Network traffic anomaly detection method and device based on diffusion model, and medium

Abstract

The invention discloses a network traffic anomaly detection method and device based on a diffusion model, and a medium, and the method comprises the steps: carrying out the feature extraction and dimension reduction of to-be-detected network traffic data, and obtaining an original time sequence feature sequence; calculating the structured distribution uncertainty corresponding to the original time sequence feature sequence; inputting the original time sequence feature sequence into the trained diffusion model to obtain a reconstructed time sequence feature sequence; wherein the process of adding noise to the original time sequence feature sequence by the diffusion model comprises the following steps of: setting disturbance based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, and gradually applying disturbance to the original time sequence feature sequence in a forward process to add noise; calculating a mean square error between the original time sequence feature sequence and the reconstructed time sequence feature sequence, and a difference between the uncertainties of the structured distribution corresponding to the original time sequence feature sequence and the reconstructed time sequence feature sequence to obtain a network traffic anomaly score; and judging that the network flow data to be detected is abnormal network flow data when the network flow data to be detected is greater than the threshold value.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and artificial intelligence, and particularly relates to a network traffic anomaly detection method, device and medium based on a diffusion model. BACKGROUND

[0002] With the continuous acceleration of global informatization process, the Internet has become an important infrastructure for social operation and economic development. Network applications are increasingly diverse, and the user base continues to expand, leading to exponential growth in the volume, complexity and dynamics of network traffic. At the same time, network attack methods continue to evolve, from traditional viruses, Trojans, denial of service attacks (DoS / DDoS) to more covert advanced persistent threats (APT), zero-day exploit, malicious behavior in encrypted traffic, etc. Security threats are becoming diversified, intelligent and persistent. Network traffic anomaly detection, as a core part of the network security protection system, aims to identify abnormal traffic that deviates from normal behavior patterns in massive, high-dimensional, non-stationary network data, thereby achieving early warning and response to potential attack behavior.

[0003] In recent years, deep learning methods have been widely used in traffic anomaly detection, such as models based on recurrent neural networks (RNN), long short-term memory networks (LSTM), gated recurrent units (GRU), and convolutional neural networks (CNN), which can automatically extract high-dimensional time series features and improve the ability to identify complex attacks. However, existing deep learning models have poor adaptability to dynamic traffic changes. Network traffic behavior changes dynamically over time, users, and applications. Existing deep learning models mostly use fixed windows or static modeling, lack adaptive perception and model updating mechanisms for traffic evolution trends, and are difficult to adapt to the dynamic evolution of network behavior patterns in real time, resulting in detection lag, outdated models, and a large number of false positives. SUMMARY

[0004] To address the deficiencies in the prior art, the present application provides a network traffic anomaly detection method, device and medium based on a diffusion model.

[0005] In a first aspect, the present application provides a network traffic anomaly detection method based on a diffusion model, which comprises the following steps:

[0006] Feature extraction and dimensionality reduction are performed on the network traffic data to be detected to obtain an original time series feature sequence;

[0007] The structured distribution uncertainty corresponding to the original time series feature sequence is calculated;

[0008] input the original time sequence feature sequence into the trained diffusion model to obtain a reconstructed time sequence feature sequence; wherein the diffusion model processes the original time sequence feature sequence in a process including: setting a disturbance based on a structured distribution uncertainty corresponding to the original time sequence feature sequence, gradually applying the disturbance to the original time sequence feature sequence for noise adding in a forward process, and de-noising the noise-added sequence in a backward process;

[0009] calculate a mean square error between the original time sequence feature sequence and the reconstructed time sequence feature sequence, and a difference between structured distribution uncertainties corresponding to the original time sequence feature sequence and the reconstructed time sequence feature sequence, to obtain a network traffic anomaly score; when the network traffic anomaly score is greater than a threshold value, determine that the network traffic data to be detected is abnormal network traffic data.

[0010] In a second aspect, an embodiment of the present application provides an electronic device, comprising:

[0011] at least one processor; and

[0012] a memory in communication with the at least one processor; wherein

[0013] the memory stores one or more computer programs executable by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the network traffic anomaly detection method based on the diffusion model.

[0014] In a third aspect, an embodiment of the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the network traffic anomaly detection method based on the diffusion model.

[0015] In a fourth aspect, an embodiment of the present application provides a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the network traffic anomaly detection method based on the diffusion model.

[0016] Compared with the prior art, the present application has the following beneficial effects:

[0017] The present application provides a network traffic anomaly detection method based on a diffusion model, which calculates a structured distribution uncertainty corresponding to an original time sequence feature sequence, sets a disturbance based on the structured distribution uncertainty corresponding to the original time sequence feature sequence in a forward noise adding process of the diffusion model on the original time sequence feature sequence, gradually applies the disturbance to the original time sequence feature sequence for noise adding, thereby effectively capturing complex and multi-scale network traffic time-dependent features under unsupervised conditions, dynamically adapting to network traffic changes, and detecting various hidden attacks, thereby improving the intelligence of network security protection. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 A flowchart of a network traffic anomaly detection method based on a diffusion model provided in an embodiment of the present invention;

[0020] Figure 2 A flowchart illustrating the training process of the diffusion model provided in this embodiment of the invention;

[0021] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.

[0024] like Figure 1 As shown in the figure, this embodiment of the invention provides a network traffic anomaly detection method based on a diffusion model, the method comprising:

[0025] Step S1: Perform feature extraction and dimensionality reduction on the network traffic data to be detected to obtain the original time-series feature sequence.

[0026] Specifically, in this example, feature extraction of network traffic data includes extracting one or more of the following network traffic features: flow duration, protocol type, total number of data packets, average packet length, standard deviation of packet length, inter-flow arrival time interval, and TCP flag statistics.

[0027] Furthermore, the process of dimensionality reduction of network traffic features includes: using a combination of mutual information and principal component analysis (PCA), firstly, redundant features are removed through mutual information, and then high-dimensional features are mapped to a low-dimensional space through principal component analysis.

[0028] The extracted and dimensionality-reduced network traffic features are segmented in chronological order to construct an original temporal feature sequence of length k and dimension d.

[0029] Step S2: Calculate the structured distribution uncertainty corresponding to the original time-series feature sequence.

[0030] Specifically, the structured distribution uncertainty is a weighted sum of the first, second, third, and fourth polynomials; the expression is as follows:

[0031]

[0032] In the formula, Indicates the weighting coefficient. This represents the first polynomial, i.e., the balance term. This represents the second polynomial, i.e., the rare amplification term. This represents the third polynomial, i.e., the coupling deviation term. This represents the fourth polynomial, i.e., the mutation term.

[0033] The first polynomial is obtained by calculating the product of the probability of each value of the target network traffic feature and a factor minus that probability, and then summing all the products; the expression for measuring the dispersion of the target network traffic feature is as follows:

[0034]

[0035] In the formula, This represents the probability of the i-th value of the target network traffic feature occurring, and K represents the number of different values ​​of the target network traffic feature within the current time window. The target network traffic feature is a single network traffic feature, such as a target port or protocol type.

[0036] The second polynomial is obtained by calculating the difference between the rarity threshold and the probability of each value of the target network traffic feature, and summing all the differences. This second polynomial is used to enhance the contribution of low-frequency target network traffic features to the overall uncertainty, amplifying the significance of low-frequency categories and preventing them from being overwhelmed by the overall frequency. The expression is as follows:

[0037]

[0038] In the formula, This represents the rarity threshold.

[0039] The third polynomial is obtained by calculating the absolute value of the difference between the joint distribution probability of the first dimension network traffic feature and the second dimension network traffic feature and the product of the respective marginal probabilities, and accumulating all the absolute values; the third polynomial is used to measure the deviation of the joint distribution of different network traffic feature dimensions from the independent assumption, depict the deviation from the independent assumption across domains (such as port-protocol), and capture the compatibility anomaly; the expression is as follows:

[0040]

[0041] In the formula, denotes the probability of the i-th value of the first dimension target network traffic feature appearing, denotes the probability of the i-th value of the second dimension target network traffic feature appearing, denotes the joint probability of the i-th value of the first dimension target network traffic feature and the i-th value of the second dimension target network traffic feature appearing, K denotes the number of different values of the first dimension target network traffic feature in the current time window, and K' denotes the number of different values of the second dimension target network traffic feature in the current time window.

[0042] The fourth polynomial is obtained by calculating the sum of squares of the difference between the logarithmic value of the probability of each value of the target network traffic feature in the current time window and the logarithmic value of the probability of each value of the target network traffic feature in the previous time window, and accumulating all the sums of squares; the fourth polynomial is used to measure the mutation degree of the target network traffic feature in adjacent time windows; the expression is as follows:

[0043]

[0044] In the formula, denotes the probability of the i-th value of the target network traffic feature appearing in the time window t, denotes the probability of the i-th value of the target network traffic feature appearing in the adjacent previous time window t-1, denotes a numerical stability constant.

[0045] In step S3, the original time series feature sequence is input into the trained diffusion model to obtain a reconstructed time series feature sequence; wherein the process of the diffusion model processing the original time series feature sequence includes: setting a disturbance based on the structured distribution uncertainty corresponding to the original time series feature sequence, gradually applying the disturbance to the original time series feature sequence for noise addition in the forward process, and de-noising the noise-added sequence in the backward process.

[0046] Further, the process of setting a disturbance based on the structured distribution uncertainty corresponding to the original time series feature sequence, and gradually applying the disturbance to the original time series feature sequence for noise addition in the forward process includes:

[0047] The disturbance is applied to the original time series feature sequence step by step in T time steps in the forward process, and the disturbance includes a first disturbance, a second disturbance and / or a third disturbance;

[0048] The first disturbance is an amplitude disturbance of continuous channels, that is, a zero-mean disturbance is injected into continuous features; the scale of the first disturbance is determined according to the normalized uncertainty of the current time step and the trajectory curvature; wherein the normalized uncertainty of the current time step is obtained according to the structured distribution uncertainty corresponding to the original time series feature sequence; the expression is as follows:

[0049]

[0050] In the formula, The scale of the first disturbance is represented by The minimum scale of the first disturbance is represented by The maximum scale of the first disturbance is represented by is a Sigmod function, The normalized uncertainty corresponding to the current time step is represented by The trajectory curvature is approximated by the second-order difference of the cumulative amount-time curve, And b represents a weight coefficient.

[0051] The second disturbance is a replacement or mask disturbance of discrete channels, and the second disturbance is performed according to a target probability The replacement or mask of network traffic features is performed, and the target probability Is set according to the normalized uncertainty of the current time step .

[0052] The third disturbance is to insert a short pulse according to a target amplitude, wherein the target amplitude is determined according to the normalized uncertainty of the current time step, the trajectory curvature and the conditional vector.

[0053]

[0054]

[0055] In the formula, The target amplitude of the third disturbance is represented by The minimum amplitude of the third disturbance is represented by The maximum amplitude of the third disturbance is represented by The normalized uncertainty corresponding to the current time step is represented by The trajectory curvature is approximated by the second-order difference of the cumulative amount-time curve, The statistical value of the conditional vector C is represented by The amplitude of the short pulse actually inserted at the current time step is represented by The maximum value of the short pulse amplitude is represented by

[0056] Further, in the present example, the calculation process of the condition vector C includes:

[0057] Obtaining the intra-sample statistical correlation of the original time series feature sequence;

[0058] Obtaining the soft mask m corresponding to the structured distribution uncertainty corresponding to the original time series feature sequence;

[0059] Obtaining the sequence context vector C according to the intra-sample statistical correlation of the original time series feature sequence and the soft mask seq ;

[0060] Obtaining the uncertainty context vector C according to the average value, maximum value, and standard deviation of the soft mask U* ;

[0061] Concatenating the sequence context vector and the uncertainty context vector to obtain the condition vector C = [C seq ;C U* ].

[0062] Further, the process of denoising the noisy sequence in the backward process includes:

[0063] In the reverse generation process, the current noisy sample is conditioned and denoised to predict by a conditioned restoration network ; wherein the conditioned restoration network can be a convolutional neural network, a feedforward network, a gated network, etc.

[0064] Step S4, calculating the mean square error between the original time series feature sequence and the reconstructed time series feature sequence, and the difference between the structured distribution uncertainty corresponding to the original time series feature sequence and the structured distribution uncertainty corresponding to the reconstructed time series feature sequence, to obtain a network traffic anomaly score; when the network traffic anomaly score is greater than a threshold value, it is determined that the network traffic data to be detected is abnormal network traffic data.

[0065]

[0066] wherein Score represents the network traffic anomaly score, k represents the length, d represents the dimension, represents the original element of the i-th length and the j-th dimension, represents the reconstructed element of the i-th length and the j-th dimension, represents the weight coefficient (in the present example, ), represents the structured distribution uncertainty corresponding to the original time series feature sequence X, represents the structured distribution uncertainty corresponding to the reconstructed time series feature sequence X’.

[0067] Further, as Figure 2As shown, the training process of the diffusion model includes:

[0068] In step S100, normal network traffic data is obtained, feature extraction and dimension reduction are performed on the normal network traffic data, and an original time series feature sequence is obtained.

[0069] In step S200, a structured distribution uncertainty corresponding to the original time series feature sequence is calculated.

[0070] In step S3, the original time series feature sequence is input into the diffusion model, a joint loss function is constructed, and the diffusion model is trained based on gradient descent method according to the joint loss function.

[0071] The expression of the joint loss function is as follows:

[0072]

[0073] In the formula, represents the disturbance vector applied to the sample in the forward noise adding process, represents the predicted disturbance vector of the sample after the conditional recovery network at the t-th step, t represents the time step index, and C represents the conditional vector, represents the sample after the s-th step in the reverse denoising process, t represents the time step index, C represents the conditional vector, and T represents the total number of time steps, is the lower limit of the budget of the s-th step, represents the decrease of the structured distribution uncertainty after the s-th step, OrderLoss represents an ordered loss function used to constrain the time order not to be reversed, and MassLoss is used to constrain the deviation between the original time series feature sequence and the reconstructed time series feature sequence, 、 、 represents the weight coefficient.

[0074] The expression of OrderLoss is as follows:

[0075]

[0076] In the formula, represents the intensity-normalized time series feature sequence (i.e., time-rescaling transform or cumulative intensity), and k represents the total length of the time series feature sequence, i.e., the total number of time steps in the time series feature sequence.

[0077] The expression of MassLoss is as follows:

[0078]

[0079]

[0080]

[0081]

[0082]

[0083] In the formula, And Indicates the weight coefficient, Indicates the stability constant to prevent the denominator from being zero, Indicates the mean vector of the original time sequence feature sequence, Indicates the mean vector of the reconstructed time sequence feature sequence, Indicates the standard deviation vector of the original time sequence feature sequence, Indicates the standard deviation vector of the reconstructed time sequence feature sequence, d indicates the dimension of the feature, Indicates the jth feature value of the original time sequence feature sequence at time t, Indicates the jth feature value of the reconstructed time sequence feature sequence at time t, Indicates the mean of the jth feature value of the original time sequence feature sequence at all time steps, Indicates the mean of the jth feature value of the reconstructed time sequence feature sequence at all time steps, t indicates the time step index, and k indicates the total length of the time sequence feature sequence, that is, the total number of time steps in the time sequence feature sequence.

[0084] In summary, the present application calculates the structured distribution uncertainty corresponding to the original time sequence feature sequence (taking into account the four types of signals of "balance degree-rarity-coupling deviation-time sequence mutation"); in the process of forward noise addition to the original time sequence feature sequence by the diffusion model, disturbance is set based on the structured distribution uncertainty corresponding to the original time sequence feature sequence, and adaptive composite disturbance is gradually applied to the original time sequence feature sequence for noise addition, so that the disturbance intensity changes adaptively with the uncertainty and curvature; In the backward generation process, conditional recovery is carried out, so that the recovery not only minimizes the disturbance estimation error, but also requires each step to realize the uncertainty decrease according to the budget and keep the order and statistics consistent, so as to form controllable and stable implicit time sequence constraint modeling and reconstruction ability in high-dimensional feature space; Therefore, complex and multi-scale network traffic time-dependent features can be effectively captured under unsupervised conditions, network traffic changes can be dynamically adapted, and various covert attacks can be detected, thereby improving the intelligence of network security protection. The problem that strong correlation and cross-time step global dependence exist between network traffic time sequence features and are difficult to effectively depict is solved.

[0085] Thus, without changing the input and output forms and the existing feature processing flow, the detection rate and robustness of multi-protocol, port and load scenarios are improved, false positives and false negatives are reduced, and cross-scene migration is enhanced; in the reasoning stage, a combination score of "reconstruction error + uncertainty difference" is used, taking into account the difficulty of recovery and the lack of structure simplification, to further improve the separability of abnormal and normal; the overall scheme of the application has low dependence on artificial rules and labels, and facilitates modular integration and deployment with existing network security platforms.

[0086] Correspondingly, the application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the network traffic anomaly detection method based on the diffusion model as described above. As Figure 3 As shown in the figure, a hardware structure diagram of any data processing capable device where the network traffic anomaly detection method based on the diffusion model provided by the embodiment of the application is located, in addition to the processor, the memory and the network interface shown in the figure, any data processing capable device where the device in the embodiment is usually according to the actual function of the data processing capable device, can also include other hardware, which will not be described here. Figure 3

[0087] Correspondingly, the application also provides a computer readable storage medium having computer instructions stored thereon, which are executed by a processor to implement the network traffic anomaly detection method based on the diffusion model as described above. The computer readable storage medium can be an internal storage unit of any data processing capable device, such as a hard disk or a memory. The computer readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can include both the internal storage unit of any data processing capable device and the external storage device. The computer readable storage medium is used to store the computer program and other programs and data required by the data processing capable device, and can also be used to temporarily store data that has been output or will be output.

[0088] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as exemplary only.

[0089] ​It is to be understood that the application is not limited to the precise construction already described above and shown in the drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope thereof.

Claims

1. A network traffic anomaly detection method based on a diffusion model, characterized in that, The method includes the following steps: Feature extraction and dimensionality reduction are performed on the network traffic data to be detected to obtain the original time-series feature sequence; Calculate the structured distribution uncertainty corresponding to the original time-series feature sequence; The original time-series feature sequence is input into the trained diffusion model to obtain the reconstructed time-series feature sequence. The process of the diffusion model processing the original time-series feature sequence includes: setting a perturbation based on the structured distribution uncertainty corresponding to the original time-series feature sequence; gradually applying the perturbation to the original time-series feature sequence to add noise during the forward process; and denoising the noisy sequence during the backward process. The mean square error between the original time-series feature sequence and the reconstructed time-series feature sequence, as well as the difference between the structured distribution uncertainties corresponding to the original time-series feature sequence and the reconstructed time-series feature sequence, are calculated to obtain the network traffic anomaly score. When the network traffic anomaly score is greater than a threshold, the network traffic data to be detected is determined to be abnormal network traffic data.

2. The network traffic anomaly detection method based on a diffusion model according to claim 1, characterized in that, The process of feature extraction from the network traffic data to be detected includes: Extract network traffic features including flow duration, protocol type, total number of packets, average packet length, standard deviation of packet length, inter-flow arrival time, and TCP flag statistics.

3. The network traffic anomaly detection method based on a diffusion model according to claim 1, characterized in that, The process of calculating the structured distribution uncertainty corresponding to the original time-series feature sequence includes: The structured distribution uncertainty is a weighted sum of the first polynomial, the second polynomial, the third polynomial, and the fourth polynomial; The first polynomial is obtained by calculating the product of the probability of each value of the target network traffic feature and a factor minus that probability, and then summing all the products; the polynomial is used to measure the dispersion of the distribution of the target network traffic feature. The second polynomial is obtained by calculating the difference between the rarity threshold and the probability of each value of the target network traffic feature, and summing all the differences; the second polynomial is used to enhance the contribution of low-frequency target network traffic features to the overall uncertainty. The third polynomial is obtained by calculating the absolute value of the difference between the joint distribution probability of the first-dimensional network traffic feature and the second-dimensional network traffic feature and the product of their respective marginal probabilities, and summing all the absolute values; the third polynomial is used to measure the degree of deviation of the joint distribution between different dimensions of network traffic features from its independence hypothesis. The fourth polynomial is obtained by summing the sum of the squares of the differences between the logarithm of the probability of each value of the target network traffic feature in the current time window and the logarithm of the probability in the previous time window; the fourth polynomial is used to measure the degree of abrupt change of the target network traffic feature in adjacent time windows.

4. The network traffic anomaly detection method based on a diffusion model according to claim 1, characterized in that, The process of adding noise by gradually applying perturbations to the original time-series feature sequence during the forward pass, based on the uncertainty of the structured distribution corresponding to the original time-series feature sequence, includes: In the forward process, perturbations are gradually applied to the original temporal feature sequence over T time steps, and the perturbations include a first perturbation, a second perturbation, and / or a third perturbation; The first disturbance is an amplitude disturbance of a continuous channel, and the scale of the first disturbance is determined based on the normalized uncertainty and trajectory curvature of the current time step; wherein, the normalized uncertainty of the current time step is obtained based on the structured distribution uncertainty corresponding to the original time series feature sequence; The second perturbation is a replacement or masking perturbation of discrete channels. The second perturbation performs the replacement or masking of network traffic features according to a target probability, which is set based on the normalized uncertainty of the current time step. The third perturbation is the insertion of short pulses at the target frequency, wherein the target frequency is determined based on the normalized uncertainty, trajectory curvature, and condition vector of the current time step.

5. The network traffic anomaly detection method based on a diffusion model according to claim 4, characterized in that, The calculation process of the condition vector includes: Obtain the intra-sample statistical correlation of the original time-series feature sequences; Obtain the soft mask corresponding to the structured distribution uncertainty of the original time-series feature sequence; The sequence context vector is obtained based on the statistical correlation within the original time-series feature sequence samples and the soft mask. Obtain the uncertainty context vector based on the mean, maximum, and standard deviation of the soft mask; The condition vector is obtained by concatenating the sequence context vector and the uncertainty context vector.

6. The network traffic anomaly detection method based on a diffusion model according to claim 1, characterized in that, The training process of the diffusion model includes: Obtain normal network traffic data, perform feature extraction and dimensionality reduction on the normal network traffic data, and obtain the original time-series feature sequence; Calculate the structured distribution uncertainty corresponding to the original time-series feature sequence; The original time-series feature sequence is input into the diffusion model to obtain the reconstructed time-series feature sequence. The process of the diffusion model processing the original time-series feature sequence includes: setting a perturbation based on the structured distribution uncertainty corresponding to the original time-series feature sequence; gradually applying the perturbation to the original time-series feature sequence to add noise during the forward process; and denoising the noisy sequence during the backward process. A joint loss function is set to train the diffusion model based on gradient descent; wherein the joint loss function is a weighted sum of the first loss function, the second loss function, the third loss function, and the fourth loss function; wherein the first loss function is used to constrain the perturbation estimation error, the second loss function is used to constrain the complexity budget, the third loss function is used to constrain the time order from being reversed, and the fourth loss function is used to constrain the deviation between the original time series feature sequence and the reconstructed time series feature sequence.

7. The network traffic anomaly detection method based on a diffusion model according to claim 6, characterized in that, The first loss function is the square of the L2 norm of the perturbation added to the original temporal feature sequence sample during the forward process at time step s, and the perturbation predicted by the conditional restoration network at step t after the perturbed sample, time step index t, and conditional vector.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores one or more computer programs that can be executed by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the network traffic anomaly detection method based on the diffusion model as described in any one of claims 1-7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network traffic anomaly detection method based on the diffusion model as described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the network traffic anomaly detection method based on the diffusion model as described in any one of claims 1-7.

Images