Cache-aware data self-driven traffic anomaly online detection method and system, computer equipment and readable storage medium

Abstract

The invention discloses a cache-aware data self-driven traffic anomaly online detection method and system, computer equipment and a readable storage medium, and the method comprises the steps: constructing a multi-stage traffic data cache pool, and storing data in different traffic data cache pools according to timeliness, performing traffic feature extraction on the data in the traffic data cache pool with the nearest data timeliness, and pre-training a base model for traffic anomaly detection through the extracted traffic features to obtain a trained base model; and calculating the characteristic drift of the flow characteristic, evaluating the flow characteristic in real time through the characteristic drift, when the characteristic drift exceeds a preset threshold value, updating the pre-trained base model to obtain an updated detection model, and carrying out anomaly detection on the real-time flow through the updated detection model. Based on the flow characteristic dynamic sensing technology, the system can automatically trigger model updating, and the adaptive capacity to a novel attack mode is remarkably enhanced.

Description

Technical Field

[0001] This invention relates to network traffic anomaly detection, specifically to a cache-aware, self-driven online traffic anomaly detection method, system, computer equipment, and readable storage medium. Background Technology

[0002] In the current network environment, with the rapid development of technologies such as cloud computing and the Internet of Things, network traffic is exhibiting explosive growth and dynamic changes, posing unprecedented challenges to traffic anomaly detection. Traditional traffic anomaly detection methods typically employ static models or fixed-period offline training mechanisms, which are ill-suited to the dynamic characteristics of network traffic changes. This results in model updates lagging behind actual traffic variations, making it difficult to guarantee detection accuracy and timeliness. Especially when facing sudden network attacks or new types of abnormal traffic, existing methods often fail to capture the changing patterns of traffic characteristics in a timely manner due to problems such as long model training cycles and rigid data sampling strategies, leading to increased false negative or missed detection rates and seriously affecting the security and stability of network operations.

[0003] In existing technologies, machine learning-based traffic anomaly detection systems typically rely on batch training with historical data, lacking the ability to dynamically perceive real-time traffic data. These systems often employ uniform sampling or fixed-weight sampling strategies, ignoring the temporal differences in traffic data and the uneven distribution of features, leading to a mismatch between model training data and actual traffic characteristics. Furthermore, traditional detection model update mechanisms often rely on manual intervention or preset periodic triggering, resulting in slow response times and difficulty adapting to the volatile characteristics of traffic anomalies in different network scenarios. This passive model update approach significantly reduces the system's protective capabilities against zero-day attacks or complex and ever-changing network environments.

[0004] Especially in high-concurrency traffic scenarios, existing methods struggle to balance the contradiction between real-time detection and model update efficiency. They cannot fully utilize the spatiotemporal correlation features of cached data, nor do they have the ability to adaptively learn the evolution patterns of abnormal traffic. Summary of the Invention

[0005] Purpose of the invention: To address the above-mentioned shortcomings, this invention provides a cache-aware, self-driven online detection method, system, computer equipment, and readable storage medium for dynamic security protection and efficient and reliable detection of data traffic anomalies.

[0006] Technical Solution: To solve the above problems, this invention employs a cache-aware, self-driven, online traffic anomaly detection method, comprising the following steps:

[0007] A multi-level traffic data cache pool is constructed, and data is stored in different traffic data cache pools according to timeliness. Traffic features are extracted from the data in the traffic data cache pool with the most recent data timeliness. The base model for traffic anomaly detection is pre-trained using the extracted traffic features to obtain the trained base model.

[0008] The feature drift of traffic characteristics is calculated. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model. The updated detection model is then used to detect anomalies in real-time traffic.

[0009] Furthermore, the multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The data is stored in different traffic data cache pools according to its timeliness, specifically including: caching real-time traffic data in the in-memory database, dividing recent traffic data and historical traffic data through a sliding window mechanism, storing recent traffic data in the in-memory database, and archiving historical traffic data to the distributed storage system.

[0010] Furthermore, the extracted traffic features are sampled, and the sampled traffic features are pre-trained into a base model for traffic anomaly detection. An adaptive sampling algorithm is used to calculate the sampling weight of each traffic feature. :

[0011]

[0012] in, As a time-dependent decay factor, The feature entropy value is used to measure the complexity of the distribution of traffic characteristics. Attention weights are used to measure the importance of anomaly-related features. For the current moment, This represents the sampling time window.

[0013] Furthermore, the feature drift includes the KL divergence index or multi-scale similarity. The KL divergence index is used to measure the degree of deviation between the current flow characteristic distribution and the historical baseline, and the multi-scale similarity... The calculation formula is:

[0014]

[0015] in, For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. This represents the natural exponential function.

[0016] Furthermore, when performing anomaly detection on real-time traffic using the updated detection model, the judgment threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.

[0017] Furthermore, the dynamically optimized decision threshold includes introducing an adaptive smoothing factor to optimize the decision threshold; the dynamic optimization formula is:

[0018]

[0019] in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

[0020] This invention also employs a cache-aware, self-driven, online traffic anomaly detection system, comprising:

[0021] The data storage module is used to build a multi-level traffic data cache pool, and the data is stored in different traffic data cache pools according to the timeliness.

[0022] The model building module is used to extract traffic features from the traffic data cache pool with the most recent data timeliness, and to pre-train a base model for traffic anomaly detection using the extracted traffic features to obtain the trained base model.

[0023] The model update module is used to calculate the feature drift of traffic features. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model.

[0024] The detection module is used to detect anomalies in real-time traffic using an updated detection model.

[0025] Furthermore, the multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The data is stored in different traffic data cache pools according to its timeliness, specifically including: caching real-time traffic data in the in-memory database, dividing recent traffic data and historical traffic data through a sliding window mechanism, storing recent traffic data in the in-memory database, and archiving historical traffic data to the distributed storage system.

[0026] Furthermore, the extracted traffic features are sampled, and the sampled traffic features are pre-trained into a base model for traffic anomaly detection. An adaptive sampling algorithm is used to calculate the sampling weight of each traffic feature. :

[0027]

[0028] in, As a time-dependent decay factor, The feature entropy value is used to measure the complexity of the distribution of traffic characteristics. Attention weights are used to measure the importance of anomaly-related features. For the current moment, This represents the sampling time window.

[0029] Furthermore, the feature drift includes the KL divergence index or multi-scale similarity. The KL divergence index is used to measure the degree of deviation between the current flow characteristic distribution and the historical baseline, and the multi-scale similarity... The calculation formula is:

[0030]

[0031] in, For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. This represents the natural exponential function.

[0032] Furthermore, when performing anomaly detection on real-time traffic using the updated detection model, the judgment threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.

[0033] Furthermore, the dynamically optimized decision threshold includes introducing an adaptive smoothing factor to optimize the decision threshold; the dynamic optimization formula is:

[0034]

[0035] in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

[0036] A high-performance parallel detection engine is deployed, which adopts a multi-level pipeline architecture to process real-time traffic in parallel, supports parallel anomaly detection under high throughput, and optimizes the data transmission path with lock-free queues and zero-copy technology, significantly reducing detection latency and improving system throughput.

[0037] The present invention also employs a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0038] The present invention also employs a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above method.

[0039] Beneficial Effects: Compared to existing technologies, the significant advantage of this invention is its dynamic traffic feature perception technology. The system can automatically trigger model updates, significantly enhancing its adaptability to new attack patterns. Automatic optimization of traffic feature sampling strategies ensures sufficient representation of abnormal traffic in training samples, improving the accuracy of anomaly detection by the model. The efficient online traffic detection engine enhances the system's throughput in high-concurrency traffic scenarios, significantly improving real-time network security protection capabilities. The dynamic threshold optimization mechanism effectively balances detection accuracy and false alarm rate, maintaining good anomaly identification performance even in complex network environments. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the detection method in this invention.

[0041] Figure 2 This is an architecture diagram of the detection system in this invention.

[0042] Figure 3 This is a flowchart illustrating the application of the present invention in the advanced measurement system of smart grids. Detailed Implementation

[0043] Example 1

[0044] like Figure 1 and Figure 2 As shown in this embodiment, a cache-aware, self-driven online traffic anomaly detection method is applicable to dynamic security protection and real-time efficient traffic monitoring in large-scale network environments. It is an online traffic anomaly detection mechanism that can dynamically sense changes in traffic characteristics and autonomously trigger model updates to achieve dynamic iteration and efficient and reliable detection of the traffic anomaly detection model.

[0045] Specifically, the following steps are included:

[0046] A multi-level traffic data cache pool is constructed, and data is stored in different traffic data cache pools according to timeliness. Traffic features are extracted from the data in the traffic data cache pool with the most recent data timeliness. The base model for traffic anomaly detection is pre-trained using the extracted traffic features to obtain the trained base model.

[0047] The feature drift of traffic characteristics is calculated, and the traffic characteristics are evaluated in real time through the feature drift. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model. The updated detection model is then used to detect anomalies in real-time traffic.

[0048] The multi-level traffic data cache pool adopts a hierarchical storage strategy, uses a sliding window mechanism to dynamically store network traffic slices, and automatically evicts expired data based on a timeliness strategy. The multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The sliding window mechanism divides recent traffic data and historical traffic data, prioritizes caching real-time traffic data in the in-memory database, and automatically archives historical data to the distributed storage system, thereby achieving efficient utilization of storage resources.

[0049] In the base model for traffic anomaly detection, which is pre-trained using extracted traffic features, an adaptive sampling algorithm is used to dynamically calculate the sampling weight of each traffic feature by comprehensively considering data timeliness, feature distribution entropy, and anomaly correlation index. The adaptive sampling algorithm introduces an attention mechanism to automatically adjust the sampling weight of each dimension feature according to the dynamic changes of traffic features, focusing on key features that are strongly correlated with anomaly detection.

[0050] A feature drift monitoring mechanism is used to assess changes in traffic feature distribution in real time and trigger model updates. This mechanism employs a multi-scale detection strategy, combining short-term sliding windows and long-term trend analysis to accurately identify substantial changes in network traffic patterns. When feature drift exceeds a preset threshold, knowledge distillation is used to fine-tune the model based on the pre-trained base model and the latest cached data. This knowledge distillation mechanism preserves the key decision weights of the original model during updates, avoiding performance degradation caused by incremental training.

[0051] A high-performance parallel detection engine is deployed, employing a multi-stage pipeline architecture to process real-time traffic in parallel, supporting parallel anomaly detection under high throughput. The high-performance parallel detection engine uses lock-free queues and zero-copy technology to optimize data transmission paths, significantly reducing detection latency and improving system throughput.

[0052] A dynamic threshold optimization strategy is implemented to automatically adjust the classification decision boundary of the detection model. This strategy automatically adjusts the sensitivity of threshold adjustment based on changes in the network environment, balancing real-time performance and stability.

[0053] Example 2

[0054] This embodiment presents a cache-aware, self-driven online traffic anomaly detection method applied to an advanced metering system for smart grids to monitor the communication traffic of smart meters. For example... Figure 3 As shown, in the advanced metering system of the smart grid, the system achieves dynamic management of communication traffic through a multi-level caching architecture. Addressing the periodic characteristics of smart meter communication (such as 15-minute heartbeat packets and hourly data reporting), the system constructs a hierarchical cache pool comprising an in-memory database and distributed storage. The in-memory cache employs a sliding window mechanism, retaining real-time traffic slices from the most recent 15 minutes, and uses a time-sensitivity decay factor. Historical data is dynamically discarded. This design ensures fast access to real-time data while avoiding excessive consumption of storage resources.

[0055] The adaptive sampling strategy introduces a multi-dimensional weight calculation model, the core expression of which is:

[0056]

[0057] Among them, the timeliness decay factor α controls the weight of data timeliness, and the feature entropy value... Attention weights are used to measure the distributional complexity of traffic features. The model automatically learns the importance of anomaly-related features through neural networks. It specifically assigns three times the base weight to sudden control commands (such as firmware upgrade commands) in smart meter communication, ensuring that abnormal traffic is adequately represented in the training samples.

[0058] The feature drift detection module uses the KL divergence index. The system continuously monitors the deviation of current traffic characteristics from historical baselines. When abnormally high-frequency sessions are detected at the meter communication protocol layer (e.g., a 200% surge in Modbus TCP connection requests), the system automatically triggers a model update mechanism. The update process employs knowledge distillation and fine-tuning techniques, using a loss function... To achieve knowledge fusion between the old and new models, while retaining the original ability to identify normal power consumption patterns, the learning ability of new man-in-the-middle attack characteristics is integrated.

[0059] The online detection engine employs a multi-stage pipeline architecture, using a protocol parsing acceleration module to achieve real-time processing of measurement data. The dynamic threshold optimization mechanism is based on sliding window baseline statistics and utilizes an exponential smoothing algorithm. Automatically adjust the anomaly detection boundaries, among which As a smoothing factor, This represents the average traffic characteristics of the current window. In this embodiment, the online detection method achieves a balance between efficient response and high-precision detection, while keeping the false positive rate for normal business operations at a low level.

[0060] Example 3

[0061] This embodiment presents a cache-aware, self-driven online traffic anomaly detection method applied to the protection scenario of an industrial control network in a smart substation, monitoring communication traffic within the substation. In the process layer network of the smart substation, a protocol-aware multimodal cache architecture is constructed, with optimized storage strategies designed for sampled values ​​(SV), GOOSE messages, and MMS control commands. The SV data stream employs time-series compression storage technology, preserving key waveform features at a 4kHz sampling frequency; the GOOSE event stream is modeled using a state machine, recording the temporal correlation characteristics of logical control nodes. This layered storage mechanism satisfies the real-time requirements of SV data transmission (storage latency <1ms) while fully preserving the event context of protection actions.

[0062] The core anomaly detection system employs the Dynamic Time Warping (DTW) algorithm to build a baseline message pattern library. Feature drift is measured using multi-scale similarity:

[0063]

[0064] in For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. When a time synchronization deviation is detected in an SV message (…),… Furthermore, when the CRC error rate suddenly increases, the system determines that a substantial feature drift has occurred. This immediately triggers the model update process. The update process incorporates a flexible weight consolidation mechanism, using regularization terms... Protect key network parameters to prevent model performance degradation caused by incremental training.

[0065] The hardware acceleration engine employs a three-stage pipeline architecture, utilizing FPGA for hardware-level optimization of protocol parsing and feature extraction. The lock-free queue design significantly reduces GOOSE message processing latency, meeting the stringent timeliness requirements of intelligent substation protection systems. The dynamic threshold strategy presets judgment threshold coefficients. Based on Mahalanobis distance Construct a multi-dimensional detection space, in which It is the vector of the sample points to be tested. It is the mean vector of the reference distribution. It is the covariance matrix of the reference distribution. It is its inverse matrix, if If this occurs, it is considered an anomaly. The system will automatically adjust based on the substation's operating status (maintenance / normal). In this embodiment, the invention achieves high detection accuracy in identifying fictitious data injection (FDI) attacks while ensuring that the false activation rate of the protection device is lower than industry security standards.

[0066] Example 4

[0067] This embodiment of a cache-aware, self-driven online traffic anomaly detection system includes:

[0068] The data storage module is used to build a multi-level traffic data cache pool, and the data is stored in different traffic data cache pools according to the timeliness.

[0069] The model building module is used to extract traffic features from the traffic data cache pool with the most recent data timeliness, and to pre-train a base model for traffic anomaly detection using the extracted traffic features;

[0070] The model update module is used to calculate the feature drift of traffic features, evaluate traffic features in real time through feature drift, and update the pre-trained base model when the feature drift exceeds a preset threshold to obtain the updated detection model.

[0071] The detection module is used to detect anomalies in real-time traffic using an updated detection model.

[0072] Example 5

[0073] This invention discloses a cache-aware, self-driven online traffic anomaly detection device. The device may include a processor and a memory. The memory stores computer instructions, and the processor executes the computer instructions stored in the memory. When the computer instructions are executed by the processor, the electronic device implements the steps of the method described in the above embodiments and achieves the same technical effect as the above method.

[0074] The memory may include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The device may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the memory may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). A program / utility having a set (at least one) of program modules may be stored in, for example, memory. Such program modules include, but are not limited to, an operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. The program modules typically perform the functions and / or methods described in the embodiments of the present invention.

[0075] The processor executes various functional applications and data processing by running programs stored in memory, such as the method provided in Embodiment 1 of the present invention.

[0076] Example 6

[0077] This invention also provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it implements the steps of the method described in the above embodiments and achieves the same technical effect as the above method.

[0078] The computer storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0079] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of sending, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0080] Program code contained on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0081] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0082] Of course, the computer-executable instructions provided in the embodiments of the present invention are not limited to the above-described method operations, but can also perform related operations in the methods provided in any embodiment of the present invention.

[0083] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cache-aware, self-driven online traffic anomaly detection method, characterized in that, Includes the following steps: A multi-level traffic data cache pool is constructed, and data is stored in different traffic data cache pools according to timeliness. Traffic features are extracted from the data in the traffic data cache pool with the most recent data timeliness. The base model for traffic anomaly detection is pre-trained using the extracted traffic features to obtain the trained base model. The feature drift of traffic characteristics is calculated. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model. The updated detection model is then used to detect anomalies in real-time traffic.

2. The cache-aware, self-driven online traffic anomaly detection method according to claim 1, characterized in that, The multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The data is stored in different traffic data cache pools according to its timeliness, specifically including: caching real-time traffic data in the in-memory database, dividing recent traffic data and historical traffic data through a sliding window mechanism, storing recent traffic data in the in-memory database, and archiving historical traffic data to the distributed storage system.

3. The cache-aware, self-driven online traffic anomaly detection method according to claim 1, characterized in that, The extracted traffic features are sampled, and the sampled traffic features are pre-trained to form a base model for traffic anomaly detection. The sampling of the extracted traffic features is performed using an adaptive sampling algorithm to calculate the sampling weight of each traffic feature. : ； in, As a time-dependent decay factor, The feature entropy value is used to measure the complexity of the distribution of traffic characteristics. Attention weights are used to measure the importance of anomaly-related features. For the current moment, This represents the sampling time window.

4. The cache-aware, self-driven online traffic anomaly detection method according to claim 1, characterized in that, The feature drift includes the KL divergence index or multi-scale similarity. The KL divergence index is used to measure the degree of deviation between the current flow characteristic distribution and the historical baseline, and the multi-scale similarity... The calculation formula is: ； in, For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. This represents the natural exponential function.

5. The cache-aware, self-driven online traffic anomaly detection method according to claim 1, characterized in that, When performing anomaly detection on real-time traffic using the updated detection model, the judgment threshold is dynamically optimized and the classification decision boundary of the detection model is adjusted.

6. The cache-aware, self-driven online traffic anomaly detection method according to claim 5, characterized in that, The dynamic optimization judgment threshold includes an adaptive smoothing factor to optimize the judgment threshold; the dynamic optimization formula is: ； in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

7. A cache-aware, self-driven, online traffic anomaly detection system, characterized in that, include: The data storage module is used to build a multi-level traffic data cache pool, and the data is stored in different traffic data cache pools according to the timeliness. The model building module is used to extract traffic features from the traffic data cache pool with the most recent data timeliness, and to pre-train a base model for traffic anomaly detection using the extracted traffic features to obtain the trained base model. The model update module is used to calculate the feature drift of traffic features. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model. The detection module is used to detect anomalies in real-time traffic using an updated detection model.

8. The cache-aware, self-driven online traffic anomaly detection system according to claim 7, characterized in that, The multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The data is stored in different traffic data cache pools according to its timeliness, specifically including: caching real-time traffic data in the in-memory database, dividing recent traffic data and historical traffic data through a sliding window mechanism, storing recent traffic data in the in-memory database, and archiving historical traffic data to the distributed storage system.

9. The cache-aware, self-driven online traffic anomaly detection system according to claim 7, characterized in that, The extracted traffic features are sampled, and the sampled traffic features are pre-trained to form a base model for traffic anomaly detection. An adaptive sampling algorithm is used to calculate the sampling weight of each traffic feature. : ； in, As a time-dependent decay factor, The feature entropy value is used to measure the complexity of the distribution of traffic characteristics. Attention weights are used to measure the importance of anomaly-related features. For the current moment, This represents the sampling time window.

10. The cache-aware, self-driven online traffic anomaly detection system according to claim 7, characterized in that, The feature drift includes the KL divergence index or multi-scale similarity. The KL divergence index is used to measure the degree of deviation between the current flow characteristic distribution and the historical baseline, and the multi-scale similarity... The calculation formula is: ； in, For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. This represents the natural exponential function.

11. The cache-aware, self-driven online traffic anomaly detection system according to claim 7, characterized in that, When performing anomaly detection on real-time traffic using the updated detection model, the judgment threshold is dynamically optimized and the classification decision boundary of the detection model is adjusted.

12. The cache-aware, self-driven online traffic anomaly detection system according to claim 11, characterized in that, The dynamic optimization judgment threshold includes an adaptive smoothing factor to optimize the judgment threshold; the dynamic optimization formula is: ； in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images