Network flow intelligent anomaly detection and traceability system and method thereof

Abstract

The invention relates to the technical field of network security, in particular to an intelligent anomaly detection and traceability system and method for network traffic, and the system comprises a multi-dimensional traffic feature extraction module which carries out the feature extraction of original network traffic data through a Riemann zeta function, and generates a feature matrix; the topological feature embedding module is in communication connection with the multi-dimensional flow feature extraction module and generates a topological manifold based on the feature matrix; the nonlinear power system mapping module is used for generating a power system state vector; the spectrum decomposition and feature extraction module is in communication connection with the nonlinear power system mapping module; performing spectral decomposition on the state vector of the power system, and extracting system features; and the anomaly detection decision module is in communication connection with the spectral decomposition and feature extraction module, performs anomaly detection decision by using a Bessel function based on the system features, and outputs an anomaly detection result, thereby improving the accuracy, efficiency and interpretability of network anomaly detection and traceability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network traffic intelligent anomaly detection and tracing system and method. Background Art

[0002] With the rapid development of network technology and the continuous expansion of its application scope, network security issues have become increasingly prominent. As an important means of network security protection, network traffic anomaly detection and tracing has always been the focus of academic and industrial attention. Traditional network traffic anomaly detection methods mainly rely on statistical analysis and machine learning techniques. Although they have achieved certain results in some scenarios, these methods have shown many shortcomings in the face of increasingly complex and changeable network attack forms.

[0003] At present, the closest existing technologies mainly include anomaly detection methods based on statistical analysis and anomaly detection methods based on machine learning. Methods based on statistical analysis usually use preset thresholds or statistical models to identify abnormal traffic. The advantages of this type of method are fast calculation speed and easy implementation, but its inherent limitations are that it is difficult to adapt to complex and changing network environments and is prone to high false alarm rates and high missed alarm rates. Especially when facing new attacks or carefully disguised abnormal traffic, the effects of this type of method are often unsatisfactory.

[0004] On the other hand, although the anomaly detection methods based on machine learning have improved the accuracy and adaptability of detection to a certain extent, there are still some significant problems. First, such methods usually require a large amount of labeled data for training, but in the actual network environment, it is often difficult and costly to obtain high-quality labeled data. Secondly, the interpretability of machine learning models is poor, and it is difficult to provide security analysts with intuitive anomaly explanations and traceability information. Furthermore, existing machine learning methods mostly focus on the extraction and analysis of static features, and it is difficult to effectively capture the dynamic evolution characteristics of network traffic.

[0005] More importantly, existing technologies have obvious deficiencies in the synergy between anomaly detection and tracing. Most methods treat anomaly detection and tracing as two independent processes, resulting in low overall system efficiency and difficulty in achieving fast and accurate anomaly location and response. In addition, existing methods are often unable to cope with high-dimensional, nonlinear network traffic data, making it difficult to fully and accurately characterize complex network behaviors.

[0006] In view of the above problems, there is an urgent need for a new system and method that can comprehensively improve the ability of network traffic anomaly detection and tracing. The system should be able to effectively process high-dimensional nonlinear data, accurately capture the dynamic characteristics of network traffic, and achieve deep integration of anomaly detection and tracing, providing efficient, accurate, and explainable anomaly analysis results. Summary of the invention

[0007] The network traffic intelligent anomaly detection and tracing system and method of the present invention are proposed to address the deficiencies of the prior art. The present invention aims to solve the following technical problems: how to effectively extract and analyze high-dimensional nonlinear network traffic characteristics, how to accurately capture the dynamic evolution characteristics of network traffic, how to achieve deep integration of anomaly detection and tracing, and how to provide efficient, accurate and explainable anomaly analysis results.

[0008] The present invention proposes a network traffic intelligent anomaly detection and tracing system, comprising:

[0009] Multi-dimensional traffic feature extraction module, used for:

[0010] Receive raw network traffic data;

[0011] Use Riemann zeta function to extract features from raw network traffic data and generate feature matrix;

[0012] A topological feature embedding module is communicatively connected to the multi-dimensional traffic feature extraction module and is used to:

[0013] Receiving a feature matrix sent by the multi-dimensional traffic feature extraction module;

[0014] Based on the feature matrix, network traffic features are embedded into a high-dimensional topological space to generate a topological manifold;

[0015] A nonlinear dynamic system mapping module is in communication with the topological feature embedding module and is used to:

[0016] Receiving the topological manifold sent by the topological feature embedding module;

[0017] Based on the topological manifold, the topological features are mapped to the nonlinear dynamic system to generate a state vector of the dynamic system;

[0018] The spectrum decomposition and feature extraction module is in communication with the nonlinear dynamic system mapping module and is used to:

[0019] Receiving a power system state vector sent by the nonlinear power system mapping module;

[0020] Performing spectral decomposition on the state vector of the power system to extract system features;

[0021] The anomaly detection decision module is in communication with the spectrum decomposition and feature extraction module and is used to:

[0022] Receiving system features sent by the spectrum decomposition and feature extraction module;

[0023] Based on the system characteristics, Bessel function is used to make anomaly detection decisions and output anomaly detection results.

[0024] Preferably, the multi-dimensional traffic feature extraction module includes:

[0025] A characteristic value calculation unit, used for extracting characteristic values ​​from raw network traffic data;

[0026] A Riemann zeta function mapping unit, which is in communication with the eigenvalue calculation unit and is used for applying the Riemann zeta function to the eigenvalue for mapping;

[0027] The characteristic matrix generating unit is communicatively connected with the Riemann zeta function mapping unit and is used for generating a characteristic matrix based on the mapping result.

[0028] Preferably, the topological feature embedding module comprises:

[0029] A dimension determination unit, used to determine the dimension of the embedding space;

[0030] A coefficient calculation unit, used to calculate embedding coefficients based on the feature matrix;

[0031] A topological mapping unit is communicatively connected with the dimension determination unit and the coefficient calculation unit, and is used for embedding the feature matrix into a high-dimensional torus to generate a topological manifold.

[0032] Preferably, the nonlinear dynamic system mapping module comprises:

[0033] A parameter matrix generating unit, used for generating a system parameter matrix;

[0034] Nonlinear function unit, used to define nonlinear functions;

[0035] The power system solving unit is in communication connection with the parameter matrix generating unit and the nonlinear function unit, and is used for solving the nonlinear power system equations and generating a power system state vector.

[0036] Preferably, the spectrum decomposition and feature extraction module comprises:

[0037] An eigenvalue calculation unit, used to calculate the eigenvalue of the state vector of the power system;

[0038] An eigenvector calculation unit, used for calculating an eigenvector corresponding to the eigenvalue;

[0039] The spectral decomposition result generating unit is communicatively connected with the eigenvalue calculating unit and the eigenvector calculating unit, and is used for generating a spectral decomposition result based on the eigenvalue and the eigenvector.

[0040] Preferably, the anomaly detection decision module comprises:

[0041] Bessel function calculation unit, used to calculate the first kind of zero-order Bessel function;

[0042] An integral calculation unit, connected in communication with the Bessel function calculation unit, for calculating the integral of the Bessel function;

[0043] The threshold comparison unit is connected to the integral calculation unit for comparing the integral result with a preset threshold value and outputting an abnormality detection result.

[0044] Preferably, it further comprises an anomaly tracing module, which is in communication connection with the anomaly detection decision module and is used for:

[0045] Receiving the anomaly detection result sent by the anomaly detection decision module;

[0046] Based on the anomaly detection result, a causal reasoning method is used to perform source tracing analysis on the abnormal traffic and output the source tracing result.

[0047] Preferably, the anomaly tracing module includes:

[0048] A graph construction unit, used to construct a traffic propagation graph based on anomaly detection results;

[0049] a causal reasoning unit, communicatively connected to the graph construction unit, and configured to perform causal reasoning on the traffic propagation graph;

[0050] A key node identification unit is communicatively connected to the causal reasoning unit and is used to identify key attack nodes based on causal reasoning results.

[0051] Preferably, it further comprises a dynamic defense strategy generation module, which is communicatively connected with the anomaly detection decision module and the anomaly tracing module, and is used for:

[0052] Receive the anomaly detection result sent by the anomaly detection decision module and the tracing result sent by the anomaly tracing module;

[0053] Based on the anomaly detection results and the tracing results, a dynamic defense strategy is generated using a deep reinforcement learning algorithm.

[0054] The method for performing network traffic anomaly detection and tracing using the network traffic intelligent anomaly detection and tracing system comprises the following steps:

[0055] S1, receiving raw network traffic data;

[0056] S2, using Riemann zeta function to extract features from the original network traffic data and generate a feature matrix;

[0057] S3, embed the feature matrix into a high-dimensional topological space to generate a topological manifold;

[0058] S4, mapping the topological manifold to the nonlinear dynamic system to generate the state vector of the dynamic system;

[0059] S5, performing spectral decomposition on the state vector of the power system to extract system characteristics;

[0060] S6. Based on the system characteristics, use Bessel function to make anomaly detection decisions and output anomaly detection results;

[0061] S7. If an anomaly is detected, a traceability analysis is performed based on the anomaly detection result, and a traceability result is output;

[0062] S8. Generate a dynamic defense strategy based on anomaly detection results and tracing results.

[0063] Specifically, the beneficial effects of the present invention are mainly reflected in the following aspects:

[0064] First, the present invention introduces the Riemann zeta function to extract multidimensional traffic features, effectively solving the difficulties of traditional methods in processing high-dimensional nonlinear data. This method can not only capture the multi-scale characteristics of traffic, but also effectively reduce the dimension of data, laying a solid foundation for subsequent analysis.

[0065] Secondly, the present invention adopts topological feature embedding technology to cleverly solve the problem that traditional methods are difficult to retain the topological structure of high-dimensional data. This method enables the system to more comprehensively grasp the internal relationship of network traffic and greatly improves the accuracy of anomaly detection.

[0066] Thirdly, the present invention introduces nonlinear dynamic system mapping, which effectively overcomes the shortcomings of traditional methods in describing the dynamic evolution characteristics of network traffic. This method can accurately capture the nonlinear dynamic behavior of traffic and provide richer and more accurate information for anomaly detection.

[0067] In addition, the anomaly detection decision method based on Bessel function adopted by the present invention cleverly solves the problem of insufficient flexibility of the traditional threshold method. This method can adaptively adjust the detection strategy and significantly reduce the false alarm rate and missed alarm rate.

[0068] Finally, this paper achieves a deep integration of anomaly detection and traceability by introducing causal reasoning technology, effectively solving the problem of separation between detection and traceability in traditional methods. This integration not only improves the overall efficiency of the system, but also provides security analysts with more intuitive and explainable analysis results.

[0069] It is worth noting that the modules of the present invention are not simply connected in series, but form an organic whole, with deep synergy and complementary effects between the modules. For example, multi-dimensional flow feature extraction provides high-quality input for topological feature embedding, and topological feature embedding provides structured data representation for nonlinear dynamic system mapping. This progressive and mutually reinforcing design greatly improves the overall performance of the system.

[0070] In summary, the network traffic intelligent anomaly detection and tracing system and method of the present invention effectively solve many problems existing in the prior art through innovative algorithm design and module combination, and significantly improve the accuracy, efficiency and interpretability of network anomaly detection and tracing. This comprehensive and in-depth technological innovation provides new research directions and practical guidance for the field of network security, and has important theoretical value and broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 It is the overall logic block diagram of the system of the present invention.

[0072] Figure 2 It is a logic block diagram of the multi-dimensional traffic feature extraction module of the present invention.

[0073] Figure 3 It is a logic block diagram of the topological feature embedding module of the present invention.

[0074] Figure 4 It is a logic block diagram of the nonlinear dynamic system mapping module of the present invention.

[0075] Figure 5 It is a logic block diagram of the spectrum decomposition and feature extraction module of the present invention.

[0076] Figure 6 It is a logic block diagram of the anomaly detection decision module of the present invention.

[0077] Figure 7 This is a logic block diagram of the exception tracing module of the present invention. DETAILED DESCRIPTION

[0078] See also Figure 1-7 The present invention provides a network traffic intelligent anomaly detection and tracing system and method thereof, the system includes multiple functional modules, and is used to implement intelligent anomaly detection and tracing of network traffic. The specific implementation of the present invention will be described in detail below.

[0079] The network traffic intelligent anomaly detection and tracing system of the present invention comprises a multi-dimensional traffic feature extraction module 1, a topological feature embedding module 2, a nonlinear dynamic system mapping module 3, a spectral decomposition and feature extraction module 4, and anomaly detection decision module 5. These modules work together to complete the anomaly detection and tracing tasks of network traffic.

[0080] The multi-dimensional traffic feature extraction module 1 is the entrance of the system and is responsible for receiving the original network traffic data and performing preliminary processing. The module uses the Riemann zeta function to extract features from the original network traffic data and generate a feature matrix. Preferably, the application of the Riemann zeta function can effectively capture the scale-invariant characteristics of network traffic. Specifically, the multi-dimensional traffic feature extraction module 1 adopts the following algorithm:

[0081] ,

[0082] in, is the original network traffic data, is the group theory mapping function, is the Riemann zeta function, From the original data The extracted eigenvalues, is the final characteristic matrix. The Riemann zeta function is defined as:

[0083] ,

[0084] By applying the Riemann zeta function, the system can effectively capture scale-invariant features in network traffic, which is very important for detecting attacks of different scales (such as DDoS attacks). The application of the Riemann zeta function enables the system to process network traffic data of different time scales and spatial scales, thereby improving the detection ability of attacks of different scales. Due to the characteristics of the Riemann zeta function, it can effectively filter out noise and improve the robustness of feature extraction. By mapping multiple eigenvalues ​​to matrix form, the system can better capture the complex structure of network traffic and provide richer information for subsequent anomaly detection.

[0085] The topological feature embedding module 2 is connected to the multidimensional traffic feature extraction module 1 for receiving the feature matrix sent by the multidimensional traffic feature extraction module 1. Based on the received feature matrix, the topological feature embedding module 2 embeds the network traffic features into the high-dimensional topological space to generate a topological manifold. The purpose of this step is to preserve the topological relationship between the features and improve the accuracy of anomaly detection. In one embodiment of the present invention, the topological feature embedding module 2 adopts the following algorithm:

[0086] ,

[0087] in, is the feature matrix, is the topological embedding function, is the topological manifold after embedding, is the dimension of the embedding space, For The calculated coefficients.

[0088] This formula converts the feature matrix Embedded into high-dimensional topological space to generate topological manifolds The core idea of ​​topological embedding is to preserve the topological relationship between data and maintain the local structure of data even in high-dimensional space.

[0089] It is a constraint that ensures that the embedded points are distributed on a specific manifold. This constraint helps to maintain the geometric properties of the data and avoid excessive stretching or compression.

[0090] Through topological embedding, the system is able to maintain complex relationships between features in high-dimensional space, which helps to identify hidden abnormal patterns, especially those that are difficult to find in low-dimensional space. Topological embedding can capture nonlinear relationships between features, thereby improving the accuracy of anomaly detection. For example, some abnormal traffic may look normal in low-dimensional space, but will show obvious abnormal behavior in high-dimensional space. By using nonlinear dimensionality reduction algorithms such as t-SNE or UMAP, the system can reduce computational complexity while maintaining the topological structure of the data, improving the real-time performance and efficiency of the system.

[0091] The nonlinear dynamic system mapping module 3 is connected to the topological feature embedding module 2 for receiving the topological manifold sent by the topological feature embedding module 2. The main function of this module is to map the topological features into the nonlinear dynamic system and generate the dynamic system state vector. This step can effectively capture the complex dynamic behavior in the network traffic.

[0092] The spectral decomposition and feature extraction module 4 is connected to the nonlinear power system mapping module 3 for receiving the power system state vector sent by the nonlinear power system mapping module 3. This module performs spectral decomposition on the power system state vector and extracts system features. The purpose of this step is to obtain the intrinsic features of the system and provide a basis for subsequent anomaly detection.

[0093] The anomaly detection decision module 5 is in communication connection with the spectrum decomposition and feature extraction module 4, and is used to receive the system features sent by the spectrum decomposition and feature extraction module 4. Based on the received system features, the anomaly detection decision module 5 uses the Bessel function to make anomaly detection decisions and output anomaly detection results.

[0094] Furthermore, the multidimensional traffic feature extraction module 1 includes an eigenvalue calculation unit 11, a Riemann zeta function mapping unit 12 and a feature matrix generation unit 13. The eigenvalue calculation unit 11 is used to extract eigenvalues ​​from the original network traffic data. In one embodiment of the present invention, the eigenvalues ​​may include traffic size, number of packets, flow duration, etc. The Riemann zeta function mapping unit 12 is communicatively connected to the eigenvalue calculation unit 11, and is used to apply the Riemannzeta function to map the eigenvalues. This step can effectively capture the scale invariance characteristics of network traffic and improve the robustness of anomaly detection. The feature matrix generation unit 13 is communicatively connected to the Riemann zeta function mapping unit 12, and is used to generate a feature matrix based on the mapping result.

[0095] Preferably, the eigenvalue calculation unit 11 can use a sliding window method to segment the original network traffic data and extract multiple eigenvalues ​​in each window. The window size can be adjusted according to actual needs, for example, it can be set to 1 minute, 5 minutes or 10 minutes. When mapping, the Riemann zeta function mapping unit 12 can select a suitable s value, usually the value range of s is between 1 and 2. When generating the feature matrix, the feature matrix generation unit 13 can select a suitable matrix dimension as needed, for example, a matrix size of 10×10 or 20×20 can be selected.

[0096] The topological feature embedding module 2 includes a dimension determination unit 21, a coefficient calculation unit 22 and a topological mapping unit 23. The dimension determination unit 21 is used to determine the dimension of the embedding space. In one embodiment of the present invention, the dimension of the embedding space can be determined according to the size and complexity of the feature matrix, and a value that is one order of magnitude higher than the dimension of the feature matrix can usually be selected. For example, if the feature matrix is ​​10×10, the dimension of the embedding space can be selected as 100. The coefficient calculation unit 22 is used to calculate the embedding coefficients based on the feature matrix. These coefficients determine the distribution of features in the high-dimensional space. The topological mapping unit 23 is communicatively connected to the dimension determination unit 21 and the coefficient calculation unit 22, and is used to embed the feature matrix into a high-dimensional torus to generate a topological manifold.

[0097] Preferably, the coefficient calculation unit 22 can use methods such as principal component analysis (PCA) or linear discriminant analysis (LDA) to calculate the embedding coefficient. When mapping, the topological mapping unit 23 can use nonlinear dimensionality reduction algorithms such as t-SNE or UMAP to maintain the topological structure of the data. This high-dimensional embedding method can effectively capture the complex relationship between network traffic features and improve the accuracy of anomaly detection.

[0098] The network traffic intelligent anomaly detection and tracing system of the present invention can effectively detect abnormal behavior in network traffic and perform source tracing analysis on abnormal traffic through the collaborative work of the above modules. The system has the following advantages: First, by using the Riemann zeta function for feature extraction, the system can capture the scale-invariant characteristics of network traffic and improve the detection capability of attacks of different scales. Secondly, topological feature embedding retains the complex relationship between features, which helps to identify hidden abnormal patterns. Thirdly, nonlinear dynamic system mapping can simulate the complex dynamic behavior of network traffic and improve the adaptability of the system to time-varying attacks. Finally, the anomaly detection decision based on the Bessel function utilizes the oscillation characteristics of the Bessel function, which can effectively distinguish normal traffic from abnormal traffic.

[0099] In general, the network traffic intelligent anomaly detection and tracing system provided by the present invention realizes efficient and accurate network anomaly detection and tracing functions through innovative algorithm design and module combination, and provides strong technical support for network security protection. In a preferred embodiment of the present invention, as described in claim 4, the nonlinear dynamic system mapping module 3 includes a parameter matrix generation unit 31, a nonlinear function unit 32 and a dynamic system solution unit 33. These units work together to realize the effective mapping of network traffic characteristics to nonlinear dynamic systems.

[0100] The parameter matrix generation unit 31 is used to generate a system parameter matrix. In the implementation process of the present invention, the selection of the system parameter matrix is ​​crucial to capturing the dynamic characteristics of network traffic. Preferably, the parameter matrix generation unit 31 can adopt an adaptive method to dynamically adjust the parameter matrix according to the input topological manifold characteristics. For example, the parameter matrix A can be generated in the following manner:

[0101] ,

[0102] in, , represents the i-th coordinate of the k-th point in the topological manifold. This approach can make the parameter matrix better adapt to the characteristics of the input data.

[0103] The nonlinear function unit 32 is used to define a nonlinear function. The nonlinear function used in the present invention plays a key role in capturing the complex dynamic behavior of network traffic. Preferably, the nonlinear function can be selected as:

[0104] ,

[0105] This combination function has good nonlinear characteristics and can simulate various complex patterns in network traffic. The sin function provides periodic characteristics, while the tanh function provides saturation effects. The combination of the two can better describe the dynamic changes of network traffic.

[0106] The power system solving unit 33 is in communication with the parameter matrix generating unit 31 and the nonlinear function unit 32, and is used to solve the nonlinear power system equation and generate the power system state vector. Specifically, the power system solving unit 33 needs to solve the following ordinary differential equation:

[0107] ,

[0108] Among them, Y is the state vector of the power system, A, B, C are the system parameter matrices, is a nonlinear function, Preferably, the fourth-order Runge-Kutta method can be used to solve the equation to obtain a high-precision numerical solution.

[0109] This formula describes a nonlinear dynamic system that can simulate complex dynamic behaviors and is particularly suitable for describing the time-varying characteristics of network traffic.

[0110] Nonlinear functions This combined function combines the periodicity of the sine function and the saturation effect of the hyperbolic tangent function, and can better describe various complex patterns in network traffic. The sine function provides periodic characteristics, while the hyperbolic tangent function provides a saturation effect. The combination of the two can better simulate the dynamic changes of network traffic.

[0111] Nonlinear dynamic systems are able to simulate complex dynamic behaviors in network traffic, especially those with periodicity, mutation, or long-term dependencies. This is very useful for detecting time-varying attacks such as slow scanning attacks. By introducing nonlinear functions, the system can better adapt to different network environments and traffic patterns, improving the generalization ability of the system. Nonlinear dynamic systems can be used not only for the analysis of the current state, but also for the prediction of future states, helping the system to identify potential abnormal behaviors in advance.

[0112] Furthermore, the spectrum decomposition and feature extraction module 4 includes an eigenvalue calculation unit 41, an eigenvector calculation unit 42 and a spectrum decomposition result generation unit 43. The coordinated work of these units realizes the effective analysis of the state vector of the power system.

[0113] The eigenvalue calculation unit 41 is used to calculate the eigenvalue of the power system state vector. In one embodiment of the present invention, the eigenvalue can be calculated using the QR algorithm, which has good numerical stability. The eigenvector calculation unit 42 is used to calculate the eigenvector corresponding to the eigenvalue. Preferably, the eigenvector can be calculated using the inverse power method, which has high efficiency in calculating the eigenvector of a large matrix.

[0114] The spectrum decomposition result generating unit 43 is in communication connection with the eigenvalue calculating unit 41 and the eigenvector calculating unit 42, and is used to generate the spectrum decomposition result based on the eigenvalue and the eigenvector. Specifically, the spectrum decomposition result can be expressed as:

[0115] ,

[0116] in, is the state vector of the power system, is the spectral decomposition function, is the characteristic value, is the corresponding eigenvector, This spectral decomposition method can effectively extract the main features of the system and provide an important basis for subsequent anomaly detection.

[0117] Spectral decomposition is a method to decompose a matrix into eigenvalues ​​and eigenvectors. For the state vector Y of a dynamic system, spectral decomposition can extract the intrinsic characteristics of the system, that is, those characteristics that best represent the behavior of the system. Through spectral decomposition, the system can simplify complex dynamic behavior into several main characteristic modes. is the eigenvalue, is the corresponding eigenvector. The eigenvalue reflects the energy distribution of the system, while the eigenvector describes the oscillation mode of the system.

[0118] Spectral decomposition can extract the most critical information from a large amount of data, reduce redundant features, and improve the computational efficiency of the system. Through spectral decomposition, the system can decompose complex dynamic behaviors into several main characteristic patterns, making the anomaly detection results more interpretable. For example, a significant change in a certain characteristic value may indicate abnormal behavior in the system. Spectral decomposition can effectively separate the characteristics of normal and abnormal traffic, thereby improving the accuracy of anomaly detection. In particular, for those anomalies that are difficult to distinguish in the time domain, spectral decomposition can clearly identify them in the frequency domain.

[0119] The anomaly detection decision module 5 includes a Bessel function calculation unit 51, an integral calculation unit 52 and a threshold comparison unit 53. These units are designed to achieve efficient and accurate anomaly detection decisions.

[0120] The Bessel function calculation unit 51 is used to calculate the first type zero-order Bessel function. In a preferred embodiment of the present invention, the Taylor series expansion method can be used to calculate the Bessel function to improve the calculation efficiency. The integral calculation unit 52 is connected to the Bessel function calculation unit 51 for calculating the integral of the Bessel function. Preferably, the adaptive Simpson method can be used for numerical integration, which can improve the calculation speed while ensuring accuracy.

[0121] The threshold comparison unit 53 is in communication with the integral calculation unit 52, and is used to compare the integral result with a preset threshold value and output an abnormality detection result. Specifically, the abnormality detection decision function can be expressed as:

[0122] ,

[0123] in, is the spectral decomposition result, is the zero-order Bessel function of the first kind, and is an adjustable parameter. In practical applications, and The value of can be optimized through machine learning methods to adapt to the characteristics of different network environments. , it is determined to be abnormal traffic. The first type of zero-order Bessel function is defined as:

[0124] ,

[0125] The Bessel function has an oscillatory characteristic and is particularly suitable for describing periodic or quasi-periodic signals. In network traffic, many abnormal behaviors (such as periodic attacks) exhibit similar oscillatory characteristics.

[0126] is the result of spectral decomposition The purpose of integration is to combine the features at different times to obtain a global anomaly score. is an adjustable parameter used to adjust the sensitivity of the Bessel function. Is a threshold used to determine whether it is an abnormality.

[0127] The oscillation characteristics of the Bessel function enable the system to effectively capture periodic or quasi-periodic anomalies in network traffic, especially when facing attacks with fixed patterns (such as SYN Flood attacks). and ,The system can make adaptive adjustments according to different network environments and traffic patterns, which improves the flexibility of the system. The oscillation characteristics of the Bessel function can help the system distinguish between normal periodic traffic and abnormal periodic attacks, thereby reducing the false alarm rate.

[0128] In another embodiment of the present invention, the system further comprises an anomaly tracing module 6, which is in communication with the anomaly detection and decision module 5. The introduction of the anomaly tracing module 6 greatly enhances the functionality of the system, enabling it to not only detect anomalies but also trace the source of the anomalies.

[0129] The abnormality tracing module 6 receives the abnormality detection results sent by the abnormality detection decision module 5. Based on these results, the abnormality tracing module 6 uses the causal reasoning method to trace the abnormal traffic and finally outputs the tracing results. This tracing analysis can help network administrators quickly locate the attack source and take targeted defense measures.

[0130] Preferably, the anomaly tracing module 6 can use a Bayesian network or a structural equation model for causal reasoning. These methods can effectively model the causal relationship between network traffic, thereby tracing the propagation path of abnormal traffic. For example, the following Bayesian network model can be constructed:

[0131] ,

[0132] in, represents the i-th node in the network, express By analyzing this probability model, the most likely propagation path of abnormal traffic can be inferred.

[0133] In general, the network traffic intelligent anomaly detection and tracing system provided by the present invention realizes comprehensive analysis and anomaly handling of network traffic through innovative methods such as nonlinear dynamic system mapping, spectral decomposition feature extraction, anomaly detection based on Bessel function, and causal reasoning tracing. The system can not only accurately detect network anomalies, but also track the source of anomalies, providing strong technical support for network security management.

[0134] In another preferred embodiment of the present invention, the abnormality tracing module 6 further includes a graph construction unit 61, a causal reasoning unit 62 and a key node identification unit 63. The coordinated work of these units makes the abnormality tracing process more accurate and efficient.

[0135] The graph construction unit 61 is used to construct a traffic propagation graph based on the anomaly detection results. In practical applications, the traffic propagation graph can be represented by a directed graph, in which nodes represent devices or IP addresses in the network and edges represent the propagation direction of the traffic. Preferably, the graph construction unit 61 can use a dynamic graph construction algorithm to update the traffic propagation relationship in real time. For example, the following graph update rules can be used:

[0136] ,

[0137] in, represents the graph structure at time t, represents the flow size from node to node j, is the preset threshold. This dynamic graph construction method can effectively capture the time-varying characteristics of network traffic.

[0138] In network traffic analysis, it is crucial to understand how traffic propagates in the network. Dynamic graph construction algorithms are used to build and update traffic propagation graphs in real time, which helps capture the time-varying characteristics of network traffic. Graph theory is a branch of mathematics that studies the relationship between points (i.e., graphs). Based on graph theory, dynamic graph construction algorithms reflect real-time changes in network traffic by continuously updating the nodes and edges in the graph. The algorithm can monitor traffic propagation in the network in real time, help identify the propagation path of abnormal traffic, and thus quickly respond to network security incidents.

[0139] The causal reasoning unit 62 is in communication with the graph construction unit 61 and is used to perform causal reasoning on the traffic propagation graph. The causal reasoning method adopted by the present invention not only considers the direct propagation relationship of traffic, but also considers the potential indirect impact.

[0140] Preferably, a structural causal model (SCM) can be used for reasoning. SCM can be expressed as:

[0141] ,

[0142] in, represents the i-th variable, express The direct cause set, Indicates external interference. By analyzing this model, we can infer the possible sources and propagation paths of abnormal traffic.

[0143] In network traffic anomaly tracing, it is necessary not only to know which nodes are affected, but also to understand the source and propagation of these impacts. SCM is a mathematical model used to represent the causal relationship between variables. It not only considers direct causal relationships, but also indirect effects between variables. By applying SCM, the source and propagation path of abnormal traffic can be inferred more accurately, thereby improving the accuracy of anomaly tracing.

[0144] The key node identification unit 63 is in communication with the causal reasoning unit 62, and is used to identify the key attack nodes based on the causal reasoning results. In one embodiment of the present invention, a centrality analysis method can be used to identify the key nodes. For example, the eigenvector centrality of the node can be calculated:

[0145] ,

[0146] in, is the characteristic value, is the adjacency matrix. Nodes with high eigenvector centrality are usually key nodes in the network, which may be attack sources or important propagation nodes.

[0147] In network analysis, identifying key nodes is essential to understanding the network structure and function. Key nodes may be attack sources or important propagation nodes. Eigenvector centrality is a measure of the importance of a node in a network. It is calculated based on the eigenvectors of the adjacency matrix of the node. Nodes with high eigenvector centrality play a more important role in the network. By identifying these nodes, attack sources or important propagation nodes can be located more effectively.

[0148] Furthermore, the system of the present invention further includes a dynamic defense strategy generation module 7, which is in communication with the anomaly detection decision module 5 and the anomaly tracing module 6. The introduction of the dynamic defense strategy generation module 7 enables the system to not only detect and trace anomalies, but also actively generate defense strategies, further improving the practicality of the system.

[0149] The dynamic defense strategy generation module 7 receives the anomaly detection results sent by the anomaly detection decision module 5 and the tracing results sent by the anomaly tracing module 6. Based on these inputs, the module generates a dynamic defense strategy using a deep reinforcement learning algorithm. Preferably, a deep Q-network (DQN) algorithm can be used to achieve dynamic strategy generation. The core of DQN is to minimize the following loss function:

[0150] ,

[0151] in, It’s an instant reward. is the discount factor, is the action-value function, and are the parameters of the current network and the target network respectively. By continuously optimizing this function, the system can learn the optimal defense strategy.

[0152] In network security, it is necessary to dynamically adjust defense strategies according to the real-time network status. DQN is a deep reinforcement learning algorithm that generates strategies by learning the optimal action-value function. DQN uses neural networks to approximate this value function. DQN can adaptively adjust defense strategies according to the dynamic changes of the network, thereby improving the robustness and effectiveness of the system.

[0153] In practical applications, the state This may include current network traffic characteristics, detected anomaly types, and tracing results. This may include adjusting firewall rules, isolating suspicious nodes, redirecting traffic, and other specific defensive measures. It can be defined based on the effectiveness of defense measures (such as the reduced proportion of abnormal traffic). This method based on deep reinforcement learning can adaptively adjust the defense strategy according to the dynamic changes of the network, improving the robustness and effectiveness of the system.

[0154] Finally, the present invention also provides a method for detecting and tracing network traffic anomalies using the above system. The method includes the following steps:

[0155] S1. Receive original network traffic data. This step is usually completed by the input interface of the system, which can receive the traffic data in the network in real time.

[0156] S2. Extract features from the original network traffic data using the Riemann zeta function to generate a feature matrix. This step is completed by the multi-dimensional traffic feature extraction module 1, using the feature extraction algorithm described above.

[0157] S3, embedding the feature matrix into a high-dimensional topological space to generate a topological manifold. This step is completed by the topological feature embedding module 2, using the topological embedding algorithm described above.

[0158] S4, mapping the topological manifold to the nonlinear dynamical system to generate the dynamical system state vector. This step is completed by the nonlinear dynamical system mapping module 3, using the nonlinear dynamical system equations described above.

[0159] S5. Perform spectral decomposition on the power system state vector to extract system features. This step is completed by the spectral decomposition and feature extraction module 4, using the spectral decomposition algorithm described above.

[0160] S6. Based on the system characteristics, use Bessel function to make anomaly detection decisions and output anomaly detection results. This step is completed by the anomaly detection decision module 5, using the decision method based on Bessel function described above.

[0161] S7: If an anomaly is detected, a source tracing analysis is performed based on the anomaly detection result, and a source tracing result is output. This step is completed by the anomaly tracing module 6, using the causal reasoning method described above.

[0162] S8. Generate a dynamic defense strategy based on the anomaly detection results and the traceability results. This step is completed by the dynamic defense strategy generation module 7, using the deep reinforcement learning method described above.

[0163] This method realizes the whole process from raw data input to the final defense strategy generation through systematic and orderly steps. Each step adopts innovative algorithms and methods to ensure the efficiency and accuracy of the whole process. In particular, the advantage of this method lies in its adaptability and comprehensiveness. It can not only accurately detect anomalies, but also conduct traceability analysis and generate corresponding defense strategies, providing a complete solution for network security management.

[0164] In general, the network traffic intelligent anomaly detection and tracing system and method provided by the present invention realizes comprehensive analysis, anomaly detection, tracing analysis and defense strategy generation of network traffic through innovative algorithm design and module combination. The system and method have significant advantages in improving network security, reducing false alarm rate, and accelerating response speed, providing strong technical support for security management in modern complex network environments.

[0165] In order to verify the superiority of the network traffic intelligent anomaly detection and tracing system of the present invention, we conducted a series of experiments and compared it with the traditional anomaly detection method. The following will introduce the experimental process and result analysis of the embodiment and comparative example in detail.

[0166] Example 1: Network traffic intelligent anomaly detection and tracing system of the present invention

[0167] In this embodiment, we use a complete network traffic intelligent anomaly detection and tracing system, including multi-dimensional traffic feature extraction, topological feature embedding, nonlinear dynamic system mapping, spectral decomposition and feature extraction, anomaly detection decision based on Bessel function, and causal reasoning tracing. The system parameters are set as follows:

[0168] 1. The value range of s in the Riemann zeta function: 1.2-1.8;

[0169] 2. Topological embedding space dimension: 100;

[0170] 3. Size of nonlinear dynamic system parameter matrix A: 20x20;

[0171] 4. Bessel function decision threshold β: 0.5;

[0172] Comparative Example 1: Traditional statistical anomaly detection method

[0173] In the comparative example, we adopted a widely used statistical anomaly detection method. The method mainly includes the following steps:

[0174] 1. Extract basic traffic characteristics (such as traffic size, number of packets, flow duration, etc.);

[0175] 2. Calculate the statistics of the features (mean, variance, etc.);

[0176] 3. Use the 3-sigma rule for anomaly detection;

[0177] In order to comprehensively evaluate the system performance, we selected the following indicators for testing:

[0178] 1. Detection Accuracy: The ratio of the number of correctly detected samples to the total number of samples

[0179] 2. False Positive Rate: The proportion of normal samples that are mistakenly judged as abnormal

[0180] 3. False Negative Rate: The proportion of abnormal samples that are not detected

[0181] 4. Tracing Accuracy: The percentage of attacks that are correctly traced back to the source

[0182] 5. Detection Latency: The average time from when an anomaly occurs to when it is detected

[0183] The experimental data set uses the public CICIDS2017 data set, which contains various types of network attack traffic. We randomly selected 100,000 normal traffic and 10,000 abnormal traffic for testing. The experimental results are shown in the following table:

[0184] Performance Indicators System of the present invention Traditional statistical methods Detection accuracy 98.7% 92.3% False Positive Rate 1.2% 5.8% False negative rate 1.5% 7.2% Traceability accuracy 94.5% N / A Detection delay 0.8s 2.3s

[0185] It can be seen from the experimental results that the network traffic intelligent anomaly detection and tracing system of the present invention is significantly superior to the traditional statistical anomaly detection method in all indicators. The specific analysis is as follows:

[0186] 1. Detection accuracy: The detection accuracy of the system of the present invention reached 98.7%, which is 6.4 percentage points higher than the traditional method. This is mainly due to the multi-dimensional feature extraction and nonlinear dynamic system mapping adopted by the system, which can more comprehensively capture the complex characteristics of network traffic.

[0187] 2. False alarm rate and missed alarm rate: The false alarm rate and missed alarm rate of the system of the present invention are 1.2% and 1.5% respectively, which are much lower than the 5.8% and 7.2% of the traditional method. This shows that the system can more accurately distinguish between normal traffic and abnormal traffic, reducing the number of misjudgments. This is mainly due to the anomaly detection decision module based on Bessel function, which can effectively capture small changes in traffic.

[0188] 3. Traceability accuracy: The traceability accuracy of the system of the present invention reaches 94.5%, while the traditional method does not have the traceability function. This highlights the comprehensiveness and advancement of the system in abnormal handling. The high-accuracy traceability capability is due to the causal reasoning method adopted by the system, which can effectively track the propagation path of abnormal traffic.

[0189] 4. Detection delay: The average detection delay of the system of the present invention is only 0.8 seconds, while the traditional method requires 2.3 seconds. This rapid response capability is crucial for real-time network security protection. The significant reduction in detection delay is mainly due to the system's parallel processing architecture and efficient algorithm implementation.

[0190] Through the above analysis, we can conclude that the network traffic intelligent anomaly detection and tracing system of the present invention has significant advantages in detection accuracy, false alarm and missed alarm control, tracing capability and response speed. These advantages mainly come from the innovative algorithm design of the system, such as using Riemann zeta function for feature extraction, using topological feature embedding to retain the high-dimensional relationship of data, using nonlinear dynamic system to capture the complex dynamic behavior of traffic, and making accurate anomaly detection decisions based on Bessel function.

[0191] It is particularly worth mentioning that the system's traceability capability fills the gap in traditional methods and provides a more comprehensive solution for network security management. The traceability accuracy rate of up to 94.5% means that the system can accurately locate the source of the attack in most cases, which is crucial for rapid response and precise defense.

[0192] In summary, the network traffic intelligent anomaly detection and tracing system of the present invention not only greatly surpasses the traditional methods in various performance indicators, but also provides more comprehensive and advanced functions. This comprehensive performance improvement will significantly enhance network security protection capabilities and provide strong technical support for coping with increasingly complex network security threats.

[0193] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. Network traffic intelligent anomaly detection and tracing system, characterized by: include: Multi-dimensional traffic feature extraction module, used for: Receive raw network traffic data; Use Riemann zeta function to extract features from raw network traffic data and generate feature matrix; A topological feature embedding module is communicatively connected to the multi-dimensional traffic feature extraction module and is used to: Receiving a feature matrix sent by the multi-dimensional traffic feature extraction module; Based on the feature matrix, network traffic features are embedded into a high-dimensional topological space to generate a topological manifold; A nonlinear dynamic system mapping module is in communication with the topological feature embedding module and is used to: Receiving the topological manifold sent by the topological feature embedding module; Based on the topological manifold, the topological features are mapped to the nonlinear dynamic system to generate a state vector of the dynamic system; The spectrum decomposition and feature extraction module is in communication with the nonlinear dynamic system mapping module and is used to: Receiving a power system state vector sent by the nonlinear power system mapping module; Performing spectral decomposition on the state vector of the power system to extract system features; The anomaly detection decision module is in communication with the spectrum decomposition and feature extraction module and is used to: Receiving system features sent by the spectrum decomposition and feature extraction module; Based on the system characteristics, Bessel function is used to make anomaly detection decisions and output anomaly detection results.

2. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: The multi-dimensional traffic feature extraction module includes: A characteristic value calculation unit, used for extracting characteristic values ​​from raw network traffic data; A Riemann zeta function mapping unit, which is in communication with the eigenvalue calculation unit and is used for applying the Riemann zeta function to the eigenvalue for mapping; The characteristic matrix generating unit is communicatively connected with the Riemann zeta function mapping unit and is used for generating a characteristic matrix based on the mapping result.

3. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: The topological feature embedding module comprises: A dimension determination unit, used to determine the dimension of the embedding space; A coefficient calculation unit, used to calculate embedding coefficients based on the feature matrix; A topological mapping unit is communicatively connected with the dimension determination unit and the coefficient calculation unit, and is used for embedding the feature matrix into a high-dimensional torus to generate a topological manifold.

4. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: The nonlinear dynamic system mapping module includes: A parameter matrix generating unit, used for generating a system parameter matrix; Nonlinear function unit, used to define nonlinear functions; The power system solving unit is in communication connection with the parameter matrix generating unit and the nonlinear function unit, and is used for solving the nonlinear power system equations and generating a power system state vector.

5. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: The spectrum decomposition and feature extraction module includes: An eigenvalue calculation unit, used to calculate the eigenvalue of the state vector of the power system; An eigenvector calculation unit, used for calculating an eigenvector corresponding to the eigenvalue; The spectral decomposition result generating unit is communicatively connected with the eigenvalue calculating unit and the eigenvector calculating unit, and is used for generating a spectral decomposition result based on the eigenvalue and the eigenvector.

6. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: The anomaly detection decision module includes: Bessel function calculation unit, used to calculate the first kind of zero-order Bessel function; An integral calculation unit, connected in communication with the Bessel function calculation unit, for calculating the integral of the Bessel function; The threshold comparison unit is connected to the integral calculation unit for comparing the integral result with a preset threshold value and outputting an abnormality detection result.

7. The network traffic intelligent anomaly detection and tracing system according to claim 1 is characterized in that: It also includes an anomaly tracing module, which is in communication with the anomaly detection decision module and is used to: Receiving the anomaly detection result sent by the anomaly detection decision module; Based on the anomaly detection result, a causal reasoning method is used to perform source tracing analysis on the abnormal traffic and output the source tracing result.

8. The network traffic intelligent anomaly detection and tracing system according to claim 7, characterized in that: The abnormality tracing module includes: A graph construction unit, used to construct a traffic propagation graph based on anomaly detection results; a causal reasoning unit, communicatively connected to the graph construction unit, and configured to perform causal reasoning on the traffic propagation graph; A key node identification unit is communicatively connected to the causal reasoning unit and is used to identify key attack nodes based on causal reasoning results.

9. The network traffic intelligent anomaly detection and tracing system according to claim 1, characterized in that: It also includes a dynamic defense strategy generation module, which is in communication with the anomaly detection decision module and the anomaly tracing module and is used to: Receive the anomaly detection result sent by the anomaly detection decision module and the tracing result sent by the anomaly tracing module; Based on the anomaly detection results and the tracing results, a dynamic defense strategy is generated using a deep reinforcement learning algorithm.

10. A method for performing network traffic anomaly detection and tracing using the network traffic intelligent anomaly detection and tracing system according to any one of claims 1 to 9, characterized in that: The following steps are involved: S1, receiving raw network traffic data; S2, using Riemann zeta function to extract features from the original network traffic data and generate a feature matrix; S3, embed the feature matrix into a high-dimensional topological space to generate a topological manifold; S4, mapping the topological manifold to the nonlinear dynamic system to generate the state vector of the dynamic system; S5, performing spectral decomposition on the state vector of the power system to extract system characteristics; S6. Based on the system characteristics, use Bessel function to make anomaly detection decisions and output anomaly detection results; S7. If an anomaly is detected, a traceability analysis is performed based on the anomaly detection result, and a traceability result is output; S8. Generate a dynamic defense strategy based on anomaly detection results and tracing results.

Images