A computational method for network traffic anomaly detection based on ESN

Abstract

The present invention discloses a network traffic anomaly detection and calculation method based on ESN, which relates to the field of traffic detection technology. The method includes the following steps: constructing a causal reasoning type reserve pool: embedding a causal neuron cluster in the ESN double-loop reserve pool to obtain a causal reasoning type reserve pool; pre-detection based on causal reasoning: analyzing the reserve pool state in real time based on the causal neuron cluster; adaptive resonance threshold adjustment: calculating the characteristic resonance degree between the reserve pool state and the historical normal mode in real time; multi-scale time gating dynamic adjustment: using the multi-scale time gating mechanism to dynamically adjust the detection window width; anomaly judgment and feedback learning: judging whether the current traffic is abnormal. The present invention realizes causal reasoning modeling by embedding a causal neuron cluster in the ESN double-loop reserve pool, thereby achieving high-precision detection of network traffic anomalies, solving the problem in the prior art that a single detection window lacks causal reasoning capabilities and is difficult to take into account multi-dimensional anomaly patterns.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic detection, and in particular to an ESN-based network traffic anomaly detection and calculation method. Background Art

[0002] With the rapid development of internet technology, network traffic has experienced explosive growth and increasingly complex structures. Cybersecurity threats such as DDoS attacks, port scanning, and malicious traffic injection are becoming frequent. Traditional network traffic anomaly detection methods struggle to effectively capture the temporal dependencies, causal relationships, and multi-scale features in traffic data, resulting in delayed detection, high false positive rates, and a lack of generalization capabilities for new attack patterns.

[0003] Currently, mainstream network traffic anomaly detection technologies generally suffer from insufficient causal reasoning capabilities, poor dynamic adaptability, and incomplete capture of multi-scale features. Specifically, they can only identify surface anomalies based on the statistical laws of historical data and cannot explore the causal relationships of traffic changes; fixed thresholds or simple dynamic threshold mechanisms are difficult to adapt to fluctuations in real-time traffic patterns; a single detection window cannot take into account the detection needs of high-frequency micro-bursts and low-frequency long-term anomalies, ultimately resulting in low anomaly detection accuracy and weak early warning capabilities for attacks.

[0004] Therefore, in summary, the existing technology lacks the ability to integrate multi-dimensional feature modeling with causal reasoning, and it is difficult to achieve coordinated detection of dynamic threshold adjustment and multi-scale temporal features. Summary of the Invention

[0005] The embodiments of the present application provide an ESN-based network traffic anomaly detection calculation method, which solves the problem in the prior art of lacking the ability to integrate multi-dimensional feature modeling with causal reasoning and difficulty in achieving coordinated detection of dynamic threshold adjustment and multi-scale time features. It realizes the mining of traffic causal relationships through causal neuron clusters, dynamic adjustment of detection sensitivity through adaptive resonance thresholds, and capture of full-cycle anomaly features covered by multi-scale time gating.

[0006] The embodiment of the present application provides a network traffic anomaly detection calculation method based on ESN, comprising the following steps: constructing a causal reasoning type reserve pool: embedding a causal neuron cluster in the ESN double-loop reserve pool to obtain a causal reasoning type reserve pool;

[0007] Pre-detection based on causal reasoning: Real-time analysis of reservoir status based on causal neuron clusters;

[0008] If the forward causal node continuously outputs abnormal trend signals with a flow growth rate exceeding the set threshold, the adaptive resonance threshold adjustment unit is triggered to enter the threshold contraction state, output the detection results and issue a first-level warning;

[0009] Adaptive resonance threshold adjustment: Real-time calculation of the characteristic resonance degree between the reservoir state and the historical normal mode;

[0010] If the resonance degree drops below the preset critical value, and the backward causal node is traced back to the historical causal chain related to the attack characteristics, the threshold emergency contraction mechanism is triggered, lowering the abnormality determination threshold and issuing a second-level warning;

[0011] Multi-scale time gating dynamic adjustment: Utilize the multi-scale time gating mechanism to dynamically adjust the detection window width;

[0012] Anomaly determination and feedback learning: Based on the lowered anomaly determination threshold and the dynamic adjustment results of multi-scale time gating, determine whether the current traffic is abnormal.

[0013] Furthermore, the steps to embed causal neuron clusters in the ESN double-loop reservoir to obtain a causal reasoning reservoir are as follows:

[0014] The neurons in the ESN double-loop reservoir are divided into forward causal nodes and backward causal nodes to obtain a causal reasoning reservoir;

[0015] The forward causal node is connected to all neurons in the current layer of the causal reasoning reservoir, and the traffic growth trend in multiple time units in the future is predicted by analyzing the current neuron activation state;

[0016] The backward causal node is connected to the historical reserve pool state storage module. Through the attention mechanism, it analyzes and compares the correlation between the current state of the causal reasoning reserve pool and the historical state of multiple historical time units in the past, and generates the correlation characteristics of the current signal and the historical abnormal pattern.

[0017] Furthermore, the steps for real-time analysis of the reservoir state based on the causal neuron cluster are as follows:

[0018] The forward causal node continuously collects neuron activation data of the current layer in the reserve pool and calculates the trend of traffic growth rate changes in the last multiple time units through the sliding window algorithm;

[0019] Based on the changing trend of the flow rate growth rate, it is determined whether the reserve pool is currently in a normal fluctuation state, a continuous upward trend state, or an abnormal fluctuation state;

[0020] The flow rate growth rate calculation formula is:

[0021]

[0022] Where, For time point The traffic growth rate, For time point The flow value, for The flow value of time units ago, is the sliding window size;

[0023] If the flow rate growth rate does not exceed the pre-set normal threshold, the reserve pool is currently in a normal fluctuation state;

[0024] If the traffic growth rate continues to be higher than the historical average within the preset time, the reserve pool is currently in a continuous upward trend;

[0025] If the traffic growth rate shows non-periodic fluctuations, it satisfies:

[0026]

[0027] Where, is the standard deviation of the traffic growth rate in the current window, is the mean of the standard deviation of historical traffic growth rate, is the oscillation coefficient threshold, the reserve pool is currently in an abnormal fluctuation state;

[0028] The backward causal node inputs the activation pattern of the current reserve pool into the predefined attack feature library;

[0029] The attack feature library contains pre-feature templates of denial of service attacks and port scans, and uses a pattern matching algorithm to determine whether the current state is associated with the pre-preparation state characteristics of a certain type of attack.

[0030] Furthermore, the steps of triggering the adaptive resonance threshold adjustment unit to enter the threshold contraction state are as follows:

[0031] Obtain historical normal traffic data and calculate the average level and fluctuation range of traffic growth rate based on the historical normal traffic data;

[0032] Set the initial abnormality judgment threshold to a dynamic sensitivity value higher than the average level;

[0033] When the forward causal node prediction values ​​for multiple consecutive time units all exceed the initial abnormality judgment threshold, it is determined that there is an abnormal trend signal;

[0034] At this time, the forward causal node sends an instruction to the adaptive resonance threshold adjustment unit to lower the current abnormality judgment threshold and enter the first-level warning state.

[0035] Furthermore, the steps for calculating the characteristic resonance degree between the reserve pool state and the historical normal mode in real time are as follows:

[0036] Convert the current reservoir state into a vector containing multi-dimensional features:

[0037]

[0038] Retrieve the template vector most similar to the current feature vector from the historical normal pattern database , calculate the matching degree between the two through the similarity algorithm and obtain the resonance value :

[0039]

[0040] Where, is the vector dot product, and are the L2 norm of the vector, is the feature difference penalty coefficient, and are the current vector and the template vector respectively. eigenvalues, is a natural constant;

[0041] The larger the resonance value, the more similar the feature vector of the current reservoir state is to the template vector of the historical normal mode. The smaller the resonance value, the greater the difference between the feature vector of the current reservoir state and the template vector of the historical normal mode.

[0042] The preset critical value is a warning threshold for distinguishing normal from abnormal.

[0043] Furthermore, the steps for triggering the threshold emergency contraction mechanism are as follows:

[0044] When the resonance value drops below the preset critical value, the backward causal chain reinforcement tracing module is activated;

[0045] Performing a temporal correlation analysis on the current reserve pool activation mode and the preceding feature template in the attack feature library;

[0046] A risk score between 0 and 1 is generated based on the degree of match between the current state and historical attack patterns, time series consistency, and feature correlation strength:

[0047] If the risk score exceeds the preset risk threshold, the adaptive resonance threshold adjustment unit is triggered to execute the emergency contraction logic, adjusting the abnormality determination threshold to a preset proportion of the historical average level.

[0048] Furthermore, the steps to lower the threshold for abnormality determination and issue a secondary warning are as follows:

[0049] Lowering the initial abnormality determination threshold from a dynamic sensitivity value above the average level to a weighted combination of the historical average level and the fluctuation range, where the weighting coefficient is dynamically determined based on the risk score;

[0050] A secondary warning containing the following content is sent through the network management interface: multi-dimensional feature vector of the current abnormal traffic, matching analysis with historical attack patterns, causal chain tracing path and recommended response measures.

[0051] Furthermore, the steps for dynamically adjusting the detection window width using the multi-scale time gating mechanism are as follows:

[0052] When a continuous upward trend or a level 1 warning is detected, the detection window time range is shortened from the default period to a shorter period to analyze high-frequency traffic changes near the current time.

[0053] When the threshold emergency contraction mechanism or the second-level warning is triggered, the window width is further contracted to the minimum period and the microburst traffic capture mode is enabled;

[0054] When no warning is triggered during multiple consecutive detection cycles, the window is gradually expanded to the length of the historical traffic cycle, and low-frequency abnormal patterns are identified through long-term analysis.

[0055] Furthermore, the steps for dynamically adjusting the results based on the lowered abnormality determination threshold and multi-scale time gating are as follows:

[0056] Within the adjusted detection window, extract the real-time traffic data and the ESN model prediction value, and calculate the deviation sequence between the two;

[0057] Perform sliding window statistics on the deviation sequence, calculate the local mean and variance, and build a dynamic distribution model;

[0058] If the local statistic exceeds the lowered anomaly determination threshold, the data in the window is marked as an anomaly candidate set and enters the anomaly determination process.

[0059] Furthermore, the steps to determine whether the current traffic is abnormal are as follows:

[0060] Perform spatiotemporal feature analysis on the anomaly candidate set to verify whether the following conditions are met simultaneously:

[0061] Condition 1: The statistics of multiple consecutive windows in the time dimension exceed the limit;

[0062] Condition 2: There is a matching pre-feature template in the attack signature library in the spatial dimension;

[0063] If only a single window triggers the threshold and there is no attack feature associated, it is considered a false alarm and the feature vector is stored in the normal pattern library to update the historical template;

[0064] If it is a real anomaly, the output weight of the ESN model is fine-tuned through the gradient descent algorithm, and the connection strength matrix of the causal reasoning reserve pool is updated at the same time.

[0065] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0066] 1. By embedding causal neuron clusters in the ESN dual-loop reservoir, a reservoir model with causal reasoning capabilities is constructed, thereby achieving multi-dimensional modeling of traffic timing dependencies and causal logic, solving the problem of the lack of multi-dimensional feature modeling capabilities that integrate causal reasoning in existing technologies.

[0067] 2. By designing an adaptive resonance threshold adjustment mechanism, the anomaly judgment threshold is dynamically adjusted to match the real-time traffic pattern, thereby achieving adaptive coordination between detection sensitivity and dynamic changes in the network environment, solving the problem in existing technologies where the fixed threshold mechanism is difficult to adapt to traffic fluctuations, resulting in low detection accuracy.

[0068] 3. By introducing a multi-scale time gating mechanism, high-frequency micro-burst anomalies can be captured in a short period, and low-frequency trend anomalies can be identified in a long period, thereby achieving abnormal feature coverage of the entire time scale, solving the problem in existing technologies that a single detection window cannot take into account multi-dimensional abnormal patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flowchart of a network traffic anomaly detection calculation method based on ESN provided in an embodiment of the present application. DETAILED DESCRIPTION

[0070] The embodiments of the present application provide an ESN-based network traffic anomaly detection calculation method to address the problems of the prior art, such as the lack of causal reasoning capability, inflexible dynamic threshold adjustment, and insufficient multi-scale feature capture. By embedding causal neuron clusters in the ESN reserve pool to mine traffic causal relationships, high-precision detection of network traffic anomalies is achieved.

[0071] In order to better understand the above technical solution, the above technical solution will be described in detail below with reference to the accompanying drawings and specific implementation methods.

[0072] like Figure 1 As shown, a flow chart of a network traffic anomaly detection calculation method based on ESN provided by an embodiment of the present application, the method includes the following steps: constructing a causal reasoning type reserve pool: embedding a causal neuron cluster in the ESN double-loop reserve pool to obtain a causal reasoning type reserve pool;

[0073] Pre-detection based on causal reasoning: Real-time analysis of reservoir status based on causal neuron clusters;

[0074] If the forward causal node continuously outputs abnormal trend signals with a flow growth rate exceeding the set threshold, the adaptive resonance threshold adjustment unit is triggered to enter the threshold contraction state, output the detection results and issue a first-level warning;

[0075] Adaptive resonance threshold adjustment: Real-time calculation of the characteristic resonance degree between the reservoir state and the historical normal mode;

[0076] If the resonance degree drops below the preset critical value, and the backward causal node is traced back to the historical causal chain related to the attack characteristics, the threshold emergency contraction mechanism is triggered, lowering the abnormality determination threshold and issuing a second-level warning;

[0077] Multi-scale time gating dynamic adjustment: Utilize the multi-scale time gating mechanism to dynamically adjust the detection window width;

[0078] Anomaly determination and feedback learning: Based on the lowered anomaly determination threshold and the dynamic adjustment results of multi-scale time gating, determine whether the current traffic is abnormal.

[0079] In this embodiment, the ESN dual-loop reservoir neurons are divided into forward and backward causal nodes, endowing the model with temporal causal reasoning capabilities. The forward nodes enhance predictability of potential anomalies by forecasting future traffic trends, while the backward nodes improve the accuracy of attack tracing through historical state correlation analysis. This enables the reservoir to not only capture dynamic features but also establish causal chains of traffic changes, significantly improving detection sensitivity for covert attacks (such as low-frequency and slow attacks).

[0080] Furthermore, the steps to embed causal neuron clusters in the ESN double-loop reservoir to obtain a causal reasoning reservoir are as follows:

[0081] The neurons in the ESN double-loop reservoir are divided into forward causal nodes and backward causal nodes to obtain a causal reasoning reservoir;

[0082] The forward causal node is connected to all neurons in the current layer of the causal reasoning reservoir, and the traffic growth trend in multiple time units in the future is predicted by analyzing the current neuron activation state;

[0083] The backward causal node is connected to the historical reserve pool state storage module. Through the attention mechanism, it analyzes and compares the correlation between the current state of the causal reasoning reserve pool and the historical state of multiple historical time units in the past, and generates the correlation characteristics of the current signal and the historical abnormal pattern.

[0084] In this embodiment, the forward node quantifies the multi-dimensional changes in traffic growth rate (normal fluctuations, continuous increases, and abnormal oscillations), and combines this with the pattern matching of the attack feature library by the backward node to achieve early detection of abnormal conditions.

[0085] The sliding window algorithm and standard deviation criterion can effectively distinguish between natural traffic fluctuations and abnormal oscillations caused by attacks, reduce the false alarm rate caused by network jitter, and ensure a rapid response to sudden attacks.

[0086] Furthermore, the steps for real-time analysis of the reservoir state based on the causal neuron cluster are as follows:

[0087] The forward causal node continuously collects neuron activation data of the current layer in the reserve pool and calculates the trend of traffic growth rate changes in the last multiple time units through the sliding window algorithm;

[0088] Based on the changing trend of the flow rate growth rate, it is determined whether the reserve pool is currently in a normal fluctuation state, a continuous upward trend state, or an abnormal fluctuation state;

[0089] The flow rate growth rate calculation formula is:

[0090]

[0091] Where, For time point The traffic growth rate, For time point The flow value, for The flow value of time units ago, is the sliding window size;

[0092] If the flow rate growth rate does not exceed the pre-set normal threshold, the reserve pool is currently in a normal fluctuation state;

[0093] If the traffic growth rate continues to be higher than the historical average within the preset time, the reserve pool is currently in a continuous upward trend;

[0094] If the traffic growth rate shows non-periodic fluctuations, it satisfies:

[0095]

[0096] Where, is the standard deviation of the traffic growth rate in the current window, is the mean of the standard deviation of historical traffic growth rate, is the oscillation coefficient threshold, the reserve pool is currently in an abnormal fluctuation state;

[0097] The backward causal node inputs the activation pattern of the current reserve pool into the predefined attack feature library;

[0098] The attack signature library contains pre-signature templates for denial of service attacks and port scans, and uses a pattern matching algorithm to determine whether the current state is associated with the pre-preparation state characteristics of a certain type of attack.

[0099] In this embodiment, dynamic sensitivity thresholds are set based on historical traffic baselines to prevent fixed thresholds from becoming ineffective due to environmental changes. When a continuous abnormal trend triggers a threshold contraction, the system proactively lowers the threshold, effectively identifying early signs of covert attacks and reducing the risk of missed reports.

[0100] Furthermore, the steps of triggering the adaptive resonance threshold adjustment unit to enter the threshold contraction state are as follows:

[0101] Obtain historical normal traffic data and calculate the average level and fluctuation range of traffic growth rate based on the historical normal traffic data;

[0102] Set the initial abnormality judgment threshold to a dynamic sensitivity value higher than the average level;

[0103] When the forward causal node prediction values ​​for multiple consecutive time units all exceed the initial abnormality judgment threshold, it is determined that there is an abnormal trend signal;

[0104] At this time, the forward causal node sends an instruction to the adaptive resonance threshold adjustment unit to lower the current abnormality judgment threshold and enter the first-level warning state.

[0105] In this embodiment, feature resonance is measured using vector space similarity, incorporating multi-dimensional feature difference penalty terms (such as temporal pattern offset and frequency domain energy change) to avoid the incompleteness of a single metric. The dynamic retrieval mechanism of historical templates enables the system to adapt to gradual changes in the network environment, preventing misjudgments caused by normal pattern drift while maintaining sensitivity to sudden anomalies.

[0106] The dynamic sensitivity threshold avoids the limitations of traditional fixed thresholds in complex network environments. It can automatically adjust the detection sensitivity based on the historical performance of traffic, significantly reducing the false alarm rate while ensuring detection accuracy.

[0107] Furthermore, the steps for calculating the characteristic resonance degree between the reserve pool state and the historical normal mode in real time are as follows:

[0108] Convert the current reservoir state into a vector containing multi-dimensional features:

[0109]

[0110] Retrieve the template vector most similar to the current feature vector from the historical normal pattern database , calculate the matching degree between the two through the similarity algorithm and obtain the resonance value :

[0111]

[0112] Where, is the vector dot product, and are the L2 norm of the vector, is the feature difference penalty coefficient, and are the current vector and the template vector respectively. eigenvalues, is a natural constant;

[0113] The larger the resonance value, the more similar the feature vector of the current reservoir state is to the template vector of the historical normal mode. The smaller the resonance value, the greater the difference between the feature vector of the current reservoir state and the template vector of the historical normal mode.

[0114] The preset critical value is the alert threshold to distinguish between normal and abnormal.

[0115] In this embodiment, risk scoring integrates three factors: timing correlation, pattern matching, and feature strength, ensuring that emergency contraction is triggered only in high-risk scenarios. For example, if port probing behavior similar to that seen in the early stages of a DDoS attack is detected, along with a sudden drop in resonance, the system automatically relaxes the judgment criteria to capture subsequent minor traffic distortions. This mechanism balances detection sensitivity with computational overhead, avoiding overreaction. Compared to traditional similarity calculation methods, it more accurately reflects the degree of deviation between current traffic status and historical patterns.

[0116] Furthermore, the steps for triggering the threshold emergency contraction mechanism are as follows:

[0117] When the resonance value drops below the preset critical value, the backward causal chain reinforcement tracing module is activated;

[0118] Perform temporal correlation analysis on the current reserve pool activation pattern and the preceding feature template in the attack feature library;

[0119] A risk score between 0 and 1 is generated based on the degree of match between the current state and historical attack patterns, time series consistency, and feature correlation strength:

[0120] If the risk score exceeds the preset risk threshold, the adaptive resonance threshold adjustment unit is triggered to execute the emergency contraction logic, adjusting the abnormality determination threshold to a preset proportion of the historical average level.

[0121] In this embodiment, the threshold adjustment adopts a weighted combination strategy so that the judgment criteria change nonlinearly with the risk score: in high-risk scenarios, the upper limit of the fluctuation range is emphasized, and in low-risk scenarios, the historical mean is emphasized.

[0122] The combination of time series correlation analysis and risk scoring mechanism enables in-depth mining of attack characteristics. It can not only identify known attack patterns, but also discover potential new attack paths through causal chain tracing, thereby improving the threat intelligence capabilities of the detection system.

[0123] Furthermore, the steps to lower the threshold for abnormality determination and issue a secondary warning are as follows:

[0124] Lowering the initial anomaly determination threshold from a dynamic sensitivity value above the average level to a weighted combination of the historical average level and the fluctuation range, where the weighting factor is dynamically determined based on the risk score;

[0125] A secondary warning containing the following content is sent through the network management interface: multi-dimensional feature vector of the current abnormal traffic, matching analysis with historical attack patterns, causal chain tracing path and recommended response measures.

[0126] In this embodiment, the early warning mechanism provides detailed alarm information including multi-dimensional feature analysis, providing network administrators with a comprehensive decision-making basis. At the same time, the dynamically weighted threshold adjustment strategy ensures the optimal configuration of detection sensitivity under different risk levels.

[0127] Furthermore, the steps for dynamically adjusting the detection window width using the multi-scale time gating mechanism are as follows:

[0128] When a continuous upward trend or a level 1 warning is detected, the detection window time range is shortened from the default period to a shorter period to analyze high-frequency traffic changes near the current time.

[0129] When the threshold emergency contraction mechanism or the second-level warning is triggered, the window width is further contracted to the minimum period and the microburst traffic capture mode is enabled;

[0130] When no warning is triggered during multiple consecutive detection cycles, the window is gradually expanded to the length of the historical traffic cycle, and low-frequency abnormal patterns are identified through long-term analysis.

[0131] In this embodiment, the dynamic switching mechanism of multi-scale time windows enables the system to adaptively focus on abnormal features at different time granularities, which can not only capture instantaneous DDoS attacks but also identify long-term latent APT attacks, thus achieving anomaly detection with full time domain coverage.

[0132] The dynamic distribution model is constructed using sliding window statistics, which are more adaptable to the chaotic characteristics of traffic compared to static thresholds. For example, in bursty video traffic scenarios, local variance is automatically amplified to avoid misjudgments; during stable periods, the statistical range is tightened to improve detection accuracy. The generation of anomaly candidate sets introduces temporal continuity constraints to filter out isolated noise points.

[0133] Furthermore, the steps for dynamically adjusting the results based on the lowered abnormality determination threshold and multi-scale time gating are as follows:

[0134] Within the adjusted detection window, extract the real-time traffic data and the ESN model prediction value, and calculate the deviation sequence between the two;

[0135] Perform sliding window statistics on the deviation sequence, calculate the local mean and variance, and build a dynamic distribution model;

[0136] If the local statistic exceeds the lowered anomaly determination threshold, the data in the window is marked as an anomaly candidate set and enters the anomaly determination process.

[0137] In this embodiment, by constructing a dynamic distribution model and local statistical analysis, refined modeling of traffic data is achieved, which can effectively identify local abnormal patterns and avoid the limitations of global statistical methods in dealing with non-stationary traffic.

[0138] Furthermore, the steps to determine whether the current traffic is abnormal are as follows:

[0139] Perform spatiotemporal feature analysis on the anomaly candidate set to verify whether the following conditions are met simultaneously:

[0140] Condition 1: The statistics of multiple consecutive windows in the time dimension exceed the limit;

[0141] Condition 2: There is a matching pre-feature template in the attack signature library in the spatial dimension;

[0142] If only a single window triggers the threshold and there is no attack feature associated, it is considered a false alarm and the feature vector is stored in the normal pattern library to update the historical template;

[0143] If it is a real anomaly, the output weight of the ESN model is fine-tuned through the gradient descent algorithm, and the connection strength matrix of the causal reasoning reserve pool is updated at the same time.

[0144] In this embodiment, the spatiotemporal dual verification mechanism significantly reduces the false alarm rate. At the same time, the feedback learning mechanism enables the model to continuously optimize according to emerging traffic characteristics, forming a self-evolving intelligent detection system and ensuring long-term stability and accuracy.

[0145] The dual-conditional verification mechanism of time and space effectively defends against strategic attacks: temporal continuity prevents single-threshold probing attacks, while spatial feature matching prevents misidentification of normal business peaks. The automatic storage of false positive samples into a normal database enables the system to evolve online.

[0146] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional modules as needed, that is, the internal structure of the specific device can be divided into different functional modules to complete all or part of the functions described above.

[0147] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0148] In the several embodiments covered by this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the division of modules is merely a logical functional division, and in actual implementation, other division methods may be used, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not implemented. In addition, the coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or module, or can be an electrical, mechanical or other form of connection.

[0149] Modules described as separate components may or may not be physically separate, and components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0150] In addition, each functional module in each embodiment of the present application can be implemented in the form of hardware or in the form of software functional modules. If these functional modules are implemented in the form of software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or partly contributed to the prior art, or all or part of the technical solution can be embodied in the form of a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program product is stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. Available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)).

[0151] The above content is merely an example and explanation of the structure of the present invention. Those skilled in the art may make various modifications or additions to the described specific embodiments or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the scope of protection of the present invention.

Claims

1. A network traffic anomaly detection and calculation method based on ESN, characterized in that: The following steps are involved: Constructing a causal reasoning reservoir: embedding a causal neuron cluster into the ESN double-loop reservoir to obtain a causal reasoning reservoir; Pre-detection based on causal reasoning: Real-time analysis of reservoir status based on causal neuron clusters; If the forward causal node continuously outputs abnormal trend signals with a flow growth rate exceeding the set threshold, the adaptive resonance threshold adjustment unit is triggered to enter the threshold contraction state, output the detection results and issue a first-level warning; Adaptive resonance threshold adjustment: Real-time calculation of the characteristic resonance degree between the reservoir state and the historical normal mode; If the resonance degree drops below the preset critical value, and the backward causal node is traced back to the historical causal chain related to the attack characteristics, the threshold emergency contraction mechanism is triggered, lowering the abnormality determination threshold and issuing a second-level warning; Multi-scale time gating dynamic adjustment: Utilize the multi-scale time gating mechanism to dynamically adjust the detection window width; Abnormality determination and feedback learning: Based on the lowered abnormality determination threshold and the dynamic adjustment results of multi-scale time gating, determine whether the current traffic is abnormal.

2. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps to embed causal neuron clusters in the ESN double-loop reservoir to obtain a causal reasoning reservoir are as follows: The neurons in the ESN double-loop reservoir are divided into forward causal nodes and backward causal nodes to obtain a causal reasoning reservoir; The forward causal node is connected to all neurons in the current layer of the causal reasoning reservoir, and the traffic growth trend in multiple time units in the future is predicted by analyzing the current neuron activation state; The backward causal node is connected to the historical reserve pool state storage module. Through the attention mechanism, it analyzes and compares the correlation between the current state of the causal reasoning reserve pool and the historical state of multiple historical time units in the past, and generates the correlation characteristics of the current signal and the historical abnormal pattern.

3. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps for real-time analysis of the reservoir state based on the causal neuron cluster are as follows: The forward causal node continuously collects neuron activation data of the current layer in the reserve pool and calculates the trend of traffic growth rate changes in the last multiple time units through the sliding window algorithm; Based on the changing trend of the flow rate growth rate, it is determined whether the reserve pool is currently in a normal fluctuation state, a continuous upward trend state, or an abnormal fluctuation state; The flow rate growth rate calculation formula is: Where, For time point The traffic growth rate, For time point The flow value, for The flow value of time units ago, is the sliding window size; If the flow rate growth rate does not exceed the pre-set normal threshold, the reserve pool is currently in a normal fluctuation state; If the traffic growth rate continues to be higher than the historical average within the preset time, the reserve pool is currently in a continuous upward trend; If the traffic growth rate shows non-periodic fluctuations, it satisfies: Where, is the standard deviation of the traffic growth rate in the current window, is the mean of the standard deviation of historical traffic growth rate, is the oscillation coefficient threshold, the reserve pool is currently in an abnormal fluctuation state; The backward causal node inputs the activation pattern of the current reserve pool into the predefined attack feature library; The attack feature library contains pre-feature templates of denial of service attacks and port scans, and uses a pattern matching algorithm to determine whether the current state is associated with the pre-preparation state characteristics of a certain type of attack.

4. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps for triggering the adaptive resonance threshold adjustment unit to enter the threshold contraction state are as follows: Obtain historical normal traffic data and calculate the average level and fluctuation range of traffic growth rate based on the historical normal traffic data; Set the initial abnormality judgment threshold to a dynamic sensitivity value higher than the average level; When the forward causal node prediction values ​​for multiple consecutive time units all exceed the initial abnormality judgment threshold, it is determined that there is an abnormal trend signal; At this time, the forward causal node sends an instruction to the adaptive resonance threshold adjustment unit to lower the current abnormality judgment threshold and enter the first-level warning state.

5. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps for calculating the characteristic resonance degree between the reserve pool state and the historical normal mode in real time are as follows: Convert the current reservoir state into a vector containing multi-dimensional features: Retrieve the template vector most similar to the current feature vector from the historical normal pattern database , calculate the matching degree between the two through the similarity algorithm and obtain the resonance value : Where, is the vector dot product, and are the L2 norm of the vector, is the feature difference penalty coefficient, and are the current vector and the template vector respectively. eigenvalues, is a natural constant; The larger the resonance value, the more similar the feature vector of the current reservoir state is to the template vector of the historical normal mode. The smaller the resonance value, the greater the difference between the feature vector of the current reservoir state and the template vector of the historical normal mode. The preset critical value is a warning threshold for distinguishing normal from abnormal.

6. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps to trigger the threshold emergency contraction mechanism are as follows: When the resonance value drops below the preset critical value, the backward causal chain reinforcement tracing module is activated; Performing a temporal correlation analysis on the current reserve pool activation mode and the preceding feature template in the attack feature library; A risk score between 0 and 1 is generated based on the degree of match between the current state and historical attack patterns, time series consistency, and feature correlation strength: If the risk score exceeds the preset risk threshold, the adaptive resonance threshold adjustment unit is triggered to execute the emergency contraction logic, adjusting the abnormality determination threshold to a preset proportion of the historical average level.

7. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps to lower the anomaly determination threshold and issue a secondary warning are as follows: Lowering the initial anomaly determination threshold from a dynamic sensitivity value above the average level to a weighted combination of the historical average level and the fluctuation range, where the weighting factor is dynamically determined based on the risk score; A secondary warning containing the following content is sent through the network management interface: multi-dimensional feature vector of the current abnormal traffic, matching analysis with historical attack patterns, causal chain tracing path and recommended response measures.

8. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps to dynamically adjust the detection window width using the multi-scale time gating mechanism are as follows: When a continuous upward trend or a level 1 warning is detected, the detection window time range is shortened from the default period to a shorter period to analyze high-frequency traffic changes near the current time. When the threshold emergency contraction mechanism or the second-level warning is triggered, the window width is further contracted to the minimum period and the microburst traffic capture mode is enabled; When no warning is triggered during multiple consecutive detection cycles, the window is gradually expanded to the length of the historical traffic cycle, and low-frequency abnormal patterns are identified through long-term analysis.

9. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps for dynamically adjusting the results based on the lowered anomaly threshold and multi-scale time gating are as follows: Within the adjusted detection window, extract the real-time traffic data and the ESN model prediction value, and calculate the deviation sequence between the two; Perform sliding window statistics on the deviation sequence, calculate the local mean and variance, and build a dynamic distribution model; If the local statistic exceeds the lowered anomaly determination threshold, the data in the window is marked as an anomaly candidate set and enters the anomaly determination process.

10. The ESN-based network traffic anomaly detection and calculation method according to claim 1, characterized in that: The steps to determine whether the current traffic is abnormal are as follows: Perform spatiotemporal feature analysis on the anomaly candidate set to verify whether the following conditions are met simultaneously: Condition 1: The statistics of multiple consecutive windows in the time dimension exceed the limit; Condition 2: There is a matching pre-feature template in the attack signature library in the spatial dimension; If only a single window triggers the threshold and there is no attack feature associated, it is considered a false alarm and the feature vector is stored in the normal pattern library to update the historical template; If it is a real anomaly, the output weight of the ESN model is fine-tuned through the gradient descent algorithm, and the connection strength matrix of the causal reasoning reserve pool is updated at the same time.

Images