Abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network

Abstract

This invention belongs to the field of computer information security and proposes an abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural networks. It aims to solve the problem that traditional methods struggle to effectively separate and identify complex and covert network attack traffic. The method collects and preprocesses network traffic data to form a multivariate time series; it then uses seasonal and trend decomposition combined with a Fourier mask function to extract high-frequency and low-frequency components of trend and seasonal elements; the extracted components are then stabilized and linearly mapped to generate new vector representations; finally, a multi-scale graph neural network is used for modeling and anomaly detection. This method, combining time-frequency decomposition and graph neural networks, can accurately capture the complex spatiotemporal dependencies of network traffic, significantly improving the detection capability for highly concealed or time-series correlated abnormal behaviors. It is suitable for real-time detection and prediction scenarios, providing efficient early warning and analysis support for network security protection.

Description

Technical Field

[0001] This invention belongs to the field of computer information security technology, specifically relating to an abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network. Background Technology

[0002] Cybersecurity threats are becoming a significant and undeniable problem in network systems. With the rapid development of information technology, the frequency and complexity of cyberattacks are constantly increasing, posing a serious challenge to various network systems. Currently, cyberattack methods targeting network systems are becoming increasingly diversified and complex, while the stealth of these attacks is also gradually improving. These attacks often blend with the normal communication behavior of network devices, significantly increasing the difficulty of detection. Traffic generated by these attacks mixed in with normal network communication is usually referred to as abnormal network traffic, while traffic carrying normal communication behavior is called normal network traffic. Traditional solutions typically employ intrusion detection systems (IDS) that analyze network traffic to identify abnormal patterns, effectively detecting various forms of cyberattacks, such as denial-of-service attacks, malware propagation, and vulnerability exploitation.

[0003] However, with the continuous evolution of attack methods, existing intrusion detection technologies face numerous bottlenecks. Therefore, designing a more intelligent, efficient, and real-time detection technology has become an important research topic in the field of cybersecurity. In recent years, to improve the performance of intrusion detection systems, many machine learning-based methods have been proposed, especially those utilizing artificial neural networks to further improve the accuracy and efficiency of abnormal traffic detection through deep analysis of massive network traffic characteristics. These methods can not only identify known attacks but also possess a certain degree of generalization ability, enabling the detection of unknown attack patterns. Current network abnormal traffic detection methods are mainly divided into four categories: payload-based detection techniques, flow-based detection methods, statistical detection methods, and machine learning-based detection methods. Traditional machine learning methods often rely on manual feature engineering when detecting network abnormal traffic, resulting in weak generalization ability, limited performance against new types of attacks, high false positive and false negative rates, and difficulty in supporting real-time detection. In contrast, network traffic characteristic-based detection methods, through automatic feature extraction and deep analysis, possess stronger generalization ability and adaptability.

[0004] Anomaly detection based on network traffic features is a technique for identifying abnormal behavior by extracting and analyzing multidimensional features from network traffic. This method first captures features from network traffic data, such as traffic volume, inter-packet time intervals, communication frequency, protocol distribution, and session duration. These features can reflect normal network traffic behavior patterns as well as potential abnormal behaviors. These features can actually constitute multivariate time series data, which can be modeled and analyzed using machine learning or deep learning models to detect potential abnormal behaviors. The features extracted from network traffic data are essentially natural multivariate time series data, with complex dynamic changes and significant nonlinear characteristics, including long-term trends, periodic changes, and short-term fluctuations. Effective separation of these features has always been an important research direction. To address this issue, we propose a novel separation method that efficiently separates different components in the time series using time-series decomposition technology. Based on the decoupling of components, each component and its interrelationships are modeled and analyzed separately, thereby more comprehensively uncovering the inherent patterns of the time series and effectively improving the accuracy and robustness of anomaly detection.

[0005] Dynamic graph neural networks (DNNs) are a class of models specifically designed to handle time-varying graph structures. They can model the dynamic evolution of nodes, edges, and the overall structure of a graph, capturing spatiotemporal dependencies. Combining the spatial feature extraction capabilities of traditional graph neural networks with time series analysis methods, they uncover deep-seated feature patterns from dynamic changes, offering significant advantages in modeling complex dynamic relationships, extracting high-dimensional spatiotemporal features, and improving prediction accuracy. Dynamic graph neural networks excel particularly in time series data analysis. By modeling the dynamic changes in network traffic characteristics, they embed the temporal evolution patterns of nodes, edges, and the graph structure into the analysis, capturing complex spatiotemporal dependencies and identifying highly concealed or time-correlated abnormal behaviors. Compared to traditional methods, they extract multiple traffic features more accurately, improving the detection capability of abnormal traffic, making them especially suitable for real-time detection and prediction applications. Summary of the Invention

[0006] The purpose of this invention is to solve the problem that traditional network traffic anomaly detection methods are unable to effectively separate and identify abnormal traffic when facing complex and covert network attacks by using multi-level time-frequency decomposition and multi-scale graph neural networks, thereby improving the accuracy and robustness of detection.

[0007] To achieve the above objectives, the present invention employs the following technical solution:

[0008] This invention provides an abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network, comprising the following steps:

[0009] Step 1: Collect and preprocess network traffic data to obtain multivariate time series data;

[0010] Step 2: Perform seasonality and trend decomposition on the preprocessed multivariate time series data to obtain the trend and seasonal components corresponding to the original multivariate time series.

[0011] Step 3: Perform Fourier mask function calculation on the trend components and seasonal components extracted in Step 2 to obtain the high-frequency and low-frequency components of the trend components and the high-frequency and low-frequency components of the seasonal components.

[0012] Step 4: Stabilize the high and low frequency components extracted in Step 3 to obtain the stabilized vector;

[0013] Step 5: Perform an embedding linear mapping process on the high-frequency and low-frequency components of the trend and seasonal components obtained from the stabilization process in Step 4 to obtain new vector representations for them.

[0014] Step 6: Perform vector embedding on the vectors obtained in Step 5 to model a graph neural network and obtain feature vectors;

[0015] Step 7: Perform anomaly detection on the feature vector to obtain the final anomaly detection result.

[0016] In the above scheme, step 1 includes:

[0017] Step 1.1: Collect normal and abnormal network traffic data from the target network using a traffic acquisition tool;

[0018] Step 1.2: Preprocess the traffic data packets to remove duplicate, erroneous, or incomplete data packets;

[0019] Step 1.3: Divide the collected traffic data into multiple independent streams according to the data packets;

[0020] Step 1.4: Extract the timestamp, packet size, and protocol type characteristics of each stream;

[0021] Step 1.5: Preprocess the feature data, including data cleaning, formatting, removing invalid data, and filling in missing values;

[0022] Step 1.6: Arrange the extracted features according to the time axis to form multivariate time series data;

[0023] In the above scheme, step 2 includes:

[0024] Step 2.1: The multivariate time series data obtained in Step 1 is processed using the moving average method to obtain the trend component and the seasonal component. Given a time series x(t), the trend component column T(t) and the seasonal component column R(t) are calculated using the moving average method, where k is the size of the moving window.

[0025]

[0026] R(t) = x(t) - T(t)

[0027] In the above scheme, step 3 includes:

[0028] Step 3.1: By dividing the time window, perform Fourier transform on each window to obtain the frequency domain representation under the window. Then, calculate the average amplitude spectrum of the frequency domain data of all windows. After that, select the top α frequencies to construct the mask function. Finally, obtain the mask function corresponding to the dataset.

[0029] Step 3.2: Process the trend components extracted in Step 2 using the mask function described above to obtain the high-frequency and low-frequency components of the trend components.

[0030] Step 3.3: Process the seasonal components extracted in Step 2 using the mask function described above to obtain the high-frequency and low-frequency components of the seasonal components.

[0031] In the above scheme, the mask function in step 3.1 is calculated using the following formula:

[0032]

[0033] Where X i.k [f] represents the frequency domain signal value at frequency f of the k-th time window of the i-th sample, Sort(*) represents sorting, and TopK(*) represents selecting the top K frequency components with the largest amplitudes. This indicates rounding down, α is a scaling factor (0 < α ≤ 1), and K is the number of total frequency components.

[0034] In the above scheme, step 4 includes:

[0035] Step 4.1: Stabilize the high-frequency and low-frequency components of the seasonal components to obtain the stabilized data;

[0036] Step 4.2: Stabilize the high-frequency and low-frequency components of the trend to obtain the stabilized data.

[0037] In the above scheme, step 5 includes:

[0038] Step 5.1: The vectors of high-frequency and low-frequency components of the trend component after stabilization and the original data residuals are concatenated, and other optional supplementary features are also concatenated. Then, the vectors are mapped to a new vector representation through a linear layer.

[0039] Step 5.2: The vectors of high-frequency and low-frequency components of the seasonal components after stabilization and the residuals of the original data are concatenated, and other optional supplementary features are also concatenated. Then, the vectors are mapped to a new vector representation through a linear layer.

[0040] In the above scheme, step 5 includes:

[0041] Step 6.1: Input the generated high-dimensional feature representation into the graph neural network (GNN) module to begin further feature processing.

[0042] Step 6.2: Group the high-dimensional features based on manually set fixed ratio rules.

[0043] Step 6.3: Apply 1D convolution operation to the features of each group, and use convolution kernels of different sizes to perform multi-scale feature extraction;

[0044] Step 6.4: Calculate the feature vectors of the nodes through graph learning mechanisms (such as feature aggregation and information propagation).

[0045] In the above scheme, the multi-scale feature extraction in step 6.3 is calculated using the following formula:

[0046]

[0047] Among them, z i Let h be the feature vector of the node, σ be the activation function, and h be the value of h. i and h j Let W be the representation vector of a node, and W be the weight matrix. (MLP) expand (*) represents the extended function of the multilayer perceptron.

[0048] In the above scheme, step 7 includes:

[0049] Step 7.1: Concatenate the feature vectors and input them into the anomaly detection module based on reconstruction error;

[0050] Step 7.2: Identify abnormal traffic through reconstruction error or anomaly scoring mechanisms;

[0051] Step 7.3: Output the detection results, including the location, category, and characteristics of the abnormal traffic.

[0052] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0053] 1. Multi-level time-frequency decomposition combined with Fourier transform: Network traffic data is decomposed into trend components and seasonal components using time-series decomposition techniques, and high-frequency and low-frequency components are extracted using Fourier transform. This combination of techniques effectively solves the problem of separating complex time-series features in network traffic data, and can more clearly capture long-term trends, periodic fluctuations, and short-term abnormal signals, providing multi-level feature representation for subsequent anomaly detection.

[0054] 2. Multi-scale Graph Neural Network Modeling: The feature vectors after time-frequency decomposition are input into a graph neural network (GNN), and features are extracted through multi-scale convolutional kernels. This combination of techniques solves the problem that traditional methods struggle to capture complex spatiotemporal dependencies, enabling more accurate extraction of latent patterns in network traffic and improving the detection capability for highly concealed or temporally correlated abnormal behaviors.

[0055] 3. Dynamic Adjacency Matrix Construction and Feature Aggregation: Utilizing the dynamic adjacency matrix construction mechanism in graph neural networks, similarity scores between nodes are automatically learned, and feature aggregation is performed using multi-scale convolutional kernels. This combination of techniques overcomes the limitations of traditional graph learning methods when processing dynamically changing data, enabling more efficient capture of complex relationships in network traffic data and enhancing the robustness of anomaly detection.

[0056] 4. Feature Fusion and Linear Mapping: The high- and low-frequency components of the trend and seasonality after time-frequency decomposition are concatenated, and a high-dimensional feature representation is generated through linear mapping. This combination of techniques solves the problem of information loss during multi-source feature fusion, fully preserving the original expression of the features and avoiding the introduction of additional complexity, thereby generating a unified high-dimensional feature representation and providing richer feature information for subsequent anomaly detection.

[0057] 5. Anomaly Detection Module and Reconstruction Error Mechanism: An anomaly detection module based on reconstruction error compares predicted results with actual traffic data to identify abnormal traffic. This combination of techniques solves the problems of high false alarm and false negative rates in traditional methods, enabling more accurate identification of abnormal traffic and outputting its location, type, and characteristics, providing real-time early warning and analysis for network security protection.

[0058] 6. Data Preprocessing and Feature Extraction: Network traffic data is collected using traffic acquisition tools and preprocessed through data cleaning and formatting to extract features such as timestamps, packet sizes, and protocol types. This combination of techniques addresses the issues of data noise and incompleteness, providing high-quality multivariate time series data for subsequent time-frequency decomposition and graph neural network modeling, thus improving the accuracy of anomaly detection.

[0059] 7. Moving Average and Seasonal Decomposition: The moving average method is used to decompose the time series into trend and seasonal components, and Fourier transform is combined to further extract frequency domain features. This combination of techniques solves the problem of noise interference in time series, effectively removes noise, highlights the long-term trend and short-term fluctuation characteristics of the time series, and provides more accurate basic data for anomaly detection.

[0060] 8. Combining Multi-Scale Convolutional Kernels with Graph Convolutional Networks: Based on Graph Convolutional Networks (GCNs), multi-scale feature extraction is performed using convolutional kernels of different sizes. This combination of techniques overcomes the limitations of traditional convolutional networks in processing multi-scale features, enabling a more comprehensive capture of multi-scale features in network traffic data and improving the ability to detect complex and abnormal behaviors.

[0061] 9. Masking Function and Frequency Domain Feature Extraction: High-frequency and low-frequency components of time series are extracted using Fourier transform and masking functions. This combination of techniques solves the noise interference problem in frequency domain feature extraction, enabling more accurate separation of the main and secondary components in the time series, and providing richer frequency domain feature information for anomaly detection.

[0062] 10. Real-time detection combined with dynamic graph neural networks: By modeling the dynamic changes in network traffic characteristics using dynamic graph neural networks, the temporal evolution patterns of nodes, edges, and graph structures are captured. This combination of techniques solves the problem that traditional methods struggle to support real-time detection, enabling more accurate extraction of multiple traffic features and improving the real-time detection capability for abnormal traffic. It is particularly suitable for applications requiring real-time detection and prediction. Attached Figure Description

[0063] Figure 1 This is a schematic diagram of the structure of the model proposed in this invention;

[0064] Figure 2 This is a flowchart illustrating a specific embodiment of the present invention. Detailed Implementation

[0065] The embodiments of the present invention will be described in detail below. Although the present invention will be described and illustrated in conjunction with some specific embodiments, it should be noted that the present invention is not limited to these embodiments. On the contrary, any modifications or equivalent substitutions made to the present invention should be covered within the scope of the claims of the present invention.

[0066] Furthermore, to better illustrate the present invention, numerous specific details are set forth in the following detailed embodiments. Those skilled in the art will understand that the present invention can be practiced without these specific details.

[0067] To address the problems mentioned above, we propose the MTFGAN (Multi-scale Time-Frequency Graph Neural Network for Anomaly Detection) model. This model is based on multi-level time-frequency decomposition techniques to separate the seasonal and trend components in network traffic data. It also extracts high-frequency and low-frequency features through Fourier transform, and finally utilizes a multi-scale graph neural network for feature fusion and anomaly detection. This approach can accurately characterize the complex characteristics of network traffic data, providing a new solution for anomaly detection.

[0068] First, we collect normal and abnormal network traffic data from the target network, dividing this traffic data into multiple independent flows based on data packets. Based on this, we extract features commonly used in network traffic anomaly detection tasks, including timestamps, packet sizes, and protocol types. These features are arranged along a timeline to form multivariate time series data, which becomes the basis for subsequent decomposition and modeling.

[0069] Next, the multivariate time series data is decomposed. First, a time-series decomposition method is used to separate the time series into trend components (representing long-term trends), seasonal components (representing periodic fluctuations), and random components (capturing irregular fluctuations). This decomposition method can more clearly separate the regular changes and abnormal characteristics in network traffic. Then, a Fourier transform is performed on each decomposed component to extract its frequency domain features, decomposing the data into high-frequency components (short-term fluctuations and anomalous signals) and low-frequency components (long-term trends and stability). This process utilizes information from both the time and frequency domains to provide rich and multi-level feature representations for subsequent modeling. The data from the time-series decomposition and Fourier decomposition are concatenated and fused, then input into a linear layer for feature transformation to generate high-dimensional feature representations. These features are then input into a graph neural network (GNN) for anomaly detection. In the GNN module, traditional graph learning methods are improved to more efficiently capture complex relationships and anomalous features in network traffic data. Specifically, based on Graph Convolutional Networks (GCNs), the feature processing flow was redesigned, extending the feature representation of each variable to a higher dimension and dividing the features into multiple groups according to a set grouping rule. Within each group, a convolutional neural network is constructed using convolutional kernels of different sizes. Finally, an anomaly detection result is generated through a mapping layer.

[0070] This invention provides a method for detecting abnormal network traffic based on a dynamic graph neural network, comprising the following steps:

[0071] Step 1. Data Collection and Preprocessing: Collect normal and abnormal network traffic data from the target network, dividing the traffic data into multiple independent streams based on data packets. Extract commonly used features for network traffic anomaly detection tasks from this traffic data, such as timestamps, packet sizes, and protocol types. Arrange the extracted features along a timeline to form multivariate time series data, providing a data foundation for subsequent decomposition and modeling.

[0072] Step 2. Time-Domain Decomposition: The multivariate time series data is decomposed. First, a time-domain decomposition method is used to separate the time series into trend components (representing long-term trends), seasonal components (representing periodic fluctuations), and residual components from the original data. Further, Fourier transforms are applied to these decomposed components to extract frequency domain features, separating the trend and seasonal components into high-frequency components (capturing short-term fluctuations and anomalous signals) and low-frequency components (reflecting long-term trends and stability). This decomposition method combines time-domain and frequency-domain feature representations, providing multi-level and rich feature data for subsequent modeling. The trend and seasonal components are decomposed as follows: the trend component is extracted using a moving average method to capture the overall trend in the flow data, while the residuals are calculated to separate seasonality, which includes periodic patterns and short-term anomalous signals. This decomposition process effectively removes noise interference, highlights the core features of the time series, and provides more accurate and detailed basic data for subsequent feature extraction and anomaly detection. Given a time series x(t), the trend component column T(t) and the seasonal column R(t) are calculated using a moving average method, where k is the size of the moving window. Then the seasonal components were calculated:

[0073]

[0074] R(t) = x(t) - T(t)

[0075] R(t) represents the seasonal component. This decomposition process can effectively remove noise interference and highlight the long-term trend and short-term fluctuation characteristics of the time series.

[0076] Step 3. Frequency Domain Decomposition: After obtaining the seasonal and trend components of the original time series data in Step 2, and using the original data as residual input, frequency domain decomposition is performed on the seasonal and trend components to obtain their high-frequency and low-frequency components. The original time series data is then subjected to Fourier decomposition in the frequency domain to statistically analyze component proportions, identifying the primary and secondary components. For the training time series, multiple time windows are divided for Fourier transform.

[0077] X train ={x1, x2, ..., x m}, x i =xi，k

[0078]

[0079] Where X train x represents the multivariate time series data of traffic obtained in step 1. i，k The k-th time series sub-segment data in the i-th time window, X i，k [f] indicates the time window (x i,k [t]) is the Fourier transform result in the frequency domain, where f represents the frequency component and the frequency corresponding to the Fourier transform. This represents the Fourier transform operator. (Regarding the formula...) N represents the length of the time series segment, and n represents the index of the sample point in the current time series. i，k [n] represents the value of the nth sample point in the time series segment.

[0080] The average amplitude spectrum is calculated and the frequency of the first α is selected as G. α Constructing the mask function M(f)

[0081]

[0082] Sort(amplitude f for allf

[0083]

[0084] amplitude f The average amplitude corresponding to frequency f is used to measure the importance of frequency f across all time windows, while m represents the total number of time windows. |X i.k [f]| represents the amplitude at frequency f, and Sort(*) represents the average amplitude over all frequencies f. f Sort them according to their magnitude from largest to smallest. TopK(*) means selecting the K frequency components with the largest amplitude. The expression indicates rounding down, α is a scaling factor (0 < α ≤ 1), and K is the total number of frequency components. The most important frequency set is selected based on the amplitude values, meaning the frequencies ranking highest. This yields the principal components, which typically correspond to the most significant periodic or trending features of the signal. Therefore, the subscripts of the principal frequencies within the frequency band are derived from these subscripts, and we can construct the mask function using these subscripts. M(f) indicates whether a frequency belongs to the selected important frequency set.

[0085] The separated mask function is applied to the seasonal and trend components extracted in step 2. This yields the high-frequency and low-frequency components of both, as shown in the table below. X[f] represents the Fourier transform of the original signal X[t], containing all frequency components. M(f) is our mask function, and S[f] is the frequency domain signal obtained after applying the mask function, representing the frequency components that retain the main components.

[0086] S[f] = M(f)·X[f]

[0087] By performing trend and seasonal decomposition on time series data and further extracting principal and secondary components, this method aims to separate the main structural information (significant trends and periodicity) in the signal from minor details or noise, thereby improving data interpretability, noise reduction, and modeling efficiency, and providing a more accurate foundation for subsequent time series prediction, feature extraction, and classification.

[0088] Step 4. Feature Fusion and Linear Mapping: After completing temporal decomposition and Fourier decomposition and stabilization, the high- and low-frequency components of seasonality and trend are concatenated as vectors. This concatenation method is intuitive and efficient, preserving the original representation of both types of features and avoiding excessive assumptions or the introduction of additional complexity to the feature space during the fusion stage. Simultaneously, the concatenated multi-source features can be fully explored and optimized in the subsequent linear mapping process, thereby generating a unified high-dimensional feature representation.

[0089] Step 5. Perform vector embedding processing on the generated high-dimensional representation. Treat each variable as a node in a graph, and use a multilayer perceptron network to map the time series of a variable into a representation vector.

[0090] Simultaneously, other features of the variables are also incorporated into the representation, treating each traffic feature as a node in a graph. A multilayer perceptron is used to map each time series into a fixed-length representation vector. While generating the node representation vectors, other supplementary features (such as protocol type, traffic direction, etc.) are integrated into the representation vectors to ensure that the representation vectors contain rich feature information. The entire process can be summarized as follows:

[0091] h i =MLP seq (x i )+MLP(F i )

[0092] Where F i As the supplementary feature vector of node i, MLP seq For multilayer perceptrons specifically designed for processing time series data, h i It is the final generated node representation vector, x iThe time series input of node i, MLP(*) represents a general multilayer perceptron.

[0093] Step 6. Graph Neural Network Modeling: Input the embedding output from Step 4 into the Graph Neural Network (GNN) module. Improvements are made to traditional graph learning methods: Based on the Graph Convolutional Network (GCN), the feature dimensions of each variable are expanded, and then grouped according to a manually set division ratio. For the features of each group, convolutional neural networks with different sized kernels are constructed to perform multi-scale graph learning. The learning process is as follows: the inner product of vector embeddings and activation functions are used to automatically learn the scores between pairs of nodes as the adjacency matrix. Based on the graph convolutional network, the representation of each variable is first expanded in dimension and then grouped. Within each group, convolutional neural networks of different sizes are used to perform graph learning to calculate the inner product between node representation vectors, and the similarity score between nodes is generated through the activation function to construct a dynamic adjacency matrix. The above formula is expressed as:

[0094]

[0095] in It is the weight of the dynamic adjacency matrix, MLP expand (h j ) is an extension of representation to capture more complex relationships, where h i The transpose of h j This represents the node representation vector of node j.

[0096] Step 7. Finally, an anomaly detection module reconstructs the prediction results to generate the final anomaly detection results. The prediction results are compared with the actual traffic data, and abnormal traffic is identified through reconstruction error or anomaly scoring mechanisms. If the reconstruction error exceeds a threshold or the anomaly score exceeds a set value, the traffic is judged as abnormal. The final output includes the location, category, and characteristics of the abnormal traffic, providing real-time early warning and analysis for network security protection.

[0097] In summary, this invention combines temporal decomposition and Fourier transform to decompose network traffic data into multi-level time and frequency domain features, effectively extracting long-term trends, periodic fluctuations, and short-term anomalous signals. Furthermore, by incorporating a multi-scale graph neural network approach, it deeply mines the potential patterns and anomaly characteristics of network traffic. Compared to traditional methods, this model significantly improves detection accuracy, reduces noise interference, and enhances the ability to identify anomalous behaviors with complex temporal dependencies, thereby achieving more comprehensive and efficient feature extraction and anomaly detection.

Claims

1. An abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network, characterized in that, Includes the following steps: Step 1: Collect and preprocess network traffic data to obtain multivariate time series data; Step 2: Perform seasonality and trend decomposition on the preprocessed multivariate time series data to obtain the trend and seasonal components corresponding to the original multivariate time series. Step 3: Perform Fourier mask function calculation on the trend components and seasonal components extracted in Step 2 to obtain the high-frequency and low-frequency components of the trend components and the high-frequency and low-frequency components of the seasonal components. Step 4: Stabilize the high and low frequency components extracted in Step 3 to obtain the stabilized vector; Step 5: Perform an embedding linear mapping process on the high-frequency and low-frequency components of the trend and seasonal components obtained from the stabilization process in Step 4 to obtain new vector representations for them. Step 6: Perform vector embedding on the vectors obtained in Step 5 to model a graph neural network and obtain feature vectors; Step 7: Perform anomaly detection on the feature vectors to obtain the final anomaly detection results; Step 6 includes: Step 6.1: Input the generated high-dimensional feature representation into the graph neural network module to begin further feature processing; Step 6.2: Group high-dimensional features based on manually set fixed ratio rules; Step 6.3: Apply 1D convolution operation to the features of each group, and use convolution kernels of different sizes to perform multi-scale feature extraction; Step 6.4: Calculate the feature vectors of the nodes using a graph learning mechanism; The multi-scale feature extraction in step 6.3 is calculated using the following formula: in, For the feature vector of the node, σ For activation function, and Let be the representation vector of the node. W This is the weight matrix. This is an extension function for the multilayer perceptron.

2. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 1 includes: Step 1.1: Collect normal and abnormal network traffic data from the target network using a traffic acquisition tool; Step 1.2: Preprocess the traffic data packets to remove duplicate, erroneous, or incomplete data packets; Step 1.3: Divide the collected traffic data into multiple independent streams according to the data packets; Step 1.4: Extract the timestamp, packet size, and protocol type characteristics of each stream; Step 1.5: Preprocess the feature data, including data cleaning, formatting, removing invalid data, and filling in missing values; Step 1.6: Arrange the extracted features according to the time axis to form multivariate time series data.

3. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 2 includes: Step 2.1: The multivariate time series data obtained in Step 1 is processed using the moving average method to obtain the trend component and the seasonal component, given the time series. The trend component column is calculated using the moving average method. and seasonal list ,in k It's the size of the sliding window: 。 4. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 3 includes: Step 3.1: By dividing the time window, perform Fourier transform on each window to obtain the frequency domain representation under the window. Then, calculate the average amplitude spectrum of the frequency domain data of all windows. After that, select the top α frequencies to construct the mask function. Finally, obtain the mask function corresponding to the dataset. Step 3.2: Process the trend components extracted in Step 2 using the mask function described above to obtain the high-frequency and low-frequency components of the trend components. Step 3.3: Process the seasonal components extracted in Step 2 using the mask function described above to obtain the high-frequency and low-frequency components of the seasonal components.

5. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 4, characterized in that, The mask function in step 3.1 is calculated using the following formula: in Indicates the first i The first sample k The frequency domain signal within a time window has a frequency range. f The value at that location, This indicates selecting the one with the largest amplitude. K One frequency component, Indicates rounding down. α It is a scaling factor , K It represents the total number of frequency components.

6. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 4 includes: Step 4.1: Stabilize the high-frequency and low-frequency components of the seasonal components to obtain the stabilized data; Step 4.2: Stabilize the high-frequency and low-frequency components of the trend to obtain the stabilized data.

7. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 5 includes: Step 5.1: The vectors of high-frequency and low-frequency components of the trend component after stabilization and the original data residuals are concatenated, and other optional supplementary features are also concatenated. Then, the vectors are mapped to a new vector representation through a linear layer. Step 5.2: The vectors of high-frequency and low-frequency components of the seasonal components after stabilization are concatenated with the original data residuals, and other optional supplementary features are also concatenated. Then, the vectors are mapped to a new vector representation through a linear layer.

8. The abnormal traffic detection method based on multi-level time-frequency decomposition and graph neural network according to claim 1, characterized in that, Step 7 includes: Step 7.1: Concatenate the feature vectors and input them into the anomaly detection module based on reconstruction error; Step 7.2: Identify abnormal traffic through reconstruction error or anomaly scoring mechanisms; Step 7.3: Output the detection results, including the location, category, and characteristics of the abnormal traffic.

Images