Network traffic anomaly detection method and system, terminal and storage medium
By decomposing and fusion of network traffic data in timing features, and using cross-scale coding and abnormality scoring methods, the problem of insufficient multi-scale feature capture capabilities in the prior art is solved, and the accuracy and flexibility of network traffic anomaly detection are improved.
Patent Information
- Application Number
- CN202510554666.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-29
- Publication Date
- 2025-08-15
AI Technical Summary
In the prior art, network traffic anomaly detection has poor ability to capture multi-scale features, resulting in low detection accuracy.
By preprocessing the network traffic data, time-series feature decomposition is performed to obtain low-frequency components and high-frequency components, time-stamp features are extracted, and time-stamp features are fused with low-frequency components and high-frequency components. The pre-trained encoder is used for cross-scale encoding, and anomaly scores are generated by combining reconstruction errors and training relative entropy.
It improves the accuracy of network traffic anomaly detection, enhances the ability to capture multi-scale features, improves detection flexibility and real-time performance, and reduces computing complexity and deployment costs.
Smart Images
Figure CN120498728A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network traffic anomaly detection method, system, terminal and storage medium. Background Art
[0002] Network traffic anomaly detection is the process of monitoring and analyzing network traffic to identify unusual traffic patterns that deviate from normal behavior. Network traffic anomaly detection plays a crucial role in network security, helping to identify potential network attacks, malicious activity, or system failures.
[0003] In the existing network traffic anomaly detection process, the ability to capture multi-scale features is poor, which reduces the accuracy of network traffic anomaly detection. Summary of the Invention
[0004] The purpose of the embodiments of the present invention is to provide a network traffic anomaly detection method, system, terminal and storage medium to solve the problem of low accuracy of network traffic anomaly detection in the prior art.
[0005] The embodiment of the present invention is implemented as follows: a method for detecting network traffic anomalies, the method comprising:
[0006] Acquire network traffic data to be detected, and preprocess the network traffic data to be detected to obtain preprocessed data;
[0007] Performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, and extracting timestamp features of the preprocessed data;
[0008] Fusing the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and inputting the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature;
[0009] Inputting the cross-scale coding features into a pre-trained decoder to perform traffic prediction to obtain predicted traffic, and determining a reconstruction error based on the predicted traffic;
[0010] A traffic anomaly score is determined according to the reconstruction error and the training relative entropy of the pre-trained decoder, and a network traffic anomaly detection result is generated according to the traffic anomaly score.
[0011] Preferably, extracting the timestamp feature of the preprocessed data includes:
[0012] Obtaining global timestamp information from the preprocessed data, and mapping the global timestamp information according to a learnable embedding matrix to obtain a global time embedding;
[0013] Acquiring position coding information from the preprocessed data, and mapping the position coding information according to a sine function to obtain a local position coding;
[0014] The formula used to map the position coding information according to the sine function includes:
[0015] E local [i,2j]=sin(i / 10000 2j / d )
[0016] Among them, E local is the local position code, d is the coding dimension, i is the position index, and j is the dimension index.
[0017] Preferably, before inputting the fusion features into the pre-trained encoder for cross-scale encoding, the method further includes:
[0018] Obtaining a training dataset and initializing the model parameters of the encoder on the training dataset using an attention mechanism;
[0019] The goal of the initialized encoder is to minimize the mean square error of traffic prediction, and the Adam optimizer is used with an initial learning rate of 10. -3 , the encoder is initially trained with a batch size of 64 and a training cycle of 100;
[0020] Freeze the underlying parameters of the encoder after initial training, train only the sparse attention layer and the cross-scale attention layer, and set the learning rate to 10 -4 , applying gradient clipping, and performing sparse fine-tuning training on the encoder after initial training for 50 training cycles;
[0021] The variable selection network in the encoder after sparse fine-tuning training is deleted, and the gated residual network is optimized to obtain the pre-trained encoder.
[0022] Preferably, the output of the cross-scale attention layer in the pre-trained encoder is:
[0023]
[0024] Q low =H low W Q ,K high =H high W K ,V high =H high W V
[0025] Among them, H outis the cross-scale encoding feature, H low is the eigenvector corresponding to the low-frequency component, H high is the eigenvector corresponding to the high frequency component, d k is the key dimension, W Q is the query projection weight matrix, W K is the key projection weight matrix, W V is the value projection weight matrix, and T is the matrix transpose.
[0026] Preferably, performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components includes:
[0027] Performing discrete wavelet transform on the preprocessed data to obtain the low-frequency component and the high-frequency component;
[0028] The formula used for performing discrete wavelet transform on the pre-processed data includes:
[0029]
[0030] Among them, X low is the low-frequency component, X high is the high frequency component, N is the number of time steps of the preprocessed data, ψ low is the low-frequency wavelet basis function, ψ high is the decomposition kernel function, n is the signal index of the preprocessed data, and k represents the decomposition coefficient index.
[0031] Preferably, the optimized gated residual network is:
[0032] GRN(x)=x+GLU(W1x)⊙(W2x)
[0033] Wherein, W1 is the first learnable parameter and W2 is the second learnable parameter, ⊙ is element-wise multiplication, x is the input feature vector of the optimized gated residual network, GLU is the gated linear unit, and GRN is the optimized gated residual network.
[0034] Preferably, the formula used to determine the reconstruction error according to the predicted flow includes:
[0035]
[0036] Among them, X t is the actual network traffic observation value at time step t, The predicted flow rate for time step t predicted by the encoder, is the reconstruction error;
[0037] The formula used to determine the traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder includes:
[0038]
[0039] Among them, Score is the traffic anomaly score, α is the balance coefficient, KL(p test ||p train ) is the training relative entropy of the decoder;
[0040]
[0041] Among them, p train is the traffic data distribution of the decoder during the training phase, p test is the traffic data distribution of the decoder in the test phase, F is the number of binning intervals, and i is the index of the discretized traffic interval.
[0042] Another object of an embodiment of the present invention is to provide a network traffic anomaly detection system, the system comprising:
[0043] A preprocessing module is used to obtain the network traffic data to be detected and preprocess the network traffic data to be detected to obtain preprocessed data;
[0044] A feature extraction module is used to perform time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, and to extract timestamp features of the preprocessed data;
[0045] a cross-scale encoding module, configured to fuse the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and input the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature;
[0046] a traffic prediction module, configured to input the cross-scale coding features into a pre-trained decoder to perform traffic prediction, obtain predicted traffic, and determine a reconstruction error based on the predicted traffic;
[0047] The traffic detection module is used to determine a traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder, and generate a network traffic anomaly detection result based on the traffic anomaly score.
[0048] The embodiments of the present invention effectively improve the data quality of the network traffic data to be detected by preprocessing the data, and obtain low-frequency components and high-frequency components by performing time series feature decomposition on the preprocessed data, thereby effectively enhancing the ability to capture multi-scale features and improving the accuracy of network traffic anomaly detection. By fusing timestamp features with low-frequency components and high-frequency components, time series embedding can be effectively fused with multi-scale features, thereby improving feature quality. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] Figure 1 is a flow chart of a method for detecting anomaly in network traffic provided by a first embodiment of the present invention;
[0050] Figure 2 is a schematic diagram of generating cross-scale coding features provided by the first embodiment of the present invention;
[0051] Figure 3 is a schematic diagram of generating network traffic anomaly detection results provided by the first embodiment of the present invention;
[0052] Figure 4 2 is a schematic diagram of the structure of a network traffic anomaly detection system provided by a second embodiment of the present invention;
[0053] Figure 5 It is a structural diagram of a terminal device provided by the third embodiment of the present invention. DETAILED DESCRIPTION
[0054] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.
[0055] In order to illustrate the technical solution of the present invention, specific embodiments are provided below.
[0056] Example 1
[0057] See also Figures 1 to 3 , is a flowchart of a network traffic anomaly detection method provided by a first embodiment of the present invention. The network traffic anomaly detection method can be applied to any device or system. The network traffic anomaly detection method includes the following steps:
[0058] Step S10, obtaining the network traffic data to be detected, and preprocessing the network traffic data to be detected to obtain preprocessed data;
[0059] Optionally, preprocessing the network traffic data to be detected (raw network traffic data) to obtain preprocessed data includes:
[0060] The network traffic data to be detected is cleaned to obtain cleaned data, and anomaly detection is performed on the cleaned data according to the sliding window to obtain data anomaly values; wherein, for the data anomaly values of the cleaned data, a sliding window dynamic threshold method is used for detection, and the window size W is used to slide through the sequence, and at the window position t, the window is calculated to exclude the current point x. t The mean μ after t (window mean) and window standard deviation σ t ,like Then it is marked as a data outlier and set to blank;
[0061] Calculate the dynamic time warping distance of the data outlier and obtain the neighboring data of the data outlier in the cleaned data; for missing values (data outliers), adopt the K-nearest neighbor interpolation algorithm based on dynamic time warping (DTW) by calculating the DTW distance between subsequences:
[0062]
[0063] Where W is the size of the sliding window, t is the current time step index, and x t is the flow value of the current time step, x i is the complete subsequence in the network traffic data to be detected, X miss is the subsequence to be interpolated containing missing values, π(regularized path) is the time step mapping relationship between the two subsequences, and p,q are the time step positions of the matching points in the regularized path;
[0064] Calculating a weighted estimate based on the neighbor data and the dynamic time warping distance, interpolating the data outliers in the cleaned data based on the weighted estimate to obtain interpolated data, and performing global normalization on the interpolated data to obtain the preprocessed data;
[0065] Among them, the most similar K (number of neighbors) neighbors are selected and the missing values are weighted interpolated:
[0066]
[0067] Among them, w k is the weight coefficient, determined by the inverse of the DTW distance, ∈ is a small constant to prevent division by zero, x k,t is the value of the kth neighbor at time step t.
[0068] After the imputation process is completed, the imputed data is globally standardized:
[0069]
[0070] in, is the preprocessed data, μglobal is the mean of the preset training data set, σ global The standard deviation of the training data set is preset, and the preprocessed data is output in a windowed manner.
[0071] Step S20, performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, and extracting timestamp features of the preprocessed data;
[0072] Among them, the preprocessed data is decomposed into low-frequency component trend features (low-frequency components) and high-frequency detail features (high-frequency components) through discrete wavelet transform (DWT) to enhance the ability to capture multi-scale features. The Daubechies-4 wavelet basis function is selected to decompose the preprocessed data. After obtaining the high-frequency component, the soft threshold processing method is used to denoise the high-frequency component, and finally the signal is reconstructed through inverse wavelet transform (IDWT).
[0073] Optionally, performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components includes:
[0074] Performing discrete wavelet transform on the preprocessed data to obtain the low-frequency component and the high-frequency component;
[0075] The formula used for performing discrete wavelet transform on the pre-processed data includes:
[0076]
[0077] Among them, X low is the low-frequency component, X high is the high frequency component, N is the number of time steps of the preprocessed data, ψ low is the low-frequency wavelet basis function, ψ high is the decomposition kernel function, n is the signal index of the preprocessed data, and k represents the decomposition coefficient index.
[0078] Furthermore, extracting the timestamp feature of the pre-processed data includes:
[0079] Obtaining global timestamp information from the preprocessed data, and mapping the global timestamp information according to a learnable embedding matrix to obtain a global time embedding; wherein the learnable embedding matrix can be set according to requirements, and the global timestamp information includes timestamp information such as hour and day of the week;
[0080] Acquiring position coding information from the preprocessed data, and mapping the position coding information according to a sine function to obtain a local position coding;
[0081] The formula used to map the position coding information according to the sine function includes:
[0082] E local [i, 2j] = sin(i / 10000 2j / d )
[0083] Among them, E local is the local position code, d is the coding dimension, i is the position index, and j is the dimension index.
[0084] Step S30, fusing the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and inputting the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature;
[0085] Among them, the low-frequency component and the high-frequency component are aligned by one-dimensional convolution to generate the feature vector H low (low-frequency feature matrix) and H high (high-frequency feature matrix) and fused with the timestamp feature. In this step, the encoder uses a TFT encoder, and a sparse attention mechanism is introduced in the TFT encoder to reduce the computational complexity. The original multi-head attention weight matrix A in the encoder is:
[0086]
[0087] Where Q is the query vector, K is the key vector, and V is the value vector. Through sparse processing, only the top-k (sparse retention number, default value: 8) weights of each row are retained.
[0088] Optionally, before inputting the fusion feature into the pre-trained encoder for cross-scale encoding, the method further includes:
[0089] Obtaining a training dataset and initializing the model parameters of the encoder on the training dataset using an attention mechanism;
[0090] The goal of the initialized encoder is to minimize the mean square error of traffic prediction, and the Adam optimizer is used with an initial learning rate of 10. -3 , the encoder is initially trained with a batch size of 64 and a training cycle of 100;
[0091] Freeze the underlying parameters of the encoder after initial training, train only the sparse attention layer and the cross-scale attention layer, and set the learning rate to 10 -4 , applying gradient clipping, and performing sparse fine-tuning training on the encoder after initial training for 50 training cycles; wherein, after completing the sparse fine-tuning training, monitoring the loss change on the encoder validation set, if the loss does not decrease for 5 consecutive cycles, then gradually increasing the gradient value from 8 to 16; if the loss steadily decreases, then maintaining the gradient value = 8;
[0092] The variable selection network in the encoder after sparse fine-tuning training is deleted, and the gated residual network is optimized to obtain the pre-trained encoder; wherein, the redundant variable selection network (VSN) is removed, and the gated residual network (GRN) is optimized to a single-layer gated linear unit (GLU) structure to simplify the encoder structure.
[0093] Furthermore, the output of the cross-scale attention layer in the pre-trained encoder is:
[0094]
[0095] Q low =H low W Q , K high =H high W K , V high =H high W V
[0096] Among them, H out is the cross-scale encoding feature, H low is the eigenvector corresponding to the low-frequency component, H high is the eigenvector corresponding to the high frequency component, d k is the key dimension, W Q is the query projection weight matrix, W K is the key projection weight matrix, W V is the value projection weight matrix, and T is the matrix transpose.
[0097] Furthermore, the optimized gated residual network is:
[0098] GRN(x)=x+GLU(W1x)⊙(W2x)
[0099] Wherein, W1 is the first learnable parameter and W2 is the second learnable parameter, ⊙ is element-wise multiplication, x is the input feature vector of the optimized gated residual network, GLU is the gated linear unit, and GRN is the optimized gated residual network.
[0100] Step S40: inputting the cross-scale coding features into a pre-trained decoder to perform traffic prediction to obtain predicted traffic, and determining a reconstruction error based on the predicted traffic;
[0101] The decoder adopts a masked autoregressive structure and inputs the encoder output H out Combined with the historical mask sequence, the traffic value of the next t steps is predicted to obtain the predicted traffic.
[0102] Optionally, the formula used to determine the reconstruction error according to the predicted flow includes:
[0103]
[0104] Among them, X t is the actual network traffic observation value at time step t, The predicted flow rate for time step t predicted by the encoder, is the reconstruction error.
[0105] Step S50, determining a traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder, and generating a network traffic anomaly detection result based on the traffic anomaly score;
[0106] The traffic anomaly score is compared with the score threshold. If the traffic anomaly score is greater than the score threshold, the network traffic data to be detected is determined to be abnormal traffic data.
[0107] Optionally, the formula used to determine the traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder includes:
[0108]
[0109] Among them, Score is the traffic anomaly score, α is the balance coefficient, KL(p test ||p train ) is the training relative entropy of the decoder;
[0110]
[0111] Among them, p train is the traffic data distribution of the decoder during the training phase, p test is the traffic data distribution of the decoder in the test phase, F is the number of binning intervals, and i is the index of the discretized traffic interval.
[0112] Furthermore, in this step, the scoring threshold τ is adjusted dynamically:
[0113] τ=μ score +β·σ score
[0114] Among them, μ score is the historical score mean of the decoder, σ score The standard deviation of the decoder's historical scores is calculated using a sliding window. β (the threshold adjustment coefficient, default value: 3) can be set based on the required false positive rate. If Score > τ, the network traffic data to be detected is considered abnormal.
[0115] This embodiment, by combining time series decomposition with a lightweight design, can effectively capture long-term trends and short-term burst characteristics in network traffic, improving the ability to detect complex attack patterns. It fully considers the trend, periodicity, and dynamic changes in traffic data, establishes a prediction benchmark through historical data analysis, and combines multi-scale feature enhancement with a sparse attention mechanism to focus on identifying key local features. It has high flexibility and can adapt to traffic changes in different network environments. It supports real-time updates and dynamic adjustments, eliminating the need to rely on large amounts of labeled data or complex rule bases, significantly reducing deployment and maintenance costs. It also balances computational efficiency and detection accuracy, providing reliable technical support for network security protection. It decomposes network traffic into low-frequency trends and high-frequency burst components through wavelet transform, enhancing the ability to capture long-term patterns and short-term anomalies. The sparse attention mechanism and module pruning strategy significantly reduce the computational complexity of the TFT model, improving real-time detection efficiency while maintaining high accuracy. A joint scoring method based on reconstruction error and data distribution offset, combined with adaptive threshold adjustment, enables robust detection in complex attack scenarios.
[0116] This embodiment effectively improves the data quality of the network traffic data to be detected by preprocessing the data. By performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, the ability to capture multi-scale features is effectively enhanced, and the accuracy of network traffic anomaly detection is improved. By fusing timestamp features with low-frequency components and high-frequency components, time series embedding can be effectively fused with multi-scale features, thereby improving feature quality.
[0117] Example 2
[0118] See also Figure 4 , is a schematic diagram of the structure of a network traffic anomaly detection system 100 provided in a second embodiment of the present invention, comprising:
[0119] The preprocessing module 10 is used to obtain the network traffic data to be detected and preprocess the network traffic data to be detected to obtain preprocessed data.
[0120] The feature extraction module 11 is used to perform time series feature decomposition on the pre-processed data to obtain low-frequency components and high-frequency components, and to extract timestamp features of the pre-processed data.
[0121] Optionally, the feature extraction module 11 is further configured to: obtain global timestamp information from the preprocessed data, and map the global timestamp information according to a learnable embedding matrix to obtain a global time embedding;
[0122] Acquiring position coding information from the preprocessed data, and mapping the position coding information according to a sine function to obtain a local position coding;
[0123] The formula used to map the position coding information according to the sine function includes:
[0124] E local [i, 2j] = sin(i / 10000 2j / d )
[0125] Among them, E local is the local position code, d is the coding dimension, i is the position index, and j is the dimension index.
[0126] Furthermore, the feature extraction module 11 is further configured to: perform discrete wavelet transform on the pre-processed data to obtain the low-frequency component and the high-frequency component;
[0127] The formula used for performing discrete wavelet transform on the pre-processed data includes:
[0128]
[0129] Among them, X low is the low-frequency component, X high is the high frequency component, N is the number of time steps of the preprocessed data, ψ low is the low-frequency wavelet basis function, ψ high is the decomposition kernel function, n is the signal index of the preprocessed data, and k represents the decomposition coefficient index.
[0130] The cross-scale encoding module 12 is configured to fuse the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and input the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature.
[0131] Optionally, the cross-scale encoding module 12 is further configured to: obtain a training dataset, and initialize the model parameters of the encoder on the training dataset using an attention mechanism;
[0132] The goal of the initialized encoder is to minimize the mean square error of traffic prediction, and the Adam optimizer is used with an initial learning rate of 10. -3 , the encoder is initially trained with a batch size of 64 and a training cycle of 100;
[0133] Freeze the underlying parameters of the encoder after initial training, train only the sparse attention layer and the cross-scale attention layer, and set the learning rate to 10 -4 , applying gradient clipping, and performing sparse fine-tuning training on the encoder after initial training for 50 training cycles;
[0134] The variable selection network in the encoder after sparse fine-tuning training is deleted, and the gated residual network is optimized to obtain the pre-trained encoder.
[0135] Furthermore, the output of the cross-scale attention layer in the pre-trained encoder is:
[0136]
[0137] Q low =H low W Q , K high =H high W K , V high =H high W V
[0138] Among them, H out is the cross-scale encoding feature, H low is the eigenvector corresponding to the low-frequency component, H high is the eigenvector corresponding to the high frequency component, d k is the key dimension, W Q is the query projection weight matrix, W K is the key projection weight matrix, W V is the value projection weight matrix, and T is the matrix transpose.
[0139] The optimized gated residual network is:
[0140] GRN(x)=x+GLU(W1x)⊙(W2x)
[0141] Wherein, W1 is the first learnable parameter and W2 is the second learnable parameter, ⊙ is element-wise multiplication, x is the input feature vector of the optimized gated residual network, GLU is the gated linear unit, and GRN is the optimized gated residual network.
[0142] The traffic prediction module 13 is configured to input the cross-scale coding features into a pre-trained decoder to perform traffic prediction, obtain predicted traffic, and determine a reconstruction error based on the predicted traffic.
[0143] Optionally, the formula used to determine the reconstruction error according to the predicted flow includes:
[0144]
[0145] Among them, X t is the actual network traffic observation value at time step t, The predicted flow rate for time step t predicted by the encoder, is the reconstruction error.
[0146] The traffic detection module 14 is configured to determine a traffic anomaly score based on the reconstruction error and the pre-trained relative entropy of the decoder, and generate a network traffic anomaly detection result based on the traffic anomaly score.
[0147] Optionally, the formula used to determine the traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder includes:
[0148]
[0149] Among them, Score is the traffic anomaly score, α is the balance coefficient, KL(p test ||p train ) is the training relative entropy of the decoder;
[0150]
[0151] Among them, p train is the traffic data distribution of the decoder during the training phase, p test is the traffic data distribution of the decoder in the test phase, F is the number of binning intervals, and i is the index of the discretized traffic interval.
[0152] In this embodiment, by preprocessing the network traffic data to be detected, the data quality of the network traffic data to be detected is effectively improved. By performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, the ability to capture multi-scale features is effectively enhanced, and the accuracy of network traffic anomaly detection is improved. By fusing the timestamp features with the low-frequency components and high-frequency components, the time series embedding and multi-scale features can be effectively fused, thereby improving the feature quality.
[0153] Example 3
[0154] Figure 5 This is a block diagram of a terminal device 2 provided in the third embodiment of the present application. Figure 5 As shown, the terminal device 2 of this embodiment includes: a processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on the processor 20, such as a program for the network traffic anomaly detection method. When the processor 20 executes the computer program 22, the steps of each embodiment of the network traffic anomaly detection method described above are implemented.
[0155] Exemplarily, the computer program 22 may be divided into one or more modules, which are stored in the memory 21 and executed by the processor 20 to implement the present application. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution process of the computer program 22 in the terminal device 2. The terminal device may include, but is not limited to, a processor 20 and a memory 21.
[0156] The processor 20 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.
[0157] The memory 21 may be an internal storage unit of the terminal device 2, such as a hard disk or memory of the terminal device 2. The memory 21 may also be an external storage device of the terminal device 2, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the terminal device 2. Furthermore, the memory 21 may include both an internal storage unit of the terminal device 2 and an external storage device. The memory 21 is used to store the computer program and other programs and data required by the terminal device. The memory 21 may also be used to temporarily store data that has been output or is about to be output.
[0158] In addition, the functional modules in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.
[0159] If the integrated module is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Among them, the computer-readable storage medium can be non-volatile or volatile. Based on this understanding, the present application implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable storage medium may include: any entity or device that can carry computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in computer-readable storage media can be appropriately increased or decreased according to the requirements of legislation and patent practices in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practices, computer-readable storage media do not include electrical carrier signals and telecommunications signals.
[0160] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.
Claims
1. A method for detecting anomaly in network traffic, characterized in that: The method comprises: Acquire network traffic data to be detected, and preprocess the network traffic data to be detected to obtain preprocessed data; Performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, and extracting timestamp features of the preprocessed data; Fusing the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and inputting the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature; Inputting the cross-scale coding features into a pre-trained decoder to perform traffic prediction to obtain predicted traffic, and determining a reconstruction error based on the predicted traffic; A traffic anomaly score is determined according to the reconstruction error and the training relative entropy of the pre-trained decoder, and a network traffic anomaly detection result is generated according to the traffic anomaly score.
2. The network traffic anomaly detection method according to claim 1, wherein: Extracting the timestamp feature of the preprocessed data includes: Obtaining global timestamp information from the preprocessed data, and mapping the global timestamp information according to a learnable embedding matrix to obtain a global time embedding; Acquiring position coding information from the preprocessed data, and mapping the position coding information according to a sine function to obtain a local position coding; The formula used to map the position coding information according to the sine function includes: Yes local [i, 2j] = sin(i / 10000 2j / d ) Among them, E local is the local position code, d is the coding dimension, i is the position index, and j is the dimension index.
3. The network traffic anomaly detection method according to claim 1, wherein: Before inputting the fusion features into the pre-trained encoder for cross-scale encoding, the method further includes: Obtaining a training dataset and initializing the model parameters of the encoder on the training dataset using an attention mechanism; The goal of the initialized encoder is to minimize the mean square error of traffic prediction, and the Adam optimizer is used with an initial learning rate of 10. -3 , the encoder is initially trained with a batch size of 64 and a training cycle of 100; Freeze the underlying parameters of the encoder after initial training, train only the sparse attention layer and the cross-scale attention layer, and set the learning rate to 10 -4 , applying gradient clipping, and performing sparse fine-tuning training on the encoder after initial training for 50 training cycles; The variable selection network in the encoder after sparse fine-tuning training is deleted, and the gated residual network is optimized to obtain the pre-trained encoder.
4. The network traffic anomaly detection method according to claim 1, wherein: The output of the cross-scale attention layer in the pre-trained encoder is: Q low =H low W Q ,K high =H high W K ,V high =H high W V Among them, H out is the cross-scale encoding feature, H low is the eigenvector corresponding to the low-frequency component, H high is the eigenvector corresponding to the high frequency component, d k is the key dimension, W Q is the query projection weight matrix, W K is the key projection weight matrix, W V is the value projection weight matrix, and T is the matrix transpose.
5. The network traffic anomaly detection method according to claim 1, wherein: Performing time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, including: Performing discrete wavelet transform on the preprocessed data to obtain the low-frequency component and the high-frequency component; The formula used for performing discrete wavelet transform on the pre-processed data includes: Among them, X low is the low-frequency component, X high is the high frequency component, N is the number of time steps of the preprocessed data, ψ low is the low-frequency wavelet basis function, ψ high is the decomposition kernel function, n is the signal index of the preprocessed data, and k represents the decomposition coefficient index.
6. The network traffic anomaly detection method according to claim 3, wherein: The optimized gated residual network is: GRN(x)=x+GLU(W1x)⊙(W2x) Wherein, W1 is the first learnable parameter and W2 is the second learnable parameter, ⊙ is element-wise multiplication, x is the input feature vector of the optimized gated residual network, GLU is the gated linear unit, and GRN is the optimized gated residual network.
7. The network traffic anomaly detection method according to claim 1, wherein: The formula used to determine the reconstruction error based on the predicted flow includes: Among them, X t is the actual network traffic observation value at time step t, The predicted flow rate for time step t predicted by the encoder, is the reconstruction error; The formula used to determine the traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder includes: Among them, Score is the traffic anomaly score, α is the balance coefficient, KL(p test ||p train ) is the training relative entropy of the decoder; Among them, p train is the traffic data distribution of the decoder during the training phase, p test is the traffic data distribution of the decoder in the test phase, F is the number of binning intervals, and i is the index of the discretized traffic interval.
8. A network traffic anomaly detection system, characterized in that: The system comprises: A preprocessing module is used to obtain the network traffic data to be detected and preprocess the network traffic data to be detected to obtain preprocessed data; A feature extraction module is used to perform time series feature decomposition on the preprocessed data to obtain low-frequency components and high-frequency components, and to extract timestamp features of the preprocessed data; a cross-scale encoding module, configured to fuse the timestamp feature with the low-frequency component and the high-frequency component to obtain a fused feature, and input the fused feature into a pre-trained encoder for cross-scale encoding to obtain a cross-scale encoded feature; a traffic prediction module, configured to input the cross-scale coding features into a pre-trained decoder to perform traffic prediction, obtain predicted traffic, and determine a reconstruction error based on the predicted traffic; The traffic detection module is used to determine a traffic anomaly score based on the reconstruction error and the training relative entropy of the pre-trained decoder, and generate a network traffic anomaly detection result based on the traffic anomaly score.
9. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.