Abnormal flow detection methods, devices, computer equipment and readable media

Abstract

This application relates to an abnormal traffic detection method, apparatus, computer device, and readable medium. The method includes: preprocessing acquired request traffic data to obtain traffic data to be detected; performing feature fusion based on the traffic data to be detected using a pre-trained deep learning model to obtain a multimodal feature vector, wherein the pre-trained deep learning model is trained based on historical request traffic data; performing abnormal change point detection on the multimodal feature vector using an adaptive change point detection algorithm to obtain target change point feature values ​​corresponding to target abnormal change points; and performing abnormal traffic detection on the request traffic data based on the target change point feature values. This application combines multimodal features, a pre-trained deep learning model, and an adaptive change point detection algorithm for abnormal traffic detection of request traffic data, enabling rapid and accurate learning and identification under complex traffic patterns, thereby improving the detection efficiency and accuracy of abnormal traffic.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) information security technology, and in particular to an abnormal traffic detection method, device, computer equipment, and readable medium. Background Technology

[0002] With the widespread adoption of IoT devices, the MQTT (Message Queuing Telemetry Transport) protocol, as a lightweight message transmission protocol, is widely used in various IoT scenarios. However, with the increasing number of MQTT devices and their increased usage frequency, monitoring and detecting abnormal request traffic from these devices has become crucial. Abnormal traffic may indicate device failure, network attacks, or data breaches. Most existing MQTT request traffic anomaly detection systems are based on traditional time-series variable point detection methods. These methods often suffer from insufficient sensitivity and high false alarm rates when facing complex and changing network environments, resulting in low detection efficiency and accuracy. Therefore, with the rapid increase in the number of IoT devices and data traffic, there is an urgent need for a more efficient and accurate anomaly traffic detection method to detect abnormal traffic during transmission. Summary of the Invention

[0003] This application provides an abnormal traffic detection method, apparatus, computer equipment, and readable medium to solve the technical problem of low detection efficiency and accuracy in the above-mentioned existing technologies based on traditional time series change point detection methods when facing complex and ever-changing network environments.

[0004] According to one aspect of the embodiments of this application, this application provides an abnormal traffic detection method, the method comprising: preprocessing acquired request traffic data to obtain traffic data to be detected; performing feature fusion based on the traffic data to be detected using a pre-trained deep learning model to obtain a multimodal feature vector, wherein the pre-trained deep learning model is trained based on historical request traffic data; performing abnormal change point detection on the multimodal feature vector using an adaptive change point detection algorithm to obtain a target change point feature value corresponding to a target abnormal change point; and performing abnormal traffic detection on the request traffic data based on the target change point feature value.

[0005] Optionally, the step of preprocessing the acquired request traffic data to obtain traffic data to be detected includes: denoising the acquired request traffic data to obtain denoised traffic data; cleaning the denoised traffic data to obtain cleaned traffic data; and standardizing the cleaned traffic data to obtain the traffic data to be detected.

[0006] Optionally, the traffic data to be detected includes standardized time-series data, device status data, and context information. The step of fusing features based on the traffic data to be detected using a pre-trained deep learning model to obtain a multimodal feature vector includes: extracting features from the standardized time-series data, device status data, and context information respectively using the pre-trained deep learning model to obtain time-series feature data, device status feature data, and context feature data; concatenating the time-series feature data, device status feature data, and context feature data to obtain a joint feature vector; and fusing the joint feature vector using the pre-trained deep learning model to obtain the multimodal feature vector.

[0007] Optionally, the step of detecting abnormal changes in the multimodal feature vector using an adaptive change point detection algorithm to obtain the target change point feature value corresponding to the target abnormal change point includes: initializing parameters for multiple different adaptive change point detection algorithms; analyzing the changes in the statistical characteristics of the multimodal feature vector over time using each of the initialized adaptive change point detection algorithms to obtain abnormal changes detected by each of the adaptive change point detection algorithms; determining the target abnormal change point based on the abnormal changes detected by each of the adaptive change point detection algorithms; obtaining the change point feature value corresponding to the target abnormal change point and performing target change point feature value calculation to obtain the target change point feature value.

[0008] Optionally, the step of detecting abnormal traffic in the request traffic data based on the target change point feature value includes: comparing the target change point feature value with a preset change point feature threshold; if the target change point feature value exceeds the preset change point feature threshold, then determining that the request traffic data has abnormal traffic and triggering an early warning; if the target change point feature value does not exceed the preset change point feature threshold, then determining that the request traffic data does not have abnormal traffic.

[0009] Optionally, after performing abnormal traffic detection on the request traffic data based on the target change point feature value, the method further includes: acquiring historical traffic data and user feedback data, wherein the historical traffic data includes abnormal traffic data, normal traffic data, and warning prompt data; constructing new training samples based on the abnormal traffic data, the normal traffic data, the warning prompt data, and the user feedback data; and training and adjusting the parameters of the pre-trained deep learning model and the adaptive change point detection algorithm based on the new training samples.

[0010] Optionally, the request traffic data includes time-series data, device status data, and context information. Before preprocessing the acquired request traffic data, the method further includes: selecting a target client library according to detection requirements and establishing a communication connection between the target client library and the target proxy server; subscribing to a target topic through the target client library to obtain the time-series data in the request traffic data of the target proxy server; and obtaining the device status data and the context information through a monitoring tool.

[0011] According to another aspect of the embodiments of this application, this application provides an abnormal traffic detection device, the device comprising: a preprocessing module, configured to preprocess acquired request traffic data to obtain traffic data to be detected; a feature fusion module, configured to perform feature fusion based on the traffic data to be detected using a pre-trained deep learning model to obtain a multimodal feature vector, wherein the pre-trained deep learning model is trained based on historical request traffic data; a change point detection module, configured to perform abnormal change point detection on the multimodal feature vector using an adaptive change point detection algorithm to obtain a target change point feature value corresponding to a target abnormal change point; and an anomaly detection module, configured to perform abnormal traffic detection on the request traffic data based on the target change point feature value.

[0012] According to another aspect of the embodiments of this application, this application provides a computer device, including a memory, a processor, a communication interface and a communication bus. The memory stores a computer program that can run on the processor. The memory and the processor communicate through the communication bus and the communication interface. When the processor executes the computer program, it implements the steps of the abnormal traffic detection method.

[0013] According to another aspect of the embodiments of this application, this application provides a computer-readable medium having processor-executable non-volatile program code that causes the processor to perform the steps of the abnormal traffic detection method.

[0014] Compared with related technologies, the technical solutions provided in this application have the following advantages:

[0015] This application provides an abnormal traffic detection method. By preprocessing the acquired request traffic data, the integrity and consistency of the data can be ensured, facilitating feature extraction. A pre-trained deep learning model is used to fuse features of the traffic data to be detected, forming a multimodal feature vector for abnormal change point analysis. This multimodal feature analysis improves the comprehensiveness and accuracy of traffic anomaly detection. An adaptive change point detection algorithm is used to detect abnormal changes in the multimodal feature vector, obtaining the target change point feature value corresponding to the target abnormal change point. This method of detecting abnormal traffic based on the target change point feature value can dynamically adjust detection parameters according to the detection situation, reducing false positive and false negative rates, thereby improving the accuracy of abnormal traffic detection and making it more adaptable to changing network environments. Furthermore, combining multimodal features, a pre-trained deep learning model, and an adaptive change point detection algorithm for abnormal traffic detection of request traffic data enables rapid and accurate learning and identification under complex traffic patterns, thereby improving the efficiency and accuracy of abnormal traffic detection. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the hardware environment for an optional abnormal traffic detection method provided according to an embodiment of this application;

[0019] Figure 2 This is a schematic diagram of an optional abnormal traffic detection method provided according to an embodiment of this application;

[0020] Figure 3 This is a schematic diagram illustrating the specific process of step S204 according to an embodiment of this application;

[0021] Figure 4 This is a schematic diagram illustrating the specific process of step S206 provided in the embodiments of this application;

[0022] Figure 5 This is a schematic diagram of an optional abnormal flow detection device provided according to an embodiment of this application;

[0023] Figure 6 This is a schematic diagram of an optional computer device structure provided for an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0025] To address the problems mentioned in the background art, according to one aspect of the embodiments of this application, an embodiment of an abnormal traffic detection method is provided.

[0026] like Figure 1 As shown, the above-described abnormal flow detection method can be applied to, for example... Figure 1 The hardware environment shown is described. The system architecture 100 of the hardware environment includes a terminal device 101 and a server 103. The server 103 is connected to the terminal 101 via a network and can be used to provide services to the terminal or clients installed on the terminal. A database 105 can be set up on the server or independently of the server to provide data storage services to the server 103. The network can include various connection types, such as wired, wireless communication links, or fiber optic cables, etc.

[0027] Users can use terminal device 101 to interact with server 103 via a network to receive or send messages, etc. Various communication client applications can be installed on terminal device 101, such as web browser applications, search applications, instant messaging tools, etc. Terminal device 101 can be various electronic devices with a display screen that support web browsing, including but not limited to smartphones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 players (Moving Picture Experts Group Audio Layer IV), laptops, and desktop computers, etc. Server 103 can be a server providing various services, such as a backend server supporting the pages displayed on terminal device 101.

[0028] It should be noted that the abnormal traffic detection method provided in this application is generally executed by a server and / or terminal device, and correspondingly, an abnormal traffic detection device is generally installed in the server / terminal device. Furthermore, it should be understood that... Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0029] like Figure 2 As shown, Figure 2 A flowchart of an abnormal traffic detection method provided in an embodiment of the present invention. Taking the abnormal traffic detection method being executed by a server as an example, an abnormal traffic detection method includes the following steps:

[0030] Step S202: Preprocess the acquired request traffic data to obtain the traffic data to be detected.

[0031] In this embodiment, the provided abnormal traffic detection method is applicable to Internet of Things (IoT) systems, especially complex and variable network environments with high data traffic demands from IoT devices, including IoT platforms, smart home systems, industrial control systems, intelligent transportation systems, and smart agricultural systems. When used in IoT platforms, it can monitor the communication traffic of various IoT devices, ensuring the security and reliability of data transmission, and detecting and preventing malicious attacks and abnormal behaviors, such as DDoS attacks and device intrusions. When used in smart home systems, it can monitor the communication traffic of smart home devices, ensuring home security, promptly detecting and handling device malfunctions or abnormal behaviors, and ensuring the normal operation of devices; for example, monitoring smart lights, smart door locks, and smart thermostats. When used in industrial control systems, it can monitor the communication traffic of industrial equipment and sensors, detecting and preventing potential risks such as equipment malfunctions, data leaks, and network attacks, ensuring the safety and stability of the production process. When used in intelligent transportation systems, it can monitor the communication traffic of traffic signal controllers, vehicle sensors, and other traffic equipment, ensuring the normal operation of the traffic system, and promptly detecting and handling abnormal traffic events, such as signal malfunctions and equipment damage. When using smart agriculture systems, they can be used to monitor the communication traffic of agricultural sensors and equipment, ensure the accuracy and timeliness of agricultural production data, and detect and prevent problems such as equipment failure, data anomalies and network attacks, thus ensuring the smooth progress of agricultural production.

[0032] In this embodiment, the aforementioned request traffic data may refer to MQTT request traffic data. After startup, each sensor and device in the system will collect and upload its own MQTT request traffic data in real time. The types of MQTT request traffic data may include connection request traffic, subscription request traffic, publish request traffic, heartbeat request traffic, etc. After obtaining the MQTT request traffic data, data preprocessing can be performed to obtain the traffic data to be detected, ensuring data integrity and consistency, and facilitating accurate feature identification and extraction.

[0033] Step S204: Based on the traffic data to be detected, feature fusion is performed using a pre-trained deep learning model to obtain a multimodal feature vector. The pre-trained deep learning model is trained based on historical request traffic data.

[0034] In this embodiment, the pre-trained deep learning model can be trained based on historical request traffic data. In other examples, it can also be trained by combining historical request traffic data and user feedback data, where historical request traffic data includes normal traffic data and abnormal traffic data. The pre-trained deep learning model can be trained using any of the following methods for feature learning: Convolutional Neural Networks (CNNs), Long Short-Term Memory (LSTM) networks, Recurrent Neural Networks (RNNs), and Deep Feedforward Networks (DFNs).

[0035] In this embodiment, a pre-trained deep learning model can extract features from the traffic data to be detected. Multiple extracted features can then be fused to obtain a multimodal feature vector. This multimodal feature vector refers to a vector composed of features from multiple dimensions, containing not only feature information from a single modality but also the interactions and complementarities between multiple modalities. This allows for a better capture of the inherent patterns and characteristics of the data, providing a more comprehensive and accurate representation of MQTT request traffic data.

[0036] Step S206: Perform abnormal change point detection on the multimodal feature vector using an adaptive change point detection algorithm to obtain the target change point feature value corresponding to the target abnormal change point.

[0037] In this embodiment, the adaptive change point detection algorithm is a method used in time series analysis to detect points where statistical characteristics change during data generation. It can automatically adjust its detection strategy based on the characteristics of the data, thereby more accurately identifying change points. Adaptive change point detection algorithms can be based on statistical methods, machine learning methods, and deep learning methods, including but not limited to piecewise linear regression, change finders, ruptures, CUMSUM (cumulative summation), Pettitt mutation test, and Kernel change point detection.

[0038] In this embodiment, after forming a multimodal feature vector, it is input into an adaptive change point detection algorithm for change point detection and analysis, which can quickly identify target abnormal changes. There can be one or multiple target abnormal changes. For each identified target abnormal change, its corresponding feature value can be extracted. These feature values ​​include, but are not limited to, the number of data packets, data packet size, number of connections, and transmission rate. These feature values ​​reflect the statistical characteristics and behavioral patterns of traffic. Furthermore, during the detection process, the algorithm's detection parameters can be dynamically adjusted based on the detection results, thereby more accurately obtaining target abnormal changes and their feature values.

[0039] Step S208: Perform abnormal traffic detection on the request traffic data based on the target variable point feature value.

[0040] In this embodiment, after extracting the target variable feature value corresponding to the target abnormal variable, it is possible to determine whether there is abnormal traffic based on the target variable feature value. Specifically, it can be compared with the extracted target variable feature value by setting a threshold, so as to determine whether there is abnormal traffic in the MQTT request traffic data according to the comparison result. For example, if the target variable feature value corresponding to the target abnormal variable A is f(A) and the threshold is a, when f(A)≥a, it is determined that there is abnormal traffic in the MQTT request traffic data; when f(A)<a, it is determined that there is no abnormal traffic in the MQTT request traffic data.

[0041] In this embodiment of the invention, preprocessing the acquired request traffic data ensures data integrity and consistency, facilitating feature extraction. A pre-trained deep learning model fuses features of the traffic data to be detected, forming a multimodal feature vector for anomaly change point analysis. This multimodal feature analysis improves the comprehensiveness and accuracy of traffic anomaly detection. An adaptive change point detection algorithm is used to detect anomalies in the multimodal feature vector, obtaining the target change point feature value corresponding to the target anomaly. This method of detecting anomalies based on the target change point feature value dynamically adjusts detection parameters according to the detection situation, reducing false positives and false negatives, thereby improving the accuracy of anomaly traffic detection and making it more adaptable to changing network environments. Furthermore, combining multimodal features, a pre-trained deep learning model, and an adaptive change point detection algorithm for anomaly traffic detection in request traffic data enables rapid and accurate learning and identification under complex traffic patterns, thus improving the efficiency of anomaly traffic detection.

[0042] In an optional embodiment, step S202 specifically includes:

[0043] S2021, The obtained request traffic data is denoised to obtain denoised traffic data;

[0044] S2022, perform data cleaning on the denoised traffic data to obtain cleaned traffic data;

[0045] S2023, The cleaned flow data is standardized to obtain the flow data to be detected.

[0046] In this embodiment, preprocessing operations can be performed using data processing libraries such as Pandas. Methods such as moving averages, Kalman filtering, exponential smoothing, and wavelet transform can be used to remove noise from the time-series data of MQTT request traffic, resulting in denoised traffic data. For example, when processing time-series or continuous data, moving averages are used to smooth the data and reduce random fluctuations in the time-series data of MQTT request traffic. By calculating the average or weighted average of data points, the data is smoothed to more closely approximate the true trend, thus effectively eliminating noise.

[0047] In this embodiment, data cleaning is performed on the denoised traffic data, including but not limited to filling missing values ​​and deleting duplicate or invalid data. Missing value filling can be done using the mean imputation method, median imputation method, or difference method. For example, if some data and timestamps are missing during the collection process, the missing timestamps can be filled according to the data collection rules, and linear interpolation methods can be used to fill the missing values ​​in the time series data of the MQTT request traffic data to obtain a continuous time series. Through data cleaning, the quality and data integrity of the cleaned traffic data can be significantly improved.

[0048] In this embodiment, data standardization can convert data to a uniform scale. Standardizing or normalizing the data before deep learning model recognition ensures that different features are compared on the same scale, effectively reducing noise caused by different feature dimensions. Data standardization can include Robust Scaler, Standardization (Z-score Normalization), Vector Normalization, etc.

[0049] In some examples, taking Robust Scaler for data normalization as an example, let the time series data in the MQTT request traffic data be x1, x2, ..., xn, where n is the number of data points. First, the median (Median, Med) is calculated based on Med = median(x1, x2, ..., xn); then, the quartile range (IQR) is calculated based on IQR = Q3 - Q1, where Q3 is the third quartile (75th quartile) and Q1 is the first quartile (25th quartile); next, data scaling is performed: for each data point xi, its scaled value xi′ is: xi′ = (xi - Med) / IQR. For example, time-series data in MQTT request traffic is [10, 12, 15, 18, 20, 25, 30, 50]. Robust Scaler normalization yields a median of 17.5 and an interquartile range (IQR) of 12.5. Finally, for each data point, data scaling is performed using a scaling formula to achieve data normalization. For example, for data point x1, its value before scaling is 10, and after scaling, it is -0.6.

[0050] It is important to know that the order of denoising, data cleaning, and normalization described above is not the only fixed one.

[0051] In this embodiment, denoising, cleaning, and standardizing the data can improve the quality, accuracy, and readability of the data, and ensure that different features can be compared on the same scale. This ensures that subsequent data analysis, model training, or decision-making processes can be based on more accurate and reliable information, thereby improving the performance and stability of machine learning models.

[0052] In an optional embodiment, prior to step S202, the method further includes:

[0053] Select a target client library based on the detection requirements, and establish a communication connection between the target client library and the target proxy server;

[0054] By subscribing to the target topic through the target client library, the time-series data in the request traffic data of the target proxy server is obtained, and the device status data and context information are obtained through monitoring tools.

[0055] In this embodiment, the requested traffic data includes time-series data, device status data, and context information. The time-series data can be real-time traffic data; the device status data can include CPU (Central Processing Unit) utilization, memory utilization, etc.; and the context information can include network load, timestamps, etc.

[0056] In this embodiment, a matching MQTT client library can be selected based on the detection requirements, i.e., a target client library can be chosen, such as Eclipse Paho, paho-mqtt, etc. The detection requirements may include protocol version, performance requirements, security requirements, etc. For example, if the device or application needs to support MQTT 3.1.1 or MQTT 5.0, then a target client library that supports that version must be selected. As another example, if the application needs to handle a large amount of MQTT request traffic data, or has high requirements for latency and throughput of traffic data transmission, then a high-performance target client library must be selected.

[0057] Furthermore, after selecting a target client library, a connection can be established with the target broker server (MQTT server) using the API provided by the target client library. Based on the data source and requirements, the target client library subscribes to the target topic, i.e., subscribes to the MQTT topic, to receive MQTT request traffic data. When a device publishes a message to the MQTT Broker, and the MQTT client library subscribes to the MQTT topic, the MQTT topic's messages are sent to the subscribers. The message data format is predefined, and the device can send MQTT request traffic data to the MQTT Broker according to the predefined data format, thereby obtaining time-series data from the MQTT request traffic data. System monitoring tools can be used to collect device status information, such as CPU utilization and memory usage using Prometheus. Context information can also be obtained through logging or network monitoring tools, such as network load monitoring.

[0058] In this embodiment, by selecting a target client library based on detection requirements and establishing a communication connection between the target client library and the target proxy server before acquiring MQTT request traffic data, data transmission is achieved while better meeting the usage scenario, ensuring the correctness and stability of the function and the response speed of MQTT request traffic data. By acquiring time series data, device status data, and context information for comprehensive analysis to construct a multimodal feature vector, the comprehensiveness and accuracy of abnormal traffic detection can be improved.

[0059] In an optional embodiment, combined with Figure 3 As shown, step S204 above specifically includes:

[0060] S2041, Based on the pre-trained deep learning model, feature extraction is performed on the standardized time series data, the device status data, and the context information to obtain time series feature data, device status feature data, and context feature data respectively;

[0061] S2042, The time series feature data, the device status feature data and the context feature data are concatenated to obtain a joint feature vector;

[0062] S2043, The joint feature vector is fused using the pre-trained deep learning model to obtain the multimodal feature vector.

[0063] In this implementation example, the traffic data to be detected includes standardized time-series data, device status data, and contextual information. After data preprocessing, a pre-trained deep learning model can be used to extract features from the traffic data to be detected, including extracting features from the time-series data, device status data, and contextual information separately, to obtain time-series feature data, device status feature data, and contextual feature data. The pre-trained deep learning model can be built and trained using TensorFlow or PyTorch frameworks to generate multimodal feature representations.

[0064] In some examples, pre-trained deep learning models can extract features from data for each modality based on networks such as Long Short-Term Memory (LSTM). Feature extraction can be performed by dimensionality reduction to decrease the dimensionality of the dataset and reduce the impact of noise, or by extracting higher-level abstract features. For example, using LSTM for feature extraction involves building an LSTM model and using its hidden states as feature extractors. After training the model, the hidden layers of the LSTM are used to extract time-series feature data, device status feature data, and contextual feature data. The effectiveness of feature extraction can be verified by visualizing the initially acquired MQTT request traffic data and the extracted feature data.

[0065] Furthermore, after extracting time-series feature data, device status feature data, and contextual feature data, the multimodal feature data can be concatenated. This concatenation can be performed directly, through a fully connected layer, or using an attention mechanism to obtain a joint feature vector. This joint feature vector can be a high-dimensional feature vector. The concatenated joint feature vector can then be further processed and fused using a pre-trained deep learning model to extract more useful information, resulting in a more representative and accurately cropped multimodal feature vector.

[0066] In this embodiment, a pre-trained deep learning model extracts features from time-series data, device status data, and contextual information, then concatenates these features to obtain a joint feature vector. This joint feature vector is further fused using the pre-trained deep learning model, improving the comprehensiveness and accuracy of anomaly detection. Simultaneously, the fusion of multimodal data better optimizes the pre-trained deep learning model's feature learning ability, reducing the risk of overfitting and enhancing its applicability in different scenarios. Furthermore, the pre-trained deep learning model, through deep learning, can accurately and efficiently learn and identify complex traffic patterns, which helps extract deeper feature representations, improves the model's feature expression capabilities, and thus enhances the efficiency of anomaly traffic detection.

[0067] In an optional embodiment, combined with Figure 4 As shown, step S206 above specifically includes:

[0068] S2061, Initialize the parameters of multiple different adaptive change point detection algorithms;

[0069] S2062, Analyze the changes in the statistical characteristics of the multimodal feature vector over time using the initialized adaptive change point detection algorithms, and obtain the abnormal change points detected by the adaptive change point detection algorithms.

[0070] S2063, Determine the target abnormal change point based on the abnormal change points detected by each of the adaptive change point detection algorithms;

[0071] S2064, Obtain the feature value of the change point corresponding to the target abnormal change point and calculate the feature value of the target change point to obtain the feature value of the target change point.

[0072] In this embodiment, multiple different adaptive change point detection algorithms can be used to detect change points based on multimodal feature vectors. These adaptive change point detection algorithms can be implemented using open-source libraries such as Python, scikit-multiflow, and ruptures. The parameters of these algorithms can be adjusted by combining historical request traffic data and real-time detection results, thus achieving adaptive adjustment, stronger adaptability, and more accurate test results. The adaptive change point detection algorithms include CUMSUM (cumulative sum) detection, Pettitt mutation test, and Kernel change point detection. CUMSUM detection detects anomalous change points in traffic by calculating the cumulative sum; the Pettitt mutation test is a non-parametric test method used to detect anomalous change points in a sequence; and Kernel change point detection is a kernel-based change point detection algorithm suitable for complex data patterns.

[0073] In some examples, outlier detection is performed using CUMSUM detection, Pettitt mutation test, and Kernel change point detection, respectively. Before outlier detection, the parameters of each change point detection algorithm can be initialized, including window size, threshold, and penalty term. After parameter initialization, the statistical characteristics of the multimodal feature vectors over time are analyzed using the aforementioned algorithms to identify outlier changes. For example, the changes in the mean, variance, and autocorrelation of the multimodal feature vectors over time can be analyzed.

[0074] In other examples, each adaptive change point detection algorithm will detect anomalous changes. The anomalous changes detected by different adaptive change point detection algorithms may include the same anomalous change point or different anomalous changes. To improve the accuracy of anomalous change point identification, target anomalous changes can be determined based on the anomalous changes detected by each adaptive change point detection algorithm. Specifically, the anomalous changes detected by each adaptive change point detection algorithm can be used as the target anomalous changes; or all anomalous changes detected by each adaptive change point detection algorithm can be used as the target anomalous changes.

[0075] In other examples, weights can be assigned to different adaptive change point detection algorithms, and target anomalous changes can be selected based on the weight magnitude. For example, if the weights assigned to CUMSUM detection, Pettitt mutation test, and Kernel change point detection are 0.4, 0.4, and 0.2 respectively, then all anomalous changes detected by CUMSUM detection and Pettitt mutation test can be considered as target anomalous changes, while the same target changes detected by Kernel change point detection that are also detected by CUMSUM detection and Pettitt mutation test can be considered as target anomalous changes. By assigning weights to different change point detection algorithms, the calculation results can be more biased towards the more accurate detection algorithm, which is beneficial for more accurately identifying target anomalous changes.

[0076] In this embodiment, after obtaining the target abnormal variable, the variable feature values ​​corresponding to the target abnormal variable can be extracted, including the number of data packets, data packet size, number of connections, transmission rate, and location of the target abnormal variable. Based on the extracted variable feature values, the target variable feature value corresponding to each target abnormal variable can be calculated. For example, the target variable feature values ​​for the number of data packets, data packet size, number of connections, and transmission rate corresponding to target abnormal variable c1 can be calculated. Optionally, weights can be assigned to different variable feature values ​​of the same target abnormal variable to calculate the target variable feature value. For better analysis, visualization tools can be used to assist in the analysis and interpretation of the results, such as time series plots and scatter plots.

[0077] In this embodiment, abnormal change point detection is performed based on different adaptive change point detection algorithms. The detection results of each algorithm are comprehensively analyzed to identify the target abnormal change point and calculate the corresponding target change point feature value. This can improve the detection accuracy of abnormal change points and the accuracy of target change point feature value calculation. Furthermore, the adaptive change point detection algorithm can automatically adjust the detection parameters according to environmental changes, which can reduce the false alarm rate and the false negative rate, thereby improving the detection accuracy.

[0078] In an optional embodiment, step S208 specifically includes:

[0079] S2081, compare the target variable point feature value with the preset variable point feature threshold;

[0080] S2082, if the target variable point feature value exceeds the preset variable point feature threshold, it is determined that the requested traffic data has abnormal traffic, and an early warning prompt is triggered;

[0081] S2083, if the target variable point feature value does not exceed the preset variable point feature threshold, then it is determined that the requested traffic data does not have abnormal traffic.

[0082] In this embodiment, an anomaly detection rule can be implemented using a rule engine, such as Drools. By pre-setting a change point feature threshold, the calculated target change point feature value is compared with the preset change point feature threshold to determine whether there is abnormal traffic in the MQTT request traffic data. When abnormal traffic is found, an early warning is triggered promptly. This early warning can be sent via SMS and email alerts using third-party services, such as Twilio or SendGrid, to operations personnel or the superior management system. Additionally, system logs are recorded to save the alarm information.

[0083] In some examples, change point feature values ​​can be compared one by one by comparing the target change point feature value corresponding to each detected target abnormal change point with a preset change point feature threshold. If any target change point feature value exceeds the preset change point feature threshold, the MQTT request traffic data corresponding to that target abnormal change point is considered abnormal.

[0084] In other examples, a comprehensive judgment can be made based on feature values. If multiple target change point feature values ​​simultaneously exceed a preset change point feature threshold, it can be determined that there is abnormal traffic in the MQTT request traffic data. The warning message can include various information about the target abnormal change point corresponding to the target change point feature value exceeding the preset change point feature threshold, such as the change point location and timestamp.

[0085] In this embodiment, by comparing the target variable point feature value with the preset variable point feature threshold, abnormal traffic can be determined. In case of abnormal traffic, an early warning prompt can be triggered in a timely manner, which is conducive to quickly discovering abnormal traffic and intervening in a timely manner.

[0086] In an optional embodiment, after step S208 above, the method further includes:

[0087] S210, acquire historical traffic data and user feedback data, wherein the historical traffic data includes abnormal traffic data, normal traffic data and early warning data;

[0088] S212, construct new training samples based on the abnormal traffic data, the normal traffic data, the early warning data, and the user feedback data;

[0089] S214, Based on the new training samples, the pre-trained deep learning model and the adaptive change point detection algorithm are trained and their parameters are adjusted respectively.

[0090] In this embodiment, to optimize the model and algorithm to achieve optimal performance, historical traffic data and user feedback data can be acquired for optimization. Specifically, during system operation, the system continuously collects and stores detected traffic data, detection results, and subsequent alarm response information, including: historical records of normal and abnormal traffic, each detected target anomaly and its corresponding target anomaly characteristic value, specific alarm triggering circumstances, including false alarms and missed alarms, and user or administrator feedback on alarm results, such as confirmation of whether it is a genuine anomaly. Historical traffic data and user feedback data can be stored using databases such as MySQL or MongoDB. Data retrieval can be achieved using commands such as Celery.

[0091] Furthermore, the acquired historical traffic data and user feedback data can be used as feedback data to construct new training samples. The system can periodically or in real-time update and optimize the pre-trained deep learning model and adaptive change point detection algorithm based on the new training samples. Specifically, model optimization can be performed using automated machine learning tools, such as H2O.ai, an AutoML tool. Model optimization includes the following aspects: a. Training dataset expansion: Adding new training samples to the training dataset expands and enriches the model's training samples, which helps the model better learn and identify new traffic patterns and anomalies. b. Model retraining: Retraining the deep learning model based on the expanded training dataset. Incremental learning can be used, training only on newly added data to avoid the high computational cost of retraining the entire model. c. Parameter tuning: Adjusting the parameters of the adaptive change point detection algorithm according to the new training samples, such as adjusting the detection threshold and window size, to better adapt to the current network environment and traffic characteristics.

[0092] In some examples, retraining and optimizing pre-trained deep learning models and adaptive change point detection algorithms can achieve adaptive adjustment through the following mechanisms: a. Dynamic threshold adjustment: Dynamically adjust the change point detection threshold based on the false positive and false negative rates in historical traffic data to achieve optimal detection results. b. Context awareness: Utilize contextual information to adjust the parameters of the detection algorithm in real time. For example, when network load is high, detection sensitivity can be improved to promptly detect potential anomalies.

[0093] In other examples, the system can continuously monitor its own detection performance, measure the optimization effect through evaluation metrics, and if a performance decline is found, it can be optimized and adjusted again. For example, it can monitor its own detection performance based on accuracy, recall, F1 score, etc.

[0094] In other examples, the system can provide a user interface that allows users or administrators to manually label and provide feedback on detection results. User feedback can serve as important reference data, helping the system to perform more accurate self-learning and optimization.

[0095] In some examples, a user interface can be provided to display real-time trend graphs of MQTT request traffic data, anomaly markers, historical traffic data, and anomaly detection records, helping administrators to intuitively understand the system status.

[0096] In this embodiment, by acquiring historical traffic data and user feedback data to construct new training samples, the pre-trained deep learning model and adaptive change point detection algorithm are trained and their parameters are adjusted. This can optimize the model and algorithm, improve their performance, and help improve detection efficiency and accuracy in subsequent identification and detection.

[0097] To better illustrate the technical solution and effects of this application, the following provides a specific example of the application of the abnormal traffic detection method in a smart home system.

[0098] In a smart home system, a user's home is equipped with multiple smart devices, including smart lights, smart door locks, and smart thermostats. These devices communicate with the central control system via the MQTT protocol. The smart home system collects MQTT communication data, device status information (such as battery level and operating status), and contextual information (such as time and network status) from each smart device in real time. The collected data is cleaned, formatted, and features extracted to generate multimodal feature vectors. A pre-trained deep learning model is used to comprehensively analyze these multimodal features and learn normal communication patterns. An adaptive change-point detection algorithm monitors communication traffic in real time and detects abnormal changes. When abnormal traffic is detected, the system triggers an alarm mechanism according to predefined rules, notifying the user via SMS, email, etc. After detection, the system collects historical traffic data and user feedback data to continuously optimize and update the model and algorithm, improving detection accuracy. Timely and accurate abnormal traffic detection and alarms prevent potential intrusion risks. When abnormal behavior of a smart thermostat is detected, an early warning alert reminds the user to perform maintenance, ensuring the device operates normally.

[0099] To better illustrate the technical solution and effects of this application, the following provides a specific example of the application of another abnormal flow detection method in an industrial control system.

[0100] In an industrial production workshop, multiple industrial devices and sensors communicate with a central control system via the MQTT protocol to transmit production data in real time. The industrial control system collects MQTT communication data, equipment status information (such as temperature and pressure), and contextual information (such as production time and environmental conditions) from the industrial devices and sensors in real time. The collected data is cleaned, formatted, and features extracted to generate multimodal feature vectors. A pre-trained deep learning model is used to comprehensively analyze these multimodal features and learn normal communication patterns. An adaptive change-point detection algorithm monitors communication traffic in real time, detecting abnormal changes. When abnormal traffic is detected, the system triggers an alarm mechanism according to predefined rules, notifying workshop management personnel via SMS, email, etc. The industrial control system collects historical traffic data and feedback data from management personnel to continuously optimize and update the model and algorithm, improving detection accuracy. By promptly detecting and alarming abnormal operation of industrial equipment, equipment failures and production accidents can be prevented; when abnormal fluctuations in sensor data are detected, management personnel are promptly alerted to inspect the equipment, ensuring a stable production environment.

[0101] According to another aspect of the embodiments of this application, such as Figure 5As shown, corresponding to the abnormal traffic detection method in the above embodiments, this embodiment provides an abnormal traffic detection device, the device comprising:

[0102] The preprocessing module 501 is used to preprocess the acquired request traffic data to obtain the traffic data to be detected;

[0103] The feature fusion module 503 is used to perform feature fusion based on the traffic data to be detected through a pre-trained deep learning model to obtain a multimodal feature vector. The pre-trained deep learning model is trained based on historical request traffic data.

[0104] The change point detection module 505 is used to perform abnormal change point detection on the multimodal feature vector through an adaptive change point detection algorithm, and obtain the target change point feature value corresponding to the target abnormal change point;

[0105] The anomaly detection module 507 is used to perform anomaly traffic detection on the request traffic data based on the target variable point feature value.

[0106] It should be noted that in this embodiment, the preprocessing module 501 can be used to execute step S202 in this application embodiment, the feature fusion module 503 in this embodiment can be used to execute step S204 in this application embodiment, the change point detection module 505 in this embodiment can be used to execute step S206 in this application embodiment, and the anomaly detection module 507 in this embodiment can be used to execute step S208 in this application embodiment.

[0107] Optionally, the preprocessing module 501 includes: a denoising submodule for denoising the acquired request traffic data to obtain denoised traffic data; a cleaning submodule for cleaning the denoised traffic data to obtain cleaned traffic data; and a normalization module for standardizing the cleaned traffic data to obtain the traffic data to be detected.

[0108] Optionally, the traffic data to be detected includes standardized time-series data, device status data, and context information. The feature fusion module 503 includes: a feature extraction submodule, used to extract features from the standardized time-series data, device status data, and context information respectively based on the pre-trained deep learning model to obtain time-series feature data, device status feature data, and context feature data; a feature concatenation submodule, used to concatenate the time-series feature data, device status feature data, and context feature data to obtain a joint feature vector; and a feature fusion submodule, used to perform feature fusion on the joint feature vector through the pre-trained deep learning model to obtain the multimodal feature vector.

[0109] Optionally, the change point detection module 505 includes: an initialization submodule for initializing parameters of multiple different adaptive change point detection algorithms; an abnormal change point detection submodule for analyzing the changes in the statistical characteristics of the multimodal feature vector over time using the initialized adaptive change point detection algorithms to obtain abnormal change points detected by each adaptive change point detection algorithm; a change point feature value extraction submodule for determining target abnormal change points based on the abnormal change points detected by each adaptive change point detection algorithm; and a calculation submodule for obtaining the change point feature value corresponding to the target abnormal change point and performing target change point feature value calculation to obtain the target change point feature value.

[0110] Optionally, the anomaly detection module 507 includes: a comparison submodule, used to compare the target change point feature value with a preset change point feature threshold; a first determination submodule, used to determine that the request traffic data has abnormal traffic and trigger an early warning if the target change point feature value exceeds the preset change point feature threshold; and a second determination submodule, used to determine that the request traffic data does not have abnormal traffic if the target change point feature value does not exceed the preset change point feature threshold.

[0111] Optionally, the device further includes: a historical data acquisition module for acquiring historical traffic data and user feedback data, wherein the historical traffic data includes abnormal traffic data, normal traffic data, and early warning data; a sample construction module for constructing new training samples based on the abnormal traffic data, the normal traffic data, the early warning data, and the user feedback data; and a model training module for training and adjusting the parameters of the pre-trained deep learning model and the adaptive change point detection algorithm based on the new training samples.

[0112] Optionally, the request traffic data includes time-series data, device status data, and context information. The device further includes: a communication module, used to select a target client library according to detection requirements and establish a communication connection between the target client library and the target proxy server; and a traffic data acquisition module, used to subscribe to target topics through the target client library, acquire the time-series data in the request traffic data of the target proxy server, and acquire the device status data and the context information through monitoring tools.

[0113] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented either through software or through hardware.

[0114] It should be noted that the suffixes such as module, component, unit, submodule, and subunit used to represent elements in the above-described device are only for the purpose of illustrative purposes and have no specific meaning in themselves. Therefore, they can be used in combination.

[0115] According to another aspect of the embodiments of this application, this application provides a computer device, such as... Figure 6 As shown, it includes a memory 601, a processor 603, a communication interface 605, and a communication bus 607. The memory 601 stores a computer program that can run on the processor 603. The memory 601 and the processor 603 communicate through the communication interface 605 and the communication bus 607. When the processor 603 executes the computer program, it implements the steps of the above-mentioned abnormal traffic detection method.

[0116] The memory and processor in the aforementioned computer equipment communicate with each other via a communication bus and a communication interface. The communication bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0117] The memory may include random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0118] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0119] According to another aspect of the embodiments of this application, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the abnormal traffic detection method in any of the above embodiments.

[0120] Optionally, in this embodiment, the computer-readable medium is configured to store program code for the processor to execute the steps of the abnormal traffic detection method described in the above embodiments, the abnormal traffic detection method including:

[0121] Step S202: Preprocess the acquired request traffic data to obtain the traffic data to be detected;

[0122] Step S204: Based on the traffic data to be detected, feature fusion is performed through a pre-trained deep learning model to obtain a multimodal feature vector. The pre-trained deep learning model is trained based on historical request traffic data.

[0123] Step S206: Perform abnormal change point detection on the multimodal feature vector using an adaptive change point detection algorithm to obtain the target change point feature value corresponding to the target abnormal change point;

[0124] Step S208: Perform abnormal traffic detection on the request traffic data based on the target variable point feature value.

[0125] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments, and will not be repeated here. Furthermore, in the specific implementation of this application embodiment, the above embodiments can be consulted, and corresponding technical effects can be achieved.

[0126] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0127] For software implementation, the techniques described herein can be implemented by units that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented in the processor or external to the processor.

[0128] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0129] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0130] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0131] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, the functional units in the various embodiments of this application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0132] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, essentially or in other words, the parts that contribute to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0133] It should be noted that, in this document, relational terms such as "first," "second," etc., are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprises a…" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0134] The above description is merely a specific embodiment of this application, enabling those skilled in the art to understand or implement this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.

Claims

1. An abnormal flow detection method, characterized in that, The method includes: The acquired request traffic data is preprocessed to obtain the traffic data to be detected; Based on the traffic data to be detected, feature fusion is performed through a pre-trained deep learning model to obtain a multimodal feature vector. The pre-trained deep learning model is trained based on historical request traffic data. An adaptive change point detection algorithm is used to detect abnormal changes in the multimodal feature vector to obtain the target change point feature value corresponding to the target abnormal change point. Abnormal traffic detection is performed on the request traffic data based on the target variable point feature value; The traffic data to be detected includes standardized time-series data, device status data, and context information. The step of fusing features based on the traffic data to be detected using a pre-trained deep learning model to obtain a multimodal feature vector includes: extracting features from the standardized time-series data, device status data, and context information respectively using the pre-trained deep learning model to obtain time-series feature data, device status feature data, and context feature data; concatenating the time-series feature data, device status feature data, and context feature data to obtain a joint feature vector; and fusing the joint feature vector using the pre-trained deep learning model to obtain the multimodal feature vector. The step of detecting abnormal changes in the multimodal feature vector using an adaptive change point detection algorithm to obtain the target change point feature value corresponding to the target abnormal change point includes: initializing parameters for multiple different adaptive change point detection algorithms; analyzing the changes in the statistical characteristics of the multimodal feature vector over time using each of the initialized adaptive change point detection algorithms to obtain abnormal changes detected by each of the adaptive change point detection algorithms; determining the target abnormal change point based on the abnormal changes detected by each of the adaptive change point detection algorithms; obtaining the change point feature value corresponding to the target abnormal change point and calculating the target change point feature value.

2. The abnormal flow detection method according to claim 1, characterized in that, The preprocessing of the acquired request traffic data to obtain the traffic data to be detected includes: The obtained request traffic data is denoised to obtain denoised traffic data; The denoised traffic data is cleaned to obtain cleaned traffic data; The cleaned flow data is standardized to obtain the flow data to be detected.

3. The abnormal flow detection method according to claim 1, characterized in that, The step of detecting abnormal traffic in the request traffic data based on the target variable point feature value includes: The target variable point feature value is compared with a preset variable point feature threshold. If the target variable point feature value exceeds the preset variable point feature threshold, it is determined that the requested traffic data has abnormal traffic, and an early warning is triggered. If the target variable point feature value does not exceed the preset variable point feature threshold, then it is determined that the requested traffic data does not contain abnormal traffic.

4. The abnormal flow detection method according to claim 1, characterized in that, After performing abnormal traffic detection on the request traffic data based on the target variable point feature value, the method further includes: Acquire historical traffic data and user feedback data, wherein the historical traffic data includes abnormal traffic data, normal traffic data, and early warning data; New training samples are constructed based on the abnormal traffic data, the normal traffic data, the early warning data, and the user feedback data; Based on the new training samples, the pre-trained deep learning model and the adaptive change point detection algorithm are trained and their parameters are adjusted, respectively.

5. The abnormal flow detection method according to any one of claims 1 to 4, characterized in that, The request traffic data includes time-series data, device status data, and context information. Before preprocessing the acquired request traffic data, the method further includes: Select a target client library based on the detection requirements, and establish a communication connection between the target client library and the target proxy server; By subscribing to the target topic through the target client library, the time-series data in the request traffic data of the target proxy server is obtained, and the device status data and context information are obtained through monitoring tools.

6. An abnormal flow detection device, used to implement the abnormal flow detection method as described in any one of claims 1 to 5, characterized in that, The device includes: The preprocessing module is used to preprocess the acquired request traffic data to obtain the traffic data to be detected; The feature fusion module is used to perform feature fusion based on the traffic data to be detected through a pre-trained deep learning model to obtain a multimodal feature vector. The pre-trained deep learning model is trained based on historical request traffic data. The change point detection module is used to perform abnormal change point detection on the multimodal feature vector through an adaptive change point detection algorithm, and obtain the target change point feature value corresponding to the target abnormal change point; An anomaly detection module is used to detect abnormal traffic in the request traffic data based on the target variable point feature value.

7. A computer device comprising a memory, a processor, a communication interface, and a communication bus, wherein the memory stores a computer program executable on the processor, and the memory and the processor communicate via the communication bus and the communication interface, characterized in that... When the processor executes the computer program, it implements the steps of the abnormal traffic detection method according to any one of claims 1 to 5.

8. A computer-readable medium having processor-executable non-volatile program code, characterized in that, The program code causes the processor to execute the steps of the abnormal traffic detection method according to any one of claims 1 to 5.

Images