Network traffic prediction method based on decoupling dynamic space-time diagram neural network D2STGNN

Abstract

The invention discloses a network flow prediction method based on a decoupling dynamic space-time diagram neural network D2STGNN. The method comprises the following steps: constructing a network flow data processing and representing module, and collecting and preprocessing flow data; then, a prediction model is constructed based on D2STGNN, a space-time framework is decoupled to decompose a network traffic space-time signal into a node-traffic association signal and a network-traffic time trend signal, and by means of a space-time local convolution layer, a gating circulation unit and a multi-head self-attention layer, an inter-node association process and a capture time sequence dependency relationship are respectively modeled; and meanwhile, a time attenuation mechanism is introduced, and the real-time dynamic capturing capability of the model on the network flow is enhanced in combination with adaptive attenuation parameter adjustment and a layered attenuation mechanism. And finally, predicting real-time network flow data by using the trained model, and evaluating a prediction effect through related evaluation indexes. According to the method, the change trend of the network flow can be efficiently and accurately predicted, and powerful support is provided for reasonable distribution of network resources, network performance optimization and the like.

Description

Technical Field

[0001] The present invention provides a method based on a decoupled dynamic spatiotemporal graph neural network D 2 The network traffic prediction method of STGNN belongs to the field of artificial intelligence network security and deep reinforcement learning. Background Art

[0002] With the rapid development of information technology, networks have become deeply integrated into every aspect of our lives, work, and social operations. From everyday smart devices to complex enterprise business systems and the large-scale networks that support critical social infrastructure, the widespread use of networks, while bringing immense convenience, also presents an increasingly complex network landscape. Accurately predicting network traffic trends is crucial for ensuring stable network operation and rationally allocating network resources.

[0003] At present, traditional network traffic prediction methods have many limitations. For example, some methods based on statistical models are difficult to adapt to the dynamic changes in network traffic; and rule-based methods have poor prediction accuracy and flexibility when facing complex network environments. In recent years, deep learning technology has achieved remarkable results in many fields such as image recognition and speech processing with its powerful feature learning and pattern recognition capabilities, and has gradually been widely used in the field of network traffic prediction. Graph Neural Network (GNN), as an important branch of deep learning, can directly process graph structured data and effectively mine the complex relationships between nodes in the data. Network traffic data naturally has graph structure characteristics. Nodes can represent devices or users in the network, and edges represent the connection relationship between them. The attributes of the edges can include information such as traffic size and connection time. Decoupled Dynamic Spatiotemporal Graph Neural Network (D 2 STGNN) is an improvement on the traditional graph neural network. It combines dynamic GNN and two-stage learning mechanism to better process complex time series data and graph structure data. In the fields of traffic flow forecasting, financial market trend analysis, etc., D 2 STGNN has shown better performance than traditional models. 2 The application of STGNN in the field of network traffic prediction is expected to build a more accurate and efficient network traffic prediction model and improve the ability to predict network traffic changes. Summary of the Invention

[0004] The present invention aims to propose a method based on D 2 The network traffic prediction method of STGNN is to build a specific prediction model and use D 2 STGNN deeply mines the spatiotemporal characteristics of network traffic data to achieve efficient and accurate prediction of network traffic.

[0005] The technical solution adopted by the present invention is as follows: a decoupled dynamic spatiotemporal graph neural network D 2 STGNN network traffic prediction method:

[0006] Step 1: Build a network traffic data processing and representation module;

[0007] 1.1 Data Collection:

[0008] Collect network traffic data from various nodes in the network, including:

[0009] Basic identification: source IP address, destination IP address, source MAC address, destination MAC address, port number, protocol type (TCP / UDP / ICMP);

[0010] Traffic characteristics: traffic size (number of bytes), number of packets, packet length distribution, connection duration, TOS field;

[0011] Time and status: timestamp, TCP flags (SYN / ACK / FIN), application layer protocol type (HTTP / DNS).

[0012] 1.2 Data cleaning:

[0013] Clean the collected data to remove noise data, duplicate data and abnormal data.

[0014] 1.3 Data preprocessing:

[0015] The cleaned data is subjected to feature engineering to extract features related to network traffic changes. The network traffic data is constructed into a graph structure, where nodes represent hosts or devices in the network, edges represent network connections between hosts, edge attributes represent relevant features of the connection, and timestamp information is used to reflect the time series characteristics of the data.

[0016] When calculating the similarity or correlation between nodes, the cosine similarity formula is used to measure the similarity between the network traffic feature vectors of two nodes. Assume that the traffic feature vectors of node i and node j are and Then the cosine similarity sim(i,j) between them is:

[0017]

[0018] By calculating the ratio of the dot product of two vectors to the product of their modulo lengths, a value between -1 and 1 is obtained. The closer the value is to 1, the more similar the traffic characteristics of the two nodes are. When constructing the graph structure, stronger connections are set between nodes with high similarity, that is, larger edge weights, for subsequent D 2The STGNN model captures the relationship between nodes.

[0019] Step 2: Based on D 2 STGNN builds a network traffic prediction model;

[0020] 2.1: Building the model: Based on D 2 The STGNN detection model architecture is designed with a decoupled spatiotemporal framework as its core, decomposing the input spatiotemporal network traffic signals into node association signals and network trend signals. In the node association model, the spatiotemporal local convolutional layer is used to accurately model the association process between nodes, capturing the connection relationship between hosts and the traffic interaction pattern. In the network trend model, the gated recurrent unit (GRU) and multi-head self-attention layer are combined to capture the short-term and long-term dependencies of the time series and analyze the changing trends of network traffic over time.

[0021] Considering the dynamic nature of network traffic data, a time decay mechanism is introduced to assign different weights to historical data based on the data timestamp, highlighting the importance of recent data in model learning;

[0022] Using the exponential decay function, assuming that the time step of network traffic data is t, the decay weight ω t The calculation formula is:

[0023] ω t =e -λt #(2)

[0024] Among them, λ is the attenuation coefficient, which is used to control the attenuation speed, t represents the time step of the data from the current time, as t increases, ω t The value of gradually decreases, that is, the weight of historical data gradually decreases. To make the attenuation mechanism more adaptable, the formula is further improved, and an adaptive attenuation parameter adjustment mechanism is introduced to dynamically adjust the attenuation coefficient in combination with the fluctuation of network traffic. The improved formula is:

[0025]

[0026] Among them, λ0 is the basic attenuation coefficient, k is the adjustment factor, σ t is the flow fluctuation rate at the current time step, is the historical average traffic volatility. When traffic fluctuates significantly, the decay rate accelerates, highlighting the importance of recent data; conversely, the decay rate slows down, preserving the influence of historical data.

[0027] When decoupling the spatiotemporal framework, it is assumed that the input spatiotemporal signal of network traffic is Among them S h represents the number of network traffic signals at each past time step considered, N is the number of network nodes, C represents the feature dimension, and the decoupling process is expressed as:

[0028] X=X nfa +X nft

[0029] Among them, X nfa and X nft They correspond to node traffic correlation signals and network traffic time trend signals respectively. Through this decoupling method, the correlation effect between hosts and the overall trend change of the network can be captured respectively. In the decoupling process, the residual decomposition mechanism is used to achieve signal separation. Taking the decoupling of node correlation signals as an example, the proportion of node correlation signals in the time series is first determined by the estimation gate. The operation of the estimation gate involves multiple formulas:

[0030]

[0031] H′=H+MultiheadAttention(Q=H,K=H,V=H)#(5)

[0032] Λ t，i =Sigmoid(H′W2)#(6)

[0033] X nfa =Λ⊙X#(7)

[0034] in, and is the time slot embedding matrix, which represents the embedding information of different time slots in a day and different days in a week respectively; and is the node embedding matrix, which is used to represent the embedding of source and target nodes; W1 and W2 are learnable parameters; σ is the activation function; ∥ represents the connection operation; ⊙ represents element-by-element multiplication. Through these formulas, the appropriate gate value is automatically learned and determined according to the current node and time embedding situation, thus optimizing the decoupling process.

[0035] The residual decomposition mechanism decomposes the network traffic signal by removing the parts that have been learned by the network trend block and the node association block in an information reconstruction manner. Each decoupled spatiotemporal layer includes a node association block and a network trend block in addition to a decoupling block, and each block consists of three parts: one from the input data Learn knowledge and generate hidden states The main model, a module for generating hidden states The prediction branch and the input signal used to generate the module The best estimated backtracking branch; the backtracking branch plays a key role in the decoupling process. The backtracking branch reconstructs the signal that has been accurately learned by the model, that is, the learned node association signal In this way, backtracking branches help isolate the parts that can be accurately represented by the model;

[0036]

[0037] where X l is the input of the (l)th layer, the superscripts nft and nfa represent the network-traffic time trend signal and the node-traffic association signal, and a nonlinear fully connected network is used to implement the backtracking branch. is the network parameter, σ is the GeLU activation function;

[0038] The first residual connection removes the well-approximated signals from the input signal and retains only the signals that have not been fully decomposed. After the processing of the first residual connection, the input information of the network trend module, that is, the network trend signal, can be obtained. The improved formula of the first residual connection is:

[0039]

[0040] The adaptive weight adjustment SE module, GELU activation function and Dropout layer are introduced to enhance the expressiveness and flexibility of the model. A second residual link is performed after the network trend block to further remove the signals that have been captured by the network trend module and only retain those residual signals that cannot be completely decomposed. The residual signal will continue to be processed in the next layer to ensure that all complex patterns can be captured by the model. The formula for the second residual connection is:

[0041]

[0042] in The residual signal that cannot be decomposed in the lth layer is retained, and a layered attenuation mechanism is added before the residual signal enters the next decoupled spatiotemporal layer to reflect the real-time dynamics of the network. That is, the attenuation of the l+1 layer is based on the residual signal of the previous layer. The attenuation parameter λ is dynamically adjusted. l+1 The formula for rate attenuation is as follows:

[0043]

[0044] Where α is a learnable scalar parameter of the layered attenuation mechanism, AvgPool is an average pooling operation used to extract feature strength, and the attenuation weight of the l+1 layer is:

[0045]

[0046] The attenuated data passed to the next layer is represented as:

[0047]

[0048] Through the above operations, appropriate models are designed according to the specific characteristics of node association signals and network trend signals, and each model focuses on its specific signal, so that the spatiotemporal signals are decoupled;

[0049] In the node association model, a spatiotemporal local convolutional layer is used to model the influence process between nodes; assuming that only the past k t k time steps s The network traffic signals of the order-neighboring nodes can affect a target node, and the spatiotemporal localized transfer matrix is ​​defined as:

[0050]

[0051] Among them, P k ∈R N×N is a k-order transfer matrix, k=1,…,k s , since information propagation has forward and backward bidirectionality, the forward transfer matrix and the backward transfer matrix are calculated separately:

[0052]

[0053] A is the adjacency matrix of the network flow graph, rowsum(A) represents the sum of the rows of matrix A, corresponding to the spatiotemporal localized transfer matrix, with a local feature matrix

[0054]

[0055] Where W k is the convolution weight of the node association model, σ is the GeLU activation function, based on the above transfer matrix and feature matrix, the spatial kernel size k is defined s The spatiotemporal local graph convolution operator is:

[0056]

[0057] in is the output of the local graph convolution operator at time step t, which takes into account the s The spatial information of the order neighbors, W k is the k-th order graph convolution parameter, is the hidden state at the subsequent time step;

[0058] In addition to the transfer matrix P f and P b , using an adaptive transfer matrix and the transfer matrix P made by prior knowledge f and P b Differently, the adaptive transfer matrix is ​​composed of two randomly initialized node embedding dictionaries E with learnable parameters. u ∈R N×d and Ed ∈R N×d Optimized:

[0059]

[0060] Among them, P apt ∈R N×N Normalized by the Softmax function, describing the transfer matrix P f and P b Similar influence process; matrix P apt As the transfer matrix P based on the influence network f and P b Supplementation of hidden influence processes omitted in the

[0061] Given three transfer matrices P f and P b and P apt , and obtain their corresponding spatiotemporal localized transfer matrices in formula 14 and And based on the operation in formula 18, the local convolution layer is given as follows:

[0062]

[0063] Given a time kernel size k t , spatial kernel size k s and input The local convolutional layer generates a hidden state sequence H by synchronously modeling the spatiotemporal correlation at each time step t scl :

[0064]

[0065] Where Θ represents all the parameters mentioned in Formula 17, Formula 19, and Formula 20, G represents the spatiotemporal local convolution in Formula 20, and the output hidden state sequence H nfa It is further used to generate two outputs, namely, the backtracking output and the prediction output;

[0066] Prediction branch: last hidden state Used to predict the value of the next step. In order to predict the hidden state in the multi-step prediction task, the autoregressive process is followed. The formula is as follows:

[0067]

[0068] Each of these values ​​is used by a nonlinear regression neural network to predict the specific value of interest;

[0069] Backtracking branch: Use nonlinear fully connected network to implement backtracking branch and generate That is, the learned node-flow correlation signal part is then removed from the original signal through the residual link in Formula 8 to achieve decomposition;

[0070] The network trend model is a hidden intrinsic time series in the original signal of each node, namely X nft For modeling, dependencies in time series are usually divided into local dependencies and global dependencies, called short-term dependencies and long-term dependencies; GRU and multi-head self-attention layers are used together to fully capture temporal patterns;

[0071] GRU can repeatedly save the hidden state of historical data and control the information flowing to the next time step. The network trend block at a given time step t For each node i, the following GRU operation is used:

[0072]

[0073] in is the updated hidden state of node i at time step t, ⊙ represents the element-wise product, W z ,W r ,W h ,U z ,U r and U h is the learnable parameter of GRU;

[0074] GRU is able to capture short-term sequence information. Since network traffic prediction is also affected by long-term dependencies, a multi-head self-attention layer is introduced to capture the global dependencies at the top of GRU. Given the output of GRU The multi-head self-attention layer performs pairwise dot product attention on the time dimension of each node, that is, the product is calculated between any two signals in different time slots; considering the attention head s, the item matrix W can be learned s Q , W s K , W s V ∈R d×d , and the output matrix W O , the attention function of node i is written as:

[0075]

[0076] in is the feature of node i in all time slots, and all nodes are calculated separately in parallel with the help of GRU; the network trend model H is obtained nft ∈R S×N×dThe hidden state of ; the self-attention layer has an infinite receptive field and ignores the relative position in the sequence. In order to consider the position, position encoding is applied between the GRU and the multi-head attention layer as shown below:

[0077]

[0078] where e t ∈R d is the position embedding at time step t;

[0079] Prediction branch: Here, autoregression is still used to generate future hidden states;

[0080]

[0081] Backtracking branch: Same as the node flow association block, a nonlinear fully connected network is used to implement the backtracking branch and generate The formula is as follows:

[0082]

[0083] That is, the learned network trend signal part;

[0084] This model uses a dynamic graph learning model to capture the dynamics of spatial dependencies. This is because the influence strength between two connected nodes changes dynamically over time, so the dynamic transfer matrix and Modeling is performed to enhance the static transfer matrix P by replacing them in Equation 20 and Equation 14 b and P f ;

[0085] right and The core of modeling is to ensure that the static, dynamic and temporal information in the data is fully encoded. For a given time step t, historical observations are used as dynamic features; given historical data The dynamic information of channel c can be formulated as X c =X[:,:,c] T ∈R N×T , where c = 1,…,d, considering time embedding and Estimate the embedding used in the gate, using two static node embedding matrices E u ∈R N×d and E d ∈R N×d , and obtain two dynamic feature matrices:

[0086]

[0087] here FC(·) is a nonlinear two-layer fully connected network that extracts features and transforms the dimension from N×dT to N×d. In addition, Concat(·) represents a broadcast cascade and uses an attention mechanism to calculate pairwise masks to obtain a dynamic graph:

[0088]

[0089] W Q and W K are the parameters of the self-attention mechanism, the matrix and The model can be enhanced by replacing the transfer matrix in Equation 20 and Equation 14;

[0090] Assuming that the model stacks L layers of decoupled spatiotemporal layers, the output hidden state contains the prediction branches of the node traffic association block and the network trend block at each layer.

[0091]

[0092] Then a two-layer fully connected network is used as a regression layer and applied to H to generate preliminary predictions. The output of the regression layer at each time step is concatenated to form the predicted output: The formula is:

[0093]

[0094] 2.2: Training model: Prepare training data set, divide the pre-processed network traffic data into training set and test set in proportion; in the training set, mark the samples with specific traffic patterns and normal network traffic samples; use the training set to train D 2 The STGNN model is trained and uses the back-propagation algorithm to optimize the model parameters, allowing the model to learn the characteristic patterns of different traffic patterns and normal network traffic;

[0095] During training, use a suitable optimizer and set reasonable hyperparameters for learning rate, number of iterations, batch size, weight decay coefficient, momentum parameter, learning rate decay strategy, dropout rate, number of decoupled spatiotemporal layers, and hidden layer dimension.

[0096] In training D 2 When using the STGNN model, the cross entropy loss function is used to measure the difference between the model prediction results and the true label, and the model parameters are adjusted by optimizing the loss function. Assuming that the model's prediction output is The true label is y, and the calculation formula of the cross entropy loss function L is:

[0097]

[0098] Where n is the number of samples. In actual training, the gradient of the loss function with respect to the model parameters is calculated through the backpropagation algorithm, and the parameters are updated using the Adam optimizer. The formula for updating the parameter θ of the Adam optimizer is:

[0099]

[0100] Where η is the learning rate, m t and v t are the first-order moment estimate and the second-order moment estimate of the gradient, respectively. ∈ is a small constant used to prevent the denominator from being zero. During the training process, the parameters are continuously updated iteratively until the loss function converges or other set stopping conditions are met.

[0101] Step 3: Use the trained model to predict network traffic and evaluate the results.

[0102] Real-time detection: After being processed by the data processing and representation module, the real-time collected network traffic data is input into the trained D2STGNN model. The model predicts the changing trend of the current network traffic based on the learned feature patterns. If the deviation between the model output and the normal traffic pattern exceeds the set threshold, it is determined that the network traffic may have abnormal changes; otherwise, the network traffic is considered to be within the normal range.

[0103] Result evaluation: The prediction performance of the model was evaluated using the test set, using the mean square error (MSE), mean absolute error (MAE), and coefficient of determination (R). 2 The indicators measure the prediction effect of the model; the mean square error represents the average of the square of the error between the predicted value and the true value, the mean absolute error represents the average of the absolute error between the predicted value and the true value, and the coefficient of determination measures the degree of fit of the model to the data; by analyzing the evaluation results, the model parameters and structure are continuously optimized to improve the prediction performance of the model.

[0104] The calculation formula for mean square error (MSE) is:

[0105]

[0106] Among them, y i is the true value, is the predicted value, and n is the number of samples. The smaller the mean square error, the more accurate the model's prediction.

[0107] The calculation formula for the mean absolute error MAE is:

[0108]

[0109] The mean absolute error directly reflects the average deviation between the predicted value and the true value;

[0110] Coefficient of determination R 2 The calculation formula is:

[0111]

[0112] in, is the mean of the true values, R 2 The value range of is between (-∞,1], and the closer it is to 1, the better the model fits the data;

[0113] If the evaluation results show that the model performs poorly on certain indicators, optimize the model parameters and structure through various methods: If the mean square error or mean absolute error is large, adjust the model's hyperparameters, increase the number of convolutional layers in the node association model or network trend model, and adjust the hidden layer size of the GRU unit; if the determination coefficient is low, increase the amount of training data so that the model can learn more traffic characteristics under different situations, or optimize the feature engineering of the network traffic data to extract more representative features.

[0114] The beneficial effects of the present invention are:

[0115] 1. By leveraging a decoupled spatiotemporal framework, network traffic spatiotemporal signals are decomposed into node-traffic correlation signals and network-traffic time trend signals, respectively accurately capturing the correlation effects between hosts and overall network trend changes, thereby improving prediction accuracy. 2. The introduction of a time decay mechanism, combined with adaptive decay parameter adjustment and a layered decay mechanism, can enhance the model's ability to capture the real-time dynamics of network traffic, making predictions more aligned with actual traffic changes. 3. The integration of structures such as spatiotemporal local convolutional layers, gated recurrent units, and multi-head self-attention layers can effectively model the correlation process between nodes, capture time series dependencies, and improve the model's ability to learn complex traffic patterns. 4. It can efficiently and accurately predict network traffic change trends, providing strong support for the rational allocation of network resources, network performance optimization, network anomaly detection, and ensuring stable network operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0116] Figure 1 This is the overall architecture diagram of the model;

[0117] Figure 2 D 2 Diagram of the training process of the STGNN model. DETAILED DESCRIPTION

[0118] A decoupled dynamic spatiotemporal graph neural network D 2 STGNN network traffic prediction method:

[0119] Step 1: Build a network traffic data processing and representation module;

[0120] 1.1 Data Collection:

[0121] Collect network traffic data from various nodes in the network, including:

[0122] Basic identification: source IP address, destination IP address, source MAC address, destination MAC address, port number, protocol type (TCP / UDP / ICMP);

[0123] Traffic characteristics: traffic size (number of bytes), number of packets, packet length distribution, connection duration, TOS field;

[0124] Time and status: timestamp, TCP flags (SYN / ACK / FIN), application layer protocol type (HTTP / DNS).

[0125] 1.2 Data cleaning:

[0126] Clean the collected data to remove noise data, duplicate data and abnormal data.

[0127] 1.3 Data preprocessing:

[0128] The cleaned data is subjected to feature engineering to extract features related to network traffic changes. The network traffic data is constructed into a graph structure, where nodes represent hosts or devices in the network, edges represent network connections between hosts, edge attributes represent relevant features of the connection, and timestamp information is used to reflect the time series characteristics of the data.

[0129] When calculating the similarity or correlation between nodes, the cosine similarity formula is used to measure the similarity between the network traffic feature vectors of two nodes. Assume that the traffic feature vectors of node i and node j are and Then the cosine similarity sim(i,j) between them is:

[0130]

[0131] By calculating the ratio of the dot product of two vectors to the product of their modulo lengths, a value between -1 and 1 is obtained. The closer the value is to 1, the more similar the traffic characteristics of the two nodes are. When constructing the graph structure, stronger connections are set between nodes with high similarity, that is, larger edge weights, for subsequent D 2 The STGNN model captures the relationship between nodes.

[0132] Step 2: Based on D 2 STGNN builds a network traffic prediction model;

[0133] 2.1: Building the model: Based on D 2The STGNN detection model architecture is designed with a decoupled spatiotemporal framework as its core, decomposing the input spatiotemporal network traffic signals into node association signals and network trend signals. In the node association model, the spatiotemporal local convolutional layer is used to accurately model the association process between nodes, capturing the connection relationship between hosts and the traffic interaction pattern. In the network trend model, the gated recurrent unit (GRU) and multi-head self-attention layer are combined to capture the short-term and long-term dependencies of the time series and analyze the changing trends of network traffic over time.

[0134] Considering the dynamic nature of network traffic data, a time decay mechanism is introduced to assign different weights to historical data based on the data timestamp, highlighting the importance of recent data in model learning;

[0135] Using the exponential decay function, assuming that the time step of network traffic data is t, the decay weight ω t The calculation formula is:

[0136] ω t =e -λt #(2)

[0137] Among them, λ is the attenuation coefficient, which is used to control the attenuation speed, t represents the time step of the data from the current time, as t increases, ω t The value of gradually decreases, that is, the weight of historical data gradually decreases. To make the attenuation mechanism more adaptable, the formula is further improved, and an adaptive attenuation parameter adjustment mechanism is introduced to dynamically adjust the attenuation coefficient in combination with the fluctuation of network traffic. The improved formula is:

[0138]

[0139] Among them, λ0 is the basic attenuation coefficient, k is the adjustment factor, σ t is the flow fluctuation rate at the current time step, is the historical average traffic volatility. When traffic fluctuates significantly, the decay rate accelerates, highlighting the importance of recent data; conversely, the decay rate slows down, preserving the influence of historical data.

[0140] When decoupling the spatiotemporal framework, it is assumed that the input spatiotemporal signal of network traffic is Among them S h represents the number of network traffic signals at each past time step considered, N is the number of network nodes, C represents the feature dimension, and the decoupling process is expressed as:

[0141] X=X nfa +X nft

[0142] Among them, X nfa and X nftThey correspond to node traffic correlation signals and network traffic time trend signals respectively. Through this decoupling method, the correlation effect between hosts and the overall trend change of the network can be captured respectively. In the decoupling process, the residual decomposition mechanism is used to achieve signal separation. Taking the decoupling of node correlation signals as an example, the proportion of node correlation signals in the time series is first determined by the estimation gate. The operation of the estimation gate involves multiple formulas:

[0143]

[0144] H′=H+MultiheadAttention(Q=H,K=H,V=H)#(5)

[0145] Λ t，i =Sigmoid(H′W2)#(6)

[0146] X nfa =Λ⊙X#(7)

[0147] in, and is the time slot embedding matrix, which represents the embedding information of different time slots in a day and different days in a week respectively; and is the node embedding matrix, which is used to represent the embedding of source and target nodes; W1 and W2 are learnable parameters; σ is the activation function; ∥ represents the connection operation; ⊙ represents element-by-element multiplication. Through these formulas, the appropriate gate value is automatically learned and determined according to the current node and time embedding situation, thus optimizing the decoupling process.

[0148] The residual decomposition mechanism decomposes the network traffic signal by removing the parts that have been learned by the network trend block and the node association block in an information reconstruction manner. Each decoupled spatiotemporal layer includes a node association block and a network trend block in addition to a decoupling block, and each block consists of three parts: one from the input data Learn knowledge and generate hidden states The main model, a module for generating hidden states The prediction branch and the input signal used to generate the module The best estimated backtracking branch; the backtracking branch plays a key role in the decoupling process. The backtracking branch reconstructs the signal that has been accurately learned by the model, that is, the learned node association signal In this way, backtracking branches help isolate the parts that can be accurately represented by the model;

[0149]

[0150] where X lis the input of the (l)th layer, the superscripts nft and nfa represent the network-traffic time trend signal and the node-traffic association signal, and a nonlinear fully connected network is used to implement the backtracking branch. is the network parameter, σ is the GeLU activation function;

[0151] The first residual connection removes the well-approximated signals from the input signal and retains only the signals that have not been fully decomposed. After the processing of the first residual connection, the input information of the network trend module, that is, the network trend signal, can be obtained. The improved formula of the first residual connection is:

[0152]

[0153] The adaptive weight adjustment SE module, GELU activation function and Dropout layer are introduced to enhance the expressiveness and flexibility of the model. A second residual link is performed after the network trend block to further remove the signals that have been captured by the network trend module and only retain those residual signals that cannot be completely decomposed. The residual signal will continue to be processed in the next layer to ensure that all complex patterns can be captured by the model. The formula for the second residual connection is:

[0154]

[0155] in The residual signal that cannot be decomposed in the lth layer is retained, and a layered attenuation mechanism is added before the residual signal enters the next decoupled spatiotemporal layer to reflect the real-time dynamics of the network. That is, the attenuation of the l+1 layer is based on the residual signal of the previous layer. The attenuation parameter λ is dynamically adjusted. l+1 The formula for rate attenuation is as follows:

[0156]

[0157] Where α is a learnable scalar parameter of the layered attenuation mechanism, AvgPool is an average pooling operation used to extract feature strength, and the attenuation weight of the l+1 layer is:

[0158]

[0159] The attenuated data passed to the next layer is represented as:

[0160]

[0161] Through the above operations, appropriate models are designed according to the specific characteristics of node association signals and network trend signals, and each model focuses on its specific signal, so that the spatiotemporal signals are decoupled;

[0162] In the node association model, a spatiotemporal local convolutional layer is used to model the influence process between nodes; assuming that only the past k t k time steps s The network traffic signals of the order-neighboring nodes can affect a target node, and the spatiotemporal localized transfer matrix is ​​defined as:

[0163]

[0164] Among them, P k ∈R N×N is a k-order transfer matrix, k=1,…,k s , since information propagation has forward and backward bidirectionality, the forward transfer matrix and the backward transfer matrix are calculated separately:

[0165]

[0166] A is the adjacency matrix of the network flow graph, rowsum(A) represents the sum of the rows of matrix A, corresponding to the spatiotemporal localized transfer matrix, with a local feature matrix

[0167]

[0168] Where W k is the convolution weight of the node association model, σ is the GeLU activation function, based on the above transfer matrix and feature matrix, the spatial kernel size k is defined s The spatiotemporal local graph convolution operator is:

[0169]

[0170] in is the output of the local graph convolution operator at time step t, which takes into account the s The spatial information of the order neighbors, W k is the k-th order graph convolution parameter, is the hidden state at the subsequent time step;

[0171] In addition to the transfer matrix P f and P b , using an adaptive transfer matrix and the transfer matrix P made by prior knowledge f and P b Differently, the adaptive transfer matrix is ​​composed of two randomly initialized node embedding dictionaries E with learnable parameters. u ∈R N×d and E d ∈R N×d Optimized:

[0172]

[0173] Among them, P apt ∈R N×N It is normalized by Sotmax function and describes the transfer matrix P f and P b Similar influence process; matrix P apt As the transfer matrix P based on the influence network f and P b Supplementation of hidden influence processes omitted in the

[0174] Given three transfer matrices P f and P b and P apt , and obtain their corresponding spatiotemporal localized transfer matrices in formula 14 and And based on the operation in formula 18, the local convolution layer is given as follows:

[0175]

[0176] Given a time kernel size k t , spatial kernel size k s and input The local convolutional layer generates a hidden state sequence H by synchronously modeling the spatiotemporal correlation at each time step t scl :

[0177]

[0178] Where Θ represents all the parameters mentioned in Formula 17, Formula 19, and Formula 20, G represents the spatiotemporal local convolution in Formula 20, and the output hidden state sequence H nfa It is further used to generate two outputs, namely, the backtracking output and the prediction output;

[0179] Prediction branch: last hidden state Used to predict the value of the next step. In order to predict the hidden state in the multi-step prediction task, the autoregressive process is followed. The formula is as follows:

[0180]

[0181] Each of these values ​​is used by a nonlinear regression neural network to predict the specific value of interest;

[0182] Backtracking branch: Use nonlinear fully connected network to implement backtracking branch and generate That is, the learned node-flow correlation signal part is then removed from the original signal through the residual link in Formula 8 to achieve decomposition;

[0183] The network trend model is a hidden intrinsic time series in the original signal of each node, namely Xnft For modeling, dependencies in time series are usually divided into local dependencies and global dependencies, called short-term dependencies and long-term dependencies; GRU and multi-head self-attention layers are used together to fully capture temporal patterns;

[0184] GRU can repeatedly save the hidden state of historical data and control the information flowing to the next time step. The network trend block at a given time step t For each node i, the following GRU operation is used:

[0185]

[0186] in is the updated hidden state of node i at time step t, ⊙ represents the element-wise product, W z ,W r ,W h ,U z ,U r and U h is the learnable parameter of GRU;

[0187] GRU is able to capture short-term sequence information. Since network traffic prediction is also affected by long-term dependencies, a multi-head self-attention layer is introduced to capture the global dependencies at the top of GRU. Given the output of GRU The multi-head self-attention layer performs pairwise dot product attention on the time dimension of each node, that is, the product is calculated between any two signals in different time slots; considering the attention head s, the item matrix can be learned And the output matrix W O , the attention function of node i is written as:

[0188]

[0189] in is the feature of node i in all time slots, and all nodes are calculated separately in parallel with the help of GRU; the network trend model H is obtained nft ∈R S×N×d The hidden state of ; the self-attention layer has an infinite receptive field and ignores the relative position in the sequence. In order to consider the position, position encoding is applied between the GRU and the multi-head attention layer as shown below:

[0190]

[0191] where e t ∈R d is the position embedding at time step t;

[0192] Prediction branch: Here, autoregression is still used to generate future hidden states;

[0193]

[0194] Backtracking branch: Same as the node flow association block, a nonlinear fully connected network is used to implement the backtracking branch and generate The formula is as follows:

[0195]

[0196] That is, the learned network trend signal part;

[0197] This model uses a dynamic graph learning model to capture the dynamics of spatial dependencies. This is because the influence strength between two connected nodes changes dynamically over time, so the dynamic transfer matrix and Modeling is performed to enhance the static transfer matrix P by replacing them in Equation 20 and Equation 14 b and P f ;

[0198] right and The core of modeling is to ensure that the static, dynamic and temporal information in the data is fully encoded. For a given time step t, historical observations are used as dynamic features; given historical data The dynamic information of channel c can be formulated as x c =x[:,:,c] T ∈R N×T , where c = 1,…,d, considering time embedding and Estimate the embedding used in the gate, using two static node embedding matrices E u ∈R N×d and E d ∈R N×d , and obtain two dynamic feature matrices:

[0199]

[0200] here FC(·) is a nonlinear two-layer fully connected network that extracts features and transforms the dimension from N×dT to N×d. In addition, Concat(·) represents a broadcast cascade and uses an attention mechanism to calculate pairwise masks to obtain a dynamic graph:

[0201]

[0202]

[0203] W Q and W K are the parameters of the self-attention mechanism, the matrix and The model can be enhanced by replacing the transfer matrix in Equation 20 and Equation 14;

[0204] Assuming that the model stacks L layers of decoupled spatiotemporal layers, the output hidden state contains the prediction branches of the node traffic association block and the network trend block at each layer. and

[0205]

[0206] Then a two-layer fully connected network is used as a regression layer and applied to H to generate preliminary predictions. The output of the regression layer at each time step is concatenated to form the predicted output: The formula is:

[0207]

[0208] 2.2: Training model: Prepare training data set, divide the pre-processed network traffic data into training set and test set in proportion; in the training set, mark the samples with specific traffic patterns and normal network traffic samples; use the training set to train D 2 The STGNN model is trained and uses the back-propagation algorithm to optimize the model parameters, allowing the model to learn the characteristic patterns of different traffic patterns and normal network traffic;

[0209] During training, use a suitable optimizer and set reasonable hyperparameters for learning rate, number of iterations, batch size, weight decay coefficient, momentum parameter, learning rate decay strategy, dropout rate, number of decoupled spatiotemporal layers, and hidden layer dimension.

[0210] In training D 2 When using the STGNN model, the cross entropy loss function is used to measure the difference between the model prediction results and the true label, and the model parameters are adjusted by optimizing the loss function. Assuming that the model's prediction output is The true label is y, and the calculation formula of the cross entropy loss function L is:

[0211]

[0212] Where m is the number of samples. In actual training, the gradient of the loss function with respect to the model parameters is calculated through the back-propagation algorithm, and the parameters are updated using the Adam optimizer. The formula for updating the parameter θ of the Adam optimizer is:

[0213]

[0214] Where η is the learning rate, m t and v tare the first-order moment estimate and the second-order moment estimate of the gradient, respectively. ∈ is a small constant used to prevent the denominator from being zero. During the training process, the parameters are continuously updated iteratively until the loss function converges or other set stopping conditions are met.

[0215] Step 3: Use the trained model to predict network traffic and evaluate the results.

[0216] Real-time detection: After being processed by the data processing and representation module, the real-time collected network traffic data is input into the trained D2STGNN model. The model predicts the changing trend of the current network traffic based on the learned feature patterns. If the deviation between the model output and the normal traffic pattern exceeds the set threshold, it is determined that the network traffic may have abnormal changes; otherwise, the network traffic is considered to be within the normal range.

[0217] Result evaluation: The prediction performance of the model was evaluated using the test set, using the mean square error (MSE), mean absolute error (MAE), and coefficient of determination (R). 2 The indicators measure the prediction effect of the model; the mean square error represents the average of the square of the error between the predicted value and the true value, the mean absolute error represents the average of the absolute error between the predicted value and the true value, and the coefficient of determination measures the degree of fit of the model to the data; by analyzing the evaluation results, the model parameters and structure are continuously optimized to improve the prediction performance of the model.

[0218] The calculation formula for mean square error (MSE) is:

[0219]

[0220] Among them, y i is the true value, is the predicted value, and n is the number of samples. The smaller the mean square error, the more accurate the model's prediction.

[0221] The calculation formula for the mean absolute error MAE is:

[0222]

[0223] The mean absolute error directly reflects the average deviation between the predicted value and the true value;

[0224] Coefficient of determination R 2 The calculation formula is:

[0225]

[0226] in, is the mean of the true values, R 2 The value range of is between (-∞,1], and the closer it is to 1, the better the model fits the data;

[0227] If the evaluation results show that the model performs poorly on certain indicators, optimize the model parameters and structure through various methods: If the mean square error or mean absolute error is large, adjust the model's hyperparameters, increase the number of convolutional layers in the node association model or network trend model, and adjust the hidden layer size of the GRU unit; if the determination coefficient is low, increase the amount of training data so that the model can learn more traffic characteristics under different situations, or optimize the feature engineering of the network traffic data to extract more representative features.

Claims

1. A Decoupled Dynamic Spatiotemporal Graph Neural Network 2 The STGNN network traffic prediction method is characterized by: Step 1: Build a network traffic data processing and representation module; Step 2: Based on D 2 STGNN builds a network traffic prediction model; 2.1: Building the model: Based on D 2 STGNN designs a detection model architecture with a decoupled spatiotemporal framework as its core, decomposing the input network traffic spatiotemporal signal into node association signals and network trend signals; In the node association model, the spatiotemporal local convolutional layer is used to accurately model the association process between nodes, capturing the connection relationship and traffic interaction pattern between hosts. In the network trend model, the gated recurrent unit (GRU) and multi-head self-attention layer are combined to capture the short-term and long-term dependencies of time series and analyze the changing trends of network traffic over time. 2.2: Training model: Prepare training data set, divide the pre-processed network traffic data into training set and test set in proportion; in the training set, mark the samples with specific traffic patterns and normal network traffic samples; use the training set to train D 2 The STGNN model is trained and uses the back-propagation algorithm to optimize the model parameters, allowing the model to learn the characteristic patterns of different traffic patterns and normal network traffic; Step 3: Use the trained model to predict network traffic and evaluate the results.

2. A Decoupled Dynamic Spatiotemporal Graph Neural Network 2 The STGNN network traffic prediction method is characterized by: The specific method in step 1 is: 1.1 Data Collection: Collect network traffic data from various nodes in the network, including: Basic identification categories: source IP address, destination IP address, source MAC address, destination MAC address, port number, protocol type; Traffic characteristics: traffic volume, number of packets, packet length distribution, connection duration, TOS field; Time and status: timestamp, TCP flag, application layer protocol type; 1.2 Data cleaning: Clean the collected data to remove noise, duplicate and abnormal data; 1.3 Data preprocessing: The cleaned data is subjected to feature engineering to extract features related to network traffic changes. The network traffic data is constructed into a graph structure, where nodes represent hosts or devices in the network, edges represent network connections between hosts, edge attributes represent relevant features of the connection, and timestamp information is used to reflect the time series characteristics of the data. When calculating the similarity or correlation between nodes, the cosine similarity formula is used to measure the similarity between the network traffic feature vectors of two nodes. Assume that the traffic feature vectors of node i and node j are and Then the cosine similarity sim(i,j) between them is: By calculating the ratio of the dot product of two vectors to the product of their modulo lengths, a value between -1 and 1 is obtained. The closer the value is to 1, the more similar the traffic characteristics of the two nodes are. When constructing the graph structure, stronger connections are set between nodes with high similarity, that is, larger edge weights, for subsequent D 2 The STGNN model captures the relationship between nodes.

3. A Decoupled Dynamic Spatiotemporal Graph Neural Network 2 The STGNN network traffic prediction method is characterized by: The specific method in 2.1 is: Considering the dynamic nature of network traffic data, a time decay mechanism is introduced to assign different weights to historical data based on the data timestamp, highlighting the importance of recent data in model learning; Using the exponential decay function, assuming that the time step of network traffic data is t, the decay weight ω t The calculation formula is: oh t =e -λt #(2) Among them, λ is the attenuation coefficient, which is used to control the attenuation speed, t represents the time step of the data from the current time, as t increases, ω t The value of gradually decreases, that is, the weight of historical data gradually decreases. To make the attenuation mechanism more adaptable, the formula is further improved, and an adaptive attenuation parameter adjustment mechanism is introduced to dynamically adjust the attenuation coefficient in combination with the fluctuation of network traffic. The improved formula is: Among them, λ0 is the basic attenuation coefficient, k is the adjustment factor, σ t is the flow fluctuation rate at the current time step, is the historical average traffic volatility. When traffic fluctuates significantly, the decay rate accelerates, highlighting the importance of recent data; conversely, the decay rate slows down, preserving the influence of historical data. When decoupling the spatiotemporal framework, it is assumed that the input spatiotemporal signal of network traffic is Among them S h represents the number of network traffic signals at each past time step considered, N is the number of network nodes, C represents the feature dimension, and the decoupling process is expressed as: X=X nfa +X nft Among them, X nfa and X nft They correspond to node traffic correlation signals and network traffic time trend signals respectively. Through this decoupling method, the correlation effect between hosts and the overall trend change of the network can be captured respectively. In the decoupling process, the residual decomposition mechanism is used to achieve signal separation. Taking the decoupling of node correlation signals as an example, the proportion of node correlation signals in the time series is first determined by the estimation gate. The operation of the estimation gate involves multiple formulas: H′=H+MultiheadAttention(Q=H,K=H,V=H)#(5) Λ t，i =Sigmoid(H′W2)#(6) X nfa =Λ⊙X#(7) in, and is the time slot embedding matrix, which represents the embedding information of different time slots in a day and different days in a week respectively; and is the node embedding matrix, which is used to represent the embedding of source and target nodes; W1 and W2 are learnable parameters; σ is the activation function; ∥ represents the connection operation; ⊙ represents element-by-element multiplication. Through these formulas, the appropriate gate value is automatically learned and determined according to the current node and time embedding situation, thus optimizing the decoupling process. The residual decomposition mechanism decomposes the network traffic signal by removing the parts that have been learned by the network trend block and the node association block in an information reconstruction manner. Each decoupled spatiotemporal layer includes a node association block and a network trend block in addition to a decoupling block, and each block consists of three parts: one from the input data Learn knowledge and generate hidden states The main model, a module for generating hidden states The prediction branch and the input signal used to generate the module The best estimated backtracking branch; the backtracking branch plays a key role in the decoupling process. The backtracking branch reconstructs the signal that has been accurately learned by the model, that is, the learned node association signal In this way, backtracking branches help isolate the parts that can be accurately represented by the model; where X l is the input of the (l)th layer, the superscripts nft and nfa represent the network-traffic time trend signal and the node-traffic association signal, and a nonlinear fully connected network is used to implement the backtracking branch. is the network parameter, σ is the GeLU activation function; The first residual connection removes the well-approximated signals from the input signal and retains only the signals that have not been fully decomposed. After the processing of the first residual connection, the input information of the network trend module, that is, the network trend signal, can be obtained. The improved formula of the first residual connection is: The adaptive weight adjustment SE module, GELU activation function and Dropout layer are introduced to enhance the expressiveness and flexibility of the model. A second residual link is performed after the network trend block to further remove the signals that have been captured by the network trend module and only retain those residual signals that cannot be completely decomposed. The residual signal will continue to be processed in the next layer to ensure that all complex patterns can be captured by the model. The formula for the second residual connection is: in The residual signal that cannot be decomposed in the lth layer is retained, and a layered attenuation mechanism is added before the residual signal enters the next decoupled spatiotemporal layer to reflect the real-time dynamics of the network. That is, the attenuation of the l+1 layer is based on the residual signal of the previous layer. The attenuation parameter λ is dynamically adjusted. l+1 The formula for rate attenuation is as follows: Where α is a learnable scalar parameter of the layered attenuation mechanism, AvgPool is an average pooling operation used to extract feature strength, and the attenuation weight of the l+1 layer is: The attenuated data passed to the next layer is represented as: Through the above operations, appropriate models are designed according to the specific characteristics of node association signals and network trend signals, and each model focuses on its specific signal, so that the spatiotemporal signals are decoupled; In the node association model, a spatiotemporal local convolutional layer is used to model the influence process between nodes; assuming that only the past k t k time steps s The network traffic signals of the order-neighboring nodes can affect a target node, and the spatiotemporal localized transfer matrix is ​​defined as: Among them, P k ∈R N×N is a k-order transfer matrix, k=1,…,k s , since information propagation has forward and backward bidirectionality, the forward transfer matrix and the backward transfer matrix are calculated separately: A is the adjacency matrix of the network flow graph, rowsum(A) represents the sum of the rows of matrix A, corresponding to the spatiotemporal localized transfer matrix, with a local feature matrix Where W k is the convolution weight of the node association model, σ is the GeLU activation function, based on the above transfer matrix and feature matrix, the spatial kernel size k is defined s The spatiotemporal local graph convolution operator is: in is the output of the local graph convolution operator at time step t, which takes into account the s The spatial information of the order neighbors, W k is the k-th order graph convolution parameter, is the hidden state at the subsequent time step; In addition to the transfer matrix P f and P b , using an adaptive transfer matrix and the transfer matrix P made by prior knowledge f and P b Differently, the adaptive transfer matrix is ​​composed of two randomly initialized node embedding dictionaries E with learnable parameters. u ∈R N×d and E d ∈R N ×d Optimized: P apt =Softmax(σ(E d (AND u ) T ))#(19) Among them, P apt ∈R N×N Normalized by the Softmax function, describing the transfer matrix P f and P b Similar influence process; matrix P apt As the transfer matrix P based on the influence network f and P b Supplementation of hidden influence processes omitted in the Given three transfer matrices P f and P b and P apt , and obtain their corresponding spatiotemporal localized transfer matrices in formula 14 and And based on the operation in formula 18, the local convolution layer is given as follows: Given a time kernel size k t , spatial kernel size k s and input The local convolutional layer generates a hidden state sequence H by synchronously modeling the spatiotemporal correlation at each time step t scl : Where Θ represents all the parameters mentioned in Formula 17, Formula 19, and Formula 20, G represents the spatiotemporal local convolution in Formula 20, and the output hidden state sequence H nfa It is further used to generate two outputs, namely, the backtracking output and the prediction output; Prediction branch: last hidden state Used to predict the value of the next step. In order to predict the hidden state in the multi-step prediction task, the autoregressive process is followed. The formula is as follows: Each of these values ​​is used by a nonlinear regression neural network to predict the specific value of interest; Backtracking branch: Use nonlinear fully connected network to implement backtracking branch and generate That is, the learned node-flow correlation signal part is then removed from the original signal through the residual link in Formula 8 to achieve decomposition; The network trend model is a hidden intrinsic time series in the original signal of each node, namely X nft For modeling, dependencies in time series are usually divided into local dependencies and global dependencies, called short-term dependencies and long-term dependencies; GRU and multi-head self-attention layers are used together to fully capture temporal patterns; GRU can repeatedly save the hidden state of historical data and control the information flowing to the next time step. The network trend block at a given time step t For each node i, the following GRU operation is used: in is the updated hidden state of node i at time step t, ⊙ represents the element-wise product, W z ,W r ,W h ,U z ,U r and U h is the learnable parameter of GRU; GRU is able to capture short-term sequence information. Since network traffic prediction is also affected by long-term dependencies, a multi-head self-attention layer is introduced to capture the global dependencies at the top of GRU. Given the output of GRU The multi-head self-attention layer performs pairwise dot product attention on the time dimension of each node, that is, the product is calculated between any two signals in different time slots; considering the attention head s, the item matrix can be learned And the output matrix W O , the attention function of node i is written as: in is the feature of node i in all time slots, and all nodes are calculated separately in parallel with the help of GRU; the network trend model G is obtained nft ∈r S×N×d The hidden state of ; the self-attention layer has an infinite receptive field and ignores the relative position in the sequence. In order to consider the position, position encoding is applied between the GRU and the multi-head attention layer as shown below: where e t ∈R d is the position embedding at time step t; Prediction branch: Here, autoregression is still used to generate future hidden states; Backtracking branch: Same as the node flow association block, a nonlinear fully connected network is used to implement the backtracking branch and generate The formula is as follows: That is, the learned network trend signal part; This model uses a dynamic graph learning model to capture the dynamics of spatial dependencies. This is because the influence strength between two connected nodes changes dynamically over time, so the dynamic transfer matrix and Modeling is performed to enhance the static transfer matrix P by replacing them in Equation 20 and Equation 14 b and P f ; right and The core of modeling is to ensure that the static, dynamic and temporal information in the data is fully encoded. For a given time step t, historical observations are used as dynamic features; given historical data The dynamic information of channel c can be formulated as X c =X[:,:,c] T ∈R N×T , where c = 1,…,d, considering time embedding and Estimate the embedding used in the gate, using two static node embedding matrices E u ∈R N×d and E d ∈R N×d , and obtain two dynamic feature matrices: here FC(·) is a nonlinear two-layer fully connected network that extracts features and transforms the dimension from N×dT to N×d. In addition, Concat(·) represents a broadcast cascade and uses an attention mechanism to calculate pairwise masks to obtain a dynamic graph: W Q and W K are the parameters of the self-attention mechanism, the matrix and The model can be enhanced by replacing the transfer matrix in Equation 20 and Equation 14; Assuming that the model stacks L layers of decoupled spatiotemporal layers, the output hidden state contains the prediction branches of the node traffic association block and the network trend block at each layer. and Then a two-layer fully connected network is used as a regression layer and applied to H to generate preliminary predictions. The output of the regression layer at each time step is concatenated to form the predicted output: The formula is:

4. A Decoupled Dynamic Spatiotemporal Graph Neural Network 2 The STGNN network traffic prediction method is characterized by: The specific method in 2.2 is: During training, use a suitable optimizer and set reasonable hyperparameters for learning rate, number of iterations, batch size, weight decay coefficient, momentum parameter, learning rate decay strategy, dropout rate, number of decoupled spatiotemporal layers, and hidden layer dimension. In training D 2 When using the STGNN model, the cross entropy loss function is used to measure the difference between the model prediction results and the true label, and the model parameters are adjusted by optimizing the loss function. Assuming that the model's prediction output is The true label is y, and the calculation formula of the cross entropy loss function L is: Where n is the number of samples. In actual training, the gradient of the loss function with respect to the model parameters is calculated through the backpropagation algorithm, and the parameters are updated using the Adam optimizer. The formula for updating the parameter θ of the Adam optimizer is: Where η is the learning rate, m t and v t are the first-order moment estimate and the second-order moment estimate of the gradient, respectively. ∈ is a small constant used to prevent the denominator from being zero. During the training process, the parameters are continuously updated iteratively until the loss function converges or other set stopping conditions are met.

5. A Decoupled Dynamic Spatiotemporal Graph Neural Network 2 The STGNN network traffic prediction method is characterized by: The specific method in step 3 is: Real-time detection: After being processed by the data processing and representation module, the real-time collected network traffic data is input into the trained D2STGNN model. The model predicts the changing trend of the current network traffic based on the learned feature patterns. If the deviation between the model output and the normal traffic pattern exceeds the set threshold, it is determined that the network traffic may have abnormal changes; otherwise, the network traffic is considered to be within the normal range. Result evaluation: The prediction performance of the model was evaluated using the test set, using the mean square error (MSE), mean absolute error (MAE), and coefficient of determination (R). 2 The indicators measure the prediction effect of the model; the mean square error represents the average of the square of the error between the predicted value and the true value, the mean absolute error represents the average of the absolute error between the predicted value and the true value, and the coefficient of determination measures the degree of fit of the model to the data; by analyzing the evaluation results, the model parameters and structure are continuously optimized to improve the prediction performance of the model. The calculation formula for mean square error (MSE) is: Among them, y i is the true value, is the predicted value, and n is the number of samples. The smaller the mean square error, the more accurate the model's prediction. The calculation formula for the mean absolute error MAE is: The mean absolute error directly reflects the average deviation between the predicted value and the true value; Coefficient of determination R 2 The calculation formula is: in, is the mean of the true values, R 2 The value range of is between (-∞,1], and the closer it is to 1, the better the model fits the data; If the evaluation results show that the model performs poorly on certain indicators, optimize the model parameters and structure through various methods: If the mean square error or mean absolute error is large, adjust the model's hyperparameters, increase the number of convolutional layers in the node association model or network trend model, and adjust the hidden layer size of the GRU unit; if the determination coefficient is low, increase the amount of training data so that the model can learn more traffic characteristics under different situations, or optimize the feature engineering of the network traffic data to extract more representative features.

Images