribution of the abnormal type. The root cause characteristics of the abnormality are identified according to the contribution of the features of each dimension. The hierarchical clustering method is used to automatically group the abnormal patterns to obtain the abnormal category label. The severity of the abnormality is determined based on the degree of abnormality and the scope of impact.

7. The network traffic anomaly monitoring method based on BiLSTM-Att network according to claim 1 is characterized in that: The multi-view decision fusion method based on confidence is used to comprehensively evaluate the detection results and generate a detection report containing the abnormality level, abnormality type and abnormality cause, including: Calculate the confidence score S1 for the detection results based on traffic characteristics, the confidence score S2 for the detection results based on resource characteristics, and the confidence score S3 for the detection results based on service characteristics. The three confidence scores are fused by weighted average method to obtain a comprehensive confidence score. Perform secondary verification and correction on the detection results with confidence lower than the threshold γ, and update the type label and severity of the abnormal event according to the corrected detection results. The time point, type, degree and scope of impact of anomaly detection are extracted as structured data, and the detected anomaly features are ranked by importance to obtain the attribution results of the anomaly causes. The multi-dimensional anomaly indicators are mapped to a predefined grading system to determine the final anomaly level. The key information and detailed analysis results of the abnormal event are written into the detection report document according to the report template specifications for output and archiving.

8. A network traffic anomaly monitoring device based on BiLSTM-Att network, characterized in that: The device comprises: A data processing module is used to obtain network traffic time series data, system resource usage data and service call topology data, extract traffic size, request quantity and response time features from the network traffic time series data to form a traffic feature subset, extract CPU utilization, memory occupancy and network bandwidth features from the system resource usage data to form a resource feature subset, extract service dependency, call frequency and error rate features from the service call topology data to form a service feature subset, use a sliding time window method to construct a multimodal time series feature matrix, calculate the importance score of each feature in the traffic feature subset, resource feature subset and service feature subset through an information gain algorithm, and select the most discriminative features based on the score threshold to construct a fusion feature subset; A feature processing module, used for inputting the fused feature subset into a set bidirectional long short-term memory-attention network, wherein the bidirectional long short-term memory unit of the bidirectional long short-term memory-attention network learns the importance of the traffic feature subset, the resource feature subset and the service feature subset through an input gating unit, selectively retains historical state information through a forgetting gating unit, controls the output ratio of features through an output gating unit, performs forward and reverse feature extraction on the input fused feature subset simultaneously, splices and fuses the extracted bidirectional features, uses an attention mechanism to adaptively calculate the importance weights of different time steps and different feature dimensions, and performs weighted combination of the importance weights and the spliced ​​and fused features to obtain target features with temporal context information; The feature analysis module is used to perform multi-level analysis on the target features, calculate statistical indicators based on the traffic size, request quantity and response time characteristics in the traffic feature subset to identify abnormal intervals, accurately locate and classify the abnormal intervals by combining the CPU utilization, memory usage, network bandwidth characteristics in the resource feature subset and the service dependency, call frequency, and error rate characteristics in the service feature subset, and use a confidence-based multi-perspective decision fusion method to comprehensively evaluate the detection results and generate a detection report containing the abnormal level, abnormal type and abnormal cause.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network traffic anomaly monitoring method based on the BiLSTM-Att network described in any one of claims 1 to 7 are implemented.

Images