Network anomaly detection method and related equipment

Abstract

The invention provides a network anomaly detection method and related equipment. The method comprises the following steps: converting an acquired network data packet into a two-dimensional image; extracting the two-dimensional image by using a lightweight convolutional neural network to obtain an image feature vector; for each network data packet, calculating statistical parameters in a time window, and constructing to obtain a structured feature vector of the network data packet; splicing the image feature vector and the structured feature vector to obtain an input vector; and inputting the input vector into a trained anomaly detection model to obtain a network anomaly detection result. According to the embodiment of the invention, the detection performance, the training efficiency and the deployment adaptability of a network anomaly detection model are remarkably improved through the image and structural expression of the network data packet, the features are extracted in combination with the lightweight convolutional neural network, and the multi-modal features are fused and optimized; and comprehensive support is provided for real-time, efficient and reliable network security protection.

Description

Technical Field

[0001] This application relates to the field of network anomaly detection technology, and in particular to a network anomaly detection method and related equipment. Background Technology

[0002] With the rapid development of smart grids, power wireless private networks serve as a crucial communication support, carrying a large amount of critical business data. Anomaly detection plays a vital role in ensuring the stability and reliability of power wireless private networks. Existing anomaly detection methods are mostly based on traditional machine learning models, such as manually extracting traffic statistical features through feature engineering and then inputting them into classification models (e.g., extreme gradient boosting, XGBoost) for identification. These methods perform well in handling simple attack patterns, but their detection capabilities are limited when facing deep-seated malicious behaviors and nonlinear characteristics in complex network traffic. Furthermore, some research attempts to use convolutional neural networks to visualize traffic data, aiming to improve detection performance by capturing high-dimensional spatial patterns. However, these deep learning models are typically large and computationally complex, making it difficult to meet the real-time detection needs in resource-constrained environments. Especially in the high-dimensional traffic data scenarios of power wireless private networks, their deployment difficulty and inference time become major obstacles to practical applications.

[0003] Existing technologies have several shortcomings. First, while some deep learning models possess strong detection capabilities, their large model size and low inference efficiency make them difficult to adapt to the real-time and resource-constrained requirements of edge computing devices. Second, the approach of visualizing network traffic data and inputting it into convolutional neural networks fails to incorporate traditional numerical features such as traffic statistics, trends, and autocorrelation, making it difficult to simultaneously capture abnormal patterns in both global behavior and subtle fluctuations. Furthermore, the low proportion of abnormal traffic samples and significant class imbalance are problems that existing methods have failed to effectively address, causing detection models to tend to favor normal traffic and limiting anomaly detection performance. Simultaneously, the "black box" nature of some deep learning models leads to insufficient interpretability in industrial applications, while traditional ensemble learning models, although possessing some interpretability, fail to fully utilize the spatial structural features in time-series images. Finally, power wireless private network traffic data exhibits characteristics such as high dimensionality, strong correlation, and significant periodic interference; existing methods have not specifically modeled and optimized for these application characteristics, making it difficult to cope with complex and ever-changing anomaly scenarios. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a network anomaly detection method and related equipment.

[0005] To achieve the above objectives, this application provides a network anomaly detection method, comprising: Convert the acquired network data packets into a two-dimensional image; The image feature vector is extracted from the two-dimensional image using a lightweight convolutional neural network; For each network data packet, statistical parameters within a time window are calculated to construct a structured feature vector for the network data packet; The image feature vector and the structured feature vector are concatenated to obtain the input vector; The input vector is fed into the trained anomaly detection model to obtain the network anomaly detection results.

[0006] In one possible implementation, converting the acquired network data packets into a two-dimensional image includes: The data payload is extracted from the network data packets; Convert the data payload to decimal; The decimal data payload is standardized in length. The standardized data payload is rearranged to obtain the two-dimensional image.

[0007] In one possible implementation, the step of extracting image feature vectors from the two-dimensional image using a lightweight convolutional neural network includes: The image feature vector is convolved independently on each channel of the lightweight convolutional neural network to obtain a first feature map. A second feature map is obtained by performing cross-channel fusion on the first feature map using a 1×1 convolution kernel; The second feature map is subjected to batch normalization, and the batch normalized second feature map is subjected to nonlinear activation function processing to obtain the third feature map; The third feature map is subjected to average pooling to obtain the image feature vector.

[0008] In one possible implementation, the statistical parameters include: mean, standard deviation, extreme values, skewness, kurtosis, first-order difference mean, difference standard deviation, missing value proportion, and maximum missing segment length.

[0009] In one possible implementation, concatenating the image feature vector and the structured feature vector to obtain the input vector includes: The image feature vector and the structured feature vector are concatenated along the feature dimension to obtain the first fusion vector; The first fusion vector is standardized to obtain the second fusion vector; The second fusion vector is compressed based on mutual information filtering to obtain the input vector.

[0010] In one possible implementation, the anomaly detection model is trained using the following method: The low-rank adversarial sampling method is used to enhance the abnormal samples in the acquired training samples; Construct an initial model and initialize the predicted values ​​of the initial model to a constant; Calculate the residual value of the current initial model in each training round; Construct a new decision tree based on the residual values; Add the new decision tree to the current initial model; In response to the fulfillment of the termination condition, training is stopped, and the anomaly detection model is obtained.

[0011] Based on the same inventive concept, embodiments of this application also provide a network anomaly detection device, including: The conversion module is configured to convert acquired network data packets into two-dimensional images; The extraction module is configured to extract image feature vectors from the two-dimensional image using a lightweight convolutional neural network; The construction module is configured to calculate statistical parameters within a time window for each network data packet, and construct a structured feature vector for the network data packet. The concatenation module is configured to concatenate the image feature vector and the structured feature vector to obtain an input vector; The input module is configured to input the input vector into the trained anomaly detection model to obtain the network anomaly detection result.

[0012] Based on the same inventive concept, embodiments of this application also provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network anomaly detection method as described in any of the above.

[0013] Based on the same inventive concept, embodiments of this application also provide a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute any of the network anomaly detection methods described above.

[0014] Based on the same inventive concept, embodiments of this application also provide a computer program product, which includes computer program instructions, the computer instructions being used to cause the computer program product to execute any of the network anomaly detection methods described above.

[0015] As can be seen from the above, the network anomaly detection method and related equipment provided in this application convert the acquired network data packets into two-dimensional images; extract image feature vectors from the two-dimensional images using a lightweight convolutional neural network; calculate statistical parameters within a time window for each network data packet to construct a structured feature vector for the network data packet; concatenate the image feature vector and the structured feature vector to obtain an input vector; and input the input vector into a trained anomaly detection model to obtain network anomaly detection results. This application embodiment, through a lightweight network anomaly detection method that integrates image feature vectors and statistical features, uses a lightweight convolutional neural network to extract features from the image representation of network data packets. While capturing deep spatial structural features, it significantly reduces model size and computational complexity, adapts to resource-constrained edge computing devices, and meets the real-time and efficiency requirements of power wireless private networks. Furthermore, by calculating traffic statistical parameters (such as average, standard deviation, autocorrelation, etc.) and fusing them with image feature vectors, it takes into account both global behavior and local minor fluctuations, effectively improving the model's ability to identify complex anomaly patterns. Furthermore, low-rank adversarial sampling is used to enhance anomalous samples, fundamentally alleviating the class imbalance problem and improving the model's accuracy and robustness in anomaly traffic detection. This application also leverages the synergistic advantages of multi-source information by combining the interpretability of ensemble learning models (such as XGBoost) with the feature extraction capabilities of lightweight convolutional neural networks, balancing detection performance and model transparency. Finally, this technical solution optimizes the modeling for the high-dimensional traffic data and periodic interference characteristics of power wireless private networks, ensuring the model can adapt to complex and ever-changing network environments and providing precise and efficient technical support for the stable operation and security of power wireless private networks. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic flowchart of the network anomaly detection method according to an embodiment of this application; Figure 2 This is a schematic diagram of the network anomaly detection device according to an embodiment of this application; Figure 3 This is a schematic diagram of the electronic device structure according to an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and the accompanying drawings.

[0019] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed after the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0020] It is understood that before using the technical solutions of the various embodiments in this disclosure, users will be informed of the type, scope of use, and usage scenarios of the personal information involved in an appropriate manner, and user authorization will be obtained.

[0021] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose, based on the prompt message, whether to provide personal information to the software or hardware such as electronic devices, applications, servers, or storage media performing the operations of this disclosed technical solution.

[0022] As an optional but not limited implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0023] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0024] As described in the background section, with the rapid development of smart grids, power wireless private networks carry a large amount of critical business data, making abnormal traffic detection crucial for ensuring their stability and reliability. Existing anomaly detection methods are mostly based on traditional machine learning models, relying on manual feature engineering and classification models (such as XGBoost), which struggle to handle deep-seated malicious behavior and nonlinear characteristics in complex network traffic. Some studies have attempted to use convolutional neural networks to visualize traffic data to improve detection performance, but these models are large and computationally complex, making them difficult to deploy on resource-constrained edge devices. Furthermore, existing methods fail to effectively integrate visualized features with traditional numerical features such as traffic statistics and autocorrelation, making it difficult to simultaneously capture abnormal patterns of global behavior and subtle fluctuations. The class imbalance problem, characterized by a low proportion of abnormal traffic samples, remains unresolved, limiting model detection performance. The "black box" nature of deep learning models lacks interpretability, while traditional ensemble learning models do not fully exploit the spatial features of time-series images. The high-dimensionality and strong correlation characteristics of power wireless private network traffic have not been specifically modeled, making it difficult to handle complex anomaly scenarios.

[0025] Based on the above considerations, this application proposes a network anomaly detection method. The method involves converting acquired network data packets into two-dimensional images; extracting image feature vectors from the two-dimensional images using a lightweight convolutional neural network; calculating statistical parameters within a time window for each network data packet to construct a structured feature vector; concatenating the image feature vector and the structured feature vector to obtain an input vector; and inputting the input vector into a trained anomaly detection model to obtain network anomaly detection results. This application utilizes a lightweight network anomaly detection method that integrates image feature vectors and statistical features. It employs a lightweight convolutional neural network to extract deep spatial features from the image representation of network data packets, significantly reducing model size and computational complexity, thus adapting to the real-time requirements of edge computing devices. By combining traffic statistical parameters (such as mean, standard deviation, autocorrelation, etc.), it achieves joint detection of global behavior and local minor fluctuations, improving the ability to identify complex anomaly patterns. Low-rank adversarial sampling is used to enhance anomaly samples, alleviating class imbalance problems and improving model accuracy and robustness. This application combines the feature extraction capabilities of lightweight convolutional neural networks with the interpretability of ensemble learning models (such as XGBoost), balancing detection performance and model transparency. Furthermore, it optimizes modeling for the characteristics of high-dimensional traffic data and periodic interference in power wireless private networks, ensuring the model adapts to complex network environments and provides accurate and efficient support for the safe operation of power wireless private networks.

[0026] The technical solutions of the embodiments of this application will be described in detail below through specific examples.

[0027] refer to Figure 1The network anomaly detection method of this application includes the following steps: Step S101: Convert the acquired network data packets into a two-dimensional image; Step S102: Use a lightweight convolutional neural network to extract image feature vectors from the two-dimensional image; Step S103: For each network data packet, calculate the statistical parameters within the time window to construct the structured feature vector of the network data packet; Step S104: Concatenate the image feature vector and the structured feature vector to obtain the input vector; Step S105: Input the input vector into the trained anomaly detection model to obtain the network anomaly detection result.

[0028] In this embodiment, the acquired network data packets are first converted into a two-dimensional image. Specifically, a network data packet is the basic data unit in network traffic, containing a header and a payload. By extracting the payload from the network data packets and performing a series of processing steps, these one-dimensional raw data are ultimately converted into a two-dimensional image. This conversion process includes reorganizing and rearranging the data format, allowing the data packets to be presented in two-dimensional space, facilitating feature extraction by subsequent deep learning models.

[0029] Next, a lightweight convolutional neural network is used to extract features from the aforementioned two-dimensional image, thereby obtaining an image feature vector. A lightweight convolutional neural network is a simple and efficient neural network structure that can extract spatial features of an image while maintaining low computational complexity. This step captures the local spatial characteristics of the image through convolution operations, extracting feature maps at different levels layer by layer, and finally generating a fixed-length image feature vector representing the important patterns and information in the two-dimensional image through operations such as global average pooling.

[0030] For each network data packet, statistical parameters within a time window are calculated, and a structured feature vector for that network data packet is constructed accordingly. These statistical parameters are based on the statistical information of network traffic data over time, including but not limited to mean, standard deviation, extreme values, skewness, kurtosis, first-order difference mean, difference standard deviation, proportion of missing values, and maximum missing segment length. These statistics effectively describe the global characteristics of network traffic, such as trends, fluctuation intensity, and anomalies. By performing statistical analysis on network data packets within a time window, a structured feature vector is constructed, which can be easily combined with image feature vectors to provide a more comprehensive feature description.

[0031] The extracted image feature vector is concatenated with the structured feature vector to obtain the input vector. The concatenation operation merges the two types of features along the feature dimension, forming a unified feature representation. To ensure consistency in the numerical range of the features, the concatenated feature vector is usually standardized to eliminate scale differences between different features. Furthermore, based on a mutual information filtering strategy, the concatenated features are compressed, retaining features highly relevant to the anomaly detection task, thus obtaining the final input vector. This feature fusion and compression strategy effectively reduces the dimensionality of the input features, improves the computational efficiency of the model, and retains key information.

[0032] Finally, the input vector is fed into the trained anomaly detection model to obtain the network anomaly detection results. The anomaly detection model, through the previous training process, learns the pattern differences between normal and abnormal traffic. Its input is the fused feature vector, and its output is the detection result of the network data packets, including the label of whether it is abnormal and the confidence level of the anomaly. Through the model's inference process, potential anomalies in network traffic can be quickly identified, providing a reliable detection method for network security.

[0033] Regarding step S101, in some embodiments, converting the acquired network data packet into a two-dimensional image includes: extracting a data payload from the network data packet; converting the data payload into decimal; standardizing the length of the decimal data payload; and rearranging the standardized data payload to obtain the two-dimensional image.

[0034] In this embodiment, the data payload is first extracted from the network data packet. A network data packet consists of a header and a data payload. The header mainly contains network protocol-related information, while the data payload carries the actual transmitted data. For anomaly detection, the data payload is extracted as the core data source, ensuring that subsequent processing focuses on the part closely related to the traffic content.

[0035] Let the original network data packet be Each data packet Contains head With data payload :

[0036] Next, the extracted data payload is converted into decimal numerical form. This is because data payloads in network packets are usually represented in hexadecimal, and hexadecimal data is not convenient for direct image construction and numerical analysis. By converting the hexadecimal data byte by byte into a decimal numerical array, the data payload can be represented in a numerical form more suitable for computer processing. The value of each byte is mapped to a decimal number, forming a one-dimensional numerical array, laying the foundation for subsequent standardization processing.

[0037] Extracting the payload Then convert it to a decimal number array:

[0038] in, This represents a one-dimensional array, specifically a decimal number array. Indicates data payload, Represents data payload The Middle A decimal value of one byte. Indicates the array length.

[0039] Subsequently, the decimal data payload is standardized in length. Since the payload lengths of different network data packets may vary significantly, length standardization is necessary to ensure data consistency. If the data payload length is less than a preset fixed length, zeros are padded at the end to achieve the required length; if the data payload length is greater than the preset fixed length, the data at the beginning and end is retained, while the middle portion is discarded. This method ensures that all data payloads have the same length, providing consistent input for subsequent two-dimensional rearrangement.

[0040] In one feasible embodiment, if If the result is zero, then fill in zero:

[0041] like Reserve 512 bytes before and after:

[0042] in, This represents the data payload after standardization.

[0043] Finally, the standardized data payload is rearranged to obtain the two-dimensional image. Specifically, the one-dimensional standardized numerical array is rearranged according to a preset two-dimensional size (e.g., 32×32) to transform it into a two-dimensional matrix. This matrix can be viewed as a grayscale image, where each value corresponds to a pixel value in the image. In this way, the payload information of network data packets is successfully represented as a two-dimensional image, preserving the original content of the data while enabling it to be effectively processed by deep learning models such as convolutional neural networks, laying the foundation for subsequent image feature vector extraction.

[0044] In this embodiment, Rearranged into a two-dimensional image:

[0045] Supports the construction of the following three image formats: single-channel grayscale images: Three-channel images: And multi-frame stacked images: .

[0046] Furthermore, regarding step S102, the step of extracting image feature vectors from the two-dimensional image using a lightweight convolutional neural network includes: independently performing convolution operations on the image feature vectors in each channel of the lightweight convolutional neural network to obtain a first feature map; performing cross-channel fusion on the first feature map using a 1×1 convolution kernel to obtain a second feature map; performing batch normalization on the second feature map, and performing nonlinear activation function processing on the batch normalized second feature map to obtain a third feature map; and performing average pooling processing on the third feature map to obtain the image feature vector.

[0047] In this embodiment, the first step is to independently perform convolution operations on each channel of the lightweight convolutional neural network on the two-dimensional image to obtain a first feature map. Specifically, the lightweight convolutional neural network employs depthwise separable convolution, applying a convolution kernel to perform convolution operations on each channel of the two-dimensional image. This operation extracts local spatial features only within a single channel, without fusing information between channels, thereby reducing computational complexity while preserving the spatial characteristics of each channel. The output of this step is the first feature map, representing the spatial features of each independent channel.

[0048] In some embodiments, the two-dimensional image is convolved independently on each channel of the lightweight convolutional neural network using the following formula:

[0049] in, This represents the feature map after depthwise convolution. Indicates the first element in the input image. The pixel values ​​of each channel. Represents the depthwise convolution kernel parameters. Next, a 1×1 convolutional kernel is used to perform cross-channel fusion on the first feature map to obtain the second feature map. The role of the 1×1 convolutional kernel is to linearly combine the features of each pixel in different channels, thereby achieving cross-channel information fusion. By using a 1×1 convolutional kernel, the first feature map with multiple channels can be compressed into a second feature map with fewer channels, while capturing the correlation between different channels. This process integrates the rich spatial features in the first feature map into a compact representation, further improving the feature representation capability.

[0050] In some embodiments, cross-channel fusion is performed on the first feature map using a 1×1 convolutional kernel as follows:

[0051] in, This represents the second feature map. This represents the feature map after depthwise convolution. This represents the parameters of the point convolution kernel.

[0052] Subsequently, the second feature map is batch-normalized, and then processed with a non-linear activation function to obtain the third feature map. The purpose of batch normalization is to normalize the values ​​in the second feature map, making its mean zero and variance one, thereby improving training stability and convergence speed, and avoiding gradient vanishing or exploding problems. After batch normalization, a non-linear activation function (such as ReLU) is used to perform a non-linear transformation on the feature map. This process enhances the model's ability to fit complex patterns and effectively improves the network's expressive power. The resulting third feature map contains high-level features after activation.

[0053] In this embodiment, in order to alleviate the gradient vanishing problem and accelerate network training, a batch normalization (BN) operation is performed after each convolutional layer to standardize the feature map. After standardization, the ReLU activation function is applied to introduce nonlinearity. ReLU can effectively improve the network's expressive power while avoiding gradient vanishing.

[0054] Finally, the third feature map is subjected to average pooling to obtain the image feature vector. Average pooling performs a global spatial averaging operation on each channel of the feature map, compressing the features of each channel into a scalar. This process preserves the global information of each channel while eliminating the influence of spatial dimension in the feature map. The resulting image feature vector is a low-dimensional feature vector that compactly represents the key information of the input two-dimensional image. These features will serve as input to the subsequent network anomaly detection model, providing strong support for anomaly detection tasks.

[0055] In some embodiments, global average pooling is performed using the following formula:

[0056] in, Indicates the first The global average value of each channel. This represents the second feature map. Indicates the height of the feature map. Indicates the width of the feature map.

[0057] Furthermore, the global average values ​​of all channels are combined into an image feature vector:

[0058] in, This represents the image feature vector.

[0059] Furthermore, for step S103, the statistical parameters include: mean, standard deviation, extreme values, skewness, kurtosis, first-order difference mean, difference standard deviation, missing value ratio, and maximum missing segment length.

[0060] These statistical parameters are calculated by analyzing the traffic characteristics of network packets within a time window to construct a structured feature vector for each network packet.

[0061] Average values ​​are used to characterize the overall level of network traffic. By calculating the average traffic data within a time window, a general description of the traffic scale can be provided. The average value of normal traffic is usually relatively stable, while abnormal traffic can cause significant changes; therefore, the average value can provide an important reference for detecting network anomalies.

[0062] Standard deviation is used to describe the intensity of fluctuations in network traffic. By calculating the standard deviation of traffic data within a time window, the stability of traffic can be identified. A larger standard deviation usually indicates more drastic traffic fluctuations, which may be associated with anomalous behavior, such as sudden attacks or traffic storms.

[0063] Extreme values, including maximum and minimum values, reflect the range of network traffic within a time window. Maximum values ​​help identify traffic spikes, often associated with sudden increases in unusual traffic, while minimum values ​​reveal traffic interruptions or significant drops.

[0064] Skewness describes the degree of asymmetry in flow distribution. By calculating the skewness of flow data, the shape of the flow distribution can be determined, such as whether it is skewed to one side. Positive skewness indicates that the right tail of the flow distribution is longer, while negative skewness indicates that the left tail is longer. Abnormal flow distributions often exhibit significant skewness.

[0065] Kurtosis reflects the sharpness of traffic distribution. By calculating the kurtosis of traffic data, it can be determined whether the traffic distribution has high peaks. Abnormal traffic often exhibits high kurtosis characteristics; for example, sudden spikes in traffic may be associated with attack behavior.

[0066] The first-order difference mean is used to characterize the trend changes in traffic flow data. By calculating the differences between adjacent data points and taking the average, the overall trend of traffic flow can be effectively described. Significant increases or decreases in traffic flow may be related to anomalous behavior.

[0067] The standard deviation of the difference is used to reflect the stability of flow rate changes. By calculating the standard deviation of the first difference of flow rate data, it is possible to assess whether the changes in flow rate are regular. A larger standard deviation of the difference indicates that the flow rate changes are more drastic and unstable, which may be related to abnormal flow.

[0068] The missing value ratio is used to describe data completeness. By statistically analyzing the proportion of missing data points within a time window, the quality of network data can be assessed. A high missing value ratio usually indicates packet loss or communication interruption, which may be a sign of network anomalies.

[0069] The maximum length of a missing segment is used to monitor the risk of communication outages. By statistically analyzing the lengths of consecutive missing segments and taking the maximum value, the duration of a network outage can be revealed. Longer missing segments typically indicate serious network connectivity problems.

[0070] By calculating the above statistical parameters, a structured feature vector of network packets can be constructed. These parameters comprehensively describe the global characteristics of the traffic and provide key information for subsequent anomaly detection.

[0071] For specific parameters, please refer to Table 1 below: Table 1 Statistical Parameters

[0072] The standard deviation of the difference is calculated using the following formula:

[0073] in, Indicates the difference standard deviation. Indicates the total length of the data sequence. Represents the first in the sequence Data points, This represents the mean of adjacent differences.

[0074] The missing ratio is expressed by the following formula:

[0075] in, Indicates the missing ratio, This indicates the total number of missing values ​​in the dataset.

[0076] Furthermore, regarding step S104, the step of concatenating the image feature vector and the structured feature vector to obtain the input vector includes: concatenating the image feature vector and the structured feature vector along the feature dimension to obtain a first fusion vector; standardizing the first fusion vector to obtain a second fusion vector; and compressing the second fusion vector based on mutual information filtering to obtain the input vector.

[0077] In this embodiment, the first step is to convert the image feature vector... and the structured feature vector The first fusion vector is obtained by concatenating the two features along their respective feature dimensions. Image feature vectors are extracted from two-dimensional images using a lightweight convolutional neural network (CNN), primarily representing the spatial patterns and structural characteristics of network data packets. Structured feature vectors, based on statistical parameter calculations, reflect the global statistical information of network data packets within a time window. By concatenating these two features along their respective feature dimensions, image feature vectors and structured feature vectors can be effectively fused, thereby constructing a more comprehensive feature representation, facilitating subsequent model learning of traffic anomaly patterns. Image feature vectors are high-level features extracted from two-dimensional images using a lightweight convolutional neural network (CNN). These features primarily capture local patterns and spatial variations in network data packets, such as the spatial structure of traffic distribution and abnormal image textures. Their feature dimensions are typically high. Structured feature vectors are structured features extracted from traffic data within a time window. These features reflect the global distribution, trends, fluctuations, and data integrity of traffic. Their feature dimensions are low. The goal of feature fusion is to merge these two types of features into a unified feature vector. This allows the final feature representation to include both local spatial features (from the image) and global statistical features (from the time window). This multimodal fusion can more comprehensively describe network traffic characteristics, thereby improving the accuracy and robustness of anomaly detection.

[0078] Image features and statistical features describe traffic information from different perspectives, and the concatenation operation achieves complementary feature fusion. Image feature vectors provide spatial characteristics, while statistical feature vectors provide global statistical information within a time window. The concatenated features can simultaneously contain local and global information, possessing stronger expressive power.

[0079] Subsequently, the first fused vector is standardized to obtain the second fused vector. Since image feature vectors and structured feature vectors may come from different feature spaces, their numerical ranges and distributions may differ significantly. If the unstandardized fused vector is used directly for subsequent processing, the influence of some features on the model may be amplified or weakened, thus affecting detection performance. Standardization ensures that all features have a consistent distribution by adjusting the mean and variance of the features, giving them the same weight in the subsequent model. Specifically, the standardization process can use the z-score method, subtracting the mean from each feature value and then dividing by the standard deviation, resulting in a mean of zero and a variance of one. After standardization, the second fused vector better represents the balance between features. In practice, z-score standardization can be performed individually for each feature dimension or uniformly for the entire feature vector. For models trained in batches (such as deep learning models), the mean and standard deviation of the training set should be preserved during standardization, and the same mean and standard deviation should be used to standardize the test data during the testing phase. The fused features incorporate both image and statistical features, representing a multimodal feature representation that can more comprehensively describe the characteristics of network traffic. Although the dimensionality of the fused features increases compared to the original statistical features, the image features extracted through a lightweight CNN have already been compressed to a lower dimension, so the fused features remain compact. After z-score normalization, the scale of the feature values ​​is standardized, facilitating subsequent model training.

[0080] Image fusion processing combines image feature vectors and statistical feature vectors, which describe network traffic from different perspectives. The fused feature vectors can more comprehensively capture abnormal patterns. A single feature may not perform well for certain types of abnormal traffic, while fused features can effectively compensate for the shortcomings of different features.

[0081] Next, the second fusion vector is compressed based on mutual information filtering to obtain the input vector. Specifically, by calculating the mutual information value between each feature dimension and the anomaly detection label, the importance of the feature to the classification task can be evaluated. Features with higher mutual information values ​​indicate a strong correlation with the target variable and contribute more to the anomaly detection task; while features with lower mutual information values ​​may be redundant or irrelevant. During the filtering process, features are sorted from highest to lowest mutual information value, and the top K features are selected to form the compressed feature vector. This feature filtering method based on mutual information can effectively reduce feature dimensionality while retaining key information highly relevant to the task, thereby improving the computational efficiency and detection performance of the model.

[0082] Through the above steps, the final generated input vector combines the advantages of image features and structured feature vectors, and has undergone standardization and feature selection optimization to ensure the compactness and effectiveness of the features. This input vector can provide high-quality feature input for the anomaly detection model, thereby improving the accuracy and robustness of anomaly detection.

[0083] Furthermore, regarding step S105, in some embodiments, the anomaly detection model is trained using the following method: anomalous samples in the acquired training samples are augmented using a low-rank adversarial sampling method; an initial model is constructed, and the predicted values ​​of the initial model are initialized to a constant; the residual value of the current initial model is calculated in each training round; a new decision tree is constructed based on the residual value; the new decision tree is added to the current initial model; and training is stopped in response to the termination condition being met, thus obtaining the anomaly detection model.

[0084] In this embodiment, firstly, a low-rank adversarial sampling method is used to enhance the anomalous samples in the acquired training samples. In network anomaly detection tasks, anomalous samples are usually far fewer than normal samples. This imbalance in sample distribution may lead to a decrease in the model's ability to identify anomalous samples. The low-rank adversarial sampling method can generate synthetic samples with a distribution similar to that of anomalous samples, expanding the coverage of anomalous samples and enhancing the model's ability to learn anomalous patterns. The low-rank adversarial sampling method utilizes the feature space of anomalous samples, introducing random perturbations to generate new samples while maintaining consistency with the distribution of real anomalous samples, thus effectively solving the sample imbalance problem.

[0085] Next, an initial model is constructed, and its predictions are initialized to a constant. In the initial stage of training, the model has not yet learned any features, so the predictions for all samples are set to a fixed constant, such as the mean of the sample labels. This initialization method provides a baseline prediction for subsequent training, ensuring that the model's initial state is consistent with the data distribution.

[0086] In each training round, the residual value of the initial model is calculated. The residual value is the difference between the model's current prediction and the true value, reflecting the model's prediction error for the samples. By calculating the residual value, we can identify sample features that the model has not yet captured in the current state, thus providing guidance for the construction of subsequent decision trees. The calculation of the residual value is usually based on the objective loss function, such as the weighted binary cross-entropy loss, which can effectively handle the problem of uneven distribution of sample classes.

[0087] A new decision tree is constructed based on the residual values. The new decision tree outputs the residual values ​​as the target, attempting to fit sample features that the current model failed to capture. By modeling the residual values, the decision tree can learn subtle patterns in the data, thereby gradually improving the model's predictive performance. During the construction of the new decision tree, regularization constraints are considered to prevent overfitting, and distributed sampling techniques are used to improve training efficiency.

[0088] The new decision tree is added to the current initial model. The model is updated by weighted summing of the outputs of the new decision tree into the current model's predictions, forming new predictions. This process gradually reduces the residual values, allowing the final model to more accurately match the sample labels. The weights of the weighted summing are controlled by the learning rate, which affects the model's training speed and stability.

[0089] Training stops upon meeting the termination conditions, resulting in the anomaly detection model. Termination conditions typically include a fixed number of iterations, no significant improvement in validation set performance, convergence of training error, and time or resource constraints. A fixed number of iterations means stopping training when the model has completed a preset number of training epochs to prevent overtraining. No significant improvement in validation set performance means terminating training early when metrics (such as the F1 score) on the validation set do not show a significant improvement for several consecutive epochs to avoid wasting resources. Convergence of training error means stopping training when the decrease in training error falls below a preset threshold to ensure model training efficiency. Time or resource constraints mean terminating training when the training time exceeds a set limit or the model's memory usage reaches the hardware limitations.

[0090] Specifically, it can include: Fixed iteration count termination: Stop when the maximum number of trees is reached (e.g., 200 trees); Termination without performance improvement (early stop mechanism): F1 score shows no significant improvement for T consecutive rounds (e.g., 10 rounds) on the validation set (improvement is less than ε=0.001). Training error convergence termination: The decrease in training error in the current round compared to the previous round is less than the threshold δ (e.g., 1e-4). Termination due to time or resource limitations: The cumulative training time exceeds the set time limit (e.g., 10 minutes), or the number of model parameters / memory usage reaches the deployment device limit.

[0091] Through the above training process, the resulting anomaly detection model can effectively identify abnormal patterns in network traffic, providing a reliable detection method for network security.

[0092] Furthermore, in this embodiment, the present application uses a two-stage optimization strategy: Bayesian optimization and the Jaya algorithm.

[0093] Bayesian optimization is used to optimize the learning rate. In the early stages of training, Bayesian optimization methods are used to find the optimal learning rate. Bayesian optimization simulates the relationship between the objective function and the learning rate by constructing a probabilistic model (such as a Gaussian process). The relationship between them. By continuously sampling and updating the model, we find the method to maximize the objective function. learning rate value .

[0094] The Jaya algorithm is used to fine-tune structural parameters. In the later stages of training, the Jaya algorithm optimizes the model's structural parameters (such as maximum tree depth and regularization coefficients). Jaya is a metaheuristic optimization algorithm that continuously updates parameters... Make it closer to the current optimal value:

[0095] in, Indicates the current optimal parameters. Indicates the current worst parameter. and All represent random numbers.

[0096] Furthermore, after training and optimization, the model needs to be deployed to the target system for real-time or offline anomaly detection tasks. The deployment process needs to balance the model's performance, inference speed, resource consumption, and interpretability, while ensuring that it can run efficiently in the target environment (such as edge devices, cloud servers, etc.).

[0097] ONNX is an open neural network model exchange format that supports a variety of deep learning frameworks (such as PyTorch, TensorFlow, XGBoost, etc.).

[0098] FP16 (16-bit floating-point) quantization converts the model's weights from 32-bit floating-point numbers (FP32) to 16-bit floating-point numbers (FP16). It can significantly reduce storage requirements and computational complexity while maintaining high precision.

[0099] As can be seen from the above embodiments, the network anomaly detection method described in this application converts the acquired network data packets into a two-dimensional image; extracts image feature vectors from the two-dimensional image using a lightweight convolutional neural network; calculates statistical parameters within a time window for each network data packet to construct a structured feature vector for the network data packet; concatenates the image feature vector and the structured feature vector to obtain an input vector; and inputs the input vector into a trained anomaly detection model to obtain a network anomaly detection result.

[0100] The technical advantage of converting acquired network data packets into two-dimensional images in this application is that it achieves a structured and graphical representation of network data packets, providing an effective input format for subsequent lightweight convolutional neural network processing. The data payload in a network data packet contains the core information of the packet, but its original form is usually a one-dimensional byte sequence, which may be difficult to effectively extract features when directly input into a deep learning model. By extracting the data payload and converting it to decimal form, the data becomes more suitable for numerical computation; further, length standardization is performed to unify the size of different network data packets, eliminating feature inconsistencies caused by differences in data payload length; finally, the standardized data payload is rearranged to obtain a two-dimensional image, realizing a mapping from one dimension to two dimensions. This graphical processing not only preserves the original content of the data payload but also endows the data with spatial structure characteristics, enabling lightweight convolutional neural networks to effectively capture the spatial patterns and local features of the data, thus providing an efficient feature representation for network anomaly detection tasks. This process also ensures repeatability and consistency through fixed conversion rules, providing a solid foundation for the training and inference of the anomaly detection model.

[0101] Furthermore, the advantage of using a lightweight convolutional neural network for feature extraction of the two-dimensional image lies in its efficient capture of local spatial patterns and global structural characteristics in network data packets, significantly improving the expressive power and detection performance of image feature vectors. By independently performing convolution operations on the two-dimensional image in each channel, spatial features within each channel can be extracted, preserving fine-grained local information. Subsequently, cross-channel fusion is performed on the first feature map using a 1×1 convolutional kernel, linearly combining the features of each channel and effectively integrating the correlation between different channels, thereby generating a more representative second feature map. In addition, batch normalization eliminates the differences in feature value ranges, avoiding gradient vanishing or exploding problems, and improving the stability and convergence speed of the lightweight convolutional neural network training. The application of nonlinear activation functions further enhances the model's ability to fit complex patterns. Finally, global average pooling is used to reduce the dimensionality of the second feature map, eliminating the influence of spatial dimension and generating a compact image feature vector, which reduces computational complexity while preserving global characteristics. This process enables the two-dimensional image to be efficiently converted into an image feature vector, providing strong feature support for subsequent anomaly detection models, while achieving a balance between computational efficiency and detection accuracy in resource-constrained environments.

[0102] Furthermore, by calculating statistical parameters within a time window and constructing a structured feature vector for network packets, the technical effect is to comprehensively capture the global statistical characteristics of network packets, providing important auxiliary information for network anomaly detection. The mean and standard deviation describe the overall level and fluctuation intensity of traffic, helping to identify the scale changes and stability of abnormal traffic; the extreme values ​​reflect traffic peaks and interruptions, showing significant differences, especially in abnormal scenarios such as sudden attacks or network storms; the skewness and kurtosis characterize the morphological characteristics of traffic distribution, revealing potential abnormal patterns in the data distribution; the first-order difference mean and the difference standard deviation, through the analysis of traffic trends and change stability, further reveal the dynamic characteristics of traffic in the time dimension; the proportion of missing values ​​and the maximum missing segment length quantify data integrity and communication interruption, effectively capturing features related to abnormal network interruptions. These statistical parameters provide a comprehensive characterization of traffic data from multiple dimensions, offering not only a global description of network behavior but also enhancing the interpretability and robustness of features. They provide crucial global information supplementation for concatenating with the image feature vectors, helping to improve the anomaly detection model's ability to identify abnormal behavior.

[0103] Furthermore, by concatenating the image feature vector with the structured feature vector and performing standardization and compression, the technical effect is to effectively fuse multimodal features, improve the comprehensiveness and effectiveness of feature representation, reduce feature redundancy, and optimize model computational efficiency. The image feature vector, extracted by the lightweight convolutional neural network, reflects the spatial patterns and local characteristics of network data packets; the structured feature vector, through statistical analysis, captures the global characteristics and dynamic changes in the temporal dimension of network data packets. Concatenating the two types of features along the feature dimension ensures that the fused input vector contains both local spatial information and global statistical information, thus providing a more comprehensive feature representation for the anomaly detection model. Standardization eliminates differences in feature value ranges, ensuring numerical consistency of features from different sources, thereby avoiding model bias towards certain features and improving training stability and convergence speed. In addition, mutual information filtering retains features highly relevant to the network anomaly detection task, and further compression reduces the dimensionality of the input vector, significantly reducing feature redundancy, lowering model computational overhead, and reducing noise interference. This process not only improves the model's detection performance but also enhances its adaptability in resource-constrained environments, laying the foundation for efficient training and inference of the trained anomaly detection model.

[0104] Furthermore, by compressing the fused input vector, the technical effect is to significantly reduce the dimensionality of the input vector while retaining key information relevant to the network anomaly detection task, thereby improving the model's computational efficiency and detection performance. The fused input vector, after concatenation, may contain a large amount of redundant information or irrelevant features. Directly inputting these into the anomaly detection model increases computational complexity and may lead to overfitting. Mutual information filtering quantifies the correlation between each feature and the target anomaly label, thus selecting the features that contribute most to the detection task. This step effectively removes redundant features irrelevant to the task, improving the quality of the input vector. Based on this, an autoencoder is further used to perform nonlinear dimensionality reduction on the selected features. By learning the feature representation in the low-dimensional latent space, the complex nonlinear relationships between features are preserved, while significantly reducing the dimensionality of the input vector. The generation of low-dimensional input vectors not only reduces the model's memory usage and computational overhead but also reduces the interference of feature redundancy on model training. In addition, the autoencoder training process minimizes reconstruction error, ensuring that the original information is preserved as completely as possible during dimensionality reduction. This input vector compression process provides the anomaly detection model with a more compact, efficient, and information-rich input, significantly improving the predictive performance and deployment applicability of the anomaly detection model.

[0105] Furthermore, by using an incremental decision tree construction method combined with optimization strategies to train the anomaly detection model, the technical effect is to gradually improve the anomaly detection model's ability to learn complex data patterns, while ensuring the efficiency and stability of the training process. Low-rank adversarial sampling is used to enhance anomaly samples in the training samples, significantly alleviating the problem of insufficient anomaly sample quantity, expanding the feature space coverage of anomaly samples, and enhancing the anomaly detection model's ability to identify anomaly patterns. The anomaly detection model is initialized with constant prediction values ​​as a baseline, providing a stable starting point for subsequent training, allowing the anomaly detection model to gradually optimize from an equilibrium state. In each training round, by calculating the residual value of the current anomaly detection model, the features or error information that the model has not yet captured is identified, providing a clear optimization direction for the construction of new decision trees. The new decision tree targets the residuals, learning finer-grained features by fitting the current error, effectively improving the prediction accuracy of the anomaly detection model. Adding the new decision tree to the current anomaly detection model, through accumulation, gradually reduces the global error, achieving incremental optimization of model performance. By combining regularization constraints and distributed sampling techniques, the anomaly detection model captures complex patterns while avoiding overfitting, ensuring generalization ability. By setting various termination conditions, such as a fixed number of rounds, no improvement in validation set performance, and convergence of training error, the anomaly detection model achieves a good balance between performance and computational resources, preventing unnecessary computational overhead. The overall training process incorporates Bayesian optimization and the Jaya algorithm to fine-tune key hyperparameters, further improving the structural efficiency and detection performance of the anomaly detection model. Ultimately, the trained anomaly detection model can efficiently capture abnormal patterns in network data packets, providing accurate and reliable detection capabilities for network security.

[0106] Furthermore, by addressing the imbalance problem of anomalous samples in the acquired training samples, the technical effect is to effectively alleviate the severe disparity between the number of normal and anomalous samples, enhance the learning ability of the anomaly detection model to anomaly patterns, and thus significantly improve the network anomaly detection performance. Anomalous samples typically account for a very small proportion of network data packets. If the original training samples are used directly for training, the anomaly detection model tends to overlearn the distribution of normal samples while ignoring the characteristics of anomalous samples, leading to a decline in anomaly detection capability. By using a low-rank adversarial sampling method to enhance the anomalous samples, synthetic samples similar to the actual distribution of anomalous samples are generated, expanding the feature space coverage of anomalous samples and ensuring that the anomaly detection model can fully learn the diversity and complexity of anomalous data packets. Simultaneously, these synthetic samples are generated through low-rank matrix factorization and random perturbation, preserving the core features of anomalous patterns while introducing a certain degree of randomness, preventing the anomaly detection model from overfitting to a small number of anomalous samples. The enhanced training samples have a more balanced proportion of sample categories, which not only improves the anomaly detection model's ability to identify anomalous samples but also enhances the overall robustness of the anomaly detection model. Furthermore, sample balancing significantly and positively impacted the evaluation metrics of the anomaly detection model, particularly in improving key performance indicators such as recall and F1 score, ensuring the accuracy and reliability of the anomaly detection model in real-world applications. Through this strategy, the anomaly detection model can more accurately detect abnormal behavior in network packets without weakening normal sample information, providing more comprehensive protection for network security.

[0107] Furthermore, by deploying the trained anomaly detection model and combining it with inference optimization, the technical effect is to achieve efficient operation of the anomaly detection model in different computing environments, while ensuring the accuracy, real-time performance, and interpretability of the inference phase. Exporting the trained anomaly detection model to the Open Neural Network Exchange (ONNX) format gives it cross-platform compatibility, allowing it to adapt to various hardware and inference frameworks. This not only facilitates deployment in cloud, edge devices, or hybrid environments but also provides convenience for long-term maintenance and upgrades of the trained anomaly detection model. By optimizing the weights and computation process of the anomaly detection model using FP16 quantization (Floating Point 16, FP16), memory consumption and computational complexity are significantly reduced while maintaining the predictive accuracy of the anomaly detection model. The quantized anomaly detection model can run with lower power consumption and faster inference speed on resource-constrained devices (such as embedded systems or edge computing terminals), thus meeting the needs of real-time detection. During the inference phase, the trained anomaly detection model can quickly process the features of the input network data packets and output network anomaly detection results, including predicted labels, anomaly confidence, and explanations of dominant features. By combining model interpretation tools such as SHAP (SHapley Additive), the contribution of each feature to the detection results can be analyzed, thereby improving the transparency and understandability of the trained anomaly detection model. This is of great significance for anomaly diagnosis in complex network environments. Furthermore, the deployment of the anomaly detection model incorporates hardware acceleration and optimization tools, making the system suitable for both high-throughput traffic detection tasks and latency-sensitive real-time scenarios. The overall technical effectiveness is reflected in the efficient implementation of network anomaly detection capabilities. It achieves accurate identification of network packet anomalies while ensuring the reliability and efficiency of the trained anomaly detection model in practical applications, providing a practical solution for network security.

[0108] It should be noted that the method in this embodiment can be executed by a single device, such as a computer or server. The method can also be applied in a distributed scenario, where multiple devices cooperate to complete the task. In such a distributed scenario, one of these devices may execute only one or more steps of the method in this embodiment, and the multiple devices will interact with each other to complete the method described.

[0109] It should be noted that the above description describes some embodiments of this application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in a different order than that shown in the above embodiments and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0110] Based on the same inventive concept, corresponding to any of the above embodiments, this application also provides a network anomaly detection device.

[0111] refer to Figure 2 The network anomaly detection device includes: Conversion module 21 is configured to convert acquired network data packets into two-dimensional images; Extraction module 22 is configured to extract image feature vectors from the two-dimensional image using a lightweight convolutional neural network; Construction module 23 is configured to calculate statistical parameters within a time window for each network data packet and construct a structured feature vector for the network data packet; The splicing module 24 is configured to splice the image feature vector and the structured feature vector to obtain an input vector; The input module 25 is configured to input the input vector into the trained anomaly detection model to obtain the network anomaly detection result.

[0112] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing this application, the functions of each module can be implemented in one or more software and / or hardware.

[0113] The apparatus of the above embodiments is used to implement the corresponding network anomaly detection method in any of the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0114] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network anomaly detection method described in any of the above embodiments.

[0115] Figure 3This embodiment illustrates a more specific hardware structure of an electronic device, which may include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, memory 1020, input / output interface 1030, and communication interface 1040 are interconnected internally via the bus 1050.

[0116] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0117] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0118] The input / output interface 1030 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components within the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices may include displays, speakers, vibrators, indicator lights, etc.

[0119] The communication interface 1040 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0120] Bus 1050 includes a pathway for transmitting information between various components of the device, such as processor 1010, memory 1020, input / output interface 1030, and communication interface 1040.

[0121] It should be noted that although the above-described device only shows the processor 1010, memory 1020, input / output interface 1030, communication interface 1040, and bus 1050, in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the embodiments of this specification, and not necessarily all the components shown in the figures.

[0122] The electronic devices described above are used to implement the corresponding network anomaly detection methods in any of the foregoing embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0123] Based on the same inventive concept, corresponding to the methods of any of the above embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the network anomaly detection method as described in any of the above embodiments.

[0124] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0125] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the network anomaly detection method as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0126] Based on the same inventive concept, corresponding to the network anomaly detection method described in any of the above embodiments, this disclosure also provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to perform the network anomaly detection method. Corresponding to the execution entity for each step in each embodiment of the network anomaly detection method, the processor executing the corresponding step can belong to the corresponding execution entity.

[0127] The computer program product of the above embodiments is used to cause the computer and / or the processor to execute the network anomaly detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0128] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0129] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be fully understood by those skilled in the art). While specific details (e.g., circuits) have been set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0130] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may be used with the embodiments discussed.

[0131] The embodiments of this application are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the embodiments of this application should be included within the protection scope of this application.

Claims

1. A method for detecting network anomalies, characterized in that, include: Convert the acquired network data packets into a two-dimensional image; The image feature vector is extracted from the two-dimensional image using a lightweight convolutional neural network; For each network data packet, statistical parameters within a time window are calculated to construct a structured feature vector for the network data packet; The image feature vector and the structured feature vector are concatenated to obtain the input vector; The input vector is fed into the trained anomaly detection model to obtain the network anomaly detection results.

2. The method according to claim 1, characterized in that, The step of converting the acquired network data packets into a two-dimensional image includes: The data payload is extracted from the network data packets; Convert the data payload to decimal; The decimal data payload is standardized in length. The standardized data payload is rearranged to obtain the two-dimensional image.

3. The method according to claim 1, characterized in that, The step of extracting image feature vectors from the two-dimensional image using a lightweight convolutional neural network includes: The image feature vector is convolved independently on each channel of the lightweight convolutional neural network to obtain a first feature map. A second feature map is obtained by performing cross-channel fusion on the first feature map using a 1×1 convolution kernel; The second feature map is subjected to batch normalization, and the batch normalized second feature map is subjected to nonlinear activation function processing to obtain the third feature map; The third feature map is subjected to average pooling to obtain the image feature vector.

4. The method according to claim 1, characterized in that, The statistical parameters include: mean, standard deviation, extreme values, skewness, kurtosis, first-order difference mean, difference standard deviation, missing value ratio, and maximum missing segment length.

5. The method according to claim 1, characterized in that, The step of concatenating the image feature vector and the structured feature vector to obtain the input vector includes: The image feature vector and the structured feature vector are concatenated along the feature dimension to obtain the first fusion vector; The first fusion vector is standardized to obtain the second fusion vector; The second fusion vector is compressed based on mutual information filtering to obtain the input vector.

6. The method according to claim 1, characterized in that, The anomaly detection model is trained using the following method: The low-rank adversarial sampling method is used to enhance the abnormal samples in the acquired training samples; Construct an initial model and initialize the predicted values ​​of the initial model to a constant; Calculate the residual value of the current initial model in each training round; Construct a new decision tree based on the residual values; Add the new decision tree to the current initial model; In response to the fulfillment of the termination condition, training is stopped, and the anomaly detection model is obtained.

7. A network anomaly detection device, characterized in that, include: The conversion module is configured to convert acquired network data packets into two-dimensional images; The extraction module is configured to extract image feature vectors from the two-dimensional image using a lightweight convolutional neural network; The construction module is configured to calculate statistical parameters within a time window for each network data packet, and construct a structured feature vector for the network data packet. The concatenation module is configured to concatenate the image feature vector and the structured feature vector to obtain an input vector; The input module is configured to input the input vector into the trained anomaly detection model to obtain the network anomaly detection result.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 6.

10. A computer program product comprising computer program instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

Images