Abnormal network flow detection method and system

Abstract

The invention relates to the technical field of data detection, and particularly discloses an abnormal network flow detection method and system. Step S01, constructing an abnormal network traffic monitoring model, wherein an LSTM module is used for acquiring a prediction error absolute value and inputting the prediction error absolute value into a GMM network module; the DNN network module is used for acquiring internal relation information of the traffic characteristics and inputting the internal relation information to the GMM network module; the GMM network module is used for performing density evaluation according to the prediction error absolute value and the internal relation information to obtain a monitoring result; s02, collecting network flow data, preprocessing the network flow data, and training the abnormal network flow monitoring model to obtain a trained abnormal network flow monitoring model, the network flow data including flow load data and network flow feature data; and S03, using the trained abnormal network traffic monitoring model to perform network traffic monitoring, outputting a sample abnormal index, and obtaining an abnormal network traffic detection result.

Description

Technical Field

[0001] The present invention relates to the technical field of data detection, and particularly to an abnormal network traffic detection method and system. Background Art

[0002] With the vigorous development of Internet technology and the increasing expansion of network scale, in the fields of industrial Internet of Things, financial risk control, network security, etc., anomaly detection technology is of great value for identifying abnormal behaviors such as equipment failures, fraudulent transactions, or network attacks. However, due to the complexity of the data types of network traffic, which include multiple tags, a large amount of data, and all belong to high-dimensional data, it is somewhat difficult to perform anomaly detection on this high-dimensional data to ensure network security and data security.

[0003] Generally, network traffic has certain rules. Through network traffic, anomalies in network traffic can be detected in a timely manner, thereby achieving the prevention of website intrusion and the protection of network security. However, the existing data anomaly detection methods are based on deep learning anomaly detection. The Deep Autoencoding Gaussian Mixture Model (DAGMM) shows high detection efficiency in static data scenarios because of its combination of the data reconstruction ability of the autoencoder and the probability density estimation advantage of the Gaussian mixture model. DAGMM reduces the dimension and reconstructs the input data, combines the latent space features and the reconstruction error to construct a joint feature vector, and then evaluates the anomaly probability of the sample through the Gaussian mixture model. However, the traditional DAGMM model only relies on the internal static relationships of the data (such as the spatial correlation or distribution consistency between features), and its core assumption is that the data samples are independent and identically distributed, without fully considering the potential temporal dependence relationships in the data generation process. Although DAGMM performs well in static data, it has deficiencies in dynamic temporal scenarios. Usually, there are problems such as high model complexity, difficulty in compatibility between feature representation and the DAGMM framework, or insufficient fusion of temporal and static features.

[0004] Therefore, how to deeply integrate temporal dependence information on the basis of retaining the advantages of efficient feature learning and density estimation of the DAGMM model to improve the anomaly detection accuracy in dynamic scenarios has become a technical problem to be solved urgently. Summary of the Invention

[0005] In view of the above problems, the first object of the present invention is to provide an abnormal network traffic detection method. By combining the anomaly detection of internal data information with temporal anomaly detection and considering whether the data is abnormal from two perspectives simultaneously, the anomaly detection accuracy is improved.

[0006] The second object of the present invention is to provide an abnormal network traffic detection system.

[0007] To achieve the first objective, the first technical solution of the present invention is: an abnormal network traffic detection method, including: Step S01: Construct an abnormal network traffic monitoring model, including an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of the traffic characteristics and input it into the GMM network module; the GMM network module is used to perform density evaluation according to the absolute value of the prediction error and the internal relationship information to obtain a monitoring result; Combining the anomaly detection of internal data information with the time-series anomaly detection, and considering whether the data is abnormal from two perspectives at the same time. It is more likely to discover abnormal network traffic and improve the accuracy of the model; Step S02: Collect network traffic data, preprocess the network traffic data, and use it to train the abnormal network traffic monitoring model to obtain a trained abnormal network traffic monitoring model. The network traffic data includes traffic load data and network traffic feature data; Step S03: Use the trained abnormal network traffic monitoring model to monitor network traffic, output a sample anomaly index, and obtain an abnormal network traffic detection result.

[0008] Preferably, in step S01, the internal relationship information of the traffic characteristics includes the reconstruction error and low-dimensional information of the network traffic characteristics.

[0009] Preferably, in step S02, the training of the abnormal network traffic monitoring model includes: using the preprocessed traffic load data to train the LSTM module to obtain a predicted traffic load, calculating the absolute value of the prediction error according to the real traffic load and the predicted traffic load, and inputting the absolute value of the prediction error into the GMM network module for density evaluation.

[0010] Normally, LSTM is used for prediction tasks. In this example, by calculating the form of the prediction error, LSTM is introduced into the abnormal network traffic monitoring task, improving the accuracy of the overall model.

[0011] Preferably, the training of the abnormal network traffic monitoring model further includes: using the preprocessed network traffic feature data to train the DNN network module to obtain low-dimensional information and reconstruction error, and inputting the low-dimensional information and reconstruction error into the GMM network module for density evaluation.

[0012] Preferably, in step S02, the Min-Max algorithm is used to preprocess the network traffic data. The calculation formula of the Min-Max algorithm is: ; Among them, is the preprocessed network traffic data, is the value of the network traffic data sample, is the minimum value of the network traffic data sample value, is the maximum value of the network traffic data sample value.

[0013] Preferably, in step S02, the following constraint function is used to train the abnormal network traffic monitoring model: ; Among them, is the constraint function with as the parameter, is the Euclidean distance, is the absolute value of the prediction error, is the sample anomaly index, is the minimum value, is the number of samples, , are the constant coefficients of the anomaly index and the minimum value in the objective function, respectively.

[0014] Preferably, in step S03, the calculation formula of the sample anomaly index is: ; ; ; ; Among them, is the input sample of the GMM network, is the th input sample, is the mixing probability of the component in the GMM, is the mean of the component in the GMM, is the th low-dimensional data under the th Gaussian mixture model component, is the anomaly index of the sample , is the Mahalanobis distance of the sample , is the distance coefficient when calculating the anomaly index, and exp() represents the natural exponential function.

[0015] To achieve the second purpose, the second technical solution of the present invention is: An abnormal network traffic detection system, including: Abnormal network traffic monitoring model construction module: used to construct an abnormal network traffic monitoring model; Network traffic data collection and processing module: used to collect network traffic data, preprocess the network traffic data, and used to train the abnormal network traffic monitoring model; Abnormal network traffic monitoring model training module: used to obtain a trained abnormal network traffic monitoring model based on the preprocessed network traffic data; Result monitoring and output module: used to monitor network traffic using the trained abnormal network traffic monitoring model, output a sample anomaly index, and obtain an abnormal network traffic detection result.

[0016] Preferably, the abnormal network traffic monitoring model includes an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of the traffic characteristics and input it into the GMM network module; the GMM network module is used to perform density evaluation based on the absolute value of the prediction error and the internal relationship information to obtain a monitoring result.

[0017] Preferably, the abnormal network traffic monitoring model training module is used to perform the following operations: Use the preprocessed traffic load data to train the LSTM module to obtain the predicted traffic load, calculate the absolute value of the prediction error according to the actual traffic load and the predicted traffic load, and input the absolute value of the prediction error into the GMM network module for density evaluation; and use the preprocessed network traffic feature data to train the DNN network module to obtain low-dimensional information and reconstruction error, and input the low-dimensional information and reconstruction error into the GMM network module for density evaluation.

[0018] Beneficial effects of the above technical solutions: The abnormal network traffic detection method provided by the present invention considers whether the data is abnormal from two perspectives at the same time, combines the abnormal detection of the internal information of the data with the time series abnormal detection. And a model structure jointly trained by the LSTM algorithm and the DAGMM (DNN+GMM) algorithm is proposed, which improves the abnormal detection accuracy of the system. Among them, LSTM is used for prediction tasks. By calculating the form of the prediction error, LSTM is introduced into the data abnormal detection task. The Mahalanobis distance is introduced in the joint training process, effectively expanding the distance between normal data and abnormal data. On the basis of retaining the advantages of efficient feature learning and density estimation of the DAGMM model, the time series dependence information is deeply fused to improve the abnormal detection accuracy in dynamic scenarios. Description of the drawings

[0019] To more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present application. For those skilled in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0020] Figure 1 Flowchart of the abnormal network traffic detection method provided by an embodiment of the present invention; Figure 2 Diagram of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 3 Working diagram of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 4 Schematic diagram of the convergence of the loss function of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 5 Schematic diagram of the change of the sample anomaly index of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 6 Schematic diagram of the convergence of the reconstruction error of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 7 Schematic diagram of the change of the matrix penalty function value of the abnormal network traffic monitoring model provided by an embodiment of the present invention; Figure 8 Relationship diagram between the reconstruction error and the anomaly index caused during the encoding and decoding processes of the DNN network module in the abnormal network traffic monitoring model provided by an embodiment of the present invention. Detailed implementation manners

[0021] The following will further describe the implementation manners of the present application in detail. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than an exhaustive list of all embodiments. It should be noted that, without conflict, the embodiments and the features in the embodiments of the present application can be combined with each other.

[0022] The terms "first", "second", etc. (if any) in the description and claims are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that comprises a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0023] It should be understood that the term " / and" used herein is merely a relational term describing associated objects, indicating that three relationships may exist. For example, A / and B may represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " herein generally represents an "or" relationship between the associated objects before and after.

[0024] Embodiment 1 An embodiment of the present invention provides a flowchart of a method for detecting normal network traffic as follows Figure 1 shown, including: Step S01: Construct an abnormal network traffic monitoring model, including an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of the traffic characteristics and input it into the GMM network module; the GMM network module is used to perform density evaluation according to the absolute value of the prediction error and the internal relationship information to obtain a monitoring result; Step S02: Collect network traffic data, preprocess the network traffic data, and use it to train the abnormal network traffic monitoring model to obtain a trained abnormal network traffic monitoring model. The network traffic data includes traffic load data and network traffic characteristic data; Step S03: Use the trained abnormal network traffic monitoring model to perform network traffic monitoring, output a sample anomaly index, and obtain an abnormal network traffic detection result.

[0025] I. Construct an abnormal network traffic monitoring model Construct an abnormal network traffic monitoring model, and the model structure is as follows Figure 2 shown, including an LSTM module, a DNN network module, and a GMM network module.

[0026] II. Abnormal network traffic monitoring method Use the abnormal network traffic monitoring model for monitoring, as follows Figure 3 shown, including the following steps: Preprocessing of Network Traffic Data In the network traffic dataset, there are significant differences in the order of magnitude between features. Some feature value ranges are between 0 and 1 billion, while some feature value ranges are between 0 and 1. To eliminate this difference, the collected network traffic data is preprocessed using the Min - Max algorithm. The calculation formula of the Min - Max algorithm is: ; Among them, is the preprocessed network traffic data, is the value of the network traffic data sample, is the minimum value of the network traffic data sample value, is the maximum value of the network traffic data sample value.

[0027] Preferably, in the present invention, the network traffic data is divided into two parts: traffic load data and network traffic feature data, and the Min - Max algorithm is used to preprocess the two parts of data respectively.

[0028] Among them, the traffic load data is time - series sensitive information, including the relationship information between traffic load changes and time. Preferably, taking the BDC dataset as an example, its format is: (network coordinates, time nodes, traffic load). The network traffic feature data is non - time - series sensitive information. Taking the NSL - KDD dataset as an example, its format is: 2,tcp, smtp, SF, 1684, 363, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1,1, 0.00, 0.00, 0.00, 0.00, 1.00, 0.00, 0.00, 104, 66, 0.63, 0.03, 0.01, 0.00,0.00, 0.00, 0.00, 0.00.

[0029] The above values are specifically divided into the following 4 categories: basic TCP connection features (9 kinds in total), content features of TCP connections (13 kinds in total), time - based network traffic statistical features (9 kinds in total), and host - based network traffic statistical features (10 kinds in total).

[0030] LSTM Model for Predicting Traffic Load After analyzing a large amount of real network traffic load data, it is found that the change of traffic load data has strong time correlation. For example, the network traffic load in the school area is relatively high during the day from Monday to Friday, and the network traffic load in the shopping mall area may be relatively high on weekends. Therefore, in this embodiment, the LSTM model is used to fit and model the network traffic load data. Assume that abnormal network traffic monitoring is carried out in an area with a network coordinate of 256. During a monitoring period, the time is equally divided into T nodes. The time node has a network traffic load of ; the time node has a network traffic load of . Based on the traffic load data format in the present invention: (network coordinate, time node, traffic load amount), when the network coordinate remains unchanged, the traffic load data can be expressed as follows: ; Using the LSTM model to model the network traffic load data and perform supervised learning training, that is, taking the network traffic load at the time node as the input of the LSTM model, and taking the network traffic load at the next time node as the output of the model for model training and prediction. In terms of model parameters, the LSTM contains two LSTM layers, the number of hidden layer nodes is 128, the learning rate is 0.001, and a dropout rate of 0.2 is set to prevent the model from overfitting.

[0031] DNN: Deep Neural Network, also known as a fully connected network. LSTM: Long Short-Term Memory network, which is an improved version of the recurrent neural network and is good at processing time-sensitive information. GMM: Gaussian Mixture Model, (Gaussian Mixture Model, GMM) as an unsupervised probability model, is favored for its powerful modeling ability for multivariate data distribution. It assumes that the data is composed of multiple Gaussian distributions (normal distributions) superimposed, and each Gaussian distribution represents a potential class or cluster in the data space. This mixture model can depict non-linear and non-convex data distributions and is widely used in many scenarios such as clustering analysis, anomaly detection, density estimation, speech recognition, and image segmentation.

[0032] Training of the abnormal network traffic monitoring model Training the abnormal network traffic monitoring model. In Figure 2 , is the traffic load data at time t - 1, is the real traffic load amount at time t, is the traffic load amount at time t predicted by the LSTM, The absolute value of the prediction error between and is the network traffic feature vector at time t, and is the reconstructed sample after the encoding and decoding processes of the DNN network, and is the low-dimensional sample encoded by the DNN network, and is the reconstruction error between and is the density estimate output by the GMM network (Gaussian mixture model).

[0033] ; ; Among them, are the encoder parameters, is the process of encoding with the encoder using as the parameter, are the decoder parameters, is the process of decoding with the decoder using as the parameter.

[0034] The output of the DNN network contains two variables: ① The low-dimensional sample ; ② The reconstruction error between and .

[0035] ; Among them, is the 2D feature, is the Euclidean distance, is the cosine similarity.

[0036] ; ; The input sample of the GMM network (Gaussian mixture model) is , and density estimation is performed by predicting the mixture membership of each sample using a multi-layer neural network. , which is the output of the multi-layer neural network using as the parameter, is a dimensional vector.

[0037] Given N data samples, , the parameters in the GMM network are as follows.

[0038] ; ; ; Among them, is the mixing probability of component in GMM, is the mean of component of in GMM, is the covariance of component in GMM, is the th sample under the th Gaussian mixture model component's density estimate.

[0039] Suppose there is a dataset with a mean of and a covariance matrix of , where the number of samples is n and the data dimension is j , then its Mahalanobis distance is expressed as: ; Then the Mahalanobis distance of sample is: ; The lower the sample anomaly index, the more normal the sample is. The specific numerical range needs to be calibrated according to different datasets. The calculation formula of the sample anomaly index is: ; The constraint function during model training is: ; Among them, is the constraint function with as the parameter, is the reconstruction error (Euclidean distance) caused by the deep autoencoder during encoding and decoding, is the prediction error from LSTM, is the sample anomaly index output by the Gaussian mixture model, is a minimum value, is the number of samples. This part is mainly applied in the training process of the Gaussian mixture model to prevent the values on the diagonal of the covariance matrix from becoming 0, which may lead to the matrix being non-invertible. is the distance coefficient when calculating the anomaly index, , They are the constant coefficients of the anomaly index and the minimum value in the objective function respectively.

[0040] The present invention also provides an abnormal network traffic monitoring system, including: an abnormal network traffic monitoring model construction module: used to construct an abnormal network traffic monitoring model; A network traffic data collection and processing module: used to collect network traffic data, preprocess the network traffic data, and used to train the abnormal network traffic monitoring model; An abnormal network traffic monitoring model training module: used to obtain a trained abnormal network traffic monitoring model according to the preprocessed network traffic data; A result monitoring and output module: used to perform network traffic monitoring using the trained abnormal network traffic monitoring model, output a sample anomaly index, and obtain an abnormal network traffic detection result.

[0041] The abnormal network traffic monitoring model includes an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of the traffic characteristics and input it into the GMM network module; the GMM network module is used to perform density evaluation according to the absolute value of the prediction error and the internal relationship information to obtain a monitoring result.

[0042] The abnormal network traffic monitoring model training module is used to perform operations: training the LSTM module using the preprocessed traffic load data to obtain a predicted traffic load, calculating the absolute value of the prediction error according to the real traffic load and the predicted traffic load, and inputting the absolute value of the prediction error into the GMM network module for density evaluation; and training the DNN network module using the preprocessed network traffic feature data to obtain low-dimensional information and a reconstruction error, and inputting the low-dimensional information and the reconstruction error into the GMM network module for density evaluation.

[0043] Simulation results of the abnormal network traffic monitoring method The operating system of the experimental environment is Windows 10 (64-bit), the CPU is Intel Core i7-8750H, the memory is 32GB, and the hard disk is a 932GB mechanical hard disk. The development language is Python 3.6.0, and the machine learning environment is numpy 1.19.5, tensorflow 1.2.0, pandas 1.1.5, torch 1.7.1, and Scikit-learn 1.0.

[0044] The NSL-KDD dataset is used in the simulation, and the parameter settings are shown in Table 1 below: Table 1 Simulation parameters

[0045] Training situation The training process is as Figures 4 - 7 shown Figure 4 Schematic diagram of the convergence of the constraint function of the abnormal network traffic monitoring model provided by an embodiment of the present invention, Figure 5 Schematic diagram of the change of the sample anomaly index of the abnormal network traffic monitoring model provided by an embodiment of the present invention, Figure 6 Schematic diagram of the convergence of the reconstruction error of the abnormal network traffic monitoring model provided by an embodiment of the present invention, Figure 7 Schematic diagram of the change of the matrix penalty function value of the abnormal network traffic monitoring model provided by an embodiment of the present invention.

[0046] Experimental results As Figure 8 shown, the vertical axis represents the reconstruction error (Euclidean distance) caused during the encoding and decoding processes of the DNN network module, and the horizontal axis represents the anomaly index of the samples; where triangles and circles are abnormal and normal samples respectively, and the vertical solid line represents the threshold, and the picture contains 100 samples from the public dataset.

[0047] Table 2 Evaluation results

[0048] The evaluation results are shown in Table 2. The present invention uses accuracy, precision, recall, and F1-score as the criteria for judging the performance of the model. The model provided by the present invention has excellent generalization and high efficiency, and solves the local optimum problem existing in the detection process. The model jointly optimizes the parameters of the deep autoencoder and the hybrid model in an end-to-end mode and performs excellently on the public benchmark dataset.

[0049] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, rather than limitations on the implementation manners of the present invention. For those of ordinary skill in the art, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the implementation manners here. Any obvious changes or modifications derived from the technical solutions of the present invention still fall within the protection scope of the present invention.

Claims

1. An abnormal network traffic detection method, characterized in that, Including: Step S01: Construct an abnormal network traffic monitoring model, including an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of traffic characteristics and input it into the GMM network module; the GMM network module is used to perform density evaluation based on the absolute value of the prediction error and the internal relationship information to obtain a monitoring result. Step S02: Collect network traffic data, preprocess the network traffic data, and use it to train the abnormal network traffic monitoring model to obtain a trained abnormal network traffic monitoring model. The network traffic data includes traffic load data and network traffic characteristic data. Step S03: Use the trained abnormal network traffic monitoring model to monitor network traffic, output a sample anomaly index, and obtain an abnormal network traffic detection result.

2. The abnormal network traffic detection method according to claim 1, wherein In step S01, the internal relationship information of the traffic characteristics includes the reconstruction error and low-dimensional information of the network traffic characteristics.

3. The abnormal network traffic detection method according to claim 1, wherein In step S02, the training of the abnormal network traffic monitoring model includes: using the preprocessed traffic load data to train the LSTM module to obtain a predicted traffic load, calculating the absolute value of the prediction error according to the real traffic load and the predicted traffic load, and inputting the absolute value of the prediction error into the GMM network module for density evaluation.

4. The abnormal network traffic detection method according to claim 3, wherein The training of the abnormal network traffic monitoring model further includes: using the preprocessed network traffic characteristic data to train the DNN network module to obtain low-dimensional information and a reconstruction error, and inputting the low-dimensional information and the reconstruction error into the GMM network module for density evaluation.

5. The abnormal network traffic detection method according to claim 1, wherein In step S02, the Min-Max algorithm is used to preprocess the network traffic data. The calculation formula of the Min-Max algorithm is: ； Among them, is the preprocessed network traffic data, is the value of the network traffic data sample, is the minimum value of the network traffic data sample value, is the maximum value of the network traffic data sample value.

6. The abnormal network traffic detection method according to claim 1, wherein In step S02, the following constraint function is used to train the abnormal network traffic monitoring model: ； Among them, is a constraint function with as the parameter, is the Euclidean distance, is the absolute value of the prediction error, is the sample anomaly index, is the minimum value, is the number of samples, , are the constant coefficients of the anomaly index and the minimum value in the objective function, respectively.

7. The abnormal network traffic detection method according to claim 1, wherein In step S03, the calculation formula of the sample anomaly index is: ； ； ； ； Among them, is the input sample of the GMM network, is the th input sample, is the mixing probability of the component in the GMM, is the mean of the component in the GMM, is the th low-dimensional data under the density estimation of the th Gaussian mixture model component, is the anomaly index of the sample , is the Mahalanobis distance of the sample , is the distance coefficient when calculating the anomaly index, and exp() is the natural exponential function.

8. An abnormal network traffic detection system, characterized in that, Including: Abnormal network traffic monitoring model construction module: used to construct an abnormal network traffic monitoring model; Network traffic data collection and processing module: used to collect network traffic data, preprocess the network traffic data, and use it to train the abnormal network traffic monitoring model; Abnormal network traffic monitoring model training module: used to obtain a trained abnormal network traffic monitoring model according to the preprocessed network traffic data; Result monitoring and output module: used to use the trained abnormal network traffic monitoring model to monitor network traffic, output a sample anomaly index, and obtain an abnormal network traffic detection result.

9. The abnormal network traffic detection system according to claim 8, wherein The abnormal network traffic monitoring model includes an LSTM module, a DNN network module, and a GMM network module. Among them, the LSTM module is used to obtain the absolute value of the prediction error and input it into the GMM network module; the DNN network module is used to obtain the internal relationship information of traffic features and input it into the GMM network module; the GMM network module is used to perform density evaluation according to the absolute value of the prediction error and the internal relationship information to obtain the monitoring result.

10. The abnormal network traffic detection system according to claim 9, wherein The abnormal network traffic monitoring model training module is used to perform the following operations: Use the preprocessed traffic load data to train the LSTM module to obtain the predicted traffic load, calculate the absolute value of the prediction error according to the real traffic load and the predicted traffic load, and input the absolute value of the prediction error into the GMM network module for density evaluation; And Use the preprocessed network traffic feature data to train the DNN network module to obtain low-dimensional information and reconstruction error, and input the low-dimensional information and reconstruction error into the GMM network module for density evaluation.

Images