A data traffic monitoring method and system based on internet communication

Abstract

The application discloses a kind of data flow monitoring method and system based on internet communication, it is related to data flow monitoring technical field, the application includes: historical characteristic space-time modeling, constructs flow mode library by three-dimensional feature, extracts normal periodic behavior and abnormal mode in combination with dynamic period detection and multiscale fusion;Real-time abnormality collaborative verification, utilize parallel running threshold detector and prediction detector, adjust multidimensional score by scene perception dynamic weight, accurately distinguish real abnormality and false alarm;Dynamic parameter correction, based on false alarm feedback and reinforcement learning optimization PID control parameter, combine exponential decay update mode library, realize threshold self-adaptive adjustment and the fusion of long-term short-term flow mode, improve system robustness.The application can effectively improve the precision and robustness of data flow monitoring, reduce false alarm and miss, adapt to complex and changeable network environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data flow monitoring, in particular to a data flow monitoring method and system based on Internet communication. BACKGROUND

[0002] In the field of Internet communication, data flow monitoring is a key technology to ensure network stability and security. With the continuous expansion of network size and the increase of traffic complexity, traditional data flow monitoring methods face many challenges. For example, traditional monitoring methods usually rely on simple threshold detection, which is difficult to adapt to the dynamic changes of traffic and is prone to a large number of false positives or false negatives. In addition, existing monitoring systems often lack accurate modeling of traffic periodic behavior when dealing with large-scale data, resulting in the inability to effectively distinguish normal traffic fluctuations from abnormal traffic.

[0003] Existing data flow monitoring technologies have obvious limitations when facing complex network environments. On the one hand, traditional monitoring methods cannot effectively integrate multi-dimensional features (such as time, space, and content features), resulting in inaccurate identification of abnormal traffic. On the other hand, existing systems lack dynamic parameter adjustment and are difficult to adaptively optimize according to real-time network status and false positive feedback. In addition, existing technologies lack effective fusion mechanisms when dealing with long-term and short-term traffic patterns, resulting in insufficient robustness of the system when dealing with sudden traffic changes.

[0004] In order to solve the above-mentioned defects, a technical solution is provided. SUMMARY

[0005] The present application aims to solve the problems of high false positive rate, inability to accurately identify abnormal traffic, insufficient dynamic adaptability, and difficulty in long-term and short-term traffic pattern fusion in existing data flow monitoring technologies, and proposes a data flow monitoring method and system based on Internet communication.

[0006] The purpose of the present application can be achieved by the following technical solutions:

[0007] A data flow monitoring method based on Internet communication, comprising the following steps:

[0008] Q1, historical feature spatiotemporal modeling, constructing a traffic pattern library through three-dimensional features, combining dynamic periodic detection and multi-scale fusion, extracting normal periodic behavior and abnormal patterns, and providing a baseline model for subsequent detection;

[0009] Q2, real-time anomaly collaborative verification, running threshold detector and prediction detector in parallel, adjusting multi-dimensional score through scene-aware dynamic weight, and distinguishing real anomalies from false positives;

[0010] Q3, dynamic parameter correction, based on false feedback and reinforcement learning to optimize PID control parameters, combined with exponential decay update mode library, to realize the fusion of threshold adaptive adjustment and long-term and short-term traffic mode, and to improve the robustness of the system.

[0011] Further, the specific process of Q1 is as follows:

[0012] Establish a traffic feature tensor: define a three-dimensional feature space , comprehensively describe the time, space and content characteristics of traffic through a three-dimensional feature space;

[0013] Where: T is the time dimension, including hour-level trends and minute-level fluctuations;

[0014] S is the spatial dimension, based on the distribution entropy of source IP and destination IP;

[0015] C is the content dimension, load entropy , where represents entropy, represents the probability that the random variable x takes a certain specific value, x is a random variable, and log is the logarithm operation on the probability ;

[0016] Construct a typical mode library, periodic pattern extraction: , through the periodic superposition of historical data; where is the periodic pattern function, Td is the traffic period, is the global historical period number, is the feature value at time point t in the kth period;

[0017] The improved DBSCAN algorithm is used for abnormal mode clustering, and the density threshold is defined as: , is the average value of the neighborhood sample, is the standard deviation.

[0018] Further, the dynamic period detection algorithm and multi-scale feature fusion mechanism are added to the periodic pattern extraction in Q1, the process is as follows:

[0019] Perform a fast Fourier transform on historical traffic data : , extract the frequency of the significant peak in the amplitude spectrum , calculate the candidate period ; where is the Fourier transform result of historical traffic data ; j is the ordinal unit, w is the angle function, and t is the time;

[0020] Define the period stability index: , where M is the verification period number, and the the period; wherein is the period stability index, m is the mth verification period, is the correlation function, Td is the flow period;

[0021] If multiple valid periods are detected , reconstruct the period pattern: , wherein is the number of historical periods corresponding to each period, is the number of candidate periods;

[0022] Expand the time dimension T into a multi-scale structure: , respectively calculate the trend component under each scale ;

[0023] Dynamically fuse multi-scale features through attention mechanism: , , is the attention weight of each time scale, is a trainable weight parameter, time scale type.

[0024] Further, the specific operation steps of Q2 are as follows:

[0025] Multi-detector parallel computing, threshold detector: , based on the 3σ principle to detect instantaneous anomalies, if the current value exceeds three times the standard deviation of the historical mean, an alarm is triggered; wherein are the historical mean and the historical standard deviation, respectively, x is the current flow feature value;

[0026] The prediction detector uses an LSTM model, and the abnormal criterion is: , wherein are the actual observation value and the LSTM model prediction value, respectively, is the error tolerance threshold; by comparing the relative error between the actual value and the predicted value, identify the flow anomaly deviation caused by attack or congestion;

[0027] The verification decision function is: the comprehensive score formula is: ;

[0028] Wherein: is the time sequence similarity, which measures the time sequence correlation between the current time point and the historical abnormal event, wherein is the time decay coefficient, is the timestamp of the historical abnormal event;

[0029] , measure the similarity between the current flow and the historical anomaly in the spatial feature through the cosine similarity, is a flow space feature vector; is an adjustable weight coefficient;

[0030] is a flow content dimension similarity.

[0031] Further, a scene-aware dynamic weight adjustment algorithm is introduced on the verification decision function in Q2. By analyzing the flow features and network environment in real time, the weight coefficients of time, space, and content dimensions are automatically optimized. The specific process is as follows:

[0032] The following environmental indicators are extracted:

[0033] Traffic type;

[0034] Network load rate;

[0035] Known threat intelligence matching degree;

[0036] Map the environmental state to a feature vector: where the traffic type is one-hot encoded;

[0037] A lightweight neural network model is constructed, with the scene feature vector as input and the weight coefficient as output: where W and b are model parameters, trained through historical data, and the objective function is to minimize the verification error;

[0038] The weights are recalculated every 5 minutes, and if the environmental state changes more than the threshold, the weight update is triggered immediately;

[0039] The constraint condition is: and the Lagrange multiplier method is used to ensure the legality of the output;

[0040] To avoid weight mutation, smoothing is used: where is a smoothing factor, and are the new weight value after smoothing, the historical weight value before weight update, and the weight value predicted by the lightweight neural network model, respectively.

[0041] Further, the specific operation steps of Q3 are as follows:

[0042] False positive feature analysis, define feature drift degree: quantifies the degree of deviation of the current feature from the historical normal range, where is the current feature value, are the historical feature mean and standard deviation, respectively;

[0043] When the drift degree of any dimension in the flow feature tensor exceeds 2.5 times the standard deviation, the parameter update is triggered;

[0044] Adaptive threshold adjustment, proportional-integral control is adopted: wherein are the proportional and integral coefficients;

[0045] Error term i.e. target false alarm rate - actual value;

[0046] Dynamic adjustment of detection threshold through PID control, automatically reduce sensitivity when false alarm rate is too high, otherwise increase;

[0047] Incremental update of mode library, update strategy: wherein is the decay factor, , hourly time constant, is the current traffic mode.

[0048] Further, the Q3 introduces a reinforcement learning driven parameter optimization module, which automatically optimizes the proportional coefficient and the integral coefficient by real-time feedback, the specific steps are as follows:

[0049] Define the environment state Senv to include: current false alarm rate , network load rate L = current bandwidth usage / total bandwidth, recent attack type distribution;

[0050] Define action A as adjustment of PID parameters: , , limit the adjustment amplitude at a time;

[0051] Multi-objective reward function: wherein, is the weight coefficient; is the threshold adjustment amplitude, is the false alarm rate after parameter adjustment;

[0052] Build a deep Q network, input is the environment state Senv, output is the Q value of each action space A: wherein Senv is the environment state, A is the action space, is the network parameter;

[0053] Store historical state transition data , sample batch data every 10 minutes to update network parameters, preferentially replay high reward experience, wherein are the environment state at time t, the action performed at time t, the immediate reward value obtained after performing the action and the new environment state after performing the action ;

[0054] Forced constraint PID parameter range: , , prevent the learning process to produce unreasonable values; if the false positive rate rises more than 5% after 3 consecutive adjustments, then automatically back to the last stable parameter configuration.

[0055] A data flow monitoring system based on Internet communication, comprising:

[0056] A multi-dimensional feature modeling module for constructing a flow feature tensor through a three-dimensional feature space, combining dynamic period detection and multi-scale fusion to generate a historical flow pattern library;

[0057] A real-time anomaly detection module for running a threshold detector and a prediction detector in parallel to capture flow anomalies in real time;

[0058] A decision verification module for verifying anomaly authenticity through a scene-aware dynamic weight adjustment algorithm, combining time series, spatial, and content multi-dimensional similarity scores;

[0059] A parameter dynamic optimization module for online optimization of PID control parameters using reinforcement learning, combining false feedback to automatically adjust detection thresholds and pattern library update strategies;

[0060] A knowledge base management module for storing historical flow patterns, anomaly feature vectors, and optimized parameters, supporting incremental updates and multi-version backtracking.

[0061] Compared with the prior art, the beneficial effects of the present application are:

[0062] (1) The present application can comprehensively and accurately describe flow characteristics through multi-dimensional feature modeling (time, space, and content dimensions) and dynamic period detection mechanisms, effectively extracting normal periodic behavior and abnormal patterns. At the same time, combined with the improved DBSCAN algorithm and multi-scale feature fusion mechanism, the recognition ability of low-density abnormal points is enhanced, significantly improving the accuracy and effectiveness of anomaly detection, and reducing false positives and false negatives;

[0063] (2) The present application introduces a dynamic parameter correction mechanism based on false feedback and reinforcement learning, dynamically adjusting detection thresholds through proportional-integral control (PID), and updating the pattern library combined with an exponential decay strategy. This adaptive adjustment mechanism can automatically optimize detection parameters according to real-time network status and false feedback, quickly respond to short-term flow changes, while preserving long-term flow regularities, significantly improving the robustness and adaptability of the system in complex network environments;

[0064] (3) The application adopts a scene-aware dynamic weight adjustment algorithm, can analyze traffic characteristics and network environment in real time, automatically optimizes multi-dimensional scoring weights, accurately distinguishes real abnormalities from false positives, and further improves the decision efficiency and management convenience of the system. BRIEF DESCRIPTION OF DRAWINGS

[0065] In order to facilitate the understanding of those skilled in the art, the application will be further described below in conjunction with the drawings;

[0066] Figure 1 The system total block diagram of the application. DETAILED DESCRIPTION

[0067] The technical solutions of the application will be described below in conjunction with the embodiments, obviously, the described embodiments are only some of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor belong to the protection scope of the application.

[0068] It should be understood that the terms "include" and "contain" used in the specification and claims of the present disclosure indicate the presence of the described features, whole, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, whole, steps, operations, elements, components and / or sets thereof.

[0069] It should also be understood that the terms used in the specification of the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure. As used in the specification and claims of the present disclosure, unless otherwise clear from the context, the singular forms "a", "an" and "the" are intended to include the plural forms. It should be further understood that the term "and / or" used in the specification and claims of the present disclosure means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0070] As Figure 1 shown, a data flow monitoring method based on Internet communication includes the following steps:

[0071] Step one, historical feature space-time modeling, constructing a traffic pattern library through three-dimensional features (time, space, content dimension), combining dynamic period detection and multi-scale fusion, extracting normal period behavior and abnormal patterns, providing a benchmark model for subsequent detection;

[0072] Establishing a traffic feature tensor: defining a three-dimensional feature space This method comprehensively describes the temporal, spatial, and content characteristics of traffic through a three-dimensional feature space, providing a structured data foundation for subsequent pattern analysis. Here, T represents the time dimension, including hourly trends and minute-level fluctuations; S represents the spatial dimension, based on the distribution entropy values ​​of source and destination IPs (measuring the randomness of IP address distribution); and C represents the content dimension (load entropy). ,in Entropy (information entropy) is used to measure the amount of information in a data packet. Log represents the probability that a random variable x will take a specific value, where x is a random variable and log is a probability. Logarithmic operations are used to measure the amount of information in a data packet.

[0073] Construct a typical pattern library and extract periodic patterns: By overlaying historical data over time, stable traffic patterns are extracted to identify normal periodic behaviors (such as daily business peaks); among which... This is a periodic pattern function, where Td is the flow period. This represents the total number of historical cycles. Let be the feature value at time point t within the k-th period; a dynamic period detection algorithm and a multi-scale feature fusion mechanism are added to the periodic pattern extraction, as follows:

[0074] Historical traffic data Perform a Fast Fourier Transform (FFT): Extracting the frequency of significant peaks in the amplitude spectrum Calculate candidate period ;in Historical traffic data The Fourier transform result; j is the ordinal unit, w is the angular function, and t is time;

[0075] Define the periodic stability index: Where M is the number of verification cycles, and is retained The cycle; among which The periodic stability index is denoted by m, where m is the m-th verification period. The correlation function is given by Td, where Td is the flow period.

[0076] If multiple valid cycles are detected Reconstructing the cycle pattern: ,in The historical cycle number corresponding to each cycle. The number of candidate periods; extending the time dimension T to a multi-scale structure: Calculate the trend components at each scale. Dynamically fuse multi-scale features through an attention mechanism: , wherein are attention weights for each time scale, are trainable weight parameters, time scale type (second, hour, week).

[0077] The abnormal pattern clustering uses an improved DBSCAN algorithm, and the density threshold is defined as: , is the mean of the neighborhood samples, is the standard deviation; in the improved DBSCAN algorithm, the recognition ability for low-density abnormal points is enhanced by reducing the density threshold (mean minus twice standard deviation).

[0078] Step two, real-time abnormality collaborative verification, parallel running of threshold detector (3σ principle) and prediction detector (LSTM model), through scene perception dynamic weight adjustment multi-dimensional score (time sequence, space, content), accurate distinction between real abnormality and false alarm;

[0079] Multi-detector parallel computing, threshold detector: , based on the 3σ principle to detect instantaneous abnormality, if the current value exceeds three times the historical mean standard deviation, an alarm is triggered; wherein are the historical mean and historical standard deviation, respectively, and x is the current flow characteristic value;

[0080] The prediction detector uses an LSTM model, and the abnormality criterion is: wherein are the actual observation value and the LSTM model prediction value, respectively, is the error tolerance threshold; by comparing the relative error between the actual value and the predicted value, the flow abnormality deviation caused by attack or congestion is identified;

[0081] The verification decision function is as follows: ; wherein: (time sequence similarity) measures the time sequence correlation between the current time point and the historical abnormal event, wherein is the time decay coefficient, is the timestamp of the historical abnormal event; measures the similarity between the current flow and the historical abnormality in the spatial feature through the cosine similarity, is the flow spatial feature vector; is the adjustable weight coefficient.

[0082] On the verification decision function, a scene-aware dynamic weight adjustment algorithm is introduced, which automatically optimizes the weight coefficients of time, space and content dimensions by real-time analysis of flow characteristics and network environment; the specific process is as follows:

[0083] Extract the following environmental indicators: traffic type (Web, video streaming, IoT devices, etc.); network load rate (current bandwidth usage / total bandwidth); known threat intelligence matching degree (such as IP blacklist hit rate);

[0084] Map the environmental state to a feature vector: , where the traffic type is one-hot encoded (e.g. Web=001, Video Stream=010, IoT=100);

[0085] Build a lightweight neural network model (3-layer fully connected) with input as the scene feature vector and output as the weight coefficient: , where W and b are model parameters trained through historical data, with the objective function being to minimize the validation error; recompute weights every 5 minutes, and if the environmental state changes more than a threshold (e.g. load rate fluctuation >20%), trigger weight update immediately;

[0086] The constraint condition is: and ensure the output is legal through the Lagrange multiplier method; to avoid weight mutation, use smoothing processing: , where is the smoothing factor, initially set to 0.7, are the new weight values after smoothing processing, the historical weight values before weight update, and the weight values predicted by the lightweight neural network model, respectively.

[0087] Step three, dynamic parameter correction, based on false alarm feedback and reinforcement learning to optimize PID control parameters, combined with an exponential decay update mode library to achieve adaptive threshold adjustment and efficient fusion of long-term / short-term traffic patterns, improving system robustness;

[0088] False alarm feature analysis, define feature drift degree: , quantify the degree of deviation of current features from historical normal range, where is the current feature value, are the historical feature mean and standard deviation, respectively; when the drift degree of any dimension in the traffic feature tensor exceeds 2.5 times the standard deviation, trigger parameter update;

[0089] Adaptive threshold adjustment, use proportional-integral control: , where are the proportional and integral coefficients; error term (target false alarm rate-actual value); dynamically adjust the detection threshold through PID control, automatically reduce sensitivity when false alarm rate is too high, and vice versa;

[0090] Incremental update of mode library, update strategy: , where is the decay factor, ( hour time constant),

[0091] Introducing reinforcement learning driven parameter optimization module, automatically optimizing proportional coefficient and integral coefficient by real-time feedback

[0092] Define the environment state Senv to include: current false positive rate , network load rate L = current bandwidth usage / total bandwidth, recent attack type distribution (such as DDoS, port scanning, data leakage proportion) ; Define action A as the adjustment of PID parameters: , Limit the adjustment range at a time to avoid parameter mutation;

[0093] Multi-objective reward function: ,wherein is the weight coefficient, initially set to 0.5, 0.3, 0.2 respectively; is the threshold adjustment amplitude (punish violent fluctuation), is the false positive rate after parameter adjustment;

[0094] Build a deep Q network (DQN), input is the environment state Senv, output is the Q value of each action A: , wherein Senv is the environment state, A is the action space, is the network parameter; store historical state transition data , wherein are the environment state at time t, the action executed at time t, the immediate reward value obtained after executing the action and the new environment state after executing the action ; update the network parameters every 10 minutes of batch data sampling, preferentially replay high reward experience; forcibly constrain the PID parameter range: , , prevent unreasonable values from being generated in the learning process; if the false positive rate rises by > 5% after 3 consecutive adjustments, automatically revert to the last stable parameter configuration.

[0095] A data flow monitoring system based on internet communication, comprising a multi-dimensional feature modeling module, a real-time anomaly detection module, a decision verification module, a parameter dynamic optimization module and a knowledge base management module;

[0096] The multi-dimensional feature modeling module constructs a traffic feature tensor through a three-dimensional feature space (time dimension, space dimension, and content dimension), generates a historical traffic pattern library by combining dynamic period detection and multi-scale fusion, and the like.

[0097] The real-time anomaly detection module runs a threshold detector (based on the 3σ principle) and a prediction detector (LSTM time series prediction) in parallel to capture traffic anomalies in real time.

[0098] The decision verification module verifies the authenticity of the anomaly by combining time series, spatial, and content multi-dimensional similarity scores through a scene-aware dynamic weight adjustment algorithm.

[0099] The parameter dynamic optimization module optimizes PID control parameters online using reinforcement learning (DQN), and automatically adjusts the detection threshold and pattern library update strategy in combination with false alarm feedback.

[0100] The knowledge base management module stores historical traffic patterns, anomaly feature vectors, and optimized parameters, and supports incremental updates and multi-version backtracking.

[0101] The preferred embodiments of the application disclosed above are only used to help explain the application. The preferred embodiments do not describe all the details, nor limit the application to the specific embodiments. Obviously, many modifications and changes can be made according to the content of the present application. The present application selects and specifically describes these embodiments in order to better explain the principles and practical applications of the application, so that those skilled in the art can well understand and utilize the application. The application is limited only by the claims and their full scope and equivalents.

Claims

1. A data traffic monitoring method based on Internet communication, characterized by, Comprise the following steps: Q1, historical feature spatio-temporal modeling, through three-dimensional feature construction flow mode library, combined with dynamic cycle detection and multi-scale fusion, extract normal cycle behavior and abnormal mode, provide benchmark model for subsequent detection; Q2, real-time anomaly collaborative verification, parallel running threshold detector and prediction detector, through scene perception dynamic weight adjustment multi-dimensional score, distinguish real anomaly and false alarm; Q3, dynamic parameter correction, based on false alarm feedback and reinforcement learning optimization PID control parameter, combined with exponential decay update mode library, realize threshold self-adaptive adjustment and long-term short-term flow mode fusion, improve system robustness.

2. The data traffic monitoring method based on Internet communication according to claim 1, wherein, The specific process of Q1 is as follows: Establishing traffic feature tensor: defining a three-dimensional feature space comprehensively describing the time, space and content characteristics of traffic through a three-dimensional feature space; In which: T is time dimension, including hour level trend and minute level fluctuation; S is spatial dimension, based on the distribution entropy of source IP and destination IP; C is the content dimension, the load entropy wherein denotes the entropy, denotes the probability that the random variable x takes on a certain specific value, x is a random variable, log is the logarithm the operation of taking the logarithm; Constructing typical pattern library, periodic pattern extraction: , through the periodic superposition of historical data; wherein is the periodic pattern function, Td is the flow period, is the global historical period number, is the feature value of the time point t in the kth period; The abnormal pattern clustering adopts the improved DBSCAN algorithm, and the density threshold is defined as: , is the mean value of the neighborhood samples, is the standard deviation.

3. The data traffic monitoring method based on Internet communication according to claim 2, wherein, The Q1 in cycle mode extraction increases dynamic cycle detection algorithm and multi-scale feature fusion mechanism, the process is as follows: on historical flow data performing a fast Fourier transform: extracting the frequency of the dominant peak in the amplitude spectrum calculating a candidate period ; wherein is the Fourier transform result of the historical flow data j is the ordinal unit, w is the angle function, and t is the time The period stability index is defined as: where M is the number of verification periods, and is the period of the retained is the period stability index, m is the mth verification period, is the correlation function, and Td is the flow period. If multiple valid periods are detected , reconstruct the period pattern: wherein is the number of historical periods corresponding to each period, is the number of candidate periods; The time dimension T is extended to a multi-scale structure: The trend components at each scale are calculated respectively ; By attention mechanism dynamically fusing multi-scale features: , , is the attention weight of each time scale, is a trainable weight parameter, time scale type.

4. The data traffic monitoring method based on Internet communication according to claim 1, wherein, The specific operation steps of Q2 are as follows: Multi-detector parallel computing, threshold detector: Detect transient anomaly based on 3σ principle, if current value exceeds three times of historical mean standard deviation, trigger alarm; Wherein Respectively, historical mean and historical standard deviation, x is the current flow characteristic value; The prediction detector adopts an LSTM model, and the abnormal criterion is: wherein are the actual observation value and the prediction value of the LSTM model, respectively, is an error tolerance threshold; by comparing the relative error between the actual value and the prediction value, the abnormal deviation of the traffic caused by attacks or congestion is identified; The verification decision function is a comprehensive score formula: ; wherein: is a time similarity, measuring the time correlation of the current time point with the historical abnormal event, wherein is a time decay coefficient, is a time stamp of the historical abnormal event; , the similarity between the current traffic and the historical anomaly in the spatial feature is measured by cosine similarity, is a traffic spatial feature vector; is an adjustable weight coefficient; is a traffic content dimension similarity.

5. The data traffic monitoring method based on Internet communication according to claim 4, wherein, In the verification decision function of Q2, scene perception dynamic weight adjustment algorithm is introduced, through real-time analysis of flow characteristics and network environment, the weight coefficients of time, space and content dimension are automatically optimized, the specific process is as follows: Extract the following environmental indicators: Traffic type; Network load rate; Known threat intelligence matching degree; Mapping the environment state to a feature vector: where the flow type is one-hot encoded; Construct a light-weight neural network model, input is a scene feature vector , output is a weight coefficient: , where W and b are model parameters, trained by historical data, with the objective function being to minimize the validation error; Recalculate the weight every 5 minutes, if the environmental state changes more than the threshold value, trigger weight update immediately; Constraint condition: forced to meet And through the Lagrange multiplier method to ensure the output is legal; To avoid weight mutation, smoothing processing is adopted: wherein is a smoothing factor, wherein are respectively the new weight value after smoothing processing, the historical weight value before weight updating, and the weight value predicted by the lightweight neural network model.

6. The data traffic monitoring method based on Internet communication according to claim 1, wherein, The specific operation steps of Q3 are as follows: False positive feature analysis, defining a feature drift degree: , quantifying how much the current feature deviates from the historical normal range, where is the current feature value, are the historical feature mean and standard deviation, respectively; When the drift degree of any dimension in the flow feature tensor exceeds 2.5 times the standard deviation, trigger parameter update; Adaptive threshold adjustment, proportional-integral control is adopted: wherein are the proportional and integral coefficients; Error term i.e. target false positive rate - actual value; Through PID control dynamic adjustment of detection threshold, automatically reduce sensitivity when false alarm rate is too high, otherwise improve; Pattern library incremental update, update strategy: wherein is a decay factor, , is a short time constant, is a current traffic pattern, is an updated traffic pattern, is a historical traffic pattern.

7. The data traffic monitoring method based on Internet communication according to claim 6, wherein, The parameter optimization module driven by reinforcement learning is introduced in the Q3, and the proportional coefficient is automatically optimized through real-time feedback and integral coefficient The specific steps are as follows: The environment state Senv is defined to include: current false positive rate , network load rate L = current bandwidth usage / total bandwidth, recent attack type distribution; Define action A as an adjustment of the PID parameters: , , limit the magnitude of a single adjustment; Multi-objective reward function: wherein, is a weight coefficient; is a threshold adjustment amplitude, is a false positive rate after parameter adjustment; The deep Q network is constructed, input is an environment state Senv, and output is Q values of each action space A: wherein Senv is an environment state, A is an action space, is a network parameter; Storing historical state transition data , sampling batch data every 10 minutes to update network parameters, and prioritizing replay of high-reward experiences, wherein , respectively, an environment state at time t, an action performed at time t, an immediate reward value obtained after performing the action , and a new environment state after performing the action ​ Forced constraint PID parameter range: , , prevent the learning process to produce unreasonable values; if the false positive rate rises more than 5% after 3 consecutive adjustments, automatically back to the last stable parameter configuration.

8. A system for applying the data traffic monitoring method based on Internet communication according to any one of claims 1 to 7, characterized in that, Comprise: Multidimensional feature modeling module, for constructing flow feature tensor through three-dimensional feature space, combined with dynamic cycle detection and multi-scale fusion, generate historical flow mode library; Real-time anomaly detection module, for parallel running threshold detector and prediction detector, real-time capture flow anomaly; Decision verification module, for scene perception dynamic weight adjustment algorithm, combined with time series, space, content multi-dimensional similarity score, verify abnormal authenticity; Parameter dynamic optimization module, for online optimization of PID control parameters by reinforcement learning, combined with false alarm feedback to automatically adjust detection threshold and mode library update strategy; Knowledge base management module, for storing historical flow mode, abnormal feature vector and optimization parameters, support incremental update and multi-version backtracking.

Images