Multi-edge cooperative anomaly detection system and method based on double-flow parallel neural network

Abstract

The application provides a multi-edge cooperative anomaly detection system and method based on a double-flow parallel neural network, which adopts a multi-edge cooperative task offloading method, can effectively improve the Internet of Things network anomaly detection efficiency, improves the single-edge gateway when facing a large number of task processing requests, and improves the overall edge system utilization; at the same time, by adopting an anomaly detection model based on a double-flow parallel network, the deep meaning and context relationship of the traffic are extracted, the traffic data structure and feature visual form can be effectively paid attention to, the data anomaly mode is intuitively described, and then the characteristics of the abnormal traffic can be more comprehensively extracted and analyzed, and accurate detection is realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network abnormal flow analysis, and particularly relates to a multi-edge cooperative anomaly detection system and method based on a double-flow parallel neural network. BACKGROUND

[0002] The abnormal flow of a network usually refers to the abnormality of the size, distribution, link state and the like of network data packets. In order to cope with this growing threat, many Internet of Things security providers adopt a cloud-based centralized abnormal flow detection system, which can effectively discover network anomalies, but this may result in multiple communications between the cloud and the device, and is heavily dependent on a good network communication environment. At the same time, considering that a real-world network usually has risks such as delay and packet loss, the network anomaly detection time is increased, and the effectiveness of the detection system is reduced. With the development of edge computing, more and more tasks are constantly sinking from the cloud to the network edge, reducing the pressure of the cloud to process a large amount of data. Edge computing, being closer to the network edge, can provide lower latency than cloud computing, thereby effectively reducing the latency of data transmission, improving the response speed of network anomaly detection, and reducing the dependence on the central server.

[0003] The inventor found that the intrusion detection based on the edge gateway usually needs to process a large number of network intrusion detection task requests, but due to the complexity of network intrusion detection, the large number of task request devices and the like, a single edge gateway is difficult to cope with a large number of complex and intensive task requests. Secondly, the existing network anomaly detection method based on artificial intelligence technology usually directly inputs flow features into a neural network and relies on the prediction result to discover network attacks. Although these methods often use larger and more complex neural networks to extract abnormal flow features, the existing scheme does not deeply mine the multi-dimensional potential information of abnormal flow, resulting in insufficient representation ability of the proposed flow features, and further making the accuracy of the network anomaly detection method poor. SUMMARY

[0004] The embodiment of the application provides a multi-edge cooperative anomaly detection system and method based on a double-flow parallel neural network, to solve the problems that the traditional scheme is difficult to cope with a large number of complex and intensive task requests, and deeply mines the multi-dimensional potential information of abnormal flow, resulting in insufficient representation ability of the proposed flow features, and further making the accuracy of the network anomaly detection method poor.

[0005] According to a first aspect of the embodiment of the application, a multi-edge cooperative anomaly detection system based on a double-flow parallel neural network is provided, comprising:

[0006] a cloud deep learning training module deployed in the cloud, configured to train a dual-stream parallel network-based anomaly detection model, and configured to receive a request for the anomaly detection model from an edge gateway, and configure the anomaly detection model based on an identification result of an Internet of Things (IoT) device connected to the edge gateway;

[0007] and,

[0008] an edge gateway anomaly detection module deployed in the edge gateway, configured to obtain network traffic data of the IoT device connected to the edge gateway, extract features from the obtained network traffic data to obtain a network traffic feature set to be detected, convert the network traffic feature set into a gray image representation and a semantic feature matrix representation respectively, and obtain a network traffic anomaly detection result based on the gray image representation and the semantic feature matrix representation by using a dual-stream parallel network-based anomaly detection model configured in the edge gateway for the current IoT device.

[0009] The dual-stream parallel neural network specifically performs the following processing process: for the input gray image representation, a convolution filter group is used to obtain visual features of the network traffic to be detected; for the input semantic feature matrix representation, a recurrent neural network is used to obtain semantic features of the network traffic to be detected; the visual features and the semantic features are combined by a fully connected layer, and based on the combined features, a preset classifier is used to obtain the network traffic anomaly detection result.

[0010] Further, the network traffic feature set is converted into a gray image representation, specifically: each data packet in the network traffic set to be detected is converted into a feature vector of a preset length; each byte in the feature vector is taken as a pixel point in the gray image, and the size of each byte is taken as the pixel value of the pixel point; based on the pixel point representation of the byte, the network traffic feature set is converted into a gray image representation.

[0011] Further, the network traffic feature set is converted into a semantic feature matrix representation, specifically: for the feature vector obtained by converting each data packet, each byte in the feature vector is vectorized to obtain a feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

[0012] Further, the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capturing unit, a data preprocessing unit, and a network anomaly detection unit, wherein the network anomaly detection unit uses the dual-stream parallel network-based anomaly detection model trained in the cloud deep learning training module.

[0013] Further, the multi-edge cooperative task offloading unit specifically performs the following processing process: real-time acquisition of hardware resource usage of different edge gateways, based on the hardware resource usage of the edge gateway, offloading the anomaly detection task of the edge gateway whose hardware resource usage is greater than the preset threshold to other edge gateways with sufficient hardware resources for execution; wherein when the hardware resource usage of each edge gateway is greater than the preset threshold, the anomaly detection task is offloaded to the cloud for execution.

[0014] Further, the training of the anomaly detection model based on the double-flow parallel network specifically comprises: acquiring historical network traffic data and corresponding anomaly detection results, and constructing a training data set; based on the constructed training data set, training of the double-flow parallel network is performed to obtain a trained anomaly detection model.

[0015] Further, the classifier uses a Sigmoid function.

[0016] According to a second aspect of the embodiment of the present application, a multi-edge cooperative anomaly detection method based on a double-flow parallel neural network is provided, which is based on the above-mentioned multi-edge cooperative anomaly detection system based on a double-flow parallel neural network, comprising:

[0017] Acquiring network traffic data of Internet of Things devices accessing the edge gateway, performing feature extraction on the obtained network traffic data to obtain a network traffic feature set to be detected;

[0018] Converting the network traffic feature set into a gray image representation and a semantic feature matrix representation, respectively;

[0019] Based on the gray image representation and the semantic feature matrix representation, obtaining a network traffic anomaly detection result through an anomaly detection model based on a double-flow parallel network configured by the edge gateway corresponding to the current Internet of Things device;

[0020] Wherein, the double-flow parallel neural network specifically performs the following processing process: for the input gray image representation, a convolution filter group is pre-constructed to obtain the visual features of the network traffic to be detected; for the input semantic feature matrix representation, a recurrent neural network is used to obtain the semantic features of the network traffic to be detected; the visual features and the semantic features are merged through a full connection layer, and based on the merged features, a preset classifier is used to obtain the anomaly detection result of the network traffic.

[0021] According to a third aspect of the embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored on the memory and running on the memory, wherein the processor implements the multi-edge cooperative anomaly detection method based on a double-flow parallel neural network when executing the program.

[0022] According to a fourth aspect of the embodiments of the present application, a non-transitory computer-readable storage medium is provided, and the computer program is stored on the medium and is executed by a processor to implement the method for multi-edge collaborative anomaly detection based on a double-flow parallel neural network.

[0023] The above one or more technical solutions have the following beneficial effects:

[0024] The present application provides a multi-edge collaborative anomaly detection system and method based on a double-flow parallel neural network, which can provide lower network latency by sinking the network anomaly detection task to the edge gateway.

[0025] The present application provides a multi-edge collaborative anomaly detection system and method based on a double-flow parallel neural network, which can provide lower network latency by sinking the network anomaly detection task to the edge gateway.

[0026] The advantages of the additional aspects of the present application will be partially given in the following description, partially become obvious from the following description, or be known by the practice of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0027] The accompanying drawings, which form a part of the specification, are included to provide a further understanding of the application and are incorporated herein by reference. The illustrations are shown for the purpose of explaining the present application and are not intended to limit the present application.

[0028] Figure 1 The accompanying drawings, which form a part of the specification, are included to provide a further understanding of the application and are incorporated herein by reference. The illustrations are shown for the purpose of explaining the present application and are not intended to limit the present application.

[0029] Figure 2 The accompanying drawings, which form a part of the specification, are included to provide a further understanding of the application and are incorporated herein by reference. The illustrations are shown for the purpose of explaining the present application and are not intended to limit the present application.

[0030] Figure 3 The accompanying drawings, which form a part of the specification, are included to provide a further understanding of the application and are incorporated herein by reference. The illustrations are shown for the purpose of explaining the present application and are not intended to limit the present application. DETAILED DESCRIPTION

[0031] It should be noted that the following detailed description is exemplary in nature and is intended to provide further description of the application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

[0032] It should be noted that the terms used herein are only intended to describe specific embodiments and are not intended to limit the exemplary embodiments according to the present application.

[0033] In the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0034] In one or more embodiments, as Figure 1 shown, the embodiment of the present application provides a multi-edge cooperative anomaly detection system based on a dual-flow parallel neural network, comprising:

[0035] a cloud deep learning training module deployed in the cloud, configured to train an anomaly detection model based on a dual-flow parallel network, and receive a request for the anomaly detection model from an edge gateway, and configure the anomaly detection model based on the identification result of the Internet of Things device accessing the edge gateway;

[0036] and,

[0037] an edge gateway anomaly detection module deployed in the edge gateway, configured to obtain network traffic data of the Internet of Things device accessing the edge gateway, perform feature extraction on the obtained network traffic data to obtain a network traffic feature set to be detected; convert the network traffic feature set into a gray image representation and a semantic feature matrix representation respectively; based on the gray image representation and the semantic feature matrix representation, obtain a network traffic anomaly detection result through the anomaly detection model based on the dual-flow parallel network corresponding to the current Internet of Things device configured by the edge gateway;

[0038] Wherein, the dual-flow parallel neural network specifically performs the following processing process: for the input gray image representation, through a pre-constructed convolution filter set, the visual features of the network traffic to be tested are obtained; for the input semantic feature matrix representation, through the use of a recurrent neural network, the semantic features of the network traffic to be tested are obtained; through a full connection layer, the visual features and the semantic features are merged, and based on the merged features, through a pre-set classifier, the anomaly detection result of the network traffic is obtained.

[0039] In a specific implementation, the network traffic feature set is converted into a gray image representation, specifically: each data packet in the network traffic set to be detected is converted into a feature vector of a predetermined length; each byte in the feature vector is taken as a pixel point in the gray image, and the size of each byte is taken as the pixel value of the pixel point; based on the pixel point representation of the byte, the network traffic feature set is converted into a gray image representation.

[0040] In specific implementation, the network traffic feature set is converted into a semantic feature matrix representation, specifically: for each data packet converted feature vector, each byte in the feature vector is vectorized to obtain a feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

[0041] In specific implementation, the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit, and a network anomaly detection unit, wherein the network anomaly detection unit adopts an anomaly detection model based on a double-flow parallel network trained in a cloud deep learning training module.

[0042] In specific implementation, the training of the anomaly detection model based on the double-flow parallel network is specifically: obtaining historical network traffic data and its corresponding anomaly detection results, and constructing a training data set; training the double-flow parallel network based on the constructed training data set to obtain a trained anomaly detection model.

[0043] In specific implementation, in the scheme of the present embodiment, the edge gateway anomaly detection module is deployed on the edge gateway, the edge gateway collects network traffic from Internet of Things devices, and uses the anomaly detection model based on the double-flow parallel network to identify malicious traffic; wherein the edge gateway anomaly detection module includes a multi-edge collaborative task offloading unit, a traffic capture unit, a data preprocessing unit, and a network anomaly detection unit, which are described in detail as follows:

[0044] The multi-edge collaborative task offloading unit mainly performs the following processing process: real-time acquisition of hardware resource usage of different edge gateways, based on the hardware resource usage of the edge gateway, offloading the anomaly detection task of the edge gateway whose hardware resource usage rate is greater than a preset threshold to other edge gateways with sufficient hardware resources for execution; wherein when the hardware resource usage rate of each edge gateway is greater than the preset threshold, the anomaly detection task is offloaded to the cloud for execution.

[0045] Specifically, this unit determines whether to offload tasks to the cloud based on the gateway's hardware resources. As the number of IoT devices connected to the gateway increases, the data processing burden on a single gateway also increases. Therefore, this module first performs a quantitative assessment to determine the current gateway resource status based on the gateway's hardware, and then determines whether to offload the task to another edge gateway or accept tasks from other gateways. This unit uses Linux commands such as psaux or top to obtain CPU and RAM parameters. The current edge gateway CPU utilization is defined as u, with a range of 0 ≤ u < u0, where u0 represents the upper limit of CPU utilization to prevent overload; the current edge gateway RAM utilization is defined as r, with a range of 0 ≤ r < r0, where r0 represents the upper limit of RAM utilization to prevent overload. Furthermore, u1 and r1 are set as the expected CPU utilization and RAM utilization of the current task, respectively. When an edge gateway simultaneously satisfies that its remaining CPU utilization u0-u is greater than the expected CPU utilization u1 of the current task, and its remaining RAM utilization r0-r is greater than the expected RAM utilization r1 of the current task, it is considered that the edge gateway's CPU and RAM are sufficient to meet the task offloading conditions. In this case, the task can be offloaded to this edge gateway for execution. Otherwise, the task needs to be offloaded to other edge gateways for execution.

[0046] The traffic capture unit is used to capture network traffic connected to the edge gateway. In specific implementations, this unit relies on a third-party external traffic capture tool to sniff and analyze network data packets. In this embodiment, the third-party traffic capture tool can be the Scapy tool.

[0047] The data preprocessing unit processes network traffic data and extracts and vectorizes network traffic features. This module cleanses the network packets captured by the traffic capture unit, including removing invalid values ​​and filling in missing values. This is done by converting the data packets into fixed-length feature vectors. Each byte is treated as a feature of the network packet, i.e., x. i ={f1,…,f k ,…,f K}, x i f represents the feature set extracted from the i-th data point in the dataset composed of all network packets. k Let k represent the byte feature of one data packet, and k represent the number of features. Finally, after feature extraction from all network data packets, we obtain the dataset X = {x1, ..., x...}. i ,…,x L};

[0048] The network anomaly detection unit is used to detect whether network traffic is abnormal. It outputs anomaly detection results by inputting the data to be detected into an anomaly detection model based on a two-stream parallel network.

[0049] It should be noted that the anomaly detection model based on the dual-stream parallel network is trained on large amounts of abnormal traffic data in the cloud and deployed directly on the edge gateway. Therefore, the detection results can be directly provided by the network anomaly detection unit. The training process of the anomaly detection model based on the dual-stream parallel network in the cloud will be explained in detail below.

[0050] In practical implementation, the cloud deep learning training module is deployed in the cloud and is used to train an anomaly detection model based on a dual-stream parallel network, which is then distributed to each edge gateway. The edge gateway collects and processes network traffic within its area, and the anomaly detection model based on a dual-stream parallel network deployed on it performs anomaly detection tasks. The cloud deep learning training module includes a data management unit, a training unit for the anomaly detection model based on a dual-stream parallel network, and a training model request and deployment unit. The following is a detailed description of each unit:

[0051] The data management unit is used to collect the feature set of data packets from the edge gateway anomaly detection system and construct an abnormal traffic dataset X = {x1,…,x}. i ,…,x L This dataset was subsequently used to train a two-stream parallel network anomaly detection model.

[0052] Training units based on a two-stream parallel network anomaly detection model, wherein, for example Figure 2 As shown, the network anomaly detection model includes: a single-stream visual information input layer, a single-stream visual information processing layer, a single-stream semantic information input layer, a single-stream semantic information processing layer, a fully connected layer, and a sigmoid function; wherein:

[0053] A single-stream visual information input layer is used to input a single data x. i ={f1,…,f k ,…,f K} is used as the input to this layer's model. Since each feature f k It is represented by bytes ranging from 0 to 255, which corresponds to the pixel range of an image. Each feature f can be represented by... k The data is visualized as a single pixel in a grayscale image with a pixel value range of 0-255, and the data length is fixed by methods such as data truncation or padding with zeros. Then, the data x... i It can be converted into a grayscale image represented by a two-dimensional matrix: GRAY = {Gray1, ..., Gray} p ,…,Gray P}, where the grayscale image consists of P*Q pixels, Gray p Represents a set of pixels in a row, Gray p ={gray1,…,gray q ,…,gray Q};

[0054] For example, a data point corresponds to K features f, each feature is converted into a pixel, resulting in a total of K pixel values. For example, here k = 1225 pixels. Then, depending on operations such as truncation or zero-padding, a grayscale image of size 35*35 = 1225 is formed.

[0055] The single-stream visual information processing layer uses a set of R convolutional filters to extract local visual features from the grayscale image. The convolution operation is as follows: s(p,q)=(GRAY*W)(p,q)=∑ m ∑ n gray(p+m,q+n)w(m,n), where W represents the weight matrix, m and n represent the window size of a convolutional filter, w(m,n) represents the weight value in the m-th row and n-th column of the weight matrix, and s is the output of the convolutional filter operation. After running the convolutional filter R times, a new feature set GRAY={Gray1,…,Gray r ,…,Gray R};

[0056] A single-stream semantic information input layer is used to embed each input data x = {f1,…,f...} using the Word2vec tool with word embedding methods. k ,…,f K} Transform into a two-dimensional matrix form, each feature f K The vector is an eigenvector Sem k And form a new semantic feature matrix SEM = {Sem1, ..., Sem} k ,…,Sem K}, where Sem k Sem represents a row of feature vectors k ={sem1,…,sem a ,…,sem A};

[0057] A single-stream semantic information processing layer is used to extract semantic features h using a recurrent neural network. k =f(USem) k +Wh k-1 +b), where U represents the input weight matrix of the network, W represents the cyclic weight matrix of the network, and Sem k h represents the semantic feature vector. k-1Let represent the previous hidden state of the network, b be the network offset, and f be the network activation function. By propagating the hidden state at different time steps, recurrent neural networks can capture long-term dependencies in semantic sequences, thereby improving the performance of abnormal traffic detection. Finally, a new feature set SEM = {Sem1, ..., Sem...} can be obtained. t ,…,Sem T};

[0058] The fully connected layer outputs the single-stream visual information processing layer GRAY = {Gray1, ...,Gray...} r ,…,Gray R The output SEM of the single-stream semantic information processing layer is {Sem1,…,Sem}. t ,…,Sem T The features are merged together to form a new feature set FEA, which is then input into the fully connected layer. This feature merging process can be represented as: FEA = {GRAY, SEM} = {Gray1, ..., Gray1} r ,…,Gray R ,Sem1,…,Sem t ,…,Sem T}, where the number of features in the merged feature set is R+T. The fully connected layer outputs H. FCN =W FCN FEA+b FCN Among them, W FCN It is the weight matrix of the neurons in the fully connected layer, b FCN It is the offset of the neurons in the fully connected layer.

[0059] Furthermore, using the sigmoid function as a classifier, the output is a binary classification result y = sigmoid(H FCN As abnormal traffic detection results, one type represents abnormal traffic, and the other type represents normal traffic.

[0060] In practice, the output y = {1, 0} usually indicates abnormal traffic, and y = {0, 1} indicates normal traffic.

[0061] The anomaly detection model based on a dual-stream parallel network in this embodiment utilizes traffic space and semantic information to effectively model the feature vector weights, thereby improving the ability to represent abnormal traffic features and enhancing anomaly detection performance.

[0062] The training model request deployment unit trains an anomaly detection model based on a dual-stream parallel network in the cloud, then deploys the model on the edge gateway and implements anomaly traffic detection on the edge gateway.

[0063] In one or more embodiments, corresponding to the above system, such as Figure 3As shown, the embodiment provides a multi-edge collaborative anomaly detection method based on a double-flow parallel neural network, which is based on the multi-edge collaborative anomaly detection system based on the double-flow parallel neural network described above, and includes the following steps:

[0064] Obtain network traffic data of Internet of Things devices accessing the edge gateway, perform feature extraction on the obtained network traffic data, and obtain a network traffic feature set to be detected;

[0065] Convert the network traffic feature set into a gray image representation and a semantic feature matrix representation, respectively;

[0066] Based on the gray image representation and the semantic feature matrix representation, obtain a network traffic anomaly detection result by using an anomaly detection model based on a double-flow parallel network corresponding to the current Internet of Things device configured by the edge gateway;

[0067] The double-flow parallel neural network specifically performs the following processing process: for the input gray image representation, a convolution filter group is used to obtain visual features of the network traffic to be detected; for the input semantic feature matrix representation, a recurrent neural network is used to obtain semantic features of the network traffic to be detected; the visual features and the semantic features are merged through a full connection layer, and based on the merged features, a preset classifier is used to obtain an anomaly detection result of the network traffic.

[0068] In more embodiments, the following are also provided:

[0069] An electronic device includes a memory and a processor, and computer instructions stored in the memory and running on the processor, when the computer instructions are run by the processor, the method described in the above embodiments is completed. For brevity, this will not be repeated here.

[0070] It should be understood that in the embodiment, the processor can be a central processing unit CPU, and the processor can also be other general-purpose processors, digital signal processors DSPs, application-specific integrated circuits ASICs, ready-to-program gate arrays FPGAs, or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0071] The memory can include read-only memory and random access memory, and provide instructions and data to the processor, and a part of the memory can also include non-volatile random access memory. For example, the memory can also store device type information.

[0072] A computer readable storage medium for storing computer instructions, when the computer instructions are executed by a processor, the method described in the above embodiments is completed.

[0073] The method in the above embodiments can be directly embodied as being completed by a hardware processor, or being completed by a combination of hardware and software modules in the processor. The software modules can be located in storage media in the art such as random access memory (RAM), flash memory, read-only memory (ROM), programmable read-only memory (PROM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), register, or the like. The storage media is located in the storage, and the processor reads information in the storage and combines the hardware to complete the steps of the above method. To avoid repetition, no further description is given here.

[0074] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments can be realized in electronic hardware or a combination of software and electronic hardware. Whether the functions are realized in hardware or software mode depends on the specific application and design constraints of the technical solution. A person skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present disclosure.

[0075] The above only describes the preferred embodiments of the present disclosure and is not intended to limit the present disclosure. Those skilled in the art can make various modifications and changes to the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A multi-edge collaborative anomaly detection system based on dual-stream parallel neural networks, characterized in that, The system comprises: a cloud deep learning training module deployed in the cloud, which is used for training of an anomaly detection model based on a dual-stream parallel network, and receiving a request for the anomaly detection model of an edge gateway and configuring the anomaly detection model based on identification results of Internet of Things devices accessing the edge gateway; and an edge gateway anomaly detection module deployed in the edge gateway, which is used for obtaining network traffic data of Internet of Things devices accessing the edge gateway, performing feature extraction on the obtained network traffic data to obtain a network traffic feature set to be detected, converting the network traffic feature set into a gray image representation and a semantic feature matrix representation respectively; obtaining a network traffic anomaly detection result based on the gray image representation and the semantic feature matrix representation through the anomaly detection model based on the dual-stream parallel network corresponding to the current Internet of Things device configured by the edge gateway; wherein the dual-stream parallel neural network specifically performs the following processing process: for the input gray image representation, a visual feature of the network traffic to be detected is obtained through a pre-constructed convolution filter set; for the input semantic feature matrix representation, a semantic feature of the network traffic to be detected is obtained through a recurrent neural network; the visual feature and the semantic feature are merged through a fully connected layer, and based on the merged features, an anomaly detection result of the network traffic is obtained through a preset classifier; The system adopts the proposed anomaly detection model based on the dual-stream parallel neural network, which converts the network traffic into a gray image and a semantic matrix form for feature extraction, effectively focuses on the structure and visual form of the traffic data while extracting the deep meaning and context relationship of the traffic, intuitively describes the data anomaly pattern, and further comprehensively extracts and analyzes the features of the abnormal traffic; The edge gateway anomaly detection module comprises a multi-edge collaborative task offloading unit, a traffic capturing unit, a data preprocessing unit, and a network anomaly detection unit, wherein the network anomaly detection unit adopts the anomaly detection model based on the dual-stream parallel network trained in the cloud deep learning training module; The multi-edge collaborative task offloading unit specifically performs the following processing process: the hardware resource usage of different edge gateways is obtained in real time, and based on the hardware resource usage of the edge gateway, the anomaly detection tasks of the edge gateway whose hardware resource usage rate is greater than a preset threshold are offloaded to other edge gateways with sufficient hardware resources for execution; wherein when the hardware resource usage rate of each edge gateway is greater than the preset threshold, the anomaly detection tasks are offloaded to the cloud for execution; The network traffic feature set is converted into a semantic feature matrix representation, specifically: for each feature vector converted from each data packet, each byte in the feature vector is vectorized to obtain a feature vector representation of each byte; based on the feature vector representation of each byte, the network traffic feature set is converted into a semantic feature matrix representation.

2. The dual-stream parallel neural network-based multi-edge collaborative anomaly detection system of claim 1, wherein, The network traffic feature set is converted into a gray image representation, specifically: each data packet in the network traffic set to be detected is converted into a feature vector of a preset length. Each byte in the eigenvector is taken as a pixel point in the gray image, and the size of each byte is taken as the pixel value of the pixel point; The network traffic feature set is converted into a gray image representation based on the pixel point representation of the byte.

3. The dual-stream parallel neural network based multi-edge collaborative anomaly detection system of claim 1, wherein, The training of the double-flow parallel network-based anomaly detection model includes: obtaining historical network traffic data and corresponding anomaly detection results, and constructing a training data set; training the double-flow parallel network based on the constructed training data set to obtain a trained anomaly detection model.

4. The dual-stream parallel neural network-based multi-edge collaborative anomaly detection system of claim 1, wherein, The classifier uses a Sigmoid function.

5. A multi-edge collaborative anomaly detection method based on a double-flow parallel neural network, characterized in that, The multi-edge collaborative anomaly detection system based on the double-flow parallel neural network according to any one of claims 1-4 comprises: Obtain the network traffic data of the Internet of Things device connected to the access edge gateway, extract features from the obtained network traffic data, and obtain a network traffic feature set to be detected; The network traffic feature set is converted into a gray image representation and a semantic feature matrix representation; Based on the gray image representation and the semantic feature matrix representation, the network traffic anomaly detection result is obtained through the double-flow parallel network-based anomaly detection model configured by the edge gateway for the current Internet of Things device. The double-flow parallel neural network specifically performs the following processing process: for the input gray image representation, a pre-constructed convolution filter set is used to obtain the visual features of the network traffic to be detected; for the input semantic feature matrix representation, a recurrent neural network is used to obtain the semantic features of the network traffic to be detected; the visual features and the semantic features are combined through a full connection layer, and based on the combined features, a preset classifier is used to obtain the network traffic anomaly detection result.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory to run on the processor, characterized in that, The processor executes the program to implement the multi-edge collaborative anomaly detection method based on the double-flow parallel neural network according to claim 5.

7. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the multi-edge collaborative anomaly detection method based on the double-flow parallel neural network according to claim 5.

Images