Abnormal traffic detection network training method, abnormal traffic detection method and device

Abstract

The embodiments of the present application provide an abnormal traffic detection network training method, an abnormal traffic detection method and an apparatus, and relate to the field of network operation and maintenance technology. Based on normal traffic features, abnormal traffic features are generated, the normal traffic features are input into a first traffic encoder for encoding to obtain normal latent space variables, abnormal latent space variables are obtained according to the normal latent space variables and the abnormal traffic features, the normal latent space variables and the abnormal latent space variables are respectively input into a detection language model to obtain normal traffic representation and abnormal traffic representation, and after constructing positive sample pairs and negative sample pairs, the function value of the ternary loss function is calculated according to the first distance of the positive sample pairs and the second distance of the negative sample pairs, the abnormal traffic detection network is weighted and trained. A contrastive learning mechanism is introduced to realize the automatic generation and dynamic adjustment of prompt words, and a fine-tuning optimization target of the detection language model is constructed based on the triplet loss function to improve the efficiency and accuracy of anomaly detection.

Description

Technical Field

[0001] The present application relates to the field of network operation and maintenance technology, and in particular to an abnormal traffic detection network training method, an abnormal traffic detection method and a device. Background Art

[0002] With the continuous addition of new computing network elements, computing networks have evolved into a multi-layered, high-dimensional, heterogeneous network architecture consisting of macro base stations, micro base stations, and various small base stations. This increasing complexity has directly led to an exponential increase in network data traffic, increasing the difficulty of detecting abnormal traffic in operations and maintenance systems.

[0003] Related technologies employ deep learning-based anomaly detection algorithms, but these algorithms typically rely on static training sets for model training, resulting in a strong dependence on the initial data feature distribution. Detection performance plummets when network traffic characteristics dynamically evolve. Furthermore, the models' generalization capabilities are significantly insufficient when faced with new, unknown traffic patterns in computing networks, making it difficult to adapt to the spatiotemporal variations in data distribution in large-scale heterogeneous network environments. These factors collectively result in low accuracy in detecting anomalies in computing networks with large-scale data patterns. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose an abnormal traffic detection network training method, an abnormal traffic detection method and an abnormal traffic detection device to improve the accuracy of abnormal traffic detection in the computing power network.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for training an abnormal traffic detection network, wherein the abnormal traffic detection network includes a first traffic encoder and a detection language model. The method includes:

[0006] Generate normal traffic features based on network traffic data extracted from the computing network, and generate abnormal traffic features based on the normal traffic features;

[0007] Inputting the normal traffic characteristics into the first traffic encoder for encoding to obtain normal latent space variables, and obtaining abnormal latent space variables according to the normal latent space variables and the abnormal traffic characteristics;

[0008] The normal latent space variables and the abnormal latent space variables are respectively input into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, and positive sample pairs and negative sample pairs are constructed according to the normal traffic characteristics, the normal traffic representation and the abnormal traffic representation;

[0009] A function value of a ternary loss function is calculated according to the first distance of the positive sample pair and the second distance of the negative sample pair. Based on the function value, at least the weight of the abnormal traffic detection network is adjusted until the trained abnormal traffic detection network is obtained.

[0010] In one embodiment, obtaining the abnormal latent space variable according to the normal latent space variable and the abnormal traffic characteristics includes:

[0011] Inputting the abnormal flow characteristics into a second flow encoder for encoding to obtain an abnormal intermediate variable, wherein the model structure of the second flow encoder is consistent with that of the first flow encoder;

[0012] The abnormal latent space variable is obtained according to the sum of the normal latent space variable and the abnormal intermediate variable.

[0013] In one embodiment, generating abnormal traffic features based on the normal traffic features includes:

[0014] Based on a preset sliding window, calculating a sliding average corresponding to each characteristic value in the normal flow characteristic, and forming a seasonal series component according to the sliding average;

[0015] Calculating a difference sequence between the normal flow characteristic and the seasonal sequence component, performing local weighted regression fitting on the difference sequence to obtain a trend sequence component;

[0016] The abnormal flow feature is obtained by subtracting the seasonal sequence component and the trend sequence component from the normal flow feature.

[0017] In one embodiment, constructing positive sample pairs and negative sample pairs based on the normal traffic characteristics, the normal traffic representation, and the abnormal traffic representation includes:

[0018] Taking the normal traffic feature as an anchor sample, taking the normal traffic representation as a normal sample, and taking the abnormal traffic representation as an abnormal sample;

[0019] The positive sample pair is formed according to the anchor point feature value of the anchor point sample and the normal feature value of the normal sample, and the negative sample pair is formed according to the anchor point feature value and the abnormal feature value of the abnormal sample.

[0020] In one embodiment, calculating the function value of the ternary loss function according to the first distance of the positive sample pair and the second distance of the negative sample pair includes:

[0021] Calculating a first similarity between the anchor point feature value and the normal feature value to obtain the first distance;

[0022] Calculating a second similarity between the anchor point feature value and the abnormal feature value in all the negative sample pairs corresponding to the anchor point sample, selecting the negative sample pair corresponding to the minimum value of the second similarity as the minimum negative sample pair, and using the second similarity of the minimum negative sample pair as the second distance;

[0023] The function value of the ternary loss function is calculated based on the first distance and the second distance.

[0024] In one embodiment, the calculating the function value of the ternary loss function according to the first distance and the second distance includes:

[0025] calculating a distance difference between the first distance and the second distance;

[0026] The loss value is obtained by calculating the sum of the distance difference and a preset margin parameter. If the loss value is a negative number, the loss value is set to zero.

[0027] In one embodiment, the detection language model includes at least a feedforward network layer, a normalization layer, and a multi-head attention module. Based on the function value, at least weight adjustment is performed on the abnormal traffic detection network until the trained abnormal traffic detection network is obtained, including:

[0028] Freeze the model parameters of the multi-head attention module during training;

[0029] Based on the function value, the model parameters corresponding to the first flow encoder, the second flow encoder, the feedforward network layer and the normalization layer are adjusted until the iteration termination condition is reached to obtain the trained abnormal flow detection network.

[0030] To achieve the above-mentioned objectives, a second aspect of an embodiment of the present application provides an abnormal traffic detection method, which is performed by an abnormal traffic monitoring network trained using the abnormal traffic detection network training method described in any one of the first aspects. The method includes:

[0031] Acquiring initial flow data and converting the initial flow data into initial flow features;

[0032] Inputting the initial traffic feature into the first traffic encoder for feature encoding to obtain a latent space representation feature;

[0033] The latent space representation feature is input into the detection language model for reconstruction to obtain the target traffic feature, and the reconstruction error between the target traffic feature and the latent space representation feature is calculated. If the reconstruction error is greater than a preset threshold, the detection result indicates that the initial traffic data is abnormal traffic.

[0034] To achieve the above-mentioned objectives, a third aspect of an embodiment of the present application provides a device for training an abnormal traffic detection network, wherein the abnormal traffic detection network includes a first traffic encoder and a detection language model, and the device includes:

[0035] Traffic feature generation module: used to generate normal traffic features based on network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features;

[0036] Latent space mapping module: used for inputting the normal traffic characteristics into the first traffic encoder for encoding to obtain normal latent space variables, and obtaining abnormal latent space variables according to the normal latent space variables and the abnormal traffic characteristics;

[0037] A comparison sample pair generation module is configured to input the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction, thereby obtaining normal traffic representation and abnormal traffic representation, and constructing positive sample pairs and negative sample pairs based on the normal traffic features, the normal traffic representation, and the abnormal traffic representation;

[0038] Loss adjustment module: used to calculate the function value of the ternary loss function according to the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjust the weight of the abnormal traffic detection network until the trained abnormal traffic detection network is obtained.

[0039] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the method described in the first or second aspect above when executing the computer program.

[0040] To achieve the above-mentioned purpose, the fifth aspect of the embodiment of the present application proposes a storage medium, which is a storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, it implements the method described in the first or second aspect above.

[0041] The abnormal traffic detection network training method, abnormal traffic detection method and device proposed in the embodiments of the present application generate normal traffic features based on network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features, input the normal traffic features into the first traffic encoder for encoding to obtain normal latent space variables, and obtain abnormal latent space variables based on the normal latent space variables and the abnormal traffic features, respectively input the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, construct positive sample pairs and negative sample pairs based on the normal traffic features, the normal traffic representation and the abnormal traffic representation, calculate the function value of the ternary loss function based on the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjust the weight of the abnormal traffic detection network until a trained abnormal traffic detection network is obtained. The embodiments of the present application train the abnormal traffic detection network based on comparative prompt word learning for complex and diverse computing power network operation and maintenance scenarios. During the training process, the normal traffic features are first adjusted by the first traffic encoder to adjust the neural network weights, converting them into learnable dynamic prompt words to achieve adaptive matching for specific operation and maintenance tasks. On this basis, a contrastive learning mechanism is introduced to automatically generate and dynamically adjust prompt words. A triplet loss function is used to construct a fine-tuning optimization objective for the detection language model. This enhances the feature separability between normal and abnormal traffic, reduces the reconstruction error between different traffic types, and employs a transfer learning strategy, enabling the detection language model to adapt to new scenarios with fine-tuning of a small number of samples based on pre-training. The resulting anomaly traffic detection network can effectively identify various types of abnormal traffic and meet the anomaly detection needs in diverse network operation and maintenance scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a flowchart of the abnormal traffic detection network training method provided in an embodiment of the present application.

[0043] Figure 2 This is a flowchart of generating abnormal traffic characteristics based on the normal traffic characteristics provided by an embodiment of the present application.

[0044] Figure 3 This is a flowchart of obtaining abnormal latent space variables based on normal latent space variables and abnormal traffic characteristics provided by an embodiment of the present application.

[0045] Figure 4 This is a schematic diagram of latent space mapping provided in an embodiment of the present application.

[0046] Figure 5 This is a flowchart of constructing positive sample pairs and negative sample pairs based on normal traffic characteristics, normal traffic representation and abnormal traffic representation provided by an embodiment of the present application.

[0047] Figure 6This is a flowchart of an embodiment of the present application for calculating the function value of a ternary loss function based on the first distance of a positive sample pair and the second distance of a negative sample pair.

[0048] Figure 7 This is a schematic diagram of data processing for positive and negative sample alignment provided in an embodiment of the present application.

[0049] Figure 8 This is a flowchart of an embodiment of the present application for calculating the function value of a ternary loss function based on the first distance and the second distance.

[0050] Figure 9 This is a schematic diagram of the calculation process of the ternary loss function provided in the embodiment of the present application.

[0051] Figure 10 This is an overall flow chart of the abnormal traffic detection network training method provided in an embodiment of the present application.

[0052] Figure 11 This is a flow chart of the abnormal traffic detection method provided in an embodiment of the present application.

[0053] Figure 12 This is a structural block diagram of an abnormal traffic detection network training device provided by another embodiment of the present application.

[0054] Figure 13 This is a schematic diagram of the hardware structure of the electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0056] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described can be performed in a different order than the module division in the device or the order in the flowchart.

[0057] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0058] First, let’s analyze some of the terms used in this application:

[0059] Artificial Intelligence (AI) is a new technical discipline that studies and develops theories, methods, technologies, and application systems for simulating, extending, and expanding human intelligence. A branch of computer science, AI seeks to understand the essence of intelligence and create new intelligent machines that can respond in a manner similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thinking. It also encompasses theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, to perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results.

[0060] With the continuous access of new computing network element entities, the computing network has evolved into a multi-layered, high-dimensional heterogeneous network architecture composed of macro base stations, micro base stations, and various small base stations. The complexity of this architecture has directly led to an exponential growth in network data traffic, requiring the operation and maintenance system to have higher performance, more efficient algorithms, and more powerful hardware support. In addition, the access of new computing network element entities has made the allocation and scheduling of computing resources more complicated, and it is impossible to directly achieve fast and efficient computing resource allocation, resulting in resource waste and task delays. It is difficult to achieve effective resource scheduling in a cross-regional and cross-vendor environment, and there are compatibility and stability issues. The above problems have increased the difficulty of detecting abnormal traffic in the operation and maintenance system.

[0061] Related technologies employ deep learning-based anomaly detection algorithms, but these algorithms typically rely on static training sets for model training, resulting in a strong dependence on the initial data feature distribution. These algorithms can only be effectively used in a few fixed detection scenarios. Detection performance plummets when network traffic characteristics evolve dynamically, and the model's generalization capabilities are significantly insufficient when faced with new, unknown traffic patterns in computing networks. It is difficult to adapt to the spatiotemporal variations in data distribution in large-scale heterogeneous network environments. Furthermore, the increasing complexity of network operation and maintenance tasks makes it impossible to generate prompt words using artificial prior knowledge. These factors collectively contribute to the low accuracy of computing network anomaly detection for large-scale data patterns.

[0062] Based on this, the embodiments of the present application provide an abnormal traffic detection network training method, an abnormal traffic detection method and an apparatus. For complex and diverse computing power network operation and maintenance scenarios, the abnormal traffic detection network is trained based on comparative prompt word learning. During the training process, the normal traffic features are first adjusted by the first traffic encoder to adjust the neural network weights, and converted into learnable dynamic prompt words to achieve adaptive matching for specific operation and maintenance tasks. On this basis, a comparative learning mechanism is introduced to realize the automatic generation and dynamic adjustment of prompt words, and a fine-tuning optimization target of the detection language model is constructed based on the triple loss function. Thereby, the feature separability of normal traffic and abnormal traffic is enhanced, the reconstruction error between different categories of traffic is expanded, and a transfer learning strategy is adopted so that the detection language model can adapt to new scenarios by fine-tuning a small amount of samples based on pre-training. The abnormal traffic detection network finally constructed can effectively identify various types of abnormal traffic and meet the anomaly detection needs in diverse network operation and maintenance scenarios.

[0063] The embodiments of the present application provide an abnormal traffic detection network training method, an abnormal traffic detection method and an apparatus, which are specifically illustrated by the following embodiments. First, the abnormal traffic detection network training method in the embodiments of the present application is described.

[0064] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) refers to the theories, methods, techniques, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce new intelligent machines that can respond in a manner similar to human intelligence. AI is the study of the design principles and implementation methods of various intelligent machines, enabling them to have the capabilities of perception, reasoning, and decision-making.

[0065] Artificial intelligence (AI) technology is a comprehensive discipline encompassing a wide range of fields, encompassing both hardware and software technologies. Foundational AI technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0066] The abnormal traffic detection network training method provided in the embodiment of the present application relates to the field of network operation and maintenance technology. The abnormal traffic detection network training method provided in the embodiment of the present application can be applied to a terminal, can also be applied to a server side, and can also be a computer program running in a terminal or a server side. For example, the computer program can be a native program or software module in the operating system; it can be a local (Native) application (Application, APP), that is, a program that needs to be installed in the operating system to run, such as a client that supports abnormal traffic detection network training, that is, a program that only needs to be downloaded to a browser environment to run; it can also be a small program that can be embedded in any APP. In short, the above-mentioned computer program can be an application, module or plug-in in any form. Among them, the terminal communicates with the server through a network. The abnormal traffic detection network training method can be executed by the terminal or the server, or by the terminal and the server in collaboration.

[0067] In some embodiments, the terminal may be a smartphone, tablet computer, laptop computer, desktop computer, or smartwatch. The server may be a standalone server or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Alternatively, the server may be a service node in a blockchain system, where each service node in the blockchain system forms a peer-to-peer (P2P) network. The P2P protocol is an application layer protocol that runs on top of the Transmission Control Protocol (TCP). The terminal and server may be connected via Bluetooth, a Universal Serial Bus (USB), or a network connection, but this embodiment does not impose any limitations thereto.

[0068] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, and the like. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected via a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0069] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to the user's identity or characteristics, such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of such data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0070] The following describes the abnormal traffic detection network training method in the embodiment of the present application.

[0071] Figure 1 This is an optional flowchart of the abnormal traffic detection network training method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to steps 110 to 140. It is also understood that this embodiment is Figure 1 The order of step 110 to step 140 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0072] Step 110: Generate normal traffic features based on the network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features.

[0073] In one embodiment, tools are first used to extract technical and statistical features related to network traffic in computing networks (such as cloud computing, edge computing, and data center networks). Basic features are directly extracted from packet or flow header information and are typically used to describe basic traffic attributes. For example, packet capture tools can be used to capture traffic source and destination IP addresses, ports, and protocol types. Flow-based statistical features are also extracted for bidirectional flows, such as duration, number of packets, and byte size. These basic and statistical features are then used as network traffic data. It should be understood that the network traffic data presented here is for illustrative purposes only and does not constitute a limitation.

[0074] Next, the network traffic data extracted in the previous step is converted into a format suitable for processing by the large language model. Specifically, the extracted network traffic data is vectorized and mapped to the input space of the large language model through an embedding layer.

[0075] First, by defining a feature template, we convert network traffic features (basic features + statistical features) into a structured natural language description. For example, a feature template might be: "Source IP is {src_ip}, Destination IP is {dst_ip}, Source port is {src_port}, Destination port is {dst_port}, Protocol is {protocol}, Flow duration is {duration} seconds, Total number of packets is {packets}, Total number of bytes is {bytes}, Average packet size is {avg_pkt_size} bytes." Then, by filling in the feature template, we can obtain the corresponding natural language description. For example, "Source IP is 192.168.1.1, Destination IP is 10.0.0.5, Source port is 54321, Destination port is 80, Protocol is TCP, Flow duration is 120 seconds, Total number of packets is 1000, Total number of bytes is 5242880, Average packet size is 5242 bytes." After obtaining the natural language description, it is mapped into a semantic vector through a pre-trained language model (such as BERT, Sentence-BERT) to obtain normal traffic features.

[0076] In one embodiment, after obtaining the normal traffic characteristics, it is necessary to generate abnormal traffic characteristics based on the normal traffic characteristics. Figure 2 , Figure 2 This is a flow chart of generating abnormal traffic features based on the normal traffic features provided by an embodiment of the present application, which specifically includes the following steps:

[0077] Step 210: Calculate the sliding average corresponding to each characteristic value in the normal flow characteristic based on the preset sliding window, and construct a seasonal series component according to the sliding average.

[0078] In one embodiment, the normal traffic characteristics are expressed as: , the STL decomposition of normal flow characteristics is performed using the addition principle, where the STL decomposition decomposes the normal flow characteristics of the time series into three main components: seasonal series component, trend series component and residual component, and the residual component is used as the abnormal flow feature.

[0079] Among them, the seasonal series component can reflect the long-term trend of the data and the overall direction of the data over a long period of time. For the calculation process of the seasonal series component, based on the preset sliding window, the sliding average corresponding to each eigenvalue in the normal flow feature is calculated, and the seasonal series component is constructed based on the sliding average. For the i-th eigenvalue in the normal flow feature, , its sliding average Expressed as:

[0080]

[0081] Among them, k represents the preset sliding window, so the seasonal series component is expressed as .

[0082] Step 220: Calculate the difference sequence between the normal flow characteristics and the seasonal series component, perform local weighted regression fitting on the difference sequence, and obtain the trend series component.

[0083] In one embodiment, the difference sequence between the normal flow characteristics and the trend sequence component is calculated, and then the difference sequence is subjected to local weighted regression fitting to obtain the trend sequence component The process of fitting the local weighted regression LOESS involves selecting a set of neighboring points around a point in the difference sequence, weighting these points, and then performing a local prediction fit. At this point, samples (points) closer to the prediction point have greater weights, while samples (points) farther from the prediction point have smaller weights. A cubic weight function can be used to determine the weight values ​​in the weighting process. Because the prediction of each point is based on its surrounding points, the resulting trend series component can well capture local trends.

[0084] Step 230: Subtract the seasonal sequence component and the trend sequence component from the normal traffic feature to obtain the abnormal traffic feature.

[0085] In one embodiment, after removing the seasonal sequence component and the trend sequence component from the normal traffic characteristics, the random fluctuation or noise part is obtained as the residual sequence, which is used as the abnormal traffic characteristics. , expressed as:

[0086]

[0087] In one embodiment, in the abnormal traffic detection scenario of the computing power network, since white noise is a random noise with a mean of 0, a constant variance, and no autocorrelation, it has no task relevance. Therefore, if white noise is used directly, it will lead to the loss of key information. However, the real network traffic may contain local burst traffic (such as short-term high load), protocol-specific behavior (such as TCP retransmission, DNS query delay) or covert attack signals (such as low-frequency DDoS, scanning behavior), etc. Therefore, the embodiment of the present application selects the residual sequence As a reflection of abnormal traffic characteristics corresponding to normal traffic, the residual sequence dynamically reflects the deviation of current traffic from the historical model. It preserves local features of normal traffic that are not explained by the global model, making it more consistent with actual traffic. A sudden increase in the data value in the residual sequence can indicate a sudden anomaly, while a persistent deviation from the mean can indicate a low-frequency attack. This shows that using the residual sequence can better reflect the traffic characteristics of the current task.

[0088] Step 120: Input the normal traffic characteristics into the first traffic encoder for encoding to obtain normal latent space variables, and obtain abnormal latent space variables based on the normal latent space variables and the abnormal traffic characteristics.

[0089] In one embodiment, an abnormal traffic detection network for abnormal traffic detection includes a first traffic encoder and a detection language model. The first traffic encoder may be composed of a Transformer encoder and a fully connected layer. The fully connected layer is located in the feedforward neural network portion of each encoder layer of the Transformer encoder and is primarily used to process features at each position in time series data to achieve dimensional alignment.

[0090] The detection language model can be a GPT-2Medium model. The GPT-2Medium model is a pre-trained large language model based on the Transformer architecture. The structure of the GPT-2Medium model includes at least a multi-head self-attention module, a feed-forward network layer (FFN) and a normalization layer (Layer Normalization, LayerNorm). Taking a Transformer layer as an example, the input of its multi-head self-attention module is the output or word embedding of the previous layer (the first layer). After processing in the multi-head self-attention module, it is sent to the feed-forward network layer through the residual connection and the normalization layer. After processing in the feed-forward network layer, it is sent to the next multi-head self-attention module through the residual connection and the normalization layer. In the GPT-2Medium model, the multi-head self-attention module is the core part of the model and is used to capture the dependencies within the sequence, but the computational overhead of this module is large. Therefore, in the embodiment of the present application, the weights of the multi-head self-attention module in the GPT-2Medium model are frozen, and only the feed-forward network layer and the normalization layer are activated, thereby reducing the training overhead and maintaining acceptable detection accuracy.

[0091] In one embodiment, the normal flow characteristics Input the first flow encoder Encode to obtain normal latent space variables , expressed as:

[0092]

[0093]

[0094] in, represents the i-th eigenvalue in the normal latent space variable.

[0095] The embodiment of the present application uses the first traffic encoder as an autoencoder to perform latent space mapping on normal traffic features, which can ensure that the mapping result is automatically updated, so that when it is used as a prompt word, it can be adapted to a specific task in real time.

[0096] Next, we get the abnormal latent space variables based on the normal latent space variables. Figure 3 , Figure 3 This is a flowchart of obtaining abnormal latent space variables based on normal latent space variables and abnormal traffic characteristics provided by an embodiment of the present application, which specifically includes the following steps:

[0097] Step 310: Input the abnormal flow characteristics into the second flow encoder for encoding to obtain abnormal intermediate variables.

[0098] In one embodiment, a second flow encoder having the same model structure as the first flow encoder is set. The model parameters of both can be obtained according to actual training. Here, the second traffic encoder is used to convert the abnormal traffic features Mapping to the latent space, obtaining abnormal intermediate variables And since the structures of the first flow encoder and the second flow encoder are consistent, the dimensions of the abnormal intermediate variables and the normal latent space variables are consistent.

[0099] Step 320: Obtain abnormal latent space variables according to the sum of normal latent space variables and abnormal intermediate variables.

[0100] In one embodiment, the normal latent space variables and the abnormal intermediate variables are added together so that the abnormal latent space variables obey the distribution of the abnormal traffic characteristics, and the abnormal latent space variables can be obtained. , expressed as:

[0101]

[0102]

[0103] in, represents the i-th value of the abnormal intermediate variable, Represents the i-th value of the abnormal latent space variable.

[0104] In one embodiment, referring to Figure 4 , Figure 4 This is a schematic diagram of latent space mapping provided in an embodiment of the present application. Figure 4 First, the normal traffic characteristics Perform STL decomposition to obtain seasonal series components , trend series component and abnormal traffic characteristics Then the normal flow characteristics Input the first flow encoder for encoding to obtain the normal latent space variable , the abnormal traffic characteristics Input the second flow encoder for encoding to obtain the abnormal intermediate variable , add up the normal latent space variables and the abnormal intermediate variables to get the abnormal latent space variables .

[0105] The normal latent space variables obtained by the above process are and abnormal latent space variables Together, they constitute the prompt word input of the subsequent detection language model. Compared with the text-based display prompt word, the normal latent space variables in the embodiment of the present application are and abnormal latent space variables The features extracted by the first traffic encoder and the second traffic encoder respectively contain more deep traffic semantic features, which can improve the accuracy of anomaly detection.

[0106] Step 130: Input the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction, obtain normal traffic representation and abnormal traffic representation, and construct positive sample pairs and negative sample pairs based on the normal traffic characteristics, normal traffic representation and abnormal traffic representation.

[0107] In one embodiment, after generating contrasting prompt words based on normal latent space variables and abnormal latent space variables, the contrasting prompt words are used as positive and negative samples to guide the detection language model to generate the desired output. In this process, the detection language model will learn to distinguish the prompt words of normal traffic from the prompt words of abnormal traffic, thereby achieving fine-tuning of the large language model. Because the normal latent space variables and the abnormal latent space variables in the embodiments of the present application can be optimized during the training process and are not fixed prompt words, the contrasting learning effect can be maximized, the difference between the two types of traffic is maximized, and the accuracy of the anomaly detection results is improved.

[0108] Next, the normal latent space variables and abnormal latent space variables are input into the detection language model for reconstruction. Assuming that the detection language model is represented by G(·), the normal traffic representation is reconstructed as and abnormal traffic indication Among them, the normal flow represents the i-th value for: , the i-th value of abnormal traffic for: .

[0109] In one embodiment, since the output dimension of the GPT-2Medium model used as the detection language model is 1024, and the feature number d used to characterize the traffic may not be equal to 1024, the embodiment of the present application also adds a fully connected layer to achieve dimensional conversion, converting the output dimension of the GPT-2Medium model from 1024 to the target feature number d, where d is the dimension of normal traffic features, normal traffic representation, and abnormal traffic representation. At this time, the i-th value of the normal traffic representation is and abnormal traffic represents the i-th value Updated to: and , correspondingly, the normal flow is expressed as , abnormal traffic is expressed as .

[0110] In one embodiment, after having the normal flow representation and the abnormal flow representation, positive and negative samples can be constructed. Figure 5 , Figure 5This is a flowchart of constructing positive sample pairs and negative sample pairs based on normal traffic characteristics, normal traffic representation, and abnormal traffic representation provided by an embodiment of the present application, specifically including the following steps:

[0111] Step 510: Use normal traffic features as anchor samples, represent normal traffic as normal samples, and represent abnormal traffic as abnormal samples.

[0112] Step 520: construct a positive sample pair based on the anchor point feature value of the anchor point sample and the normal feature value of the normal sample, and construct a negative sample pair based on the anchor point feature value and the abnormal feature value of the abnormal sample.

[0113] In one embodiment, the normal flow characteristics As an anchor sample, normal traffic represents As a normal sample, abnormal traffic represents As an abnormal sample. For an anchor point sample, it has v anchor point feature values. According to each anchor point feature value and the normal feature value of the normal sample at the corresponding position and the abnormal feature value of the abnormal sample, a set of positive and negative sample pairs can be obtained.

[0114] Take the i-th anchor point feature value in the anchor point sample For example, the normal feature value of the i-th normal sample is , the i-th abnormal feature value in the abnormal sample is , corresponding to the positive sample pair and negative sample pairs .

[0115] According to the above process, multiple groups of positive sample pairs and negative sample pairs corresponding to the anchor point samples are obtained.

[0116] Step 140: Calculate the function value of the ternary loss function according to the first distance of the positive sample pair and the second distance of the negative sample pair. Based on the function value, at least adjust the weight of the abnormal traffic detection network until a trained abnormal traffic detection network is obtained.

[0117] In one embodiment, referring to Figure 6 , Figure 6 This is a flowchart of calculating the function value of the ternary loss function based on the first distance of the positive sample pair and the second distance of the negative sample pair provided in an embodiment of the present application, which specifically includes the following steps:

[0118] Step 610: Calculate a first similarity between the anchor point feature value and the normal feature value to obtain a first distance.

[0119] In one embodiment, for a certain anchor point sample, the i-th anchor point feature value The corresponding positive sample pair is , the negative sample pair is First, calculate the positive sample pair Anchor point feature value and normal eigenvalues The first similarity between them, get the first distance Among them, the distance function Used to measure the similarity or difference between positive sample pairs or negative sample pairs.

[0120] It is understandable that clustering samples of the same category, that is, positive sample pairs, together in the feature space can increase the similarity of similar samples, thereby enhancing the detection language model's ability to identify samples of the same category. Therefore, the embodiment of the present application can maximize the first distance to bring positive sample pairs closer to each other in the embedding space.

[0121] Step 620: Calculate the second similarity between the anchor feature value and the abnormal feature value in all negative sample pairs corresponding to the anchor sample, select the negative sample pair corresponding to the minimum value of the second similarity as the minimum negative sample pair, and use the second similarity of the minimum negative sample pair as the second distance.

[0122] In one embodiment, for each anchor point sample, when the identifier i of the anchor point feature value has different values, it corresponds to different negative sample pairs. At this time, all negative sample pairs constitute a negative sample pair set, and the negative sample pair set is expressed as: { }.

[0123] At this time, the second similarity between the anchor point feature value and the abnormal feature value in each negative sample pair in the negative sample pair set is calculated. Taking the i-th negative sample pair as an example, the second similarity is expressed as: Then, the minimum value of the second similarity is selected, the negative sample pair corresponding to the minimum value is used as the minimum negative sample pair, and the second similarity of the minimum negative sample pair is used as the second distance.

[0124] Therefore, the second distance is expressed as:

[0125]

[0126] It can be understood that since the negative sample pair refers to a sample of a different category from the anchor sample, the embodiment of the present application needs to minimize the second distance so that samples of different categories are further away in the embedding space, thereby increasing the distinction between samples of different categories and improving the detection language model's ability to recognize negative sample pairs.

[0127] In one embodiment, referring to Figure 7 , Figure 7 This is a diagram of data processing for positive and negative samples provided in the embodiment of the present application. As an example, it is input into the detection language model G(·) for data processing to obtain the i-th eigenvalue of normal traffic representation , and then process it with the fully connected layer to get the updated , and the anchor point eigenvalue Constitute a positive sample pair Then, input the distance function Calculate the first distance .

[0128] For the i-th eigenvalue of the abnormal latent space variable , input it into the detection language model G(·) for data processing, and obtain the i-th eigenvalue of abnormal traffic representation , and then process it with the fully connected layer to get the updated , and the anchor point eigenvalue Constitute a negative sample pair Then, input the distance function Calculate the second similarity , and further calculate the second distance based on the second similarity.

[0129] Step 630: Calculate the function value of the ternary loss function according to the first distance and the second distance.

[0130] In one embodiment, referring to Figure 8 , Figure 8 This is a flowchart of calculating the function value of the ternary loss function according to the first distance and the second distance provided in an embodiment of the present application, which specifically includes the following steps:

[0131] Step 810: Calculate the distance difference between the first distance and the second distance.

[0132] Step 820: Calculate the sum of the distance difference and the preset margin parameter to obtain a loss value. If the loss value is negative, set the loss value to zero.

[0133] In one embodiment, the distance difference is expressed as:

[0134]

[0135] Assume that the preset margin parameter is m ( ), which is used to ensure that the first distance between positive sample pairs is not only smaller than the minimum distance between negative sample pairs, but also smaller by at least m units, which helps to provide additional separation between positive and negative sample pairs, making positive sample pairs more closely clustered in the embedding space, while negative sample pairs are more dispersed.

[0136] Therefore, the loss value of the ternary loss function is expressed as:

[0137]

[0138] In one embodiment, to ensure that the loss value is not negative, if the loss value is negative, the loss value is set to zero. Therefore, the loss value L is expressed as:

[0139]

[0140] The above process uses max(...,0) to ensure that it is not a negative number.

[0141] In one embodiment, referring to Figure 9 , Figure 9 This is a schematic diagram of the calculation process of the ternary loss function provided in an embodiment of the present application. First, the normal traffic features originally extracted are encoded into normal latent space variables about normal traffic by the first traffic encoder with updateable weights. At the same time, the normal traffic features are decomposed into residual components that are strongly correlated with the detection task to obtain abnormal traffic features. The abnormal traffic features are then input into the second traffic encoder for encoding to obtain abnormal intermediate variables, and the abnormal latent space variables are obtained based on the sum of the normal latent space variables and the abnormal intermediate variables. Next, the normal latent space variables and the abnormal latent space variables are respectively input into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, and then positive sample pairs and negative sample pairs are constructed as comparison sample pairs based on the normal traffic features, normal traffic representation and abnormal traffic representation. Finally, the loss value of the ternary loss function is calculated based on the positive and negative sample pairs as the optimization target to fine-tune the large language model serving as the detection language model.

[0142] In one embodiment, the ternary loss function consists of three parts: anchor samples, positive samples, and negative samples. The goal of this function is to make the distance between the anchor samples and the positive samples as small as possible, while making the distance between the anchor points and the negative samples as large as possible, thereby effectively improving the model's discrimination ability.

[0143] If the embodiment of the present application only judges the condition that the distance between the anchor point sample and a certain negative sample exceeds the threshold when calculating the function value of the ternary loss function, the abnormal flow representation generated by the interference of the residual component is For example, it is too easy to meet this condition, resulting in poor fine-tuning of the detection language model and inability to apply to downstream abnormal traffic detection tasks. Therefore, in the embodiment of this application, the minimum distance of all negative sample pairs in each anchor point sample is considered. In the negative sample pair set { }, select the anchor feature value The nearest abnormal feature value The corresponding negative sample pairs are used as the minimum negative sample pairs, so that the detection language model pays more attention to the negative samples that are difficult to distinguish, thereby improving the discrimination ability of the detection language model.

[0144] It can be seen that in the loss value calculation process of the embodiment of the present application, the difficulty of distinction is improved by using the minimum negative sample pair, and the preset margin parameter m is introduced to optimize the distribution of samples in the embedding space, ultimately making the positive sample pairs closer and the negative sample pairs farther away, thereby improving the classification performance of the detection language model.

[0145] In one embodiment, once the function value is obtained, the weights of at least the abnormal traffic detection network can be adjusted based on the function value until a trained abnormal traffic detection network is obtained. The training process is described as follows: during training, the model parameters of the multi-head attention module are frozen. Based on the function value, the model parameters corresponding to the first traffic encoder, the second traffic encoder, the feedforward network layer, and the normalization layer are adjusted until an iteration termination condition is met, thereby obtaining a trained abnormal traffic detection network. The iteration termination condition here can be when the number of iterations reaches a preset number or when the optimization performance reaches a preset standard.

[0146] In the above process, the feedforward network layer and normalization layer of the detection language model, as well as the first flow encoder and the second flow encoder are fine-tuned using the ternary loss function, while the fully connected layer used to update the normal flow representation and abnormal flow representation is used. The original random weights are retained and not updated. By adjusting the network weights corresponding to the first and second traffic encoders corresponding to the normal and abnormal traffic representations as prompt words, the abnormal traffic detection network can more flexibly adapt to specific tasks, avoiding the high computational cost of fine-tuning the entire model. Only a small number of prompt word parameters need to be fine-tuned to quickly adapt to multiple tasks, thereby improving the generalization ability of the abnormal traffic detection network.

[0147] It is understandable that after the training is completed, only the first traffic encoder needs to be retained in the abnormal traffic detection network.

[0148] In one embodiment, referring to Figure 10 , Figure 10 This is an overall flow chart of the abnormal traffic detection network training method provided in an embodiment of the present application.

[0149] After obtaining normal traffic features, normal and abnormal traffic features are generated based on them. The normal and abnormal latent space variables are respectively input into the detection language model for reconstruction, resulting in normal and abnormal traffic representations. These representations are then dimensionalized to obtain reconstructed normal and abnormal traffic representations. Next, positive and negative sample pairs are constructed based on the normal traffic features, normal traffic representation, and abnormal traffic representation as comparison samples. Finally, the loss value of the ternary loss function is calculated based on the positive and negative sample pairs as the optimization target to train the abnormal traffic detection network.

[0150] The technical solution provided by the embodiment of the present application generates normal traffic features based on the network traffic data extracted from the computing power network, and generates abnormal traffic features based on the normal traffic features, inputs the normal traffic features into the first traffic encoder for encoding to obtain normal latent space variables, and obtains abnormal latent space variables based on the normal latent space variables and the abnormal traffic features, respectively inputs the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, constructs positive sample pairs and negative sample pairs based on the normal traffic features, the normal traffic representation and the abnormal traffic representation, calculates the function value of the ternary loss function based on the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjusts the weight of the abnormal traffic detection network until a trained abnormal traffic detection network is obtained. The embodiment of the present application trains the abnormal traffic detection network based on comparative prompt word learning for complex and diverse computing power network operation and maintenance scenarios. During the training process, the normal traffic features are first adjusted by the first traffic encoder to adjust the neural network weights and convert them into learnable dynamic prompt words to achieve adaptive matching for specific operation and maintenance tasks. On this basis, a contrastive learning mechanism is introduced to automatically generate and dynamically adjust prompt words. A triplet loss function is used to construct a fine-tuning optimization objective for the detection language model. This enhances the feature separability between normal and abnormal traffic, reduces the reconstruction error between different traffic types, and employs a transfer learning strategy, enabling the detection language model to adapt to new scenarios with fine-tuning of a small number of samples based on pre-training. The resulting anomaly traffic detection network can effectively identify various types of abnormal traffic and meet the anomaly detection needs in diverse network operation and maintenance scenarios.

[0151] In one embodiment, after the abnormal traffic detection network is trained, abnormal traffic monitoring network is used to perform abnormal traffic detection. Figure 11 , Figure 11 This is a flow chart of the abnormal traffic detection method provided by an embodiment of the present application, which specifically includes the following steps:

[0152] Step 1110: Acquire initial flow data and convert the initial flow data into initial flow features.

[0153] In one embodiment, initial traffic data is obtained in a manner consistent with network traffic data, and the initial traffic data is converted into initial traffic features through a pre-trained language model. The calculation method of the initial traffic features is consistent with that of normal traffic features.

[0154] Step 1120: Input the initial traffic features into the first traffic encoder for feature encoding to obtain latent space representation features.

[0155] In one embodiment, the initial flow characteristics Input the first flow encoder Perform feature encoding to obtain latent space representation features .

[0156] Step 1130: Input the latent space representation features into the detection language model for reconstruction to obtain the target traffic features, and calculate the reconstruction error between the target traffic features and the latent space representation features. If the reconstruction error is greater than a preset threshold, the detection result indicates that the initial traffic data is abnormal traffic.

[0157] In one embodiment, the detection language model will represent features based on the latent space Reconstruct and obtain the target traffic characteristics The purpose of reconstruction is to make the target traffic characteristics as With initial flow characteristics At this time, the difference between the target traffic feature and the latent space representation feature is calculated as the reconstruction error.

[0158] Specifically, during the training process, the goal of the detection language model is to make its output representation of normal traffic closer to the actual normal traffic characteristics. The closer the closer, the more its feature extraction capabilities match normal traffic scenarios. At this time, if its input is abnormal traffic characteristics, the output should differ significantly from the input. Therefore, during the inference process, the reconstruction error can be used to measure the degree of fit between the output of the detection language model and the input. The smaller the reconstruction error, the closer the input and output of the detection language model are, and the closer the input data is to normal traffic scenarios, the detection result is normal traffic data. The larger the reconstruction error, the more divergent the input and output of the detection language model are. Since the detection language model is trained to output data closer to normal traffic scenarios, it can be inferred that the input data is abnormal traffic data.

[0159] In one embodiment, a preset threshold can be determined using the 3-standard-deviation principle or an ROC curve. The ROC curve (Receiver Operating Characteristic Curve) is a tool used to evaluate the performance of a classification model and can help select the optimal classifier and threshold. Next, the reconstruction error is compared with the preset threshold. If the reconstruction error is greater than the preset threshold, it indicates that the input initial traffic data may be abnormal. The detection result indicates that the initial traffic data is abnormal. This is because abnormal data typically does not conform to the normal data pattern learned by the detection language model, resulting in a larger reconstruction error. Therefore, abnormal traffic in the computing power network can be detected, ultimately generating an anomaly detection report.

[0160] It can be seen that the abnormal traffic detection method proposed in the embodiment of the present application combines prompt word fine-tuning with large model technology, which can achieve efficient and accurate anomaly detection. First, the triple loss function based on the minimum negative sample pair is adopted as the optimization target of network fine-tuning, which not only enhances the feature separability of normal traffic and abnormal traffic, but also improves the detection sensitivity by expanding the reconstruction error between categories. Secondly, it integrates the feature extraction advantages of deep neural networks and the generalization ability of large language models, and accurately captures the distribution pattern of normal data through guided learning. This hybrid architecture enables the abnormal traffic detection network to have excellent anomaly recognition capabilities in downstream network operation and maintenance tasks. Not only does it improve detection efficiency and detection accuracy, but it also has good interpretability. It is especially suitable for abnormal traffic detection under complex computing power network architecture.

[0161] The embodiment of the present application also provides an abnormal traffic detection network training device, which can implement the above abnormal traffic detection network training method. Figure 12 , the device comprises:

[0162] Traffic feature generation module 1210: used to generate normal traffic features based on network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features.

[0163] Latent space mapping module 1220: used to input normal traffic features into the first traffic encoder for encoding to obtain normal latent space variables, and obtain abnormal latent space variables based on the normal latent space variables and abnormal traffic features.

[0164] Comparison sample pair generation module 1230: used to input normal latent space variables and abnormal latent space variables into the detection language model for reconstruction, obtain normal traffic representation and abnormal traffic representation, and construct positive sample pairs and negative sample pairs based on normal traffic characteristics, normal traffic representation and abnormal traffic representation.

[0165] Loss adjustment module 1240: used to calculate the function value of the ternary loss function based on the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjust the weight of the abnormal traffic detection network until a trained abnormal traffic detection network is obtained.

[0166] The specific implementation of the abnormal traffic detection network training device of this embodiment is basically the same as the specific implementation of the abnormal traffic detection network training method described above, and will not be repeated here.

[0167] In one embodiment, the abnormal traffic flow detection method also includes a corresponding abnormal traffic flow detection device, which includes:

[0168] Initial traffic acquisition module: used to obtain initial traffic data and convert the initial traffic data into initial traffic features.

[0169] Feature encoding module: used to input the initial traffic features into the first traffic encoder for feature encoding to obtain latent space representation features.

[0170] Reconstruction analysis module: used to input the latent space representation features into the detection language model for reconstructing, obtain the target traffic features, and calculate the reconstruction error between the target traffic features and the latent space representation features. If the reconstruction error is greater than the preset threshold, the detection result indicates that the initial traffic data is abnormal traffic.

[0171] The specific implementation of the abnormal flow detection device of this embodiment is basically the same as the specific implementation of the abnormal flow detection method described above, and will not be repeated here.

[0172] An embodiment of the present application further provides an electronic device, including:

[0173] At least one memory; at least one processor; at least one program; the program is stored in the memory, and the processor executes the at least one program to implement the abnormal traffic detection network training method or abnormal traffic detection method described above. The electronic device can be any intelligent terminal, including a mobile phone, tablet computer, personal digital assistant (PDA), and vehicle-mounted computer.

[0174] See also Figure 13 , Figure 13 The hardware structure of an electronic device according to another embodiment is shown. The electronic device includes:

[0175] The processor 1301 may be implemented as a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0176] The memory 1302 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1302 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1302 and is called by the processor 1301 to execute the abnormal traffic detection network training method or the abnormal traffic detection method in the embodiments of this application.

[0177] Input / output interface 1303, used to implement information input and output;

[0178] Communication interface 1304, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WiFi, Bluetooth, etc.);

[0179] Bus 1305 , which transmits information between various components of the device (e.g., processor 1301 , memory 1302 , input / output interface 1303 , and communication interface 1304 );

[0180] The processor 1301 , the memory 1302 , the input / output interface 1303 and the communication interface 1304 are connected to each other in communication within the device via a bus 1305 .

[0181] An embodiment of the present application further provides a storage medium, which is a storage medium that stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned abnormal traffic detection network training method, or the abnormal traffic detection method.

[0182] The memory, as a non-transient storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0183] The abnormal traffic detection network training method, abnormal traffic detection method and device proposed in the embodiments of the present application generate normal traffic features based on network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features, input the normal traffic features into the first traffic encoder for encoding to obtain normal latent space variables, and obtain abnormal latent space variables based on the normal latent space variables and the abnormal traffic features, respectively input the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, construct positive sample pairs and negative sample pairs based on the normal traffic features, the normal traffic representation and the abnormal traffic representation, calculate the function value of the ternary loss function based on the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjust the weight of the abnormal traffic detection network until a trained abnormal traffic detection network is obtained. The embodiments of the present application train the abnormal traffic detection network based on comparative prompt word learning for complex and diverse computing power network operation and maintenance scenarios. During the training process, the normal traffic features are first adjusted by the first traffic encoder to adjust the neural network weights, converting them into learnable dynamic prompt words to achieve adaptive matching for specific operation and maintenance tasks. On this basis, a contrastive learning mechanism is introduced to automatically generate and dynamically adjust prompt words. A triplet loss function is used to construct a fine-tuning optimization objective for the detection language model. This enhances the feature separability between normal and abnormal traffic, reduces the reconstruction error between different traffic types, and employs a transfer learning strategy, enabling the detection language model to adapt to new scenarios with fine-tuning of a small number of samples based on pre-training. The resulting anomaly traffic detection network can effectively identify various types of abnormal traffic and meet the anomaly detection needs in diverse network operation and maintenance scenarios.

[0184] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0185] It will be understood by those skilled in the art that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown, or a combination of certain steps, or different steps. The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0186] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0187] The terms "first," "second," "third," "fourth," and the like (if any) in the specification of the present application and the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in orders other than those illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such process, method, product, or apparatus.

[0188] It should be understood that in this application, "at least one (item)" means one or more, and "more" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships can exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or plural.

[0189] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the above-mentioned units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0190] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0191] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0192] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0193] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for training an abnormal traffic detection network, characterized in that: The abnormal traffic detection network includes a first traffic encoder and a detection language model, and the method includes: Generate normal traffic features based on network traffic data extracted from the computing network, and generate abnormal traffic features based on the normal traffic features; Inputting the normal traffic characteristics into the first traffic encoder for encoding to obtain normal latent space variables, and obtaining abnormal latent space variables according to the normal latent space variables and the abnormal traffic characteristics; The normal latent space variables and the abnormal latent space variables are respectively input into the detection language model for reconstruction to obtain normal traffic representation and abnormal traffic representation, and positive sample pairs and negative sample pairs are constructed according to the normal traffic characteristics, the normal traffic representation and the abnormal traffic representation; A function value of a ternary loss function is calculated according to the first distance of the positive sample pair and the second distance of the negative sample pair. Based on the function value, at least the weight of the abnormal traffic detection network is adjusted until the trained abnormal traffic detection network is obtained.

2. The abnormal traffic detection network training method according to claim 1 is characterized in that: The obtaining of abnormal latent space variables according to the normal latent space variables and the abnormal traffic characteristics includes: Inputting the abnormal flow characteristics into a second flow encoder for encoding to obtain an abnormal intermediate variable, wherein the model structure of the second flow encoder is consistent with that of the first flow encoder; The abnormal latent space variable is obtained according to the sum of the normal latent space variable and the abnormal intermediate variable.

3. The abnormal traffic detection network training method according to claim 1, characterized in that: Generating abnormal traffic characteristics based on the normal traffic characteristics includes: Based on a preset sliding window, calculating a sliding average corresponding to each characteristic value in the normal flow characteristic, and forming a seasonal series component according to the sliding average; Calculating a difference sequence between the normal flow characteristic and the seasonal sequence component, performing local weighted regression fitting on the difference sequence to obtain a trend sequence component; The abnormal flow feature is obtained by subtracting the seasonal sequence component and the trend sequence component from the normal flow feature.

4. The abnormal traffic detection network training method according to claim 1, characterized in that: The constructing of positive sample pairs and negative sample pairs according to the normal traffic characteristics, the normal traffic representation, and the abnormal traffic representation includes: Taking the normal traffic feature as an anchor sample, taking the normal traffic representation as a normal sample, and taking the abnormal traffic representation as an abnormal sample; The positive sample pair is formed according to the anchor point feature value of the anchor point sample and the normal feature value of the normal sample, and the negative sample pair is formed according to the anchor point feature value and the abnormal feature value of the abnormal sample.

5. The abnormal traffic detection network training method according to claim 4 is characterized in that: The function value of the ternary loss function is calculated according to the first distance of the positive sample pair and the second distance of the negative sample pair, including: Calculating a first similarity between the anchor point feature value and the normal feature value to obtain the first distance; Calculating a second similarity between the anchor point feature value and the abnormal feature value in all the negative sample pairs corresponding to the anchor point sample, selecting the negative sample pair corresponding to the minimum value of the second similarity as the minimum negative sample pair, and using the second similarity of the minimum negative sample pair as the second distance; The function value of the ternary loss function is calculated based on the first distance and the second distance.

6. The abnormal traffic detection network training method according to claim 5, characterized in that: The calculating the function value of the ternary loss function according to the first distance and the second distance includes: calculating a distance difference between the first distance and the second distance; The sum of the distance difference and a preset margin parameter is calculated to obtain a loss value. If the loss value is a negative number, the loss value is set to zero.

7. The abnormal traffic detection network training method according to claim 2, characterized in that: The detection language model includes at least a feedforward network layer, a normalization layer, and a multi-head attention module. Based on the function value, at least the abnormal traffic detection network is weighted and adjusted until the trained abnormal traffic detection network is obtained, including: Freeze the model parameters of the multi-head attention module during training; Based on the function value, the model parameters corresponding to the first flow encoder, the second flow encoder, the feedforward network layer and the normalization layer are adjusted until the iteration termination condition is reached to obtain the trained abnormal flow detection network.

8. A method for detecting abnormal traffic, characterized in that: Executed by an abnormal traffic monitoring network trained using the abnormal traffic detection network training method according to any one of claims 1 to 7, the method comprising: Acquiring initial flow data and converting the initial flow data into initial flow features; Inputting the initial traffic feature into the first traffic encoder for feature encoding to obtain a latent space representation feature; The latent space representation feature is input into the detection language model for reconstruction to obtain the target traffic feature, and the reconstruction error between the target traffic feature and the latent space representation feature is calculated. If the reconstruction error is greater than a preset threshold, the detection result indicates that the initial traffic data is abnormal traffic.

9. An abnormal traffic detection network training device, characterized in that: The abnormal traffic detection network includes a first traffic encoder and a detection language model, and the device includes: Traffic feature generation module: used to generate normal traffic features based on network traffic data extracted from the computing power network, and generate abnormal traffic features based on the normal traffic features; Latent space mapping module: used for inputting the normal traffic characteristics into the first traffic encoder for encoding to obtain normal latent space variables, and obtaining abnormal latent space variables according to the normal latent space variables and the abnormal traffic characteristics; A comparison sample pair generation module is configured to input the normal latent space variables and the abnormal latent space variables into the detection language model for reconstruction, thereby obtaining normal traffic representation and abnormal traffic representation, and constructing positive sample pairs and negative sample pairs based on the normal traffic features, the normal traffic representation, and the abnormal traffic representation; Loss adjustment module: used to calculate the function value of the ternary loss function according to the first distance of the positive sample pair and the second distance of the negative sample pair, and based on the function value, at least adjust the weight of the abnormal traffic detection network until the trained abnormal traffic detection network is obtained.

10. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the abnormal traffic detection network training method according to any one of claims 1 to 7, or the abnormal traffic detection method according to claim 8.

11. A storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the abnormal traffic detection network training method according to any one of claims 1 to 7 or the abnormal traffic detection method according to claim 8 is implemented.

Images