Network anomaly detection method and system for STN equipment

Abstract

The invention discloses a network anomaly detection method and system for STN equipment. The method comprises the following steps: collecting network traffic data of the STN equipment; performing multi-dimensional feature extraction on the network flow data to obtain a time sequence feature set, a statistical feature set and a protocol feature set; performing cross-domain information fusion on the time sequence feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector; and inputting the fusion feature vector into a pre-trained network anomaly detection model, and outputting a network anomaly detection result. Through cooperative extraction of a time sequence feature set, a statistical feature set and a protocol feature set, the limitation of the expression ability of single-dimensional entropy features in the prior art is overcome. A feature fusion mechanism is introduced, contribution weights of different feature domains to anomaly detection are dynamically learned, and compared with simple feature splicing in the prior art, the detection accuracy is improved. And the fusion feature vector is identified based on a network anomaly detection model, so that the robustness is improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network anomaly detection, in particular to a network anomaly detection method and system for STN equipment. BACKGROUND

[0002] In the current digital era, the network has become a key infrastructure for social operation and economic development. The STN network topology presents significant complexity. Application publication number CN115622720A discloses a network anomaly detection method, acquires feature parameters of network traffic data, detects the feature parameters by using a network anomaly detection model at the access layer, and obtains a detection result, wherein the network anomaly detection model is constructed based on a K-means clustering analysis algorithm. There are the following technical problems: 1. Feature extraction limitation: only single-dimensional statistical features (such as source / desination IP entropy, port entropy, etc.) are used to represent the network state by calculating the information entropy; 2. Detection model simplification: based on the K-means clustering algorithm, the distance between the sample and the cluster center is compared to determine the anomaly (if the distance exceeds the cluster radius, it is determined to be abnormal); 3. Mechanical association of abnormal types: relying on single feature changes to determine attack types (such as increasing source IP entropy to determine DDoS attack); 4. Insufficient feature expression capability: STN network traffic has strong time sequence correlation, protocol diversity and complex statistical mode, and single entropy feature cannot capture multi-dimensional abnormal mode; 5. Lack of cross-domain association: lacking processing of time sequence fluctuation, statistical distribution and protocol anomaly features, lacking fusion analysis, resulting in high false alarm rate; 6. Low robustness of K-means clustering to STN network environment, unable to learn nonlinear feature relationship (such as protocol flag bit combination anomaly). SUMMARY

[0003] The present application aims to at least partially solve one of the above technical problems. To this end, the purpose of the present application is to propose a network anomaly detection method and system for STN equipment, to perform multi-dimensional feature extraction and cross-domain association, to perform fusion analysis, and to improve the accuracy of network anomaly detection. Based on the network anomaly detection model, the fusion feature vector is identified to improve the robustness.

[0004] To achieve the above purpose, an embodiment of the present application proposes a network anomaly detection method for STN equipment, comprising:

[0005] Collecting network traffic data of the STN equipment;

[0006] Performing multi-dimensional feature extraction on the network traffic data to obtain a time sequence feature set, a statistical feature set and a protocol feature set;

[0007] Performing cross-domain information fusion on the time sequence feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector;

[0008] The fusion feature vector is input into a pre-trained network anomaly detection model, and a network anomaly detection result is output.

[0009] According to some embodiments of the application, network traffic data of the STN device is collected, including:

[0010] For the edge access layer, port mirroring is deployed on the edge router of the STN device to collect device-level communication traffic data;

[0011] For the core switching layer, backbone network traffic is physically shunted through a network shunt to collect cross-node interaction traffic data;

[0012] For the virtualization platform layer, vSwitch traffic monitoring is enabled in the NFV infrastructure to collect cloud-based STN device environment traffic data;

[0013] The network traffic data of the STN device is determined according to the device-level communication traffic data, the cross-node interaction traffic data, and the cloud-based STN device environment traffic data.

[0014] According to some embodiments of the application, multi-dimensional feature extraction is performed on the network traffic data to obtain a time series feature set, a statistical feature set, and a protocol feature set, including:

[0015] The network traffic data is input into a pre-set DNN network model for multi-dimensional feature extraction to capture the dynamic pattern of traffic changes over time and determine the time series feature set; the time series feature set includes traffic fluctuation period entropy, connection duration variance, and packet arrival interval time skewness;

[0016] The global distribution characteristics of the traffic are described to determine the statistical feature set; the statistical feature set includes source IP entropy in a unit time window, destination port distribution dispersion, and byte length kurtosis;

[0017] The protocol types and behaviors used in the traffic are analyzed to determine the protocol feature set; the protocol feature set includes abnormal protocol type identification, TCP flag combination abnormal frequency, and HTTP response code error rate.

[0018] According to some embodiments of the application, cross-domain information fusion is performed on the time series feature set, the statistical feature set, and the protocol feature set to generate a fusion feature vector, including:

[0019] The time series feature set, the statistical feature set, and the protocol feature set are respectively subjected to dimension reduction processing to obtain a reduced dimension time series feature set, a reduced dimension statistical feature set, and a reduced dimension protocol feature set;

[0020] Calculate mutual information of all feature pairs between any two feature sets among the reduced time series feature set, the reduced statistical feature set and the reduced protocol feature set based on the kernel density estimation method, and take the average value of mutual information of all feature pairs as the mutual information correlation degree between the corresponding two feature sets; the mutual information correlation degree includes the first mutual information correlation degree between the reduced time series feature set and the reduced statistical feature set, the second mutual information correlation degree between the reduced time series feature set and the reduced protocol feature set, and the third mutual information correlation degree between the reduced statistical feature set and the reduced protocol feature set;

[0021] Determine the importance scores corresponding to the reduced time series feature set, the reduced statistical feature set and the reduced protocol feature set, respectively;

[0022] Convert the importance scores corresponding to the reduced time series feature set, the reduced statistical feature set and the reduced protocol feature set into corresponding weight coefficients;

[0023] According to the weight coefficients, perform cross-domain information fusion on the time series feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector.

[0024] According to some embodiments of the present application, the importance scores corresponding to the reduced time series feature set, the reduced statistical feature set and the reduced protocol feature set are determined respectively, including:

[0025] Take the sum of the first mutual information correlation degree and the second mutual information correlation degree as the importance score corresponding to the reduced time series feature set;

[0026] Take the sum of the first mutual information correlation degree and the third mutual information correlation degree as the importance score corresponding to the reduced statistical feature set;

[0027] Take the sum of the second mutual information correlation degree and the third mutual information correlation degree as the importance score corresponding to the reduced protocol feature set.

[0028] According to some embodiments of the present application, the importance scores corresponding to the reduced time series feature set, the reduced statistical feature set and the reduced protocol feature set are converted into corresponding weight coefficients, including:

[0029] αt=exp(St) / (exp(St)+exp(Ss)+exp(Sp))

[0030] αs=exp(Ss) / (exp(St)+exp(Ss)+exp(Sp))

[0031] αp=exp(Sp) / (exp(St)+exp(Ss)+exp(Sp))

[0032] Wherein, at is a weight coefficient corresponding to the reduced time sequence feature set; St is an importance score corresponding to the reduced time sequence feature set; Ss is an importance score corresponding to the reduced statistical feature set; Sp is an importance score corresponding to the reduced protocol feature set; as is a weight coefficient corresponding to the reduced time sequence feature set; ap is a weight coefficient corresponding to the reduced statistical feature set.

[0033] According to some embodiments of the application, the fusion feature vector is input into a pre-trained network anomaly detection model, and a network anomaly detection result is output, including:

[0034] The fusion feature vector is input into a pre-trained network anomaly detection model, and a network anomaly detection result is output, including:

[0035] The convolutional feature map is processed along the channel dimension to obtain a pooling feature map;

[0036] The pooling feature map is processed along the channel dimension to obtain a pooling feature map;

[0037] The activation feature map is compared with a preset activation feature map, and the network anomaly detection result is determined according to the comparison result.

[0038] According to some embodiments of the application, the activation feature map is compared with a preset activation feature map, and the network anomaly detection result is determined according to the comparison result, including:

[0039] The brightness difference parameter of the activation feature map and the preset activation feature map is calculated;

[0040] The contrast difference parameter of the activation feature map and the preset activation feature map is calculated;

[0041] The structural content difference parameter of the activation feature map and the preset activation feature map is calculated;

[0042] The comparison result is determined according to the brightness difference parameter, the contrast difference parameter and the structural content difference parameter, and the network anomaly detection result is determined according to the comparison result.

[0043] According to some embodiments of the application, it further includes: determining a network anomaly type according to the network anomaly detection result, and issuing corresponding early warning information according to the network anomaly type; the network anomaly type includes periodic attack, traffic surge / drop, port scanning anomaly, data leakage and protocol anomaly.

[0044] According to some embodiments of the application, the detection system of the network anomaly detection method of the STN device is applied, including:

[0045] The acquisition module is used for acquiring network flow data of the STN device;

[0046] an extraction module configured to perform multi-dimensional feature extraction on the network traffic data to obtain a time-series feature set, a statistical feature set, and a protocol feature set;

[0047] a fusion module configured to perform cross-domain information fusion on the time-series feature set, the statistical feature set, and the protocol feature set to generate a fusion feature vector;

[0048] an output module configured to input the fusion feature vector into a pre-trained network anomaly detection model and output a network anomaly detection result.

[0049] The present application provides a network anomaly detection method and system for an STN device, which overcomes the expression capacity limitation of single-dimensional entropy features in the prior art through the cooperative extraction of a time-series feature set (capturing traffic periodicity), a statistical feature set (quantifying distribution anomalies), and a protocol feature set (analyzing industrial protocol semantics). The feature fusion mechanism is introduced to dynamically learn the contribution weight of different feature domains to anomaly detection, which improves the detection accuracy compared with the simple feature splicing of the prior art. The network anomaly detection model is used to identify the fusion feature vector, thereby improving the robustness.

[0050] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the present application. The objects and other advantages of the present application can be achieved and obtained by means of the structures particularly pointed out in the written description and the accompanying drawings.

[0051] The technical solutions of the present application will be further described in detail below with the help of the accompanying drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0052] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, illustrate the present application, and are used to explain the present application together with the embodiments of the present application, and do not constitute a limitation on the present application. In the drawings:

[0053] Figure 1 is a flowchart of a network anomaly detection method for an STN device according to an embodiment of the present application;

[0054] Figure 2 is a flowchart of collecting network traffic data of an STN device according to an embodiment of the present application;

[0055] Figure 3 is a block diagram of a network anomaly detection system for an STN device according to an embodiment of the present application. DETAILED DESCRIPTION

[0056] The preferred embodiments of the present application will be described below with reference to the accompanying drawings, and it should be understood that the preferred embodiments described herein are only used to explain and illustrate the present application, and do not constitute a limitation on the present application.

[0057] As Figure 1 shown, the embodiment of the application proposes a network anomaly detection method of STN device, comprising steps S1-S4:

[0058] S1, collecting network traffic data of STN device;

[0059] S2, performing multi-dimensional feature extraction on network traffic data to obtain time series feature set, statistical feature set and protocol feature set;

[0060] S3, performing cross-domain information fusion on the time series feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector;

[0061] S4, inputting the fusion feature vector into a pre-trained network anomaly detection model to output a network anomaly detection result.

[0062] The working principle of the above technical solution is: the network traffic data includes device-level communication traffic data, cross-node interaction traffic data and cloudized STN device environment traffic data; multi-dimensional feature extraction is performed on the network traffic data to obtain time series feature set, statistical feature set and protocol feature set; cross-domain information fusion is performed on the time series feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector; the fusion of multi-dimensional features is realized, which facilitates the comprehensive and accurate display of the feature parameters corresponding to the network traffic data based on the fusion feature vector. The fusion feature vector is input into a pre-trained network anomaly detection model to output a network anomaly detection result. The network anomaly detection model can realize the recognition of the multi-dimensional feature vector and perform network anomaly detection.

[0063] The beneficial effects of the above technical solution are: through the cooperative extraction of the time series feature set (capturing periodicity of traffic), the statistical feature set (quantifying distribution anomaly) and the protocol feature set (analyzing industrial protocol semantics), the expression ability limitation of single-dimensional entropy feature in the prior art is overcome. The feature fusion mechanism is introduced to dynamically learn the contribution weight of different feature domains to anomaly detection, which improves the detection accuracy compared with the simple feature splicing of the prior art. The network anomaly detection model is used to recognize the fusion feature vector, which improves the robustness.

[0064] As Figure 2 shown, according to some embodiments of the application, the network traffic data of the STN device is collected, comprising steps S11-S14:

[0065] S11, deploying port mirroring at the edge router of the STN device for the edge access layer to collect device-level communication traffic data;

[0066] S12, physically shunting backbone network traffic through a network shunt for the core exchange layer to collect cross-node interaction traffic data;

[0067] S13. For the virtualization platform layer, enable vSwitch traffic monitoring in the NFV infrastructure to collect traffic data from the cloud STN equipment environment;

[0068] S14. Determine the network traffic data of the STN device based on the device-level communication traffic data, the cross-node interaction traffic data, and the cloud-based STN device environment traffic data.

[0069] The above technical solution works by collecting device-level communication traffic data as single-point network traffic data. It also collects cross-node interaction traffic data to determine the interaction data between individual nodes as composite node network traffic data. In NFV (Network Function Virtualization) infrastructure, by enabling vSwitch (virtual switch) traffic monitoring, it collects environmental traffic data from cloud-based STN (Software-defined Transport Network) devices to determine network traffic data for the entire environment.

[0070] The beneficial effect of the above technical solution is that it facilitates comprehensive and accurate acquisition of network traffic data.

[0071] According to some embodiments of the present invention, multi-dimensional feature extraction is performed on network traffic data to obtain a temporal feature set, a statistical feature set, and a protocol feature set, including:

[0072] Input the network traffic data into a preset DNN network model to perform multi-dimensional feature extraction, capture the dynamic pattern of traffic changes over time, and determine a time series feature set; the time series feature set includes traffic fluctuation period entropy, connection duration variance, and packet arrival interval skewness;

[0073] Describe the global distribution characteristics of traffic and determine a statistical feature set; the statistical feature set includes source IP entropy, destination port distribution dispersion, and byte length kurtosis within a unit time window;

[0074] Analyze the protocol types and behaviors used in the traffic and determine the protocol feature set; the protocol feature set includes abnormal protocol type identification, abnormal frequency of TCP flag bit combinations, and HTTP response code error rate.

[0075] The working principle of the technical scheme is as follows: based on the DNN network model, multi-dimensional feature extraction is performed on network traffic, dynamic patterns of traffic changing over time are captured, periodic, burst or abnormal fluctuation behaviors are identified, and a time sequence feature set is determined. Traffic fluctuation period entropy is obtained by decomposing the traffic sequence into a frequency domain by using FFT, and the energy proportion of each frequency component is calculated, and then the entropy is determined, which is used to measure the periodic complexity. Connection duration time variance is obtained by calculating the variance of the duration time of all connections in a statistical window, which is used to identify abnormal long / short connections (such as DDoS slow attack). The skewness of the inter-arrival time (IAT) is calculated to detect burst traffic. The global distribution characteristics of the traffic are described, and the abnormal distribution mode is identified to determine the statistical feature set. The source IP entropy in a unit time window is determined by calculating the frequency distribution of the source IP in the statistical window, and the IP flooding (high entropy→uniform IP distribution) is detected. The destination port distribution dispersion is obtained by calculating the standard deviation of the destination port frequency, and the port scanning (high dispersion→port dispersion) is identified. The kurtosis of the data packet byte length is calculated to detect abnormal packet size. The protocol type and behavior are analyzed, and the protocol violation or abnormal interaction mode is identified. The abnormal protocol type identifier is used to check the protocol on a non-standard port and identify the protocol confusion attack. The TCP flag combination abnormal frequency is used to count the illegal flag combination in the statistical window to detect port scanning or vulnerability exploitation. The HTTP response code error rate is used to count the proportion of HTTP response codes of 4xx / 5xx to identify web attacks.

[0076] The beneficial effects of the technical scheme are as follows: the time sequence feature set, the statistical feature set and the protocol feature set can be accurately determined.

[0077] According to some embodiments of the application, cross-domain information fusion is performed on the time sequence feature set, the statistical feature set and the protocol feature set to generate a fusion feature vector, which includes:

[0078] The time sequence feature set, the statistical feature set and the protocol feature set are respectively subjected to dimension reduction processing to obtain a reduced dimension time sequence feature set, a reduced dimension statistical feature set and a reduced dimension protocol feature set.

[0079] Based on the kernel density estimation method, mutual information of all feature pairs between any two feature sets of the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set is calculated, and the average value of the mutual information of all feature pairs is taken as the mutual information correlation degree between the corresponding two feature sets. The mutual information correlation degree includes a first mutual information correlation degree between the reduced dimension time sequence feature set and the reduced dimension statistical feature set, a second mutual information correlation degree between the reduced dimension time sequence feature set and the reduced dimension protocol feature set, and a third mutual information correlation degree between the reduced dimension statistical feature set and the reduced dimension protocol feature set.

[0080] The importance scores corresponding to the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set are respectively determined.

[0081] convert the importance scores corresponding to the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set into corresponding weight coefficients;

[0082] perform cross-domain information fusion on the time sequence feature set, the statistical feature set and the protocol feature set according to the weight coefficients to generate a fusion feature vector.

[0083] The working principle and beneficial effects of the above technical solution are as follows: the time sequence feature set, the statistical feature set and the protocol feature set are respectively subjected to dimension reduction processing, which facilitates reduction of feature redundancy, improvement of calculation efficiency, and retention of key information. Based on a kernel density estimation method, mutual information of all feature pairs between any two of the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set is calculated, and an average value of the mutual information of all feature pairs is taken as a mutual information correlation degree between the two corresponding feature sets. The mutual information correlation degree includes a first mutual information correlation degree between the reduced dimension time sequence feature set and the reduced dimension statistical feature set, a second mutual information correlation degree between the reduced dimension time sequence feature set and the reduced dimension protocol feature set, and a third mutual information correlation degree between the reduced dimension statistical feature set and the reduced dimension protocol feature set. Importance scores corresponding to the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set are respectively determined, and the contribution of each reduced dimension feature set to the overall task is quantified. The importance scores corresponding to the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set are converted into corresponding weight coefficients. The importance scores are converted into weight coefficients. The time sequence feature set, the statistical feature set and the protocol feature set are subjected to cross-domain information fusion according to the weight coefficients to generate a fusion feature vector. The mutual information guides the fusion, the statistical dependence dynamically adjusts the weight, and information conflicts are avoided. This facilitates improvement of the accuracy of cross-domain information fusion of the time sequence feature set, the statistical feature set and the protocol feature set, and facilitates obtaining of an accurate fusion feature vector.

[0084] According to some embodiments of the present application, the importance scores corresponding to the reduced dimension time sequence feature set, the reduced dimension statistical feature set and the reduced dimension protocol feature set are respectively determined, and the method comprises:

[0085] the sum of the first mutual information correlation degree and the second mutual information correlation degree is taken as the importance score corresponding to the reduced dimension time sequence feature set;

[0086] the sum of the first mutual information correlation degree and the third mutual information correlation degree is taken as the importance score corresponding to the reduced dimension statistical feature set;

[0087] the sum of the second mutual information correlation degree and the third mutual information correlation degree is taken as the importance score corresponding to the reduced dimension protocol feature set.

[0088] The working principle and beneficial effects of the technical solution are as follows: the importance of the time sequence feature is determined by the correlation strength of the time sequence feature, the statistical feature and the protocol feature. The importance of the statistical feature is determined by the correlation strength of the time sequence feature, the statistical feature and the protocol feature. The importance of the protocol feature is determined by the correlation strength of the time sequence feature, the statistical feature and the protocol feature. Based on the corresponding importance scores, the importance quantification of the feature set is facilitated.

[0089] According to some embodiments of the application, converting the importance scores corresponding to the dimension-reduced time sequence feature set, the dimension-reduced statistical feature set and the dimension-reduced protocol feature set into corresponding weight coefficients comprises:

[0090] αt=exp(St) / (exp(St)+exp(Ss)+exp(Sp))

[0091] αs=exp(Ss) / (exp(St)+exp(Ss)+exp(Sp))

[0092] αp=exp(Sp) / (exp(St)+exp(Ss)+exp(Sp))

[0093] Wherein, αt is the weight coefficient corresponding to the dimension-reduced time sequence feature set; St is the importance score corresponding to the dimension-reduced time sequence feature set; Ss is the importance score corresponding to the dimension-reduced statistical feature set; Sp is the importance score corresponding to the dimension-reduced protocol feature set; αs is the weight coefficient corresponding to the dimension-reduced time sequence feature set; αp is the weight coefficient corresponding to the dimension-reduced statistical feature set.

[0094] The beneficial effects of the technical solution are as follows: the importance scores corresponding to the dimension-reduced time sequence feature set, the dimension-reduced statistical feature set and the dimension-reduced protocol feature set are accurately converted into corresponding weight coefficients, facilitating cross-domain information fusion.

[0095] According to some embodiments of the application, the fusion feature vector is input into a pre-trained network anomaly detection model, and a network anomaly detection result is output, comprising:

[0096] The fusion feature vector is input into the pre-trained network anomaly detection model, and a two-dimensional convolution kernel of the network anomaly detection model is used to perform convolution processing on the fusion feature vector to obtain a convolution feature map;

[0097] The convolution feature map is subjected to a channel-dimension pooling processing to obtain a pooling feature map;

[0098] The pooling feature map is subjected to a nonlinear activation to obtain an activation feature map;

[0099] The activation feature map is compared with a preset activation feature map, and the network anomaly detection result is determined according to the comparison result.

[0100] The working principle and beneficial effects of the above technical solution are as follows: the fusion feature vector is input into a pre-trained network anomaly detection model, a two-dimensional convolution kernel of the network anomaly detection model is used to perform convolution processing on the fusion feature vector to obtain a convolution feature map, and the local spatial correlation mode of the fusion feature vector is conveniently extracted. The convolution feature map is subjected to pooling processing along the channel dimension to obtain a pooling feature map, which is used to reduce the feature map dimension and retain significant modes. The pooling feature map is subjected to nonlinear activation to obtain an activated feature map; the nonlinear activation enhances the model expression capability. The activated feature map is preset to be an activated feature map corresponding to network normality. The activated feature map is compared with the preset activated feature map, and a network anomaly detection result is determined according to a comparison result. The accuracy of network anomaly detection is conveniently improved.

[0101] According to some embodiments of the application, the activated feature map is compared with the preset activated feature map, and a network anomaly detection result is determined according to a comparison result, which includes:

[0102] A luminance difference parameter of the activated feature map and the preset activated feature map is calculated.

[0103] A contrast difference parameter of the activated feature map and the preset activated feature map is calculated.

[0104] A structural content difference parameter of the activated feature map and the preset activated feature map is calculated.

[0105] The comparison result is determined according to the luminance difference parameter, the contrast difference parameter and the structural content difference parameter, and the network anomaly detection result is determined according to the comparison result.

[0106] The working principle of the above technical solution is as follows: the luminance difference parameter is used to measure the overall luminance difference, i.e., the mean difference, between the activated feature map and the preset activated feature map. The contrast difference parameter is used to measure the contrast difference, i.e., the variance difference, between the activated feature map and the preset activated feature map. The structural content difference parameter is used to measure the spatial structural similarity between the activated feature map and the preset activated feature map. The structural similarity index is used to display the structural content difference parameter. The luminance difference parameter, the contrast difference parameter and the structural content difference parameter are subjected to normalization processing and weighted calculation to obtain a numerical value corresponding to the comparison result, and the numerical value is compared with a preset threshold value or a corresponding preset data table to determine the network anomaly detection result. The preset threshold value is a threshold value for judging whether the network is abnormal. The preset data table is a network state (normal or abnormal) and type corresponding to each numerical value.

[0107] The beneficial effects of the above technical solution are as follows: multi-dimensional difference analysis is performed according to the luminance difference parameter, the contrast difference parameter and the structural content difference parameter, and the accuracy and robustness of anomaly detection are improved.

[0108] According to some embodiments of the present invention, it also includes: determining the type of network anomaly based on the network anomaly detection results, and issuing corresponding early warning information based on the network anomaly type; the network anomaly types include periodic attacks, sudden increase / decrease in traffic, port scanning anomalies, data leakage, and protocol anomalies.

[0109] The working principle and beneficial effects of the above technical solution are as follows: the network anomaly type is determined based on the network anomaly detection results, and corresponding warning information is issued based on the network anomaly type, so as to quickly understand the network anomaly type and then take corresponding measures to deal with the anomaly in a timely manner.

[0110] like Figure 3 As shown, according to some embodiments of the present invention, a detection system using the above-mentioned network anomaly detection method for STN equipment includes:

[0111] Collection module, used to collect network traffic data of STN equipment;

[0112] The extraction module is used to extract multi-dimensional features from network traffic data to obtain time series feature sets, statistical feature sets, and protocol feature sets;

[0113] The fusion module is used to perform cross-domain information fusion on the time series feature set, statistical feature set and protocol feature set to generate a fusion feature vector;

[0114] The output module is used to input the fused feature vector into the pre-trained network anomaly detection model and output the network anomaly detection results.

[0115] The beneficial effects of this technical solution include: By collaboratively extracting a temporal feature set (to capture traffic periodicity), a statistical feature set (to quantify distribution anomalies), and a protocol feature set (to analyze the semantics of industrial protocols), it overcomes the expressive limitations of single-dimensional entropy features in existing technologies. A feature fusion mechanism is introduced to dynamically learn the contribution weights of different feature domains to anomaly detection, improving detection accuracy compared to the simple feature splicing used in existing technologies. The fused feature vectors are identified based on the network anomaly detection model, improving robustness.

[0116] Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims

1. A network anomaly detection method for STN equipment, characterized in that: include: Collect network traffic data of STN equipment; Perform multi-dimensional feature extraction on network traffic data to obtain time series feature sets, statistical feature sets, and protocol feature sets; Perform cross-domain information fusion on the time series feature set, statistical feature set and protocol feature set to generate a fused feature vector; The fused feature vector is input into the pre-trained network anomaly detection model and the network anomaly detection result is output.

2. The network anomaly detection method for STN equipment according to claim 1, wherein Collect network traffic data of STN equipment, including: For the edge access layer, deploy port mirroring on the edge router of the STN device to collect device-level communication traffic data; For the core switching layer, the backbone network traffic is physically split by the network splitter to collect cross-node interactive traffic data; For the virtualization platform layer, vSwitch traffic monitoring is enabled in the NFV infrastructure to collect traffic data from the cloud-based STN equipment environment. Determine the network traffic data of STN devices based on device-level communication traffic data, cross-node interaction traffic data, and cloud-based STN device environment traffic data.

3. The network anomaly detection method of STN equipment according to claim 1, wherein Perform multi-dimensional feature extraction on network traffic data to obtain time series feature sets, statistical feature sets, and protocol feature sets, including: Input the network traffic data into a preset DNN network model to perform multi-dimensional feature extraction, capture the dynamic pattern of traffic changes over time, and determine a time series feature set; the time series feature set includes traffic fluctuation period entropy, connection duration variance, and packet arrival interval skewness; Describe the global distribution characteristics of traffic and determine a statistical feature set; the statistical feature set includes source IP entropy, destination port distribution dispersion, and byte length kurtosis within a unit time window; Analyze the protocol types and behaviors used in the traffic and determine the protocol feature set; the protocol feature set includes abnormal protocol type identification, abnormal frequency of TCP flag bit combinations, and HTTP response code error rate.

4. The network anomaly detection method for STN equipment according to claim 1, wherein Perform cross-domain information fusion on the time series feature set, statistical feature set, and protocol feature set to generate a fused feature vector, including: Performing dimensionality reduction processing on the time series feature set, the statistical feature set and the protocol feature set respectively to obtain a reduced-dimensionality time series feature set, a reduced-dimensionality statistical feature set and a reduced-dimensionality protocol feature set; Based on the kernel density estimation method, the mutual information of all feature pairs between any two feature sets among the reduced dimensionality time series feature set, the reduced dimensionality statistical feature set and the reduced dimensionality protocol feature set is calculated, and the average value of the mutual information of all feature pairs is used as the mutual information correlation between the corresponding two feature sets; the mutual information correlation includes a first mutual information correlation between the reduced dimensionality time series feature set and the reduced dimensionality statistical feature set, a second mutual information correlation between the reduced dimensionality time series feature set and the reduced dimensionality protocol feature set, and a third mutual information correlation between the reduced dimensionality statistical feature set and the reduced dimensionality protocol feature set; Determine the importance scores corresponding to the reduced dimensionality time series feature set, reduced dimensionality statistical feature set, and reduced dimensionality protocol feature set respectively; Convert the importance scores of the reduced-dimensionality time series feature set, the reduced-dimensionality statistical feature set, and the reduced-dimensionality protocol feature set into corresponding weight coefficients; The time series feature set, statistical feature set and protocol feature set are fused across domains according to the weight coefficient to generate a fused feature vector.

5. The network anomaly detection method for STN equipment according to claim 4, wherein: Determine the importance scores corresponding to the dimensionality reduction time series feature set, dimensionality reduction statistical feature set, and dimensionality reduction protocol feature set, including: The sum of the first mutual information correlation and the second mutual information correlation is used as the importance score corresponding to the dimensionality-reduced time series feature set; The sum of the first mutual information correlation and the third mutual information correlation is used as the importance score corresponding to the dimensionality reduction statistical feature set; The sum of the second mutual information correlation and the third mutual information correlation is used as the importance score corresponding to the dimensionality reduction protocol feature set.

6. The network anomaly detection method for STN equipment according to claim 5, wherein: The importance scores corresponding to the reduced-dimensionality time series feature set, reduced-dimensionality statistical feature set, and reduced-dimensionality protocol feature set are converted into corresponding weight coefficients, including: αt=exp(St) / (exp(St)+exp(Ss)+exp(Sp)) αs=exp(Ss) / (exp(St)+exp(Ss)+exp(Sp)) αp=exp(Sp) / (exp(St)+exp(Ss)+exp(Sp)) Among them, αt is the weight coefficient corresponding to the reduced dimensionality time series feature set; St is the importance score corresponding to the reduced dimensionality time series feature set; Ss is the importance score corresponding to the reduced dimensionality statistical feature set; Sp is the importance score corresponding to the reduced dimensionality protocol feature set; as is the weight coefficient corresponding to the reduced dimensionality time series feature set; αp is the weight coefficient corresponding to the reduced dimensionality statistical feature set.

7. The network anomaly detection method for STN equipment according to claim 1, wherein Input the fused feature vector into the pre-trained network anomaly detection model and output the network anomaly detection results, including: The fused feature vector is input into the pre-trained network anomaly detection model, and the fused feature vector is convolved based on the two-dimensional convolution kernel of the network anomaly detection model to obtain a convolution feature map; The convolution feature map is pooled along the channel dimension to obtain a pooled feature map; Perform nonlinear activation on the pooled feature map to obtain an activated feature map; The activation feature map is compared with the preset activation feature map, and the network anomaly detection result is determined based on the comparison result.

8. The network anomaly detection method for STN equipment according to claim 7, wherein: Compare the activation feature map with the preset activation feature map, and determine the network anomaly detection result based on the comparison result, including: Calculate the brightness difference parameter between the activation feature map and the preset activation feature map; Calculate the contrast difference parameter between the activation feature map and the preset activation feature map; Calculating the structural content difference parameter between the activation feature map and the preset activation feature map; The comparison result is determined according to the brightness difference parameter, the contrast difference parameter and the structure content difference parameter, and the network anomaly detection result is determined according to the comparison result.

9. The network anomaly detection method for STN equipment according to claim 1, wherein: Also includes: Determine the network anomaly type based on the network anomaly detection results and issue corresponding warning information based on the network anomaly type; The network anomaly types include periodic attacks, sudden increase / decrease in traffic, port scanning anomalies, data leakage, and protocol anomalies.

10. A detection system using the network anomaly detection method for STN equipment according to any one of claims 1 to 9, characterized in that: include: Collection module, used to collect network traffic data of STN equipment; The extraction module is used to extract multi-dimensional features from network traffic data to obtain time series feature sets, statistical feature sets, and protocol feature sets; The fusion module is used to perform cross-domain information fusion on the time series feature set, statistical feature set and protocol feature set to generate a fusion feature vector; The output module is used to input the fused feature vector into the pre-trained network anomaly detection model and output the network anomaly detection results.

Images