Multi-edge collaborative anomaly detection system and method based on double-flow parallel neural network

Abstract

The invention provides a multi-edge collaborative anomaly detection system and method based on a double-flow parallel neural network, and the scheme employs a multi-edge collaborative task unloading method, can effectively improve the network anomaly detection efficiency of the Internet of Things, improves the defects when a single-edge gateway faces a large number of task processing requests, and improves the utilization rate of an overall edge system. Meanwhile, by adopting an anomaly detection model based on a double-flow parallel network, while the deep meaning and the context relationship of the traffic are extracted, a traffic data structure and a feature visual representation form can be effectively concerned, and a data anomaly mode can be visually described, so that the features of the abnormal traffic can be more comprehensively extracted and analyzed, and accurate detection is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of network abnormal traffic analysis, and in particular relates to a multi-edge collaborative anomaly detection system and method based on a dual-stream parallel neural network. Background Art

[0002] Abnormal network traffic usually refers to abnormalities in the size, distribution, and link status of network data packets. In order to cope with this growing threat, many IoT security providers use cloud-based centralized abnormal traffic detection systems, which can effectively detect network anomalies. However, this may lead to multiple communications between the cloud and the device, which is heavily dependent on a good network communication environment. At the same time, considering that real-world networks usually have risks such as delays and packet loss, the network anomaly detection time is increased and the effectiveness of the detection system is reduced. With the development of edge computing, more and more tasks are constantly being transferred from the cloud to the edge of the network, alleviating the pressure on the cloud to process large amounts of data. Edge computing, because it is closer to the edge of the network, can provide lower latency than cloud computing, thereby effectively reducing the delay in data transmission, improving the response speed of network anomaly detection, and reducing dependence on central servers.

[0003] The inventors found that intrusion detection based on edge gateway deployment usually needs to process a large number of network intrusion detection task requests. However, due to the complexity of network intrusion detection, the large number of task request devices and tasks, a single edge gateway is difficult to cope with a large number of complex and intensive task requests; secondly, existing network anomaly detection methods based on artificial intelligence technology usually directly input traffic features into the neural network and rely on prediction results to discover network attacks. Although these methods often use larger and more complex neural networks to extract abnormal traffic features, the existing solutions do not deeply explore the multi-dimensional potential information of abnormal traffic, resulting in insufficient representation capabilities of the proposed traffic features, which in turn makes the accuracy of the network anomaly detection method poor. Summary of the invention

[0004] The embodiments of the present invention provide a multi-edge collaborative anomaly detection system and method based on a dual-stream parallel neural network to solve the problem that traditional solutions are difficult to cope with a large number of complex and intensive task requests, and have to deeply mine the multi-dimensional potential information of abnormal traffic, resulting in insufficient characterization capabilities of the proposed traffic characteristics, and thus making the accuracy of the network anomaly detection method poor.

[0005] According to a first aspect of an embodiment of the present invention, a multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network is provided, comprising:

[0006] A cloud deep learning training module deployed in the cloud, which is used to train anomaly detection models based on a dual-stream parallel network, receive requests for anomaly detection models from edge gateways, and configure anomaly detection models based on recognition results of IoT devices connected to the edge gateways;

[0007] as well as,

[0008] The edge gateway anomaly detection module deployed on the edge gateway is used to obtain network traffic data of the IoT device connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a network traffic feature set to be detected; the network traffic feature set is converted into a grayscale image representation and a semantic feature matrix representation respectively; based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained through an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device configured by the edge gateway;

[0009] Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

[0010] Furthermore, the network traffic feature set is converted into a grayscale image representation, specifically: each data packet in the network traffic set to be detected is converted into a feature vector of a preset length; each byte in the feature vector is used as a pixel point in the grayscale image, and the size of each byte is used as the pixel value of the pixel point; based on the pixel point representation of the byte, the network traffic feature set is converted into a grayscale image representation.

[0011] Furthermore, the network traffic feature set is converted into a semantic feature matrix representation, specifically: for the feature vector obtained by converting each data packet, each byte in the feature vector is vectorized to obtain the feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

[0012] Furthermore, the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit and a network anomaly detection unit, wherein the network anomaly detection unit adopts an anomaly detection model based on a dual-stream parallel network trained in a cloud deep learning training module.

[0013] Furthermore, the multi-edge collaborative task offloading unit specifically performs the following processing process: obtaining the hardware resource usage of different edge gateways in real time, and based on the hardware resource usage of the edge gateways, offloading the anomaly detection task of the edge gateway whose hardware resource usage is greater than a preset threshold to other edge gateways with sufficient hardware resources for execution; wherein, when the hardware resource usage of each edge gateway is greater than the preset threshold, the anomaly detection task is offloaded to the cloud for execution.

[0014] Furthermore, the training of the anomaly detection model based on the dual-stream parallel network is specifically as follows: obtaining historical network traffic data and its corresponding anomaly detection results, and constructing a training data set; training the dual-stream parallel network based on the constructed training data set to obtain a trained anomaly detection model.

[0015] Furthermore, the classifier adopts Sigmoid function.

[0016] According to a second aspect of an embodiment of the present invention, a multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network is provided, which is based on the above-mentioned multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network, including:

[0017] Obtain network traffic data of IoT devices connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a set of network traffic features to be detected;

[0018] Converting the network traffic feature set into a grayscale image representation and a semantic feature matrix representation respectively;

[0019] Based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained by configuring an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device on the edge gateway;

[0020] Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

[0021] According to a third aspect of an embodiment of the present invention, there is provided an electronic device, comprising a memory, a processor, and a computer program stored and running on the memory, wherein when the processor executes the program, the multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network is implemented.

[0022] According to a fourth aspect of an embodiment of the present invention, a non-transitory computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network is implemented.

[0023] One or more of the above technical solutions have the following beneficial effects:

[0024] The present invention provides a multi-edge collaborative anomaly detection system and method based on a dual-stream parallel neural network. The scheme can provide lower network latency by sinking the network anomaly detection task to the edge gateway. At the same time, the scheme adopts the proposed anomaly detection model based on a dual-stream parallel neural network, and converts the network traffic into grayscale images and semantic matrices for feature extraction respectively. While extracting the deep meaning and contextual relationship of the traffic, it can effectively focus on the traffic data structure and feature visual expression, intuitively describe the data anomaly pattern, and then more comprehensively extract and analyze the characteristics of abnormal traffic to achieve accurate detection.

[0025] The solution described in the present invention can effectively improve the efficiency of IoT network anomaly detection by adopting a multi-edge collaborative task offloading strategy, improve the inadequacy of a single edge gateway when facing a large number of task processing requests, and improve the overall edge system utilization.

[0026] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0028] Figure 1 It is a schematic diagram of the overall processing flow of a multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network described in an embodiment of the present invention;

[0029] Figure 2 Schematic diagram of the structure of the anomaly detection model based on the dual-stream parallel network described in an embodiment of the present invention;

[0030] Figure 3 This is a flow chart of a multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network described in an embodiment of the present invention. DETAILED DESCRIPTION

[0031] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0032] It should be noted that the terms used herein are for describing specific embodiments only and are not intended to be limiting of exemplary embodiments according to the present invention.

[0033] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0034] In one or more embodiments, Figure 1 As shown, an embodiment of the present invention provides a multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network, including:

[0035] A cloud deep learning training module deployed in the cloud, which is used to train anomaly detection models based on a dual-stream parallel network, receive requests for anomaly detection models from edge gateways, and configure anomaly detection models based on recognition results of IoT devices connected to the edge gateways;

[0036] as well as,

[0037] The edge gateway anomaly detection module deployed on the edge gateway is used to obtain network traffic data of the IoT device connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a network traffic feature set to be detected; the network traffic feature set is converted into a grayscale image representation and a semantic feature matrix representation respectively; based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained through an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device configured by the edge gateway;

[0038] Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

[0039] In a specific implementation, the network traffic feature set is converted into a grayscale image representation, specifically: each data packet in the network traffic set to be detected is converted into a feature vector of a preset length; each byte in the feature vector is used as a pixel point in the grayscale image, and the size of each byte is used as the pixel value of the pixel point; based on the pixel point representation of the byte, the network traffic feature set is converted into a grayscale image representation.

[0040] In a specific implementation, the network traffic feature set is converted into a semantic feature matrix representation, specifically: for the feature vector obtained by converting each data packet, each byte in the feature vector is vectorized to obtain a feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

[0041] In a specific implementation, the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit, and a network anomaly detection unit, wherein the network anomaly detection unit adopts an anomaly detection model based on a dual-stream parallel network trained in a cloud deep learning training module.

[0042] In a specific implementation, the training of the anomaly detection model based on the dual-stream parallel network is specifically as follows: obtaining historical network traffic data and its corresponding anomaly detection results, and constructing a training data set; training the dual-stream parallel network based on the constructed training data set to obtain a trained anomaly detection model.

[0043] In a specific implementation, in the solution described in this embodiment, the edge gateway anomaly detection module is deployed on the edge gateway, the edge gateway collects network traffic from IoT devices, and uses an anomaly detection model based on a dual-stream parallel network to identify malicious traffic; wherein, the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit, and a network anomaly detection unit, and each unit is described in detail below:

[0044] The multi-edge collaborative task offloading unit mainly performs the following processing procedures: obtaining the hardware resource usage of different edge gateways in real time, and based on the hardware resource usage of the edge gateways, offloading the anomaly detection tasks of the edge gateways whose hardware resource usage is greater than a preset threshold to other edge gateways with sufficient hardware resources for execution; among them, when the hardware resource usage of each edge gateway is greater than the preset threshold, the anomaly detection task is offloaded to the cloud for execution.

[0045] Specifically, this unit is used to decide whether to offload tasks to the cloud for execution according to the hardware resource situation of the gateway. As the number of IoT devices connected to the gateway increases, the burden of data processing for a single gateway is also increasing. Therefore, this module first performs a quantitative evaluation to judge the current gateway resource situation according to the gateway hardware situation, and determines whether to offload tasks to other edge gateways for execution or accept tasks from other gateways according to the current gateway resource situation. This unit uses Linux commands such as psaux or top to obtain CPU parameters and RAM memory parameters. After that, the current edge gateway CPU usage is defined as u, with a value range of 0≤u<u0, where u0 represents the upper limit of CPU usage to prevent overload; the current edge gateway RAM memory usage is defined as r, with a value range of 0≤r<r0, where r0 represents the upper limit of RAM memory usage to prevent overload. In addition, let u1 and r1 be the expected CPU usage and RAM memory usage of the current task, respectively. When the edge gateway simultaneously satisfies the conditions that the remaining CPU usage u0-u is greater than the expected CPU usage u1 of the current task, and the remaining RAM memory usage r0-r is greater than the expected RAM memory usage r1 of the current task, it is considered that the CPU and RAM memory of the edge gateway are sufficient to meet the task offloading conditions. At this time, the task can be offloaded to the edge gateway for execution. Otherwise, the task needs to be offloaded to other edge gateways for execution.

[0046] A traffic capture unit, used to capture network traffic connected to the edge gateway. In a specific implementation, the unit relies on a third-party external traffic capture tool to sniff and analyze network data packets. In this embodiment, the third-party traffic capture tool can be a Scapy tool;

[0047] The data preprocessing unit is used to process network traffic data and realize network traffic feature extraction and vectorization. This module cleans the network data packets captured by the traffic capture unit, including deleting illegal values ​​and filling missing values. By converting the data packets into fixed-length feature vectors, each byte is regarded as a feature of a network data packet, that is, x i ={f1,…,f k ,…,f K}, x i represents the feature set extracted from the i-th data in the dataset composed of all network packets, f k represents one of the data packet byte features, and k represents the number of features. Finally, after extracting features from all network data packets, we get the data set X = {x1,…,x i ,…,x L};

[0048] The network anomaly detection unit is used to detect whether the network traffic is abnormal traffic. By inputting the data to be detected into the anomaly detection model based on the dual-stream parallel network, the abnormal traffic detection result is given.

[0049] It should be noted here that the anomaly detection model based on the dual-stream parallel network is trained in the cloud based on abnormal traffic big data and directly deployed on the edge gateway, so the detection results can be directly given through the network anomaly detection unit. The training process of the anomaly detection model based on the dual-stream parallel network in the cloud will be described in detail below.

[0050] In the specific implementation, the cloud deep learning training module is deployed in the cloud, which is used to train the anomaly detection model based on the dual-stream parallel network and send it to each edge gateway. The edge gateway collects and processes the network traffic within the area, and the anomaly detection model based on the dual-stream parallel network deployed on it performs the anomaly detection task; wherein, the cloud deep learning training module includes a data management unit, a training unit based on the dual-stream parallel network anomaly detection model, and a training model request deployment unit. The following is a detailed description of each unit:

[0051] The data management unit is used to collect the data packet feature set from the edge gateway anomaly detection system and construct an abnormal traffic data set X = {x1,…,x i ,…,x L}. Afterwards, the dataset was subsequently used to train a two-stream parallel network anomaly detection model;

[0052] A training unit based on a two-stream parallel network anomaly detection model, where Figure 2 As shown, the network anomaly detection model includes: a single-stream visual information input layer, a single-stream visual information processing layer, a single-stream semantic information input layer, a single-stream semantic information processing layer, a fully connected layer and a Sigmoid function; wherein:

[0053] The single-stream visual information input layer is used to convert a piece of data x i ={f1,…,f k ,…,f K} as the input of this layer model. Since each feature f k It is represented by a byte ranging from 0 to 255, which is consistent with the image pixel range. Each feature f k It is visualized as a pixel in a grayscale image with a pixel value range of 0-255, and the data length is fixed by truncation or zero padding. i It can be converted into a grayscale image represented by a two-dimensional matrix GRAY = {Gray1,…,Gray p ,…,Gray P}, where the grayscale image is composed of P*Q pixels, Gray p Represents a row of pixels set Gray p ={gray1,…,gray q ,…,gray Q};

[0054] For example, a piece of data corresponds to a total of K features f, each feature is converted into a pixel point, a total of K pixel values. For example, here k = 1225 pixels. Then, relying on operations such as truncation or zero filling, a grayscale image of size 35*35=1225 is formed.

[0055] The single-stream visual information processing layer uses a set of R convolution filters to extract local visual features from the grayscale image. The convolution operation is: s(p,q)=(GRAY*W)(p,q)=∑ m ∑ n gray(p+m,q+n)w(m,n), where W represents the weight matrix, m and n represent the window size of a convolution filter, w(m,n) represents the weight value of the mth row and nth column in the weight matrix, and s is the output result of the convolution filter operation. After running the convolution filter R times, a new feature set GRAY={Gray1,…,Gray r ,…,Gray R};

[0056] The single-stream semantic information input layer is used to embed each input data x={f1,…,f k ,…,f K} is transformed into a two-dimensional matrix, each feature f K The vector is a eigenvector Sem k , and form a new semantic feature matrix SEM = {Sem1,…,Sem k ,…,Sem K}, where Sem k Represents a row of feature vectors Sem k ={sem1,…,sem a ,…,sem A};

[0057] Single-stream semantic information processing layer, which is used to extract semantic features h using a recurrent neural network k =f(USem k +Wh k-1 +b), where U represents the network input weight matrix, W represents the network cycle weight matrix, Sem k represents the semantic feature vector, h k-1represents the previous hidden state of the network, b is the offset of the network, and f is the activation function of the network. By transferring the hidden state at different time steps, the recurrent neural network can capture the long-term dependencies of the semantic sequence, thereby improving the performance of abnormal traffic detection. Finally, a new feature set SEM = {Sem1,…,Sem t ,…,Sem T};

[0058] The fully connected layer converts the single-stream visual information processing layer output to GRAY={Gray1,…,Gray r ,…,Gray R} and the single-stream semantic information processing layer output SEM={Sem1,…,Sem t ,…,Sem T} are merged together to form a new feature set FEA, which is input to the fully connected layer. The feature merging process can be expressed as: FEA = {GRAY, SEM} = {Gray1,…,Gray r ,…,Gray R ,Sem1,…,Sem t ,…,Sem T}, where the number of features in the merged feature set is R+T. The fully connected layer outputs H FCN =W FCN FEA+b FCN , where W FCN is the weight matrix of neurons in the fully connected layer, b FCN is the offset of neurons in the fully connected layer.

[0059] Furthermore, the Sigmoid function is used as a classifier to output the binary classification result y = sigmoid (H FCN ) as abnormal traffic detection results, one category represents abnormal traffic and the other represents normal traffic.

[0060] In a specific implementation, the output y={1, 0} usually indicates abnormal traffic, and y={0, 1} indicates normal traffic.

[0061] The anomaly detection model based on the dual-stream parallel network in this embodiment uses traffic space and semantic information to effectively model feature vector weights, improve the ability to represent abnormal traffic features, and enhance anomaly detection performance.

[0062] The training model request deployment unit trains the anomaly detection model based on the dual-stream parallel network in the cloud, deploys the model on the edge gateway, and implements abnormal traffic detection on the edge gateway.

[0063] In one or more embodiments, corresponding to the above system, such as Figure 3As shown, this embodiment provides a multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network, which is based on the above-mentioned multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network, including:

[0064] Obtain network traffic data of IoT devices connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a set of network traffic features to be detected;

[0065] Converting the network traffic feature set into a grayscale image representation and a semantic feature matrix representation respectively;

[0066] Based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained by configuring an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device on the edge gateway;

[0067] Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

[0068] In further embodiments, there is also provided:

[0069] An electronic device includes a memory and a processor and computer instructions stored in the memory and executed on the processor, wherein the computer instructions, when executed by the processor, perform the method described in the above embodiment. For the sake of brevity, no further description is given here.

[0070] It should be understood that in this embodiment, the processor may be a central processing unit CPU, and the processor may also be other general-purpose processors, digital signal processors DSP, application-specific integrated circuits ASIC, off-the-shelf programmable gate arrays FPGA or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0071] The memory may include a read-only memory and a random access memory, and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0072] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the method described in the above embodiment is completed.

[0073] The method in the above embodiment can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0074] Those skilled in the art will appreciate that the units, i.e., algorithm steps, of the various examples described in the present embodiment can be implemented in electronic hardware or in a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this disclosure.

[0075] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network, characterized in that: include: A cloud deep learning training module deployed in the cloud, which is used to train anomaly detection models based on a dual-stream parallel network, receive requests for anomaly detection models from edge gateways, and configure anomaly detection models based on recognition results of IoT devices connected to the edge gateways; as well as, The edge gateway anomaly detection module deployed on the edge gateway is used to obtain network traffic data of IoT devices connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a network traffic feature set to be detected; and convert the network traffic feature set into a grayscale image representation and a semantic feature matrix representation respectively; Based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained by configuring an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device on the edge gateway; Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

2. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 1 is characterized in that: Converting the network traffic feature set into a grayscale image representation, specifically: converting each data packet in the network traffic set to be detected into a feature vector of a preset length; Each byte in the feature vector is regarded as a pixel in the grayscale image, and the size of each byte is regarded as the pixel value of the pixel; Based on the pixel representation of bytes, the network traffic feature set is converted into a grayscale image representation.

3. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 1 is characterized in that: The network traffic feature set is converted into a semantic feature matrix representation, specifically: for the feature vector obtained by converting each data packet, each byte in the feature vector is vectorized to obtain a feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

4. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 1, characterized in that: The edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit and a network anomaly detection unit, wherein the network anomaly detection unit adopts an anomaly detection model based on a dual-stream parallel network trained in a cloud deep learning training module.

5. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 4 is characterized in that: The multi-edge collaborative task offloading unit specifically performs the following processing process: obtaining the hardware resource usage of different edge gateways in real time, and based on the hardware resource usage of the edge gateways, offloading the anomaly detection task of the edge gateway whose hardware resource usage is greater than a preset threshold to other edge gateways with sufficient hardware resources for execution; wherein, when the hardware resource usage of each edge gateway is greater than the preset threshold, the anomaly detection task is offloaded to the cloud for execution.

6. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 1, characterized in that: The training of the anomaly detection model based on the dual-stream parallel network is specifically as follows: obtaining historical network traffic data and its corresponding anomaly detection results, and constructing a training data set; training the dual-stream parallel network based on the constructed training data set to obtain a trained anomaly detection model.

7. The multi-edge collaborative anomaly detection system based on dual-stream parallel neural network according to claim 1, characterized in that: The classifier adopts Sigmoid function.

8. A multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network, characterized in that: The system is based on a multi-edge collaborative anomaly detection system based on a dual-stream parallel neural network as described in any one of claims 1 to 7, comprising: Obtain network traffic data of IoT devices connected to the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a set of network traffic features to be detected; Converting the network traffic feature set into a grayscale image representation and a semantic feature matrix representation respectively; Based on the grayscale image representation and the semantic feature matrix representation, a network traffic anomaly detection result is obtained by configuring an anomaly detection model based on a dual-stream parallel network corresponding to the current IoT device on the edge gateway; Among them, the dual-stream parallel neural network specifically performs the following processing process: for the input grayscale image representation, the visual features of the network traffic to be tested are obtained through a pre-constructed convolution filter group; for the input semantic feature matrix representation, the semantic features of the network traffic to be tested are obtained by adopting a recurrent neural network; the visual features and semantic features are merged through a fully connected layer, and based on the merged features, the abnormal detection results of the network traffic are obtained through a preset classifier.

9. An electronic device comprising a memory, a processor and a computer program stored and running on the memory, characterized in that: When the processor executes the program, the multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network as described in claim 8 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the multi-edge collaborative anomaly detection method based on a dual-stream parallel neural network as described in claim 8 is implemented.

Images