A cache-aware data self-driven traffic anomaly online detection method, system, computer device and readable storage medium

Abstract

The application discloses a cache-aware data self-driven traffic anomaly online detection method and system, computer equipment and a readable storage medium, comprising constructing a multi-level traffic data cache pool, storing data in different traffic data cache pools according to timeliness, extracting traffic features of data in the traffic data cache pool with the latest data timeliness, pre-training a base model for traffic anomaly detection through the extracted traffic features, obtaining a trained base model, calculating feature drift of the traffic features, real-time evaluating the traffic features through the feature drift, updating the pre-trained base model when the feature drift exceeds a preset threshold, obtaining an updated detection model, and performing anomaly detection on real-time traffic through the updated detection model. Based on the traffic feature dynamic perception technology, the system can automatically trigger model updating, and significantly enhances the adaptability to new attack modes.

Description

TECHNICAL FIELD

[0001] The application relates to network traffic anomaly detection, in particular to a cache-aware data self-driven online traffic anomaly detection method, system, computer device and readable storage medium. BACKGROUND

[0002] In the current network environment, with the rapid development of cloud computing, Internet of Things and other technologies, network traffic presents the characteristics of explosive growth in scale and dynamic change, which makes traffic anomaly detection face unprecedented challenges. Traditional traffic anomaly detection methods usually use static models or fixed period offline training mechanism, which is difficult to adapt to the dynamic change characteristics of network traffic, resulting in model update lagging behind the actual traffic change, and the detection accuracy and timeliness are difficult to guarantee. Especially in the face of sudden network attacks or new abnormal traffic, the existing methods often cannot capture the change rule of traffic characteristics in time due to the long training period and rigid data sampling strategy of the model, causing the increase of missed detection or false detection rate, which seriously affects the security and stability of network operation.

[0003] In the prior art, the traffic anomaly detection system based on machine learning usually relies on historical data for batch training, and lacks dynamic perception ability for real-time traffic data. Such systems often use uniform sampling or fixed weight sampling strategy, ignoring the timeliness difference of traffic data in time dimension and the distribution imbalance in feature space, resulting in mismatch between model training data and actual traffic characteristics. In addition, the traditional detection model updating mechanism adopts manual intervention or preset period trigger mode, which not only has slow response speed, but also is difficult to adapt to the variable characteristics of traffic anomaly in different network scenarios. This passive model updating mode makes the system significantly decrease in protection ability when facing zero-day attacks or complex and variable network environment.

[0004] Especially in the high concurrency traffic scenario, the existing method is difficult to balance the contradiction between detection real-time and model updating efficiency, which cannot fully utilize the spatio-temporal correlation characteristics of cache data, and lacks self-adaptive learning ability for abnormal traffic evolution rule. SUMMARY

[0005] The application provides a cache-aware data self-driven online traffic anomaly detection method, system, computer device and readable storage medium for dynamic security protection and efficient and reliable detection.

[0006] Technical scheme: To solve the above problems, the application adopts a cache-aware data self-driven online traffic anomaly detection method, which comprises the following steps:

[0007] A multi-level traffic data cache pool is constructed, data is stored in different traffic data cache pools according to timeliness, traffic feature extraction is performed on data in the traffic data cache pool with the most recent timeliness, a base model for traffic anomaly detection is pre-trained through the extracted traffic features, and a trained base model is obtained;

[0008] The feature drift of the traffic features is calculated, the pre-trained base model is updated when the feature drift exceeds a preset threshold, an updated detection model is obtained, and real-time traffic is detected for anomalies through the updated detection model.

[0009] Further, the multi-level traffic data cache pool includes a memory database and a distributed storage system, and the data is stored in different traffic data cache pools according to timeliness, specifically including: caching real-time traffic data in the memory database, and dividing the recent traffic data and the historical traffic data through a sliding window mechanism, storing the recent traffic data in the memory database, and archiving the historical traffic data to the distributed storage system.

[0010] Further, the extracted traffic features are sampled, the pre-trained base model is pre-trained through the sampled traffic features, and the sampling weight of each traffic feature is calculated through an adaptive sampling algorithm

[0011]

[0012] wherein, is a timeliness decay factor, is a feature entropy value for measuring the complexity of traffic feature distribution, is an attention weight for measuring the importance of abnormal related features, is the current time, is a sampling time window.

[0013] Further, the feature drift includes a KL divergence index or a multi-scale similarity The KL divergence index is used to measure the deviation degree of the current traffic feature distribution from the historical baseline, and the multi-scale similarity The calculation formula of the multi-scale similarity is:

[0014]

[0015] wherein, is a scale adjustment parameter, denotes the regular path distance of the current packet sequence and the reference mode, denotes a natural exponential function.

[0016] Further, when the real-time traffic is detected for anomalies through the updated detection model, the decision threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.​

[0017] Furthermore, the dynamically optimized decision threshold includes introducing an adaptive smoothing factor to optimize the decision threshold; the dynamic optimization formula is:

[0018]

[0019] in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

[0020] This invention also employs a cache-aware, self-driven, online traffic anomaly detection system, comprising:

[0021] The data storage module is used to build a multi-level traffic data cache pool, and the data is stored in different traffic data cache pools according to the timeliness.

[0022] The model building module is used to extract traffic features from the traffic data cache pool with the most recent data timeliness, and to pre-train a base model for traffic anomaly detection using the extracted traffic features to obtain the trained base model.

[0023] The model update module is used to calculate the feature drift of traffic features. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain the updated detection model.

[0024] The detection module is used to detect anomalies in real-time traffic using an updated detection model.

[0025] Furthermore, the multi-level traffic data cache pool includes an in-memory database and a distributed storage system. The data is stored in different traffic data cache pools according to its timeliness, specifically including: caching real-time traffic data in the in-memory database, dividing recent traffic data and historical traffic data through a sliding window mechanism, storing recent traffic data in the in-memory database, and archiving historical traffic data to the distributed storage system.

[0026] Furthermore, the extracted traffic features are sampled, and the sampled traffic features are pre-trained into a base model for traffic anomaly detection. An adaptive sampling algorithm is used to calculate the sampling weight of each traffic feature. :

[0027]

[0028] in, As a time-dependent decay factor, The feature entropy value is used to measure the complexity of the distribution of traffic characteristics. Attention weights are used to measure the importance of anomaly-related features. For the current moment, This is the sampling time window.

[0029] Furthermore, the feature drift includes the KL divergence index or multi-scale similarity. The KL divergence index is used to measure the degree of deviation between the current flow characteristic distribution and the historical baseline, and the multi-scale similarity... The calculation formula is:

[0030]

[0031] in, For scaling parameters, This indicates the normalized path distance between the current message sequence and the baseline pattern. This represents the natural exponential function.

[0032] Furthermore, when performing anomaly detection on real-time traffic using the updated detection model, the judgment threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.

[0033] Furthermore, the dynamically optimized decision threshold includes introducing an adaptive smoothing factor to optimize the decision threshold; the dynamic optimization formula is:

[0034]

[0035] in, for The threshold for determining time. for The threshold for determining time. As a smoothing factor, This represents the average flow characteristics of the current window.

[0036] A high-performance parallel detection engine is deployed, which adopts a multi-level pipeline architecture to process real-time traffic in parallel, supports parallel anomaly detection under high throughput, and optimizes the data transmission path with lock-free queues and zero-copy technology, significantly reducing detection latency and improving system throughput.

[0037] The present invention also employs a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0038] The present invention also employs a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above method.

[0039] The significant advantage of the present application over the prior art is based on the flow feature dynamic perception technology. The system can automatically trigger model updating, significantly enhancing the adaptability to new attack patterns. The sampling strategy of the flow feature is automatically optimized to ensure sufficient representation of abnormal flow in the training sample, improving the accuracy of the detection model in abnormal judgment. Through the efficient flow online detection engine, the throughput of the system in high-concurrency flow scenarios is improved, significantly improving the real-time protection capability of network security. Based on the dynamic threshold optimization mechanism, the detection accuracy and false positive rate are effectively balanced, and the abnormal identification effect is still good in complex network environment. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 The flowchart of the detection method in the present application.

[0041] Figure 2 The architecture diagram of the detection system in the present application.

[0042] Figure 3 The flowchart of the present application applied to the advanced measurement system scenario of smart grid. DETAILED DESCRIPTION

[0043] Embodiment 1

[0044] As shown in Figure 1 and Figure 2 , the cache-aware data self-driven flow anomaly online detection method in this embodiment is suitable for dynamic security protection and real-time efficient flow monitoring in large-scale network environment; the online flow anomaly detection mechanism can dynamically perceive flow feature changes and autonomously trigger model updating to realize dynamic iteration and efficient and reliable detection of the flow anomaly detection model.

[0045] Specifically includes the following steps:

[0046] A multi-level flow data cache pool is constructed, and data is stored in different flow data cache pools according to timeliness. The data in the flow data cache pool with the most recent timeliness is subjected to flow feature extraction. The base model for flow anomaly detection is pre-trained through the extracted flow features to obtain a trained base model.

[0047] The feature drift of the flow feature is calculated. The flow feature is evaluated in real time through the feature drift. When the feature drift exceeds a preset threshold, the pre-trained base model is updated to obtain an updated detection model. The real-time flow is subjected to abnormal detection through the updated detection model.

[0048] The multi-level traffic data cache pool adopts a hierarchical storage strategy, dynamically stores network traffic slices using a sliding window mechanism, and automatically eliminates expired data based on a timeliness strategy. The multi-level traffic data cache pool includes a memory database and a distributed storage system. The sliding window mechanism is used to divide recent traffic data and historical traffic data. The recent traffic data is cached in the memory database, and the historical traffic data is archived to the distributed storage system. Real-time traffic data is preferentially cached in the memory database, and historical data is automatically archived to the distributed storage system, thereby achieving efficient use of storage resources.

[0049] In the base model for traffic anomaly detection pre-trained by the extracted traffic features, an adaptive sampling algorithm is used to dynamically calculate the sampling weights of each traffic feature by comprehensively considering the data timeliness, feature distribution entropy value and abnormal correlation degree index. The adaptive sampling algorithm introduces an attention mechanism to automatically adjust the sampling weights of each dimension feature according to the dynamic changes of the traffic features, and focuses on key features that are strongly related to anomaly detection.

[0050] Through the feature drift monitoring mechanism, the change of traffic feature distribution is evaluated in real time, and model updating is triggered. The feature drift monitoring mechanism uses a multi-scale detection strategy, combining short-term sliding windows and long-term trend analysis to accurately identify substantial changes in network traffic patterns. When the feature drift exceeds the preset threshold, the base model after pre-training and the latest cache data are used to fine-tune the model using knowledge distillation technology. The knowledge distillation mechanism retains the key decision weights of the original model during model updating, avoiding performance degradation caused by incremental training.

[0051] A high-performance parallel detection engine is deployed, which uses a multi-stage pipeline architecture to process real-time traffic in parallel, supporting parallel anomaly detection with high throughput. The high-performance parallel detection engine uses lock-free queues and zero-copy technology to optimize data transmission paths, significantly reducing detection latency and improving system throughput.

[0052] A dynamic threshold optimization strategy is implemented to automatically adjust the classification decision boundary of the detection model. The dynamic threshold optimization strategy automatically adjusts the sensitivity of threshold adjustment according to changes in the network environment, balancing the real-time performance and stability of detection.

[0053] Embodiment 2

[0054] The data-driven traffic anomaly online detection method with cache awareness in this embodiment is applied to the advanced measurement system of the smart grid to monitor the communication traffic of the smart meter. As shown in Figure 3As shown, in the smart grid advanced measurement system, the system realizes dynamic management of communication traffic through a multi-level cache architecture. In view of the periodic characteristics (such as 15-minute heartbeat packets and hourly data reporting) of smart meter communication, the system constructs a hierarchical cache pool including an in-memory database and distributed storage. The in-memory level cache adopts a sliding window mechanism to retain real-time traffic slices for the last 15 minutes, and a time decay factor is used to dynamically eliminate historical data. This design not only ensures fast access to real-time data, but also avoids excessive occupation of storage resources.

[0055] The adaptive sampling strategy introduces a multi-dimensional weight calculation model, the core expression of which is:

[0056]

[0057] Among them, the time decay factor α controls the weight of data timeliness, the feature entropy value measures the distribution complexity of traffic features, and the attention weight automatically learns the importance of abnormal related features through a neural network. This model particularly gives 3 times the basic weight to sudden control instructions (such as firmware upgrade instructions) in smart meter communication, ensuring that abnormal traffic is fully represented in the training sample.

[0058] The feature drift detection module uses the KL divergence index to continuously monitor the degree of deviation of the current traffic feature distribution from the historical baseline. When an abnormally high frequency session (such as a 200% increase in Modbus TCP connection requests) is detected in the meter communication protocol layer, the system automatically triggers the model update mechanism. The update process uses knowledge distillation and fine-tuning techniques to realize knowledge fusion of new and old models through a loss function , which integrates the learning ability of new intermediate attack features on the basis of retaining the original normal power consumption mode recognition ability.

[0059] The online detection engine adopts a multi-stage pipeline architecture and realizes real-time processing of metering data through a protocol analysis acceleration module. The dynamic threshold optimization mechanism is based on sliding window baseline statistics and uses an exponential smoothing algorithm to automatically adjust the abnormal judgment boundary, where is the smoothing factor, represents the mean value of the traffic features of the current window. The online detection method in this embodiment can achieve a balance between efficient response and high-precision detection, while controlling the normal business misjudgment rate at a low level.

[0060] Embodiment 3

[0061] The cache-aware data self-driven flow anomaly online detection method in the embodiment is applied to the intelligent substation industrial control network protection scene, and monitors the communication flow in the intelligent substation. In the process layer network of the intelligent substation, a protocol-aware multi-modal cache system is constructed, and an optimized storage strategy is designed for the sampled value (SV), GOOSE message and MMS control instruction. The SV data stream adopts time series compression storage technology, and the key waveform characteristics under the 4kHz sampling frequency are retained; the GOOSE event stream is modeled by a state machine, and the timing correlation characteristics of the logic control node are recorded. This hierarchical storage mechanism not only meets the real-time requirement of SV data transmission (storage delay <1ms), but also retains the event context of the protection action.

[0062] The anomaly detection core adopts a dynamic time warping (DTW) algorithm to construct a reference message mode library . Feature drift is measured by multi-scale similarity

[0063]

[0064] wherein is a scale adjustment parameter, represents the warping path distance of the current message sequence and the reference mode. When the time synchronization deviation of the SV message and the sudden increase of the CRC error rate are detected, it is determined that substantial feature drift occurs, and the model updating process is triggered immediately. The updating process introduces an elastic weight consolidation mechanism, and the regular term protects the key network parameters, and prevents the model performance degradation caused by incremental training.

[0065] The hardware acceleration engine adopts a three-stage pipeline architecture, and the protocol analysis and feature extraction are optimized at the hardware level through FPGA. The lock-free queue design greatly reduces the processing delay of the GOOSE message, and meets the strict requirements of the intelligent substation protection system on the transmission timeliness. The dynamic threshold strategy presets the determination threshold coefficient , and constructs a multi-dimensional detection space based on the Mahalanobis distance , wherein is the sample point vector to be tested, is the mean vector of the reference distribution, is the covariance matrix of the reference distribution, is the inverse matrix thereof, and if , it is considered that an anomaly occurs. According to the operation state of the substation (maintenance / normal), the threshold is automatically adjusted . The invention in this embodiment achieves high detection accuracy when identifying false data injection (FDI) attacks, while ensuring that the misoperation rate of the protection device is lower than the industry safety standard.

[0066] Embodiment 4

[0067] The embodiment of the application discloses a cache-aware data self-driven flow anomaly online detection system, which comprises:

[0068] A data storage module is configured to construct a plurality of flow data cache pools, and data is stored in different flow data cache pools according to timeliness.

[0069] A model construction module is configured to extract flow features of data in a flow data cache pool with the latest timeliness, and pre-train a base model for flow anomaly detection through the extracted flow features.

[0070] A model updating module is configured to calculate feature drift of the flow features, and evaluate the flow features in real time through the feature drift, and when the feature drift exceeds a preset threshold, update the pre-trained base model to obtain an updated detection model.

[0071] A detection module is configured to perform anomaly detection on real-time flow through the updated detection model.

[0072] Embodiment 5

[0073] The embodiment of the application discloses a cache-aware data self-driven flow anomaly online detection device, which can comprise a processor and a memory, the memory stores computer instructions, and the processor is configured to execute the computer instructions stored in the memory, when the computer instructions are executed by the processor, the electronic device realizes the steps of the method described in the above embodiment, and can achieve the same technical effect as the above method.

[0074] The memory can include computer system readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. The device can further include other removable / non-removable, volatile / non-volatile computer system storage media. For example, the memory can be used to read and write to a non-removable, non-volatile magnetic media, commonly referred to as a "hard disk drive". The program / utility, having a set of program modules, can be stored in, for example, memory, such as operating system, one or more application programs, other program modules, and program data, each or a combination thereof, can include implementation of a network environment. The program modules typically perform the functions and / or methodologies of the embodiments described in the application.

[0075] The processor performs various functional applications and data processing by running the program stored in the memory, for example, the method provided by the embodiment of the application.

[0076] Embodiment 6

[0077] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize steps of the method in the above embodiment and achieve the same technical effects.

[0078] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer readable storage medium can be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus or device.

[0079] The computer readable signal medium can include a data signal propagated in a baseband or propagated as a carrier wave in a propagated data signal, in which the computer readable program code is contained. Such a propagated data signal can take many forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate or transport program for use by or in connection with an instruction execution system, apparatus, or device.

[0080] The program code contained in the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, cable, RF, etc., or any suitable combination thereof.

[0081] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). The application is not limited to a specific programming language or computer system.

[0082] Of course, the storage medium provided by the embodiments of the present application includes computer executable instructions, and the computer executable instructions are not limited to the method operations described above, but can also perform related operations in the method provided by any embodiment of the present application.

[0083] The above specific embodiments further illustrate the purposes, technical solutions and beneficial effects of the present application. It should be understood that the above description is only for specific embodiments of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A cache-aware data self-driven traffic anomaly online detection method, characterized in that, The method comprises the following steps: A multi-level traffic data cache pool is constructed, data is stored in different traffic data cache pools according to timeliness, the multi-level traffic data cache pool comprises a memory database and a distributed storage system, real-time traffic data is cached in the memory database, and the traffic data in the memory database is divided into recent traffic data and historical traffic data through a sliding window mechanism, the recent traffic data is stored in the memory database, and the historical traffic data is archived to the distributed storage system; Traffic feature extraction is performed on the recent traffic data, a pre-trained base model is obtained through the extracted traffic features, and the base model is used for traffic anomaly detection; Feature drift of the traffic features is calculated, the pre-trained base model is updated when the feature drift exceeds a preset threshold, and an updated detection model is obtained; The extracted flow features are sampled by an adaptive sampling algorithm, and the sampled flow features are pre-trained to obtain a base model, and the sampling weights of the flow features are are: ； wherein, is an aging decay factor, is a feature entropy value measuring the complexity of the flow feature distribution, is an attention weight measuring the importance of the abnormal correlation feature, is the current time, is a sampling time window.

2. The cache-aware data self-driven traffic anomaly online detection method of claim 1, wherein, The feature drift includes a KL divergence index or a multi-scale similarity The KL divergence index is used to measure the deviation degree of the current traffic feature distribution from the historical baseline, and the multi-scale similarity The calculation formula is: ； wherein, is a scale adjustment parameter, denotes the normalized path distance of the current message sequence to the reference pattern, denotes the natural exponential function.

3. The cache-aware data self-driven traffic anomaly online detection method of claim 1, wherein, When the real-time traffic is detected for anomaly through the updated detection model, the decision threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.

4. The cache-aware data self-driven traffic anomaly online detection method of claim 3, wherein, The dynamic optimization of the decision threshold comprises introducing an adaptive smoothing factor to optimize the decision threshold, and the dynamic optimization formula is: ； wherein, is a decision threshold for the time instant, is a decision threshold for the time instant, is a smoothing factor, is the mean of the traffic feature of the current window.

5. A cache-aware data self-driven traffic anomaly online detection system, characterized in that, The method comprises the following steps: A data storage module is configured to construct a multi-level traffic data cache pool, and data is stored in different traffic data cache pools according to timeliness; The multi-level traffic data cache pool comprises a memory database and a distributed storage system, real-time traffic data is cached in the memory database, and the traffic data in the memory database is divided into recent traffic data and historical traffic data through a sliding window mechanism, the recent traffic data is stored in the memory database, and the historical traffic data is archived to the distributed storage system; A model construction module is configured to perform traffic feature extraction on the recent traffic data, a pre-trained base model is obtained through the extracted traffic features, and the base model is used for traffic anomaly detection; A model update module is configured to calculate feature drift of the traffic features, and update the pre-trained base model when the feature drift exceeds a preset threshold to obtain an updated detection model. A detection module is configured to detect real-time traffic for anomaly through the updated detection model. The extracted flow features are sampled by an adaptive sampling algorithm, and the sampled flow features are pre-trained to obtain a base model, and the sampling weights of the flow features are are: ； wherein, is an aging decay factor, is a feature entropy value measuring the complexity of the flow feature distribution, is an attention weight measuring the importance of the abnormal correlation feature, is the current time, is a sampling time window.

6. The cache-aware data self-driven flow anomaly online detection system of claim 5, wherein, The feature drift includes a KL divergence index or a multi-scale similarity The KL divergence index is used to measure the deviation degree of the current traffic feature distribution from the historical baseline, and the multi-scale similarity The calculation formula is: ； wherein, is a scale adjustment parameter, denotes the normalized path distance of the current message sequence to the reference pattern, denotes the natural exponential function.

7. The cache-aware data self-driven flow anomaly online detection system of claim 5, wherein, When the real-time traffic is detected for anomaly through the updated detection model, the decision threshold is dynamically optimized, and the classification decision boundary of the detection model is adjusted.

8. The cache-aware data self-driven flow anomaly online detection system of claim 7, wherein, The dynamic optimization of the decision threshold comprises introducing an adaptive smoothing factor to optimize the decision threshold, and the dynamic optimization formula is: ； wherein, is the decision threshold for the time instant, is the decision threshold for the time instant, is the decision threshold for the time instant, is the decision threshold for the time instant, is a smoothing factor, is the mean of the traffic features of the current window.

9. A computer device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to realize the steps of the method in any one of claims 1 to 4.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the steps of the method in any one of claims 1 to 4.

Images