Proactive security defense methods based on network traffic time patterns and data volume analysis

Abstract

This invention relates to the field of information data processing technology, and in particular provides a proactive security defense method based on network traffic time pattern and data volume analysis, solving the problem of poor security and reliability in network security defense. The method includes: using a network traffic capture tool to obtain the time pattern and data volume of network traffic corresponding to network nodes; obtaining a model dataset containing time patterns and data volume attack patterns; segmenting the model dataset into a training set, a test set, and a validation set; using the training set to train the proactive security defense model, obtaining the trained proactive security defense model; deploying the proactive security defense model to a regional location, establishing communication with specific devices, analyzing network traffic, obtaining assessment results of potential network attacks, and implementing security protection measures if a network attack is detected. This invention can improve the efficiency of identifying and defending against various network attacks, ensuring network security and stability.

Description

Technical Field

[0001] This invention relates to the field of information data processing technology, and in particular to a proactive security defense method based on network traffic time patterns and data volume analysis. Background Technology

[0002] The primary purpose of network security defense is to protect computer systems, networks, and data from unauthorized access, use, disclosure, damage, modification, or interference. Common network security defense measures include firewalls, intrusion detection systems, intrusion prevention systems, antivirus software, encryption technologies, and authentication and access control. While these measures can effectively defend against conventional network attacks to a certain extent, they also face challenges and limitations as network threats continue to evolve. For example, traditional firewalls, intrusion detection systems, and intrusion prevention systems typically rely on predefined rules and signatures, making them ill-equipped to handle new and complex attacks. Furthermore, they are primarily passive defenses, relying on detection and response after an attack occurs, lacking proactive prediction and defense capabilities.

[0003] Existing technology 1, Chinese patent application number: 202010188489.5, discloses a cloud-based proactive immune security defense method and device. The main steps include: an immune library management module establishing a mirror virtual machine system within the cloud that is completely identical to the instance system outside the cloud in its initial state; an immune cleaning module pushing the cloud-based mirror system to the instance system outside the cloud for replacement, maintaining complete consistency between the operation and maintenance instance system and the cloud-based mirror system, while identifying inconsistent heterogeneous software; an immune update module performing a security upgrade on the cloud-based mirror system; and an immune agent module running in the instance system outside the cloud in a hardware remote boot state, receiving cleaning instructions from the cloud-based immune cleaning module and executing cleaning actions. While this method achieves high system security, reduces the risk of continuous penetration and intrusion by advanced threats due to long-term exposure of the system's attack surface to the network and operational environments, identifies backdoors, Trojans, and other abnormal programs in a whitelist, periodically restores the system to its initial state, and provides one-way isolation between the cloud and the endpoint, achieving proactive immunity, it requires a large number of deployed devices, increasing defense costs. Furthermore, the passive defense approach results in poor defense effectiveness and slow response times.

[0004] Prior art two, Chinese patent application number 202110026307.9, discloses a method, apparatus, storage medium, and electronic device for dynamic security protection. The method includes: responding to a first access request by acquiring visitor information and access device information; the first access request being used to access a target resource set; determining whether to allow the visitor to access the target resource set based on the visitor information and access device information; if access is allowed, generating access evaluation information based on the visitor information and access device information; the access evaluation information dynamically changing according to the visitor's access behavior; acquiring a second access request and responding to the second access request based on the access evaluation information; the second access request being used to access resources in the target resource set. While this method can achieve proactive security defense, its defense process is relatively complex, has a low level of intelligence, lacks autonomy in defense, and to some extent affects the efficiency of network security defense.

[0005] Prior art three, Chinese patent application number 202110651977.X, discloses a website security defense system and method with active defense capabilities. The system includes an input end, a processing end, an output end, and a feedback end. The input end includes N parallel data receiving channels and a feedback data input channel. The processing end includes multiple data encoding channels for encoding network input data received by the data receiving channels, generating encoded channel data. Multiple encoding prediction models at the processing end use the encoded channel data as input, and the encoding prediction models output multiple security prediction results, which are sent to the output end. The output end filters the multiple security prediction results according to preset conditions, sending at least one selected security prediction result to the feedback end. When the selected security prediction result meets the preset conditions, the processing end updates the encoding prediction model. Although this method can efficiently achieve active website defense and dynamic feedback updates, it is primarily a passive network security defense, lacking initiative, indicating that the network security defense technology needs further improvement.

[0006] Current technologies 1, 2, and 3 lack proactive technical means for network security defense, which affects not only the security of network security defense but also its reliability. Therefore, this invention provides a proactive security defense method based on network traffic time patterns and data volume analysis. Summary of the Invention

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] In one aspect, the present invention provides a proactive security defense method based on network traffic time pattern and data volume analysis, which uses a proactive security defense model to capture abnormal patterns and obtain data on local anomalies and global anomalies.

[0009] Local and global outliers are aligned according to their timestamps. Based on the degree of anomalousness of local and global outliers, their respective weights are calculated. Local and global outliers are then weighted and merged to generate a comprehensive outlier. The degree of anomalousness of the comprehensive outlier is the weighted sum of the degree of anomalousness of the local and global outliers.

[0010] Hierarchical clustering is performed using local and global outliers as initial cluster centers. Based on the feature similarity between outliers, multiple outlier clusters are generated, each representing a similar outlier pattern. The mean of each outlier cluster is used for comprehensive evaluation to calculate its outlier degree. Based on the characteristics of the outlier cluster, its local or global outlier type is determined. Based on the comprehensive evaluation results, the final outlier pattern is generated, and each outlier pattern includes the outlier's timestamp, outlier degree, outlier type, and possible cause analysis.

[0011] A proactive security defense model is used to analyze network traffic and obtain assessment results of network attacks. Based on the prediction results of its time series prediction layer, the proactive security defense model dynamically sets the threshold for anomaly detection in its anomaly detection layer. In the anomaly detection layer of the proactive security defense model, real-time traffic data is compared and analyzed with the prediction results at multiple levels to identify traffic behaviors that deviate significantly from the prediction results. Time series analysis is performed on the traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are then clustered to classify different categories of abnormal behaviors and distinguish between different types of abnormal behaviors.

[0012] In one optional implementation, the future traffic prediction results generated by the time series prediction layer of the proactive security defense model are transformed into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependence and periodicity features of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model.

[0013] In the anomaly detection layer, real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type. These features are then fused with the high-dimensional feature vectors transmitted from the time series prediction layer to form a comprehensive feature space.

[0014] Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the threshold for anomaly detection. In the anomaly detection layer, real-time traffic data is compared and analyzed with the prediction results at multiple levels to identify traffic behaviors that deviate significantly from the prediction results. Time series analysis is performed on the traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are clustered and classified into different categories to distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning.

[0015] In one alternative implementation, the process of identifying traffic behavior that deviates significantly from the predicted results includes the following steps:

[0016] The anomaly detection layer performs a preliminary comparison between real-time traffic data and the prediction results of the time series prediction layer. Based on a preset threshold, it determines whether the traffic data deviates significantly from the normal range. Then, by sliding the time window, it performs a local comparison of the traffic data to identify abnormal fluctuations in a short period of time. Combined with historical traffic data, it performs a global comparison to capture abnormal changes in long-term trends.

[0017] By extracting time-series features, network traffic data is analyzed over time to extract features such as the size, rate of change, and fluctuation amplitude of network traffic, reflecting the current state of network traffic and including the time dependence and periodicity of historical traffic patterns. Through feature extraction, network traffic data is transformed into a high-dimensional time-series feature vector.

[0018] Local pattern recognition is performed on time-series features to capture local anomalies in network traffic data; global pattern recognition is performed on time-series features to capture long-term abnormal trends in network traffic data, thereby achieving the capture of abnormal patterns.

[0019] In one alternative implementation, the process of capturing abnormal patterns includes the following steps:

[0020] Acquire data on local anomalies, including timestamps, anomaly severity, and anomaly characteristics; simultaneously acquire data on global anomalies, including timestamps, anomaly severity, and anomaly characteristics.

[0021] Local and global outliers are aligned according to their timestamps. Based on the degree of anomalousness of local and global outliers, their respective weights are calculated. Local and global outliers are then weighted and merged to generate a comprehensive outlier. The degree of anomalousness of the comprehensive outlier is the weighted sum of the degree of anomalousness of the local and global outliers.

[0022] Hierarchical clustering is performed using local and global outliers as initial cluster centers. Based on the feature similarity between outliers, multiple outlier clusters are generated, each representing a similar outlier pattern. The mean of each outlier cluster is used for comprehensive evaluation to calculate its degree of anomalousness. Based on the characteristics of the outlier cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final outlier pattern is generated, and each outlier pattern includes the timestamp of the anomaly, the degree of anomaly, the anomaly type, and an analysis of possible causes of the anomaly.

[0023] In one optional implementation, the proactive security defense model adopts a multi-layered construction approach, including the following steps:

[0024] An autoregressive integral moving average (ARM) model is employed to predict future traffic trends by capturing the autocorrelation and moving average characteristics of time series data. Historical traffic data is cleaned, normalized, and differencing, and grid search is used to optimize the parameters of the ARM model. K-fold cross-validation is used to evaluate the performance of the ARM model on different data subsets. A rolling forecasting method is employed to continuously update the ARM model using the latest historical traffic data, generating traffic forecast results for a future period.

[0025] An isolated forest model is adopted. By randomly partitioning the data space, anomalies are identified, and abnormal samples of DDoS attack traffic and malicious scanning traffic are extracted from historical data to construct the training set for the anomaly detection model. Traffic size, packet length distribution, and protocol type features are extracted from traffic data and used as inputs to the anomaly detection model. The model parameters are optimized by training with abnormal samples. Real-time network traffic data is input into the anomaly detection model to perform real-time anomaly detection, generate anomaly scores, and assess the severity of abnormal behavior in real-time traffic data.

[0026] The multi-level model is divided into a time series prediction layer and an anomaly detection layer, forming a bottom-up hierarchical structure. The time series prediction model and the anomaly detection model are designed as independent modules, and the prediction results of the time series prediction model are used as the input of the anomaly detection model to realize data flow between layers. In the anomaly detection layer, real-time traffic data is compared with the prediction results to identify abnormal traffic behaviors that do not match the prediction results. The anomaly detection results are fed back to the time series prediction layer to update the prediction model.

[0027] The multi-level model is jointly trained using the training set to optimize the parameters of each level; the parameters of the multi-level model are continuously updated based on real-time analysis results.

[0028] In one optional implementation, the training process of the proactive security defense model includes the following steps:

[0029] Based on time series analysis, dynamic features including traffic change rate and data volume growth rate are generated to capture short-term and long-term trends in network traffic.

[0030] A multi-layered proactive security defense model is constructed by integrating a time series prediction model and an anomaly detection model. The time series prediction model is used to predict the future trend of normal network traffic. The anomaly detection model is used to identify abnormal traffic behavior that does not match the prediction results. The multi-layered model is trained using a training set to optimize the parameters of the proactive security defense model.

[0031] The trained proactive security defense model is deployed to network nodes to analyze network traffic in real time and generate assessment results of potential network attacks. Based on the real-time analysis results, the security protection strategy is dynamically adjusted. The real-time analysis results are fed back to the training layer of the proactive security defense model to dynamically update the parameters of the proactive security defense model.

[0032] In one optional implementation, the process of obtaining the training set includes the following steps:

[0033] By using intelligent sensing networks, the time patterns and data volume of network traffic can be captured in real time, while potential attack patterns can be identified and recorded. By fusing multi-source data, a dynamic and comprehensive model dataset can be constructed.

[0034] The system analyzes the model dataset according to time series, automatically identifies and divides time windows with similar characteristics; identifies and segments different traffic patterns between weekdays and weekends; groups data of the same attack type in the same region into a single slice; and automatically identifies and clusters similar attack patterns, classifying and categorizing them.

[0035] It automatically detects outliers and missing values ​​in the dataset and uses generative adversarial networks to generate alternative data; it then adaptively adjusts the segmentation strategy based on the validation results.

[0036] In one alternative implementation, the process of adaptively adjusting the segmentation strategy includes the following steps:

[0037] Analyze the performance of the validation set, including key metrics such as accuracy, recall, and F1 score, to identify which types of data the model fails to meet the standard, and which attack patterns or time windows fail to achieve the expected prediction results.

[0038] Detect outliers and classification errors in the dataset, use clustering algorithms to classify the outlier data, and identify which anomalies are caused by improper data segmentation;

[0039] Re-evaluate the division of time windows to ensure that time windows with similar features are correctly divided into the same dataset; re-cluster similar attack patterns to ensure that attack data of the same type are concentrated in one slice; generate alternative data through generative adversarial networks to balance the proportion of attack types and normal traffic in the dataset and ensure that the model can be trained on different types of data.

[0040] In one optional implementation, network traffic is collected by a network traffic capture tool deployed at a network node of a specific device. The network traffic capture tool is used to obtain the time pattern and data volume of the network traffic corresponding to the network node. The process of deploying at least one network traffic capture tool includes the following steps:

[0041] Initialize the network interface of the specific device, and then create the process of the network node deployed by the network traffic capture tool. The process runs in the application of the specific device; establish communication between the specific device and the core network through the process, and send network traffic collection commands to the network traffic capture tool.

[0042] The network between specific devices and the core network is divided into several equally spaced segments, and the midpoint of each segment is set as the network node for deploying network traffic capture tools; an objective function for the average absolute and relative error of network traffic capture time is established to determine the deployment location of the network traffic capture tools.

[0043] Once the deployment location is confirmed, the deployment location and the identifier of the network traffic capture tool are sent to the application on the specific device for storage.

[0044] In one alternative implementation, after the application sent to the specific device is stored, the following steps need to be performed:

[0045] Initialization and Configuration of Network Traffic Capture Tool: During the initialization phase, the network traffic capture tool obtains key parameters of the current network environment through external interfaces. These key parameters include network topology, bandwidth utilization, and device connection status.

[0046] Network traffic capture tools automatically adjust configuration parameters, including dynamically selecting network interfaces and optimizing capture intervals, or adjusting packet size limits based on network load.

[0047] Network traffic capture tools analyze the current operating system and hardware configuration to automatically identify and load drivers; monitor driver performance in real time and dynamically switch or upgrade them.

[0048] This invention acquires the location of monitored areas for complete network defense. By deploying network traffic capture tools at network nodes of specific devices, it can obtain real-time network traffic time patterns and data volumes, enabling real-time monitoring of network activity. By analyzing the time patterns and data volumes of traffic, it can identify abnormal traffic behaviors, such as DDoS attacks and brute-force attacks, providing data support for subsequent defense measures. The invention automatically acquires network traffic time patterns and data volumes captured by the network traffic capture tools according to a preset period, reducing manual intervention and improving the efficiency and accuracy of data collection. The acquired time patterns, data volumes, and attack patterns are integrated into a model dataset, providing rich data support for model training. The model dataset is divided into training, testing, and validation sets to ensure the scientific rigor and reliability of model training and validation. The proactive security defense model is trained using a training set. This training enables the model to learn and recognize various network attack patterns, improving its accuracy and generalization ability. The trained proactive security defense model is then deployed to specific locations and communicates with specific devices, enabling real-time analysis of network traffic and rapid identification of potential network attacks. When a network attack is detected, corresponding security protection measures are automatically taken, such as blocking the attack source and isolating the attacked device, to ensure network security and stability. Attached Figure Description

[0049] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0050] Figure 1 This is a flowchart of the proactive security defense method based on network traffic time pattern and data volume analysis provided in Embodiment 1 of the present invention;

[0051] Figure 2 This is a process diagram of deploying at least one network traffic capture tool as provided in Embodiment 2 of the present invention;

[0052] Figure 3 This is a diagram illustrating the process of storing the application sent to a specific device as provided in Embodiment 3 of the present invention.

[0053] Figure 4 This is a diagram illustrating the process of segmenting the model dataset to obtain the training set, test set, and validation set, as provided in Embodiment 4 of the present invention.

[0054] Figure 5 This is a process diagram of adaptively adjusting the segmentation strategy provided in Embodiment 5 of the present invention;

[0055] Figure 6This is a flowchart illustrating the process of obtaining the trained active security defense model provided in Embodiment 6 of the present invention.

[0056] Figure 7 This is a process diagram of constructing a multi-layered proactive security defense model provided in Embodiment 7 of the present invention;

[0057] Figure 8 This is a process diagram of forming a bottom-up hierarchical structure provided in Embodiment 8 of the present invention;

[0058] Figure 9 This is a process diagram for identifying traffic behavior that significantly deviates from the prediction results, provided in Embodiment 9 of the present invention;

[0059] Figure 10 This is a flowchart illustrating the process of capturing abnormal patterns provided in Embodiment 10 of the present invention;

[0060] Figure 11 A block diagram of the electronic device provided by the present invention;

[0061] Figure 12 A block diagram of a computer-readable storage medium provided for this invention. Detailed Implementation

[0062] The technical solutions of the present invention will now be described with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0063] Hereinafter, the terms "first," "second," etc., are used for descriptive convenience only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0064] In this invention, unless otherwise explicitly specified and limited, the term "connection" should be interpreted broadly. For example, "connection" can be a fixed mechanical connection, a detachable mechanical connection, or an integral part; or, "connection" can be a direct connection or an indirect connection through an intermediate medium. Furthermore, unless otherwise explicitly specified and limited, the term "coupling" should be interpreted broadly. For example, "coupling" can be a direct electrical connection, such as physical contact and electrical conduction between two components; it can also be understood as an electrical connection between different components in a circuit structure through physical lines capable of transmitting electrical signals, such as copper foil or wires on a printed circuit board (PCB), to transmit electrical signals; or, "coupling" can be an indirect electrical connection between two components through an intermediate medium; or, "coupling" can be an electrical connection between two components in a non-contact manner, such as an electrical connection between two components using capacitive coupling to transmit electrical signals.

[0065] In this embodiment of the invention, directional terms such as "up," "down," "left," and "right" may be defined relative to the orientation of the components shown in the accompanying drawings. It should be understood that these directional terms can be relative concepts, used for relative description and clarification, and can change accordingly depending on the orientation of the components in the accompanying drawings.

[0066] The embodiments of this invention can be widely applied to various scenarios requiring real-time monitoring and defense against network attacks, such as: enterprise internal networks: protecting enterprise internal networks from external attacks; data centers: ensuring high availability and data security of data centers; cloud service providers: ensuring the security and stability of cloud services; financial institutions: preventing the theft or tampering of financial data. Through the method of this invention, real-time monitoring and intelligent analysis of network traffic can be achieved, enabling timely detection and defense against potential network attacks, thereby improving network security and reliability.

[0067] Example 1:

[0068] like Figure 1 As shown, this embodiment of the invention provides a proactive security defense method based on network traffic time patterns and data volume analysis, comprising the following steps:

[0069] Step S100: Obtain the location of the monitored area for complete network defense, obtain the specific device being monitored from the location, and deploy at least one network traffic capture tool at the network node of the specific device. The network traffic capture tool is used to obtain the time pattern and data volume of the network traffic corresponding to the network node.

[0070] Traffic temporal patterns refer to the distribution of network traffic at different times. Under normal circumstances, network traffic follows certain patterns, such as higher traffic during peak hours on weekdays and lower traffic at night or on weekends. By analyzing traffic temporal patterns, abnormal traffic behavior can be identified. For example, if traffic suddenly increases significantly within a certain period of time, and this increase does not conform to normal work or business patterns, it may be a sign of an attack, such as a DDoS attack (Distributed Denial of Service attack). If traffic suddenly decreases significantly during normal peak hours, it may be that the network has been taken over by attackers, preventing normal traffic from passing through. If traffic exhibits abnormal periodic fluctuations, it may be that attackers are using automated tools to conduct periodic scans or attacks.

[0071] Data volume refers to the total amount of data transmitted over a network within a specific time period. The size of the data volume can reflect the intensity and nature of network activity. By analyzing the data volume of traffic, the following anomalies can be identified: If an IP address transmits a large amount of data in a short period of time, it may be that the IP address is launching an attack, such as brute-force attack or data theft; if the data volume of a certain network protocol (such as HTTP, FTP, etc.) suddenly increases significantly, and this increase does not meet normal business needs, it may be that attackers are using this protocol for malicious activities; if a large number of abnormally large data packets appear in the network (such as extremely small or extremely large data packets), it may be that attackers are trying to bypass security detection or launch a data overflow attack.

[0072] Step S200: Automatically acquire the time pattern and data volume of network traffic captured by the network traffic capture tool according to a preset cycle, as well as the corresponding attack pattern, and obtain a model data set containing the time pattern and data volume attack pattern. Then, divide the model data set to obtain the training set, test set and validation set.

[0073] Step S300: Train the proactive security defense model using the training set to obtain the trained proactive security defense model; deploy the proactive security defense model to the area location, establish communication with specific devices, analyze network traffic, obtain the assessment results of potential network attacks, and take security protection measures to protect against network attacks if they exist.

[0074] In the above embodiments, step S100 obtains the location of the monitored area for complete network defense. By deploying network traffic capture tools at network nodes of specific devices, the time pattern and data volume of network traffic can be obtained in real time, enabling real-time monitoring of network activities. By analyzing the time pattern and data volume of traffic, abnormal traffic behaviors, such as DDoS attacks and brute-force attacks, can be identified, providing data support for subsequent defense measures. Step S200 automatically obtains the time pattern and data volume of network traffic captured by the network traffic capture tool according to a preset period. Automatically obtaining network traffic data through a preset period reduces manual intervention and improves the efficiency and accuracy of data collection. The obtained time pattern, data volume, and attack pattern are integrated into a model dataset, providing rich data support for model training. The model dataset is divided into training, testing, and validation sets to ensure the scientific nature and reliability of model training and validation. Step S300 uses a training set to train the proactive security defense model. By using the training set to train the proactive security defense model, the model can learn and identify various network attack patterns, improving the model's accuracy and generalization ability. The trained proactive security defense model is deployed to regional locations and establishes communication with specific devices, enabling real-time analysis of network traffic and rapid identification of potential network attacks. When a network attack is identified, corresponding security protection measures are automatically taken, such as blocking the attack source and isolating the attacked device, to ensure network security and stability.

[0075] In summary, this embodiment, by acquiring and analyzing network traffic data in real time, can promptly detect and identify abnormal network behavior; through automated data collection, model training, and real-time analysis, it can quickly respond to network attacks and automatically take protective measures; through the learning and recognition of AI models, it can improve the efficiency of identifying and defending against various network attacks, ensuring network security and stability. It not only improves the automation level of network security defense but also enhances the accuracy and response speed of defense, effectively protecting the network from various attack threats.

[0076] Example 2:

[0077] like Figure 2 As shown, based on Embodiment 1, the process of deploying at least one network traffic capture tool in step S100 of this embodiment of the invention includes the following steps:

[0078] Step S101: Initialize the network interface of the specific device. After initialization, create the process of the network node deployed by the network traffic capture tool. The process runs in the application of the specific device. Establish communication between the specific device and the core network through the process and send network traffic collection instructions to the network traffic capture tool.

[0079] Step S102: Divide the network between the specific device and the core network into several equally spaced segments, and set the midpoint of each segment as the network node for deploying the network traffic capture tool; establish the objective function of the average absolute relative error of the network traffic capture time, and determine the deployment location of the network traffic capture tool;

[0080] The objective function for the mean absolute relative error of network traffic capture time is expressed as follows:

[0081]

[0082] The error in network traffic capture time is expressed as:

[0083] Δt i =t i -t ideal

[0084] Network latency d i The impact on network traffic capture time, and the error, can be further expressed as:

[0085] Δt i =t i -t ideal +d i

[0086] Considering the distribution of network traffic f(p) i ), and the error term Δt i Further details:

[0087]

[0088] The mean absolute relative error (MARE) is expressed as:

[0089]

[0090] In the formula, t i p represents the network traffic capture time of the i-th network node. i f(p) represents the deployment location of the i-th network node. i ) indicates network traffic at location p i The distribution function at Δt i The error in network traffic capture time for the i-th network node is represented by d, where N represents the total number of network nodes. i Let p represent the network latency of the i-th network node, and p represent the deployment location vector of the network node, where P = [p1, p2, ..., p]. N ], where T represents the network traffic capture time vector, T = [t1, t2, ..., t N ], where D represents the network delay vector, D = [d1, d2, ..., d N ], tideal It is the ideal network traffic capture time, represented by matrix w, where w ij This represents the influence weight of the i-th network node on the j-th network node; the expression combines the distribution of network traffic, deployment location, network latency, mutual influence between network nodes, and the importance of different locations, ensuring that the deployment location of the network traffic capture tool can minimize the error in capture time.

[0091] Step S103: After confirming the deployment location, send the deployment location and the identifier of the network traffic capture tool to the application of the specific device for storage.

[0092] In the above embodiments, step S101 initializes the network interface of the specific device to ensure that the device can access the network normally and creates a process for deploying the network traffic capture tool; this ensures the establishment of a communication channel between the device and the core network, providing a basis for sending traffic collection commands; the process sends network traffic collection commands to the network traffic capture tool, ensuring that the tool can start capturing network traffic and providing raw data for data analysis and processing. Step S102 divides the network between the specific device and the core network into several equally spaced segments, and deploys the network traffic capture tool at the midpoint of each segment; this ensures uniform capture of network traffic and avoids traffic overload or omission problems that may occur at a single node; by establishing an objective function for the average absolute relative error of network traffic capture time, the deployment position of the network traffic capture tool is optimized, ensuring that the captured traffic data has high accuracy and reliability. After confirming the deployment location, step S103 sends the deployment location and the identifier of the network traffic capture tool to the application of the specific device for storage; this ensures the persistence and traceability of the deployment information, facilitating subsequent management and maintenance; at the same time, the stored identifier information also provides convenience for the identification and invocation of the tool, ensuring that the network traffic capture tool can operate stably and continuously provide data.

[0093] Example 3:

[0094] like Figure 3 As shown, based on Embodiment 2, the application sent to the specific device in step S103 of this embodiment of the invention needs to perform the following steps after storage:

[0095] Step S1031: Initialization and configuration of the network traffic capture tool. During the initialization phase, the network traffic capture tool obtains key parameters of the current network environment through an external interface. These key parameters include network topology, bandwidth utilization, and device connection status.

[0096] Step S1032: The network traffic capture tool automatically adjusts configuration parameters, including dynamically selecting network interfaces and optimizing capture time intervals, or adjusting packet size limits according to network load.

[0097] Step S1033: The network traffic capture tool automatically identifies and loads drivers by analyzing the current operating system and hardware configuration; it monitors the performance of drivers in real time and performs dynamic switching or upgrades.

[0098] In the above embodiments, step S1031, the initialization and configuration of the network traffic capture tool, obtains key parameters of the network environment through an external interface, such as network topology, bandwidth utilization, and device connection status. These parameters provide basic data for configuration and optimization. The network traffic capture tool can perform initial configuration according to the current network environment, ensuring normal startup and operation under different network conditions. Step S1032: The network traffic capture tool automatically adjusts configuration parameters. Based on network load and demand, it automatically selects the most suitable network interface for data capture, ensuring the efficiency and accuracy of the capture process. It dynamically adjusts the capture time interval according to network traffic conditions to avoid over-capturing and resource waste, while ensuring the integrity of the captured data. It also dynamically adjusts the packet size limit according to network load conditions to ensure a moderate amount of captured data, neither too much nor too little. Step S1033: The network traffic capture tool analyzes the current operating system and hardware configuration, automatically identifies and loads drivers, ensuring compatibility and performance between the capture tool and the hardware. It monitors driver performance in real time and dynamically switches or upgrades as needed, ensuring the capture tool always runs in optimal condition and avoiding performance bottlenecks or data loss due to driver issues. Through these steps, network traffic capture tools can not only adapt to different network environments and hardware configurations, but also dynamically adjust according to real-time conditions, ensuring the efficiency, accuracy, and stability of the capture process.

[0099] Example 4:

[0100] like Figure 4 As shown, based on Example 1, the process of dividing the training set, test set, and validation set from the model dataset in step S200 of this embodiment of the invention includes the following steps:

[0101] Step S201: Through the intelligent sensing network, capture the time pattern and data volume of network traffic in real time, identify and record potential attack patterns, and construct a dynamic and comprehensive model data set through the fusion of multi-source data;

[0102] Step S202: Analyze the model dataset according to time series, automatically identify and divide time windows with similar characteristics; identify and segment different traffic patterns on weekdays and weekends; for the same attack type in the same region, concentrate the data in one slice; automatically identify and cluster similar attack patterns, identify and classify them;

[0103] Step S203: Automatically detect outliers and missing values ​​in the dataset and generate alternative data using a generative adversarial network; adaptively adjust the segmentation strategy based on the validation results.

[0104] In the above embodiments, step S201, through an intelligent sensing network, can capture the time patterns and data volume of network traffic in real time, ensuring the timeliness and freshness of the data; through the fusion of multi-source data, a dynamic and comprehensive model dataset is constructed, ensuring the diversity and coverage of the dataset; potential attack patterns are identified and recorded, providing basic data for security analysis and defense. Step S202, through analysis of time series, automatically identifies and divides time windows with similar characteristics, which helps to deeply understand changes in traffic patterns; identifies and segments different traffic patterns on weekdays and weekends, which helps to analyze security threats in different time periods; automatically identifies and clusters similar attack patterns, identifying and classifying them, which helps to systematically analyze and respond to various attack types. Step S203 automatically detects outliers and missing values ​​in the dataset, ensuring the integrity and accuracy of the dataset; uses generative adversarial networks to generate alternative data to fill in missing values, enhancing the richness and diversity of the dataset; and adaptively adjusts the segmentation strategy based on the verification results, ensuring the scientific nature and effectiveness of the segmentation strategy. This ensures the high quality and high availability of the model dataset, providing a solid foundation for subsequent training, testing, and verification.

[0105] Example 5:

[0106] like Figure 5 As shown, based on Example 4, the process of adaptively adjusting the segmentation strategy in step S203 of this embodiment of the invention includes the following steps:

[0107] Step S2031: Analyze the performance of the validation set, including key indicators such as accuracy, recall and F1 score, and identify which types of data the model does not meet the standard, as well as which attack patterns or time windows do not meet the prediction effect.

[0108] Step S2032: Detect outliers and classification errors in the dataset, use clustering algorithms to classify the outlier data, and identify which anomalies are caused by improper data segmentation;

[0109] The clustering algorithm expression is as follows:

[0110]

[0111] In the formula, D = {d1, d2, ..., d} k} represents the model data set, where d k Let E = {e1, e2, ..., e} represent the k-th data sample. m} represents the abnormal data set, where e m Let C represent the m-th outlier, where C = {c1, c2, ..., c...} l} represents the clustering result set, where c l Let A represent the l-th cluster; A = {a1, a2, ..., a...} p} represents the set of outliers caused by improper data partitioning, where a p This represents the p-th outlier caused by improper data partitioning; T = {t1, t2, ..., t} q} represents the set of time windows, where t q This represents the q-th time window; F = {f1, f2, ..., fq} s Let f be the feature set, where f s Let represent the s-th feature; `belongs to(e,c)` indicates whether the outlier data `e` belongs to cluster `c`, and `dynamicfeature(e,z) ≠ dynamic feature(c,z)` means that the dynamic feature of data sample `e` in time or context `z` is inconsistent with the dynamic feature of its category `c` in the same time or context. For each outlier data in the outlier data set, determine whether it belongs to a certain cluster; determine whether the cluster is consistent with the segmentation strategy of the current time window; further determine whether the dynamic feature of the outlier data in the time window is consistent with the dynamic feature of the cluster in the time window; if the cluster is inconsistent with the segmentation strategy of the current time window, and the dynamic feature of the outlier data in the time window is inconsistent with the dynamic feature of the cluster in the time window, then classify the outlier data as outlier data caused by improper data segmentation and add it to the set; in this way, outlier data caused by improper data segmentation can be identified more accurately, and corresponding adjustments and processing can be performed;

[0112] Step S2033: Re-evaluate the division of time windows to ensure that time windows with similar features are correctly divided into the same dataset; re-cluster similar attack patterns to ensure that attack data of the same type are concentrated in one slice; generate alternative data through generative adversarial networks to balance the proportion of attack types and normal traffic in the dataset and ensure that the model can be trained on different types of data.

[0113] In the above embodiments, step S2031, validation set performance analysis, quantifies the model's performance on the validation set using key indicators such as accuracy, recall, and F1 score, providing clear data support for adjustments; it identifies poor model performance on specific types of data and poor prediction results in certain attack patterns or time windows, providing direction for adjustments. Step S2032, anomaly detection and classification, classifies abnormal data using clustering algorithms, identifying outliers and classification errors in the dataset, especially anomalies caused by improper data segmentation; it clarifies which anomalies are caused by improper data segmentation strategies, providing a basis for subsequent strategy adjustments. Step S2033, segmentation strategy adjustment, re-evaluates the division of time windows, ensuring that time windows with similar characteristics are correctly segmented into the same dataset, improving the internal consistency of the dataset; it re-clusters similar attack patterns, ensuring that attack data of the same type is concentrated in one slice, avoiding model confusion between different types of attacks during training; it generates alternative data using generative adversarial networks (GANs), balancing the proportion of attack types and normal traffic in the dataset, ensuring that the model can be adequately trained on different types of data, improving the model's generalization ability.

[0114] In summary, this embodiment improves the model's accuracy, recall, and F1 score on the validation set by optimizing the data segmentation strategy, thereby enhancing the model's predictive ability. It also enhances the model's robustness to different data types by balancing the proportion of attack types and normal traffic in the dataset. Furthermore, it improves the internal consistency and quality of the dataset by optimizing time window partitioning and attack pattern clustering, providing a higher-quality data foundation for model training. These steps ensure that the model's dataset segmentation strategy can be adaptively optimized, thus improving the model's overall performance and generalization ability.

[0115] Example 6:

[0116] like Figure 6 As shown, based on Example 1, the process of obtaining the trained active security defense model in step S300 of this embodiment of the invention includes the following steps:

[0117] Step S301: Based on time series analysis, generate dynamic features including traffic change rate and data volume growth rate to capture short-term and long-term trends in network traffic.

[0118] Step S302: Integrate the proactive security defense model using a multi-layered model, combining the time series prediction model and the anomaly detection model to construct a multi-layered proactive security defense model; the time series prediction model is used to predict the future trend of normal network traffic; the anomaly detection model is used to identify abnormal traffic behavior that does not match the prediction results; train the multi-layered model using the training set to optimize the parameters of the proactive security defense model.

[0119] Step S303: Deploy the trained proactive security defense model to network nodes, analyze network traffic in real time, and generate assessment results of potential network attacks; dynamically adjust security protection strategies, such as traffic restriction, IP blocking, and protocol filtering, based on the real-time analysis results; feed the real-time analysis results back to the training layer of the proactive security defense model to dynamically update the parameters of the proactive security defense model.

[0120] In the above embodiments, step S301 generates dynamic features based on time series analysis. Through time series analysis, the model can effectively capture the short-term and long-term trends of network traffic, which helps to identify changes in traffic patterns, such as traffic surges during peak hours or traffic decreases during off-peak hours. The dynamic features generated by the model (such as traffic change rate and data volume growth rate) provide a rich data foundation for subsequent prediction and anomaly detection. These features can reflect the real-time status of network traffic and help the model better understand and predict network behavior. Step S302 adopts a multi-layered model to integrate the proactive security defense model. The time series prediction model can predict the future trend of normal network traffic, helping the model to identify potential traffic anomalies in advance. By predicting future trends, the model can take preventive measures before anomalies occur. The anomaly detection model can identify abnormal traffic behavior that does not match the prediction results, which helps to quickly discover potential network attacks. The efficiency of the anomaly detection model directly affects the response speed and accuracy of security defense. By training the multi-layered model using a training set, the parameters of the proactive security defense model can be optimized, improving the overall performance and stability of the model. The optimized parameters make the model more efficient and reliable in practical applications. Step S303 involves deploying the trained proactive security defense model and analyzing network traffic in real time. After deploying the trained proactive security defense model to network nodes, the model can analyze network traffic in real time, generate assessment results of potential network attacks, and its real-time monitoring capability enables the security team to respond quickly to network threats and reduce the losses caused by attacks. Based on the real-time analysis results, the model can dynamically adjust security protection strategies, such as traffic limiting, IP blocking, and protocol filtering. This dynamic adjustment capability makes security defense more flexible and adaptable, and can cope with constantly changing network threats. The real-time analysis results are fed back to the training layer of the proactive security defense model for dynamic updates to model parameters. This continuous optimization mechanism ensures that the model can continuously adapt to new network environments and attack methods, maintaining its efficiency and accuracy. Through these steps, the proactive security defense model can not only effectively identify and respond to network threats, but also continuously optimize its own performance, providing strong protection for network security.

[0121] Example 7:

[0122] like Figure 7As shown, based on Example 6, the process of constructing a multi-layered proactive security defense model in step S302 of this embodiment of the invention includes the following steps:

[0123] Step S3021: An autoregressive integral moving average model is used to predict future traffic trends by capturing the autocorrelation and moving average characteristics of time series data; historical traffic data is cleaned, normalized, and differencing; grid search is used to optimize the parameters of the autoregressive integral moving average model; K-fold cross-validation is used to evaluate the performance of the autoregressive integral moving average model on different data subsets; a rolling forecasting method is used to continuously update the autoregressive integral moving average model using the latest historical traffic data to generate traffic forecast results for a future period.

[0124] Step S3022: Using the Isolation Forest model, anomalies are identified by randomly partitioning the data space. Anomalies such as DDoS attack traffic and malicious scanning traffic are extracted from historical data to construct a training set for the anomaly detection model. Features such as traffic size, packet length distribution, and protocol type are extracted from traffic data and used as input to the anomaly detection model. Anomaly samples are used for training to optimize model parameters. Real-time network traffic data is input into the anomaly detection model for real-time anomaly detection, generating anomaly scores to assess the severity of abnormal behavior in real-time traffic data.

[0125] Step S3023: Divide the multi-level model into a time series prediction layer and an anomaly detection layer to form a bottom-up hierarchical structure; design the time series prediction model and the anomaly detection model as independent modules, and use the prediction results of the time series prediction model as the input of the anomaly detection model to realize data flow between layers; in the anomaly detection layer, compare the real-time traffic data with the prediction results to identify abnormal traffic behaviors that do not match the prediction results; feed the anomaly detection results back to the time series prediction layer to update the prediction model.

[0126] Step S3024: Jointly train the multi-level model using the training set to optimize the parameters of each level of the model; continuously update the parameters of the multi-level model based on real-time analysis results.

[0127] In the above embodiments, step S3021 involves the construction and optimization of the time series prediction model. The autoregressive integral moving average model, by capturing the autocorrelation and moving average characteristics of time series, can accurately predict future traffic trends, providing a reliable benchmark for anomaly detection. Historical traffic data is cleaned, normalized, and differentially processed to ensure data quality and consistency, thereby improving the model's prediction accuracy. Grid search is used to optimize the parameters of the autoregressive integral moving average model, ensuring stable model performance on different data subsets and improving the model's generalization ability. A rolling prediction method is adopted to continuously update the model using the latest historical data, generating traffic prediction results for a future period, ensuring the real-time nature and accuracy of the prediction results. Step S3022 involves the construction and optimization of the anomaly detection model. The Isolation Forest model, by randomly partitioning the data space, can quickly identify anomalies and is suitable for anomaly detection in high-dimensional data, with low computational complexity. Anomaly samples such as DDoS attack traffic and malicious scanning traffic are extracted from historical data to construct the training set for the anomaly detection model, ensuring the model can effectively identify various abnormal behaviors. Features such as traffic size, packet length distribution, and protocol type are extracted from traffic data and used as input to the anomaly detection model to improve its recognition ability. Real-time network traffic data is input into the anomaly detection model for real-time anomaly detection, generating anomaly scores to assess the severity of abnormal behaviors in real-time traffic data, ensuring real-time monitoring of network security. Step S3023: Integration and Data Flow of the Multi-Level Model. The time series prediction model and anomaly detection model are designed as independent modules, facilitating module replacement and upgrades, and improving system flexibility and maintainability. The prediction results of the time series prediction model are used as input to the anomaly detection model, enabling data flow between levels and ensuring information transmission and collaborative work between models at each level. Anomaly detection results are fed back to the time series prediction layer to update the prediction model, improving its adaptability and accuracy, and ensuring the model can adapt to dynamic changes in network traffic. Step S3024: Joint Training and Continuous Optimization of the Multi-Level Model. The multi-level model is jointly trained using the training set, optimizing the parameters of each level to ensure overall model performance and stability, and improving the model's prediction and detection capabilities. During joint training, collaborative optimization between levels enhances the model's overall prediction and detection capabilities, ensuring the model can effectively cope with complex network environments. Based on real-time analysis results, the parameters of the multi-level model are continuously updated, ensuring the model can adapt to dynamic changes in network traffic and improving the system's real-time performance and accuracy. Through the above steps, the multi-layered proactive security defense model can effectively combine time series prediction and anomaly detection to achieve comprehensive monitoring and dynamic defense of network traffic, ensuring network security and stability.

[0128] Example 8:

[0129] like Figure 8 As shown, based on Embodiment 7, the process of forming a bottom-up hierarchical structure in step S3023 of this embodiment of the invention includes the following steps:

[0130] Step S30231: The future traffic prediction results generated by the time series prediction layer are transformed into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependence and periodicity features of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model.

[0131] Step S30232: In the anomaly detection layer, real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type. These features are then fused with the high-dimensional feature vector transmitted from the time series prediction layer to form a comprehensive feature space.

[0132] Step S30233: Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the threshold for anomaly detection; in the anomaly detection layer, real-time traffic data and prediction results are compared and analyzed at multiple levels to identify traffic behaviors that deviate significantly from the prediction results, and time series analysis is performed on the traffic data to capture abnormal patterns; the identified abnormal traffic behaviors are clustered and classified into different categories of abnormal behaviors to distinguish different types of abnormal behaviors such as DDoS attacks and malicious scanning.

[0133] In the above embodiments, step S30231, the generation and transmission of high-dimensional feature vectors, transforms the future traffic prediction results of the time series prediction layer into high-dimensional feature vectors through data processing and feature extraction. These feature vectors not only contain traffic trend information but also embed the time dependence and periodicity features of historical traffic patterns. Refined feature extraction provides a richer reference benchmark for the anomaly detection layer, enhancing the accuracy of anomaly detection. The generation of high-dimensional feature vectors improves the expressive power of the data, enabling the anomaly detection model to more comprehensively understand and analyze traffic data, thereby more effectively identifying abnormal behavior. Step S30232, multi-dimensional feature fusion, involves preprocessing real-time traffic data in the anomaly detection layer to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type. These features are then fused with the high-dimensional feature vectors transmitted from the time series prediction layer to form a comprehensive feature space. Multi-dimensional feature fusion allows the anomaly detection model to more comprehensively capture the dynamic changes and potential anomalies in traffic data. By fusing multi-dimensional features, the anomaly detection model can not only identify anomalies in traffic size but also capture anomalies in packet length distribution, protocol type, and other aspects, thereby improving the comprehensiveness and accuracy of anomaly detection. Step S30233, dynamic threshold setting and multi-level comparative analysis, involves dynamically setting the anomaly detection threshold based on the prediction results of the time series prediction layer. This dynamic threshold setting allows the anomaly detection model to flexibly adjust its detection sensitivity according to fluctuations in real-time traffic data, avoiding false positives and false negatives caused by fixed thresholds. In the anomaly detection layer, real-time traffic data is compared and analyzed with the prediction results at multiple levels. First, numerical comparison quickly identifies traffic behaviors that significantly deviate from the prediction results. Then, a deep learning model is used for time series analysis to capture more subtle anomaly patterns. This multi-level comparative analysis improves the accuracy and efficiency of anomaly detection. The identified abnormal traffic behaviors are then clustered and classified to further distinguish different types of anomalies, such as DDoS attacks and malicious scanning. This refined clustering and classification process enhances the accuracy and targeting of anomaly detection.

[0134] In summary, the inter-layer data flow in this embodiment not only achieves the fusion of prediction results and real-time data, but also improves the accuracy and efficiency of anomaly detection through dynamic threshold setting and multi-layer comparative analysis. Specifically, this includes: refined feature extraction, enhanced data representation capabilities, comprehensive feature space construction, improved anomaly detection comprehensiveness, dynamic threshold setting, multi-layer comparative analysis, and anomalous behavior clustering and classification, making the anomaly detection system more intelligent and efficient. Through refined processing and multi-layer comparative analysis, the inter-layer data flow not only achieves the fusion of prediction results and real-time data, but also improves the accuracy and efficiency of anomaly detection through dynamic threshold setting and anomalous behavior clustering and classification, meeting the requirements of innovation.

[0135] Example 9:

[0136] like Figure 9 As shown, based on Example 8, the process of identifying traffic behavior that significantly deviates from the prediction result in step S30233 of this embodiment of the invention includes the following steps:

[0137] Step S302331: The anomaly detection layer performs a preliminary comparison between the real-time traffic data and the prediction results of the time series prediction layer. Based on a preset threshold, it determines whether the traffic data deviates significantly from the normal range. Then, by sliding the time window, it performs a local comparison of the traffic data to identify abnormal fluctuations in a short period of time. Combined with historical traffic data, it performs a global comparison to capture abnormal changes in the long-term trend.

[0138] Step S302332: Extract time-series features. Through time-series analysis of network traffic data, extract features such as network traffic size, rate of change, and fluctuation amplitude to reflect the current state of network traffic. It also includes the time dependence and periodicity features of historical traffic patterns. Through feature extraction, the network traffic data is transformed into a high-dimensional time-series feature vector.

[0139] Step S302333: Perform local pattern recognition on the time-series features to capture local anomalies in network traffic data; perform global pattern recognition on the time-series features to capture long-term abnormal trends in network traffic data, thereby capturing abnormal patterns.

[0140] In the above embodiments, step S302331, the anomaly detection layer performs a preliminary comparison between real-time traffic data and the prediction results of the time series prediction layer; by setting a preset threshold, it can quickly identify whether the traffic data significantly deviates from the normal range; through sliding comparison of the time window, it can capture abnormal fluctuations in a short period of time, and by combining global comparison with historical data, it can identify abnormal changes in long-term trends; it can promptly detect abnormal behavior in traffic, providing basic data for analysis. Step S302332 extracts time-series features. Through time-series analysis of traffic data, features such as traffic size, rate of change, and fluctuation amplitude are extracted, which can comprehensively reflect the current state of network traffic. At the same time, the time dependence and periodicity features of historical traffic patterns are extracted, transforming the traffic data into a high-dimensional time-series feature vector, providing rich data support for pattern recognition; enhancing the analyzability of the data, making anomaly detection more accurate. Step S302333 performs local pattern recognition and global pattern recognition on the time series features. Through local pattern recognition, local anomalies in traffic data can be captured, and abnormal behavior in a short period of time can be detected in a timely manner. Through global pattern recognition, long-term abnormal trends in traffic data can be captured, and potential systemic problems can be identified. It can comprehensively cover the detection needs of traffic anomalies and improve the system's early warning capability and response speed.

[0141] In summary, the steps of this embodiment, through data comparison, feature extraction, and pattern recognition, form a complete anomaly detection process that can effectively identify abnormal behavior in network traffic and ensure stable network operation. This embodiment achieves comprehensive analysis and accurate anomaly detection of traffic data through hierarchical temporal analysis and anomaly pattern capture. The specific process includes preliminary deviation identification, multi-level comparative analysis, temporal feature extraction, anomaly pattern capture, and anomaly behavior clustering and classification. This not only improves the accuracy and efficiency of anomaly detection but also enhances the system's intelligence and adaptability.

[0142] Example 10:

[0143] like Figure 10 As shown, based on Example 9, the process of capturing abnormal patterns in step S302333 provided in this embodiment of the invention includes the following steps:

[0144] Step S3023331: Obtain data on local anomalies, including the timestamp, degree of anomaly, and characteristics of anomalies (such as traffic volume, rate of change, fluctuation amplitude, etc.); at the same time, obtain data on global anomalies, including the timestamp, degree of anomaly, and characteristics of anomalies (such as long-term trend changes, periodic changes, etc.).

[0145] Step S3023332: Align local outliers and global outliers according to timestamps, calculate their respective weights based on their degree of abnormality, and then perform a weighted fusion of local and global outliers according to their respective weights to generate a comprehensive outlier. The degree of abnormality of the comprehensive outlier is the weighted sum of the degree of abnormality of the local and global outliers.

[0146] Step S3023333: Using local and global outliers as initial cluster centers, hierarchical clustering is performed. Based on the feature similarity between outliers, hierarchical clustering is performed to generate multiple outlier clusters, each representing a similar outlier pattern. The mean of each outlier cluster is used for comprehensive evaluation to calculate its outlier degree. Based on the characteristics of the outlier cluster, its local or global outlier type is determined. Based on the comprehensive evaluation results, the final outlier pattern is generated. Each outlier pattern includes the outlier's timestamp, outlier degree, outlier type, and possible cause analysis.

[0147] In the above embodiments, step S3023331 acquires anomaly data. By acquiring data on local and global anomalies, the comprehensiveness of anomaly detection is ensured. Local anomalies can capture abnormal fluctuations in a short period of time, while global anomalies can capture abnormal changes in long-term trends. Combining the two can more comprehensively reflect the anomalies in network traffic. Acquiring the timestamps, anomaly severity, and anomaly characteristics (such as traffic volume, rate of change, and fluctuation amplitude) of anomalies provides a rich data foundation for anomaly pattern analysis. Step S3023332 performs data alignment and weighted fusion. By aligning local and global anomalies according to their timestamps, the consistency of data in the time dimension is ensured, avoiding analysis errors caused by time misalignment. By calculating the weights of local and global anomalies and performing weighted fusion, the generated comprehensive anomaly point can more accurately reflect the overall anomaly situation. The weighted fusion method gives anomalies with higher anomaly severity a greater influence during the fusion process, improving the accuracy of anomaly detection. Step S3023333 Hierarchical Clustering and Comprehensive Evaluation: Hierarchical clustering is used to cluster local and global anomalies, generating multiple anomaly clusters. Each cluster represents a similar anomaly pattern, enabling clearer identification of different types of abnormal behavior. The mean of each cluster is used for comprehensive evaluation to calculate its anomaly severity, quantifying the severity of the anomaly and providing a basis for anomaly analysis and handling. Based on the characteristics of the anomaly clusters, their local or global anomaly types are determined, enabling more accurate classification of abnormal behavior and providing guidance for targeted handling measures. Based on the comprehensive evaluation results, the final anomaly pattern is generated. Each anomaly pattern includes the anomaly's timestamp, anomaly severity, anomaly type, and possible cause analysis. This information provides network administrators with a detailed anomaly report, facilitating timely response.

[0148] In summary, this embodiment ensures comprehensive anomaly detection and rich data, improving the accuracy of anomaly detection and the overall situation reflection; it clearly identifies different types of abnormal behavior, quantifies the severity of anomalies, and provides a basis for subsequent processing; it accurately classifies abnormal behavior and generates detailed anomaly reports, facilitating timely response. This makes the capture of anomaly patterns more comprehensive, accurate, and efficient, improving the reliability and practicality of network traffic anomaly detection.

[0149] Figure 11 A block diagram of an exemplary electronic device suitable for implementing embodiments of the present invention is shown.

[0150] The electronic device may include a central processing unit / microprocessor / main control chip, etc. 1; and a storage medium 2, coupled to the central processing unit / microprocessor / main control chip, etc. 1, and storing computer-executable instructions therein for performing the steps of various methods of embodiments of the present invention when executed by the processor.

[0151] The central processing unit / microprocessor / main control chip, etc., can include, but are not limited to, one or more processors or microprocessors.

[0152] Storage medium 2 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, computer storage media (e.g., hard disk, floppy disk, solid-state drive, removable disk, CD-ROM, DVD-ROM, Blu-ray disc, etc.).

[0153] In addition, the electronic device may include (but is not limited to) a data bus 3, an input / output bus / external bus / device bus 4, a display 5, and input / output devices 6 (e.g., keyboard, mouse, speaker, etc.).

[0154] The central processing unit / microprocessor / main control chip, etc. 1 can communicate with external devices (5, 6, etc.) via I / O bus 4 through wired or wireless network (not shown).

[0155] The storage medium 2 may also store at least one computer-executable instruction for performing the steps of various functions and / or methods in the embodiments described herein when the central processing unit / microprocessor / main control chip, etc., is running.

[0156] In one embodiment, the at least one computer-executable instruction may also be compiled into or comprise a software product, wherein one or more computer-executable instructions are executed by a processor to perform the steps of the various functions and / or methods in the embodiments described herein.

[0157] Figure 12 A schematic diagram of a computer-readable storage medium according to an embodiment of the present invention is shown.

[0158] like Figure 12 As shown, the non-transitory computer-readable storage medium 8 stores instructions, such as computer-readable instruction 7. When the computer-readable instruction 7 is executed by a processor, the various methods described above can be performed. The non-transitory computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-transitory non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. For example, the non-transitory computer-readable storage medium 11 can be connected to a computing device such as a computer, and then, when the computing device executes the computer-readable instruction 10 stored on the computer-readable storage medium 11, the various methods described above can be performed.

[0159] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0160] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0161] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0162] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for executing all or part of the steps of the methods of the various embodiments of this invention through a computer device (which may be a personal computer, server, or network device, etc.). The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0163] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A proactive security defense method based on network traffic time patterns and data volume analysis, characterized in that, The process of capturing abnormal patterns is achieved by adopting a proactive security defense model, which acquires data on local anomalies and global anomalies. Local and global outliers are aligned according to their timestamps. Based on the degree of anomalousness of local and global outliers, their respective weights are calculated. Local and global outliers are then weighted and merged to generate a comprehensive outlier. The degree of anomalousness of the comprehensive outlier is the weighted sum of the degree of anomalousness of the local and global outliers. Hierarchical clustering is performed using local and global outliers as initial cluster centers. Based on the feature similarity between outliers, multiple outlier clusters are generated, each representing a similar outlier pattern. The mean of each outlier cluster is used for comprehensive evaluation to calculate its outlier degree. Based on the characteristics of the outlier cluster, its local or global outlier type is determined. Based on the comprehensive evaluation results, the final outlier pattern is generated, and each outlier pattern includes the outlier's timestamp, outlier degree, outlier type, and possible cause analysis. The proactive security defense model is used to analyze network traffic and obtain the assessment results of potential network attacks. The proactive security defense model is based on the prediction results of its time series prediction layer, and the anomaly detection layer dynamically sets the threshold for anomaly detection. In the anomaly detection layer of the proactive security defense model, real-time traffic data is compared and analyzed with prediction results at multiple levels to identify traffic behaviors that deviate significantly from the prediction results. Time-series analysis of traffic data is performed to capture abnormal patterns. Cluster analysis is performed on the identified abnormal traffic behaviors to classify different categories of abnormal behaviors and distinguish between different types of abnormal behaviors.

2. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 1, characterized in that, The future traffic prediction results generated by the time series prediction layer of the proactive security defense model are transformed into high-dimensional feature vectors through data processing and feature extraction. The feature vectors contain traffic trend information and embed the time dependence and periodic features of historical traffic patterns. The high-dimensional feature vectors are passed to the anomaly detection layer as a reference benchmark for the anomaly detection model. In the anomaly detection layer, real-time traffic data is preprocessed to extract multi-dimensional features such as traffic size, packet length distribution, and protocol type. These features are then fused with the high-dimensional feature vectors transmitted from the time series prediction layer to form a comprehensive feature space. Based on the prediction results of the time series prediction layer, the anomaly detection layer dynamically sets the threshold for anomaly detection. In the anomaly detection layer, real-time traffic data is compared and analyzed with the prediction results at multiple levels to identify traffic behaviors that deviate significantly from the prediction results. Time series analysis is performed on the traffic data to capture abnormal patterns. The identified abnormal traffic behaviors are clustered and classified into different categories to distinguish between different types of abnormal behaviors such as DDoS attacks and malicious scanning.

3. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 2, characterized in that, The process of identifying traffic behavior that deviates significantly from prediction results includes the following steps: The anomaly detection layer performs a preliminary comparison between real-time traffic data and the prediction results of the time series prediction layer. Based on a preset threshold, it determines whether the traffic data deviates significantly from the normal range. Then, by sliding the time window, it performs a local comparison of the traffic data to identify abnormal fluctuations in a short period of time. Combined with historical traffic data, it performs a global comparison to capture abnormal changes in long-term trends. By extracting time-series features, network traffic data is analyzed over time to extract features such as the size, rate of change, and fluctuation amplitude of network traffic, reflecting the current state of network traffic and including the time dependence and periodicity of historical traffic patterns. Through feature extraction, network traffic data is transformed into a high-dimensional time-series feature vector. Local pattern recognition is performed on time-series features to capture local anomalies in network traffic data; global pattern recognition is performed on time-series features to capture long-term abnormal trends in network traffic data, thereby achieving the capture of abnormal patterns.

4. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 3, characterized in that, The process of capturing abnormal patterns includes the following steps: Acquire data on local anomalies, including timestamps, anomaly severity, and anomaly characteristics; simultaneously acquire data on global anomalies, including timestamps, anomaly severity, and anomaly characteristics. Local and global outliers are aligned according to their timestamps. Based on the degree of anomalousness of local and global outliers, their respective weights are calculated. Local and global outliers are then weighted and merged to generate a comprehensive outlier. The degree of anomalousness of the comprehensive outlier is the weighted sum of the degree of anomalousness of the local and global outliers. Hierarchical clustering is performed using local and global outliers as initial cluster centers. Based on the feature similarity between outliers, multiple outlier clusters are generated, each representing a similar outlier pattern. The mean of each outlier cluster is used for comprehensive evaluation to calculate its degree of anomalousness. Based on the characteristics of the outlier cluster, its local or global anomaly type is determined. Based on the comprehensive evaluation results, the final outlier pattern is generated, and each outlier pattern includes the timestamp of the anomaly, the degree of anomaly, the anomaly type, and an analysis of possible causes of the anomaly.

5. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 1, characterized in that, The proactive security defense model adopts a multi-layered construction approach, including the following steps: An autoregressive integral moving average (ARM) model is employed to predict future traffic trends by capturing the autocorrelation and moving average characteristics of time series data. Historical traffic data is cleaned, normalized, and differencing, and grid search is used to optimize the parameters of the ARM model. K-fold cross-validation is used to evaluate the performance of the ARM model on different data subsets. A rolling forecasting method is employed to continuously update the ARM model using the latest historical traffic data, generating traffic forecast results for a future period. An isolated forest model is adopted. By randomly partitioning the data space, anomalies are identified, and abnormal samples of DDoS attack traffic and malicious scanning traffic are extracted from historical data to construct the training set for the anomaly detection model. Traffic size, packet length distribution, and protocol type features are extracted from traffic data and used as inputs to the anomaly detection model. The model parameters are optimized by training with abnormal samples. Real-time network traffic data is input into the anomaly detection model to perform real-time anomaly detection, generate anomaly scores, and assess the severity of abnormal behavior in real-time traffic data. The multi-level model is divided into a time series prediction layer and an anomaly detection layer, forming a bottom-up hierarchical structure. The time series prediction model and the anomaly detection model are designed as independent modules, and the prediction results of the time series prediction model are used as the input of the anomaly detection model to realize data flow between layers. In the anomaly detection layer, real-time traffic data is compared with the prediction results to identify abnormal traffic behaviors that do not match the prediction results. The anomaly detection results are fed back to the time series prediction layer to update the prediction model. The multi-level model is jointly trained using the training set to optimize the parameters of each level; the parameters of the multi-level model are continuously updated based on real-time analysis results.

6. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 5, characterized in that, The training process of the proactive security defense model includes the following steps: Based on time series analysis, dynamic features including traffic change rate and data volume growth rate are generated to capture short-term and long-term trends in network traffic. A multi-layered proactive security defense model is constructed by integrating a multi-layered model with a time series prediction model and anomaly detection model; the time series prediction model is used to predict the future trend of normal network traffic. Anomaly detection models are used to identify abnormal traffic behavior that does not match the prediction results; The multi-layer model is trained using the training set to optimize the parameters of the proactive security defense model. The trained proactive security defense model is deployed to network nodes to analyze network traffic in real time and generate assessment results of potential network attacks. Based on the real-time analysis results, the security protection strategy is dynamically adjusted. The real-time analysis results are fed back to the training layer of the proactive security defense model to dynamically update the parameters of the proactive security defense model.

7. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 6, characterized in that, The process of obtaining the training set includes the following steps: By using intelligent sensing networks, the time patterns and data volume of network traffic can be captured in real time, while potential attack patterns can be identified and recorded. By fusing multi-source data, a dynamic and comprehensive model dataset can be constructed. The model dataset is analyzed according to time series, and time windows with similar characteristics are automatically identified and divided. Identify and segment different traffic patterns between weekdays and weekends; group data of the same attack type in the same region into a single slice; automatically identify and cluster similar attack patterns, and classify them. Automatically detect outliers and missing values ​​in the dataset and use generative adversarial networks to generate alternative data; Based on the validation results, the segmentation strategy is adaptively adjusted.

8. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 7, characterized in that, The process of adaptively adjusting the segmentation strategy includes the following steps: Analyze the performance of the validation set, including key metrics such as accuracy, recall, and F1 score, to identify which types of data the model fails to meet the standard, and which attack patterns or time windows fail to achieve the expected prediction results. Detect outliers and classification errors in the dataset, use clustering algorithms to classify the outlier data, and identify which anomalies are caused by improper data segmentation; Re-evaluate the division of time windows to ensure that time windows with similar features are correctly divided into the same dataset; re-cluster similar attack patterns to ensure that attack data of the same type are concentrated in one slice; By generating alternative data through generative adversarial networks, the proportion of attack types and normal traffic in the dataset is balanced, ensuring that the model can be trained on different types of data.

9. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 7, characterized in that, Network traffic is collected through network traffic capture tools deployed at network nodes of specific devices. These tools are used to obtain the time pattern and data volume of network traffic corresponding to the network nodes. The process of deploying at least one network traffic capture tool includes the following steps: Initialize the network interface of the specific device, and then create the process of the network node deployed by the network traffic capture tool. The process runs in the application of the specific device; establish communication between the specific device and the core network through the process, and send network traffic collection commands to the network traffic capture tool. The network between the specific device and the core network is divided into several equally spaced segments, and the midpoint of each segment is set as the network node where the network traffic capture tool is deployed. Establish an objective function for the average absolute relative error of network traffic capture time, and determine the deployment location of the network traffic capture tool; Once the deployment location is confirmed, the deployment location and the identifier of the network traffic capture tool are sent to the application on the specific device for storage.

10. The proactive security defense method based on network traffic time pattern and data volume analysis as described in claim 9, characterized in that, After the application is sent to a specific device for storage, the following steps are required: Initialization and Configuration of Network Traffic Capture Tool: During the initialization phase, the network traffic capture tool obtains key parameters of the current network environment through external interfaces. These key parameters include network topology, bandwidth utilization, and device connection status. Network traffic capture tools automatically adjust configuration parameters, including dynamically selecting network interfaces and optimizing capture intervals, or adjusting packet size limits based on network load. Network traffic capture tools analyze the current operating system and hardware configuration to automatically identify and load drivers; monitor driver performance in real time and dynamically switch or upgrade them.

Images