Network traffic anomaly detection method and system based on multi-modal coupling Mamba model and hybrid experts

Abstract

The invention discloses a network traffic anomaly detection method and system based on a multi-modal coupling Mamba model and a mixed expert. The method comprises the following steps: collecting network traffic; cleaning the network flow data, and standardizing the data format; shunting the cleaned network traffic data based on quintuple (a source IP, a destination IP, a source port, a destination port and a protocol type) information; extracting data packet length, transmission direction and load byte information, constructing a data packet length sequence and a load byte sequence based on a time sequence view angle and an interaction view angle, and constructing a layered data packet interaction graph; the multi-mode flow representation is input into a coupling Mamba model, deep coupling and dynamic interaction are carried out among different modes, and high-level feature representation with higher identification capacity is generated; dynamically selecting and activating a plurality of expert sub-networks through a gating network by utilizing a hybrid expert system; and a final flow detection result is generated in combination with a result output by the MoE classifier and the original features, and confidence feedback is provided.

Description

Technical Field

[0001] The present invention relates to the fields of network security, artificial intelligence and network traffic anomaly detection technology, and specifically to a network traffic anomaly detection method and system based on a multimodal coupling Mamba model and hybrid experts. Background Art

[0002] With the rapid development of internet technology and the deepening of digital transformation, network infrastructure has become a critical pillar of social operations. As a carrier of network activity, network traffic not only carries massive amounts of information exchange and business collaboration, but also serves as a key indicator of network health, playing a vital role in providing real-time warnings of security threats and ensuring the continuity of critical business operations. However, with the continuous evolution of attack techniques, new, highly organized and covert attack methods are emerging. From botnet-based Distributed Denial of Service (DDoS) attacks to Advanced Persistent Threats (APTs) exploiting zero-day vulnerabilities, from data exfiltration disguised by encrypted traffic to ransomware targeting industrial control systems, these attacks have become systemic threats to the infrastructure of vital sectors such as finance, energy, healthcare, and transportation.

[0003] Against this backdrop, network traffic anomaly detection, as a core line of defense for digital infrastructure security, faces unprecedented challenges. On the one hand, encrypted traffic, cross-protocol communication, and multi-source heterogeneous data make it difficult for traditional rule-based or single-modal feature-based detection methods to fully capture attack behavior. On the other hand, there is a significant conflict between the need to process massive amounts of high-dimensional traffic data in real time and the generalization capabilities of detection models. Traditional rule-based and feature-engineering-based anomaly detection methods, such as those based on statistical thresholds and machine learning classifiers, are struggling to cope with complex new threats. Statistical threshold-based methods rely on predefined statistical thresholds to identify anomalies. However, new attacks often disguise themselves as normal traffic or utilize encryption techniques to conceal their activities, making these fixed thresholds difficult to capture covert malicious behavior. Similarly, while machine learning classifier-based methods perform well in certain scenarios, they typically rely on extensive historical data for training. When faced with zero-day vulnerabilities or advanced persistent threats (APTs), the lack of training samples makes the models incapable of accurately identifying unknown types of attacks. Therefore, there is an urgent need to break through the existing technical bottleneck and design a new solution that can deeply integrate multimodal traffic characteristics, adaptively distinguish abnormal patterns, and take into account both detection efficiency and accuracy, so as to provide core technical support for building the next generation of intelligent security protection system. Summary of the Invention

[0004] In order to overcome the defects in the prior art, the present invention provides a network traffic anomaly detection method and system based on a multimodal coupling Mamba model and hybrid experts.

[0005] The first aspect of the present invention relates to a network traffic anomaly detection method based on a multimodal coupled Mamba model and hybrid experts, the main steps of which are as follows:

[0006] S1: Collect network traffic data. Collect network traffic to ensure that all necessary network communication details are covered for subsequent analysis. The collected data should include, but is not limited to, five-tuple information such as source IP address, destination IP address, source port, destination port, and protocol type, to fully capture all key elements of network communication.

[0007] S2: Cleaning network traffic data. This involves removing and reassembling out-of-order packets, processing missing values, filtering invalid or damaged packets, and standardizing the data format to improve the accuracy and efficiency of subsequent processing steps.

[0008] S3: Divide network traffic data. Divide the cleaned network traffic data based on the five-tuple information (source IP, destination IP, source port, destination port, protocol type). Data streams with the same five-tuple characteristics are grouped together to form different data stream sets, providing structured input data for subsequent multimodal modeling.

[0009] S4: Construct a multimodal flow representation. Extract packet length, transmission direction, and payload byte information from the split data. Based on the timing and interaction perspectives, construct a packet length sequence (timing modality) and a payload byte sequence (semantic modality). Simultaneously, construct a hierarchical packet interaction graph (structural modality) to represent the interaction relationship between packets within the flow.

[0010] S5: Coupled Mamba Model Feature Learning and Fusion. The constructed multimodal stream representation is input into the coupled Mamba model. Leveraging the parallel computing capabilities and long-range dependency modeling advantages of its state-space model (SSM), the model performs deep coupling and dynamic interaction between different modalities, thereby learning and fusing temporal, semantic, and structural features to generate more discriminative high-level feature representations.

[0011] S6: Hybrid Expert System Classification. Using a Mixture of Experts (MoE), multiple expert sub-networks are dynamically selected and activated through a gating network. Each expert sub-network focuses on identifying a specific type of network anomaly pattern and fuses its classification results through weighted averaging, significantly improving the detection accuracy and robustness of diverse abnormal traffic. It should be noted that in this patent, "hybrid expert" explicitly refers to a machine learning model architecture, not a human expert;

[0012] S7: Final traffic detection result generation and confidence feedback. The MoE classifier output is combined with the original features to generate the final traffic detection result and provide confidence feedback to evaluate the reliability and accuracy of the detection result, thereby achieving efficient detection and early warning of abnormal network traffic.

[0013] Preferably, step S1 includes: collecting network traffic data. Comprehensive network traffic is collected to ensure that all necessary network communication details are covered for subsequent analysis. Specifically, the system collects network traffic data in real time through traffic mirroring or bypass deployment. The collected content includes but is not limited to five-tuple information (source IP address, destination IP address, source port, destination port, protocol type), as well as auxiliary information such as timestamp, transmission duration, packet length, and transmission direction, to comprehensively capture all key elements and time series characteristics of network communication.

[0014] Preferably, step S2 includes: cleaning network traffic data. Collected network traffic data is systematically cleaned to improve the accuracy and processing efficiency of subsequent modeling and analysis. Specifically, data packets are first sorted using a timestamp check mechanism to restore their original transmission order. Second, the integrity and validity of data packets are determined based on the IP header and TCP or UDP checksum fields, and abnormal data packets that fail the checksum are filtered out. For data streams with missing fields, default values ​​of 0 are used to fill them in.

[0015] Preferably, step S3 includes: diverting the network traffic data. Based on the cleaned network traffic data, the system diverts the data stream according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol type). Specifically, data packets with the same five-tuple characteristics are classified together to form an independent communication session flow (i.e., logical data flow) F = (sIP, dIP, sPort, dPort, Proto), where sIP represents the source IP address, dIP represents the destination IP address, sPort represents the source port number, dPort represents the destination port number, and Proto represents the type of transport layer protocol used, providing structured input for subsequent multimodal modeling.

[0016] Preferably, the step S4 includes:

[0017] S4.1: Constructing a packet length sequence (temporal modality). Extract basic communication features from each split data stream, including packet length and transmission direction, and construct a packet length sequence (temporal modality) representation based on a temporal perspective.

[0018] S4.1.1: Modeling packet length sequence. Specifically, the length values ​​and transmission directions of the first n packets of a flow form a time sequence L = {l1, l2, ..., l n}, where |l i |,i∈n represents the length of the data packet. Considering the bidirectionality of the communication process, different transmission directions are represented by ±1;

[0019] S4.1.2: Fill missing values ​​in the packet length sequence. For packets less than n, fill the missing values ​​with zeros to form a time series modality.

[0020] S4.2: Constructing the data packet payload byte sequence (semantic modality). Extract the payload byte information of each data packet from each data stream after diversion, and construct the data packet payload byte sequence (semantic modality) based on the time sequence perspective.

[0021] S4.2.1: Modeling the data packet payload byte sequence. Specifically, the first m original payload bytes of the data packet are converted into a fixed-length byte sequence B = {b1, b2, ..., b m}, b j ∈[0,255],j∈m represents the byte value at a certain position;

[0022] S4.2.2: Fill missing values ​​in the data packet payload byte sequence. If the original payload bytes are less than m, fill the missing values ​​with zeros to form a semantic mode.

[0023] S4.3: Construct a packet interaction graph (structural modality). Based on the interaction relationships between packets, construct a hierarchical packet interaction graph G = (V, E), where the node set V represents all packets in the data flow, with their size and transmission direction as node features, and the edge set E represents the temporal order and interaction associations between packets, forming a structural modality.

[0024] S4.3.1: Nodes for modeling structural modes. Structural modes are constructed with packets as nodes, and their length and direction as node features. Continuous packets transmitted in the same direction are logically grouped into the same layer or column.

[0025] S4.3.2: Modeling Structural Mode Edges. Edges are established between packets within the same layer and between the head and tail packets of packets traveling in different directions. This captures the complex interactions and dependencies within the data flow, forming a structural mode. This mode effectively captures the complex interactions and dependencies within the data flow, enhancing the ability to identify abnormal behavior.

[0026] Preferably, step S5 includes:

[0027] S5.1: Input the constructed multimodal stream representation (temporal modality, semantic modality, and structural modality) into the coupled Mamba model. Specifically, the data of each modality is first preliminarily encoded through its respective embedding layer to generate the initial hidden state vector where mod∈{T,S,G} represents temporal, semantic, and graph modalities. These initial latent state vectors serve as input to the coupled Mamba model to capture the dynamic interactions between different modalities in the state space.

[0028] S5.2: State evolution of the Mamba model. The basic Mamba model is based on the state space equations of the continuous system.

[0029] S5.2.1: Process discretized data. Process discretized data using a zero-order holder.

[0030] S5.2.2: Multimodal state coupling mechanism. In the coupled Mamba model, the state transition process of each modality depends not only on its own previous state but is also affected by the states of other modalities. This coupling mechanism enables the model to better capture cross-modal correlations and interactions.

[0031] S5.3: Parallel aggregation of multimodal features. The model aggregates the feature information of each modality in parallel layer by layer through multiple coupled Mamba blocks.

[0032] S5.3.1: Parallel Efficient Computing Strategy. To fully utilize the efficient parallel computing capabilities of the Mamba model on hardware, this paper adopts a parallel computing strategy based on the global convolution kernel K. This enables efficient parallel execution of state updates and feature fusion across different modalities, significantly improving model training and inference speed.

[0033] S5.4: Introduce the attention mechanism to weight the contribution of each modality. Specifically, calculate the importance weight w of each modality mod The final high-level feature representation is obtained by weighted averaging. The weights are adaptively adjusted during the learning process to ensure that the model focuses on the most informative modal features, thereby improving the robustness and accuracy of the overall feature representation.

[0034] Preferably, step S6 includes:

[0035] S6.1: Input the high-level feature representation Z into the gating network. The high-level stream feature representation Z generated by the coupled Mamba model is input into the gating network, which dynamically selects the most suitable expert sub-network based on the characteristics of the current sample.

[0036] S6.2: Calculate the expert sub-network weights and sparse activation mechanism, including:

[0037] S6.2.1: Perform nonlinear transformation on high-level stream feature representation. Specifically, the high-level stream feature representation Z is transformed nonlinearly through the multi-layer perceptron MLP to generate the intermediate hidden state H g ;

[0038] S6.2.2: Calculate the weight of the expert sub-network. Calculate the weight w of each expert sub-network through the Softmax function k .

[0039] S6.2.3: Sparse activation of hybrid experts. In this process, only the top-K experts are activated and assigned non-zero weights, thus achieving sparse activation and reducing computational overhead.

[0040] S6.3: Each expert subnetwork makes a classification prediction for the current sample. Each expert subnetwork focuses on identifying a specific type of abnormal pattern. For example, some experts may be good at detecting DDoS attacks, while other experts may be better at identifying botnet activity or other types of malicious behavior. Each expert subnetwork receives the same high-level feature representation Z as input and outputs the corresponding classification result y k , represents the classification prediction of the k-th expert sub-network for the current sample;

[0041] S6.4: Weighted average calculation of classification results. To combine the classification results of each expert sub-network, a weighted average is used to calculate the final classification result Y. Because the contribution of each expert sub-network is adaptively adjusted based on its importance to the current sample, this mechanism helps improve classification accuracy and enhance the robustness of the system.

[0042] Preferably, step S7 includes combining the MoE classifier output, Y, with the original features, Z, to generate a final traffic detection result and provide confidence feedback. Specifically, by comparing the classification result, Y, with the actual label, the accuracy and reliability of the detection result are evaluated. Furthermore, the confidence feedback mechanism helps users better understand and apply the detection results, thereby achieving efficient detection and early warning of abnormal network traffic.

[0043] Another aspect of the present invention relates to a network traffic anomaly detection system based on a multimodal coupled Mamba model and hybrid experts, comprising a traffic collection and diversion storage module, a data cleaning engine, a multimodal construction module, a coupled Mamba feature learning and fusion module, a hybrid expert system (MoE) classification module, and a confidence feedback module.

[0044] The traffic collection and diversion storage module is responsible for collecting network traffic data in real time and classifying and diverting traffic according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol type);

[0045] The data cleaning engine cleans the collected network traffic data, removes and reorganizes out-of-order messages, processes missing values, filters invalid or damaged data packets, and standardizes the data format;

[0046] The multimodal construction module extracts packet length, transmission direction, and payload byte information from the diverted data, constructs a packet length sequence (temporal mode), a payload byte sequence (semantic mode), and simultaneously constructs a hierarchical packet interaction graph (structural mode);

[0047] The coupled Mamba feature learning and fusion module inputs multimodal features into the coupled Mamba model, captures the dynamic interactions between different modalities in the state space, and generates a high-level traffic feature representation;

[0048] The hybrid expert system (MoE) classification module uses the hybrid expert system to sparsely activate Top-K experts based on the input high-level flow features, and obtains the classification results through weighted averaging, thereby reducing computational overhead;

[0049] The confidence feedback module combines the results output by the MoE classifier with the original features to generate the final flow detection result and provides confidence feedback for evaluating the reliability and accuracy of the detection result.

[0050] As can be seen from the above technical solution, compared with the existing technology, the present invention provides a network traffic anomaly detection method and system based on a multimodal coupled Mamba model and hybrid experts. By constructing feature representations for three modalities: temporal, semantic, and structural, and utilizing the coupled Mamba model to capture the dynamic interactions between these modalities within the state space, a high-level traffic feature representation is generated. This method not only comprehensively captures the time series characteristics, semantic information, and complex internal interactive dependencies of complex network traffic, but also introduces an attention mechanism to weight the contributions of each modality, ensuring that the model focuses on the most informative features, thereby improving the robustness and accuracy of the overall feature representation. Furthermore, the present invention combines a hybrid expert system to select multiple expert subnetworks that are most suitable for the current sample based on the input high-level flow features, and obtains classification results through weighted averaging, significantly improving classification accuracy and system robustness. Finally, through a confidence feedback mechanism, users can better understand and apply detection results, achieving efficient detection and early warning of network anomaly traffic. The goal of this method is to improve the accuracy and real-time performance of network traffic anomaly detection, helping network security teams to promptly identify and respond to complex new threats and ensure the continuity and security of critical services. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific embodiments of the present invention, the following will briefly introduce the drawings required for use in the specific embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 A flow chart of a method for detecting abnormal traffic flow according to an embodiment of the present invention;

[0053] Figure 2 A schematic diagram of a structural modal data packet interaction diagram provided by an embodiment of the present invention;

[0054] Figure 3 A diagram of the coupled Mamba model architecture provided by an embodiment of the present invention;

[0055] Figure 4 A schematic diagram of hybrid expert detection provided by an embodiment of the present invention;

[0056] Figure 5 This is an architecture diagram of the network traffic anomaly detection system provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] The technical solutions of the present invention are described clearly and completely below with reference to the embodiments. It is obvious that the embodiments described are only a portion of the embodiments of the present invention, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are also within the scope of protection of the present invention.

[0058] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0059] Example 1

[0060] Refer to the attached Figure 1 As shown, this embodiment provides a network traffic anomaly detection method based on a multimodal coupling Mamba model and hybrid experts, and the steps are as follows:

[0061] S1: Collect network traffic data. Collect network traffic, covering all necessary network communication details for subsequent analysis. The collected data should include five-tuple information such as source IP address, destination IP address, source port, destination port, and protocol type, to fully capture the key elements of network communication.

[0062] S2: Cleaning network traffic data. Collected network traffic data is cleaned by removing and reorganizing out-of-order messages, processing missing values, filtering invalid or damaged data packets, and standardizing the data format to improve the accuracy and efficiency of subsequent processing steps.

[0063] S3: Divide network traffic data. Divide the cleaned network traffic data based on the five-tuple information (source IP, destination IP, source port, destination port, protocol type). Data streams with the same five-tuple characteristics are grouped together to form different data stream sets, providing structured input data for subsequent multimodal modeling.

[0064] S4: Construct a multimodal flow representation. Extract packet length, transmission direction, and payload byte information from the split data. Based on the timing and interaction perspectives, construct a packet length sequence (timing modality) and a payload byte sequence (semantic modality). Simultaneously, construct a hierarchical packet interaction graph (structural modality) to represent the interaction relationship between packets within the flow.

[0065] S4.1: Constructing a packet length sequence (temporal modality). Extract basic communication features from each split data stream, including packet length and transmission direction, and construct a packet length sequence (temporal modality) representation based on a temporal perspective.

[0066] S4.1.1: Modeling packet length sequence. Specifically, the length values ​​and transmission directions of the first n packets of a flow form a time sequence L = {l1, l2, ..., l n}, where |l i |,i∈n represents the length of the data packet. Considering the bidirectionality of the communication process, different transmission directions are represented by ±1.

[0067] S4.1.2: Fill missing values ​​in the packet length sequence. For packets less than n, fill the missing values ​​with zeros to form a time series modality.

[0068] For example, consider a network communication flow consisting of 120 packets. The first n = 40 packets are selected as samples, with lengths of 100 bytes, 120 bytes, 80 bytes, and so on, up to 60 bytes. To reflect the bidirectional nature of communication, the direction of packet transmission is represented by ±1. A sequence of lengths L is constructed, i.e., [100, -120, 80, ..., -60], following the chronological order of packet generation. If a flow contains fewer than 40 packets, zero padding is used to ensure that all time series have the same length, for example, [100, -120, 80, ..., 0].

[0069] S4.2: Constructing the data packet payload byte sequence (semantic modality). Extract the payload byte information of each data packet from each data stream after diversion, and construct the data packet payload byte sequence (semantic modality) based on the time sequence perspective.

[0070] S4.2.1: Modeling the data packet payload byte sequence. Specifically, the first m original payload bytes of the data packet are converted into a fixed-length byte sequence B = {b1, b2, ..., b m}, b j ∈[0,255],j∈m represents the byte value at a certain position;

[0071] S4.2.2: Fill missing values ​​in the data packet payload byte sequence. If the original payload bytes are less than m, fill the missing values ​​with zeros to form a semantic mode.

[0072] For example, select the first 16 bytes of payload information from each packet. The first 16 bytes of the first packet are 2a0500a800002a0500a900002a0500bc. Convert these hexadecimal values ​​to decimal to fit the sequence data format: [42,5,0,168,0,0,42,5,0,169,0,0,42,5,0,188]. Packets with payloads less than 16 bytes are padded with zeros to ensure consistent sequence length.

[0073] Refer to the attached Figure 2 As stated, Figure 2 For Figure 1 The process of constructing the traffic structure mode and packet interaction diagram in the flowchart shown is as follows:

[0074] S4.3: Construct a packet interaction graph (structural modality). Based on the interaction relationships between packets, construct a hierarchical packet interaction graph G = (V, E), where the node set V represents all packets in the data flow, with their size and transmission direction as node features, and the edge set E represents the temporal order and interaction associations between packets, forming a structural modality.

[0075] S4.3.1: Nodes for modeling structural modes. Structural modes are constructed with packets as nodes, and their length and direction as node features. Continuous packets transmitted in the same direction are logically grouped into the same layer or column.

[0076] S4.3.2: Modeling Structural Mode Edges. Edges are established between packets within the same layer and between the head and tail packets of packets traveling in different directions. This captures the complex interactions and dependencies within the data flow, forming a structural mode. This mode effectively captures the complex interactions and dependencies within the data flow, enhancing the ability to identify abnormal behavior.

[0077] Refer to the attached Figure 3 As stated, Figure 3 For Figure 1 The flowchart shown is about the design of the coupled Mamba model architecture for extracting and fusing multimodal traffic features. The specific process is as follows:

[0078] S5: Coupled Mamba Model Feature Learning and Fusion. The constructed multimodal stream representation is input into the coupled Mamba model. Leveraging the parallel computing capabilities and long-range dependency modeling advantages of its state-space model (SSM), deep coupling and dynamic interaction between different modalities are achieved. This allows for learning and fusing temporal, semantic, and structural features to generate more discriminative high-level feature representations.

[0079] S5.1: Input the constructed multimodal stream representation (temporal modality, semantic modality, and structural modality) into the coupled Mamba model. Specifically, the data of each modality is first preliminarily encoded through its respective embedding layer to generate the initial hidden state vector Where mod∈{T,S,G} represents temporal, semantic, and graph modalities. These initial latent state vectors serve as input to the coupled Mamba model to capture the dynamic interactions between different modalities in the state space:

[0080]

[0081] S5.2: State evolution of the Mamba model. The basic Mamba model is based on the state space equations of the continuous system. For the input x t , hidden state h t The evolution equation is:

[0082] h′ t =Ah t +Bx t ,y t =Ch t (2)

[0083] in, is the state transition matrix, is the projection matrix.

[0084] S5.2.1: Processing discretized data. Processing discretized data through a zero-order holder, introducing a time step parameter ∆:

[0085]

[0086] The recursive equation after discretization is:

[0087]

[0088] S5.2.2: Multimodal state coupling mechanism. In the coupled Mamba model, the state transition process of each modality depends not only on its own previous state, but also on the states of other modalities:

[0089]

[0090] Among them, S mod represents the state transfer matrix of a certain mode, Represents the discretized input projection matrix. This coupling mechanism enables the model to better capture cross-modal correlations and interactions;

[0091] S5.3: Parallel aggregation of multimodal features. The model aggregates the feature information of each modality in parallel layer by layer through multiple coupled Mamba blocks.

[0092] S5.3.1: Parallel efficient computing strategy. In order to fully utilize the efficient parallel computing capability of the Mamba model on hardware, the present invention adopts a method based on the global convolution kernel. The parallel computing strategy enables efficient parallel execution of state updates and feature fusion of different modalities, significantly improving model training and inference speed:

[0093]

[0094] S5.4: Introduce the attention mechanism to weight the contribution of each modality. Specifically, calculate the importance weight w of each modality mod And the final high-level feature representation Z is obtained by weighted averaging:

[0095]

[0096] Where W is a learnable weight matrix, which is adaptively adjusted through the learning process to ensure that the model can focus on the most informative modal features, thereby improving the robustness and accuracy of the overall feature representation.

[0097] Refer to the attached Figure 4 As stated, Figure 4 For Figure 1 The flow chart shown is about the design of flow detection of the Mixed Expert (MoE) module. The specific process is as follows:

[0098] S6: Hybrid Expert System Classification. Using a hybrid expert system (MoE), a gating network dynamically selects and activates multiple expert sub-networks. Each expert sub-network focuses on identifying a specific type of network anomaly pattern, and their classification results are combined through weighted averaging, significantly improving the detection accuracy and robustness of diverse anomaly traffic.

[0099] S6.1: Input the high-level feature representation Z into the gating network. The high-level stream feature representation Z generated by the coupled Mamba model is input into the gating network, which dynamically selects the most suitable expert sub-network based on the characteristics of the current sample.

[0100] S6.2: Calculate the expert sub-network weights and sparse activation mechanism, including:

[0101] S6.2.1: Perform nonlinear transformation on high-level stream feature representation. Specifically, the high-level stream feature representation Z is transformed nonlinearly through the multi-layer perceptron MLP to generate the intermediate hidden state H g ;

[0102] S6.2.2: Calculate the weight of the expert sub-network. Calculate the weight w of each expert sub-network through the Softmax function k , where k∈{1,2,...,N} represents the kth of the N expert subnetworks:

[0103] H g =ReLU(W g Z+b g ) (10)

[0104]

[0105] Among them, W g,b g denote the weight matrix and bias term respectively, is the score of the kth expert sub-network, v g is a learnable parameter vector;

[0106] S6.2.3: Sparse activation of hybrid experts. In this process, only the top-K experts are activated and assigned non-zero weights, thus achieving sparse activation and reducing computational overhead.

[0107] S6.3: Each expert subnetwork makes a classification prediction for the current sample. Each expert subnetwork focuses on identifying a specific type of abnormal pattern. For example, some experts may be good at detecting DDoS attacks, while other experts may be better at identifying botnet activity or other types of malicious behavior. Each expert subnetwork receives the same high-level feature representation Z as input and outputs the corresponding classification result y k , represents the classification prediction of the k-th expert sub-network for the current sample:

[0108] y k =f k (Z;θ k ) (12)

[0109] Among them, f k (·) is the function of the kth expert sub-network, θ k are the parameters of the expert sub-network.

[0110] S6.4: Weighted average calculation of classification results. To combine the classification results of each expert sub-network, a weighted average is used to calculate the final classification result Y. Because the contribution of each expert sub-network is adaptively adjusted based on its importance to the current sample, this mechanism helps improve classification accuracy and enhance the robustness of the system.

[0111]

[0112] S7: Final traffic detection result generation and confidence feedback. The MoE classifier output is combined with the original features to generate the final traffic detection result and provide confidence feedback to evaluate the reliability and accuracy of the detection result, thereby achieving efficient detection and early warning of abnormal network traffic.

[0113] Example 2

[0114] Refer to the attached Figure 5 This embodiment provides a network traffic anomaly detection system based on a multimodal coupling Mamba model and hybrid experts, which is used to implement the network traffic anomaly detection method of embodiment 1, and includes the following modules:

[0115] The traffic collection and diversion storage module is responsible for collecting network traffic data in real time and classifying and diverting traffic according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol type);

[0116] The data cleaning engine cleans the collected network traffic data, removes and reorganizes out-of-order messages, processes missing values, filters invalid or damaged data packets, and standardizes the data format;

[0117] The multimodal construction module extracts packet length, transmission direction, and payload byte information from the diverted data, constructs a packet length sequence (temporal mode), a payload byte sequence (semantic mode), and simultaneously constructs a hierarchical packet interaction graph (structural mode);

[0118] The coupled Mamba feature learning and fusion module inputs multimodal features into the coupled Mamba model, captures the dynamic interactions between different modalities in the state space, and generates a high-level traffic feature representation;

[0119] The hybrid expert system (MoE) classification module uses the hybrid expert system to sparsely activate Top-K experts based on the input high-level flow features, and obtains the classification results through weighted averaging, thereby reducing computational overhead;

[0120] The confidence feedback module combines the results output by the MoE classifier with the original features to generate the final flow detection result and provides confidence feedback for evaluating the reliability and accuracy of the detection result.

[0121] The embodiments described above are merely descriptions of preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Without departing from the spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by persons skilled in the art should fall within the scope of protection defined by the claims of the present invention.

Claims

1. A network traffic anomaly detection method based on the multimodal coupling Mamba model and hybrid experts includes the following steps: S1: Collect network traffic data. Collect network traffic, covering all necessary network communication details for subsequent analysis. The collected data should include five-tuple information such as source IP address, destination IP address, source port, destination port, and protocol type, to fully capture the key elements of network communication. S2: Cleaning network traffic data: Cleaning the collected network traffic data by removing and reorganizing out-of-order messages, processing missing values, filtering invalid or damaged data packets, and standardizing the data format to improve the accuracy and efficiency of subsequent processing steps. S3: Diverts network traffic data; The cleaned network traffic data is divided based on the five-tuple information (source IP, destination IP, source port, destination port, protocol type); data streams with the same five-tuple characteristics are classified together to form different data stream sets, providing structured input data for subsequent multimodal modeling; S4: Construct a multimodal flow representation. Extract packet length, transmission direction, and payload byte information from the split data. Based on the timing and interaction perspectives, construct a packet length sequence (timing modality) and a payload byte sequence (semantic modality). Simultaneously, construct a hierarchical packet interaction graph (structural modality) to represent the interaction relationship between packets within the flow. S5: Coupled Mamba model feature learning and fusion: The constructed multimodal stream representation is input into the coupled Mamba model. Leveraging the parallel computing capabilities and long-range dependency modeling advantages of its state-space model (SSM), deep coupling and dynamic interaction between different modalities are achieved. This allows for learning and fusing temporal, semantic, and structural features to generate more discriminative high-level feature representations. S6: Hybrid Expert System Classification: Using a hybrid expert system (MoE), multiple expert sub-networks are dynamically selected and activated through a gating network. Each expert sub-network focuses on identifying a specific type of network anomaly pattern, and their classification results are combined through weighted averaging, significantly improving the detection accuracy and robustness of diverse anomaly traffic. S7: Generate final traffic detection results and provide confidence feedback. The MoE classifier combines the output of the MoE classifier with the original features to generate the final traffic detection results and provide confidence feedback to evaluate the reliability and accuracy of the detection results, thereby achieving efficient detection and early warning of abnormal network traffic.

2. The network traffic anomaly detection method based on multimodal coupling Mamba model and hybrid experts according to claim 1 is characterized in that: Step S4 specifically includes: S4.1: Construct a packet length sequence (temporal modality); extract basic communication features from each split data stream, including packet length and transmission direction, and construct a packet length sequence (temporal modality) representation based on a temporal perspective; S4.1.1: Modeling packet length sequence; Specifically, the length values ​​and transmission directions of the first n packets of a flow form a time sequence L = {l1,l2,...,l n }, where |l i |,i∈n represents the length of the data packet. Considering the bidirectionality of the communication process, different transmission directions are represented by ±1; S4.1.2: Fill missing values ​​in the packet length sequence; if the number of packets is less than n, fill the missing values ​​with zeros to form a time series mode; S4.2: Constructing a data packet payload byte sequence (semantic modality). Extract the payload byte information of each data packet from each split data stream and construct a data packet payload byte sequence (semantic modality) based on a temporal perspective. S4.2.1: Model the data packet payload byte sequence; specifically, convert the first m original payload bytes of the data packet into a fixed-length byte sequence B = {b1, b2, ..., b m }, b j ∈[0,255],j∈m represents the byte value at a certain position; S4.2.2: Fill missing values ​​in the data packet payload byte sequence; if the original payload byte sequence is less than m, fill the missing value with zeros to form a semantic mode; S4.3: Construct a packet interaction graph (structural modality). Based on the interaction relationships between packets, construct a hierarchical packet interaction graph G = (V, E), where the node set V represents all packets in the data flow, with their size and transmission direction as node features, and the edge set E represents the temporal order and interaction associations between packets, forming a structural modality. S4.3.1: Modeling nodes of structural modes; Structural modes are constructed with packets as nodes, and their length and direction as node features. Continuous packets transmitted in the same direction are logically grouped into the same layer or column. S4.3.2: Model the edges of structural modes; establish edges between packets in the same layer and between the head and tail packets of packets in different transmission directions to capture the complex interactive dependencies within the flow and form structural modes.

3. The network traffic anomaly detection method based on multimodal coupling Mamba model and hybrid experts according to claim 1 is characterized in that: Step S5 specifically includes: S5.1: Input the constructed multimodal stream representation (temporal modality, semantic modality, and structural modality) into the coupled Mamba model; specifically, the data of each modality is first preliminarily encoded through its respective embedding layer to generate the initial hidden state vector where mod∈{T,S,G} represents temporal, semantic, and graph modalities; these initial latent state vectors serve as input to the coupled Mamba model to capture the dynamic interactions between different modalities in the state space: S5.2: State evolution of the Mamba model; The basic Mamba model is based on the state space equations of the continuous system; For the input x t , hidden state h t The evolution equation is: h′ t =Ah t +Bx t ,the t =Ch t (2) in, is the state transition matrix, is the projection matrix; S5.2.1: Processing discretized data; Processing discretized data through a zero-order holder, introducing a time step parameter ∆: The recursive equation after discretization is: S5.2.2: Multimodal state coupling mechanism; In the coupled Mamba model, the state transition process of each mode depends not only on its own previous state, but also on the states of other modes: Among them, S mod represents the state transfer matrix of a certain mode, Represents the discretized input projection matrix; this coupling mechanism enables the model to better capture cross-modal correlations and interactions; S5.3: Parallel aggregation of multimodal features: The model aggregates the feature information of each modality in parallel layer by layer through multiple coupled Mamba blocks; S5.3.1: Parallel efficient computing strategy; adopt a global convolution kernel based Parallel computing strategy: S5.4: Introduce the attention mechanism to weight the contribution of each modality; specifically, calculate the importance weight w of each modality mod And the final high-level feature representation Z is obtained by weighted averaging: Where W is the learnable weight matrix.

4. The network traffic anomaly detection method and system based on multimodal coupling Mamba model and hybrid experts according to claim 1 is characterized in that: Step S6 specifically includes: S6.1: Input the high-level feature representation into the gating network; Input the high-level stream feature representation Z generated by the coupled Mamba model into the gating network, and dynamically select the most suitable expert sub-network based on the characteristics of the current sample; S6.2: Calculate the expert sub-network weights and sparse activation mechanism, including: S6.2.1: Perform nonlinear transformation on high-level stream feature representation; specifically, perform nonlinear transformation on high-level stream feature representation Z through multi-layer perceptron MLP to generate intermediate hidden state H g ; S6.2.2: Calculate the weight of the expert sub-network; calculate the weight w of each expert sub-network through the Softmax function k , where k∈{1,2,...,N} represents the kth of the N expert subnetworks: H g =ReLU(W g Z+b g ) (10) Among them, W g ,b g denote the weight matrix and bias term respectively, is the score of the kth expert sub-network, v g is a learnable parameter vector; S6.2.3: Sparse activation of hybrid experts; in this process, only the top-K experts are activated and assigned non-zero weights, thus achieving sparse activation and reducing computational overhead; S6.3: Each expert sub-network performs classification prediction on the current sample; each expert sub-network focuses on identifying a specific type of abnormal pattern; each expert sub-network receives the same high-level feature representation Z as input and outputs the corresponding classification result y k , represents the classification prediction of the k-th expert sub-network for the current sample: y k =f k (Z:θ k ) (12) Among them, f k (·) is the function of the kth expert sub-network, θ k are the parameters of the expert sub-network; S6.4: Calculate the classification results by weighted average. In order to integrate the classification results of each expert sub-network, the final classification result Y is calculated by weighted average:

5. A network traffic anomaly detection system based on a multimodal coupling Mamba model and hybrid experts, characterized by including: Traffic collection and diversion storage module is responsible for collecting network traffic data in real time, and classifying and diverting traffic according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol type); The data cleaning engine cleans the collected network traffic data, removes and reorganizes out-of-order messages, processes missing values, filters invalid or damaged data packets, and standardizes the data format; The multimodal construction module extracts packet length, transmission direction, and payload byte information from the diverted data, constructs packet length sequences (temporal mode), payload byte sequences (semantic mode), and constructs a hierarchical packet interaction graph (structural mode). The coupled Mamba feature learning and fusion module inputs multimodal features into the coupled Mamba model, captures the dynamic interactions between different modalities in the state space, and generates high-level traffic feature representations; The hybrid expert system (MoE) classification module uses a hybrid expert system to sparsely activate Top-K experts based on the input high-level flow features and obtains the classification results through weighted averaging, thus reducing computational overhead. The confidence feedback module combines the output of the MoE classifier with the original features to generate the final traffic detection results and provides confidence feedback to evaluate the reliability and accuracy of the detection results.

Images