An abnormal traffic auxiliary analysis method based on multiple selection of signal features
By preprocessing signals and selecting features, Pearson coefficients, mutual information, random forests, and Fisher discriminant ratios are used to select signal features and construct a neural network model. This solves the problems of low efficiency and reliance on labeled data in abnormal traffic auxiliary analysis methods, and achieves efficient, accurate, and transparent analysis results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING INST OF COMP TECH & APPL
- Filing Date
- 2025-09-12
- Publication Date
- 2026-07-03
AI Technical Summary
Existing methods for analyzing abnormal traffic are inefficient, highly accurate but rely on large amounts of labeled data and lack high interpretability.
By combining signal preprocessing and feature extraction with Pearson coefficient, mutual information, random forest and Fisher discriminant ratio, signal features are selected from three perspectives: correlation, importance and discriminant, and a neural network model is constructed for abnormal traffic analysis.
It reduces feature computation costs, improves analytical accuracy and interpretability, and enhances analytical speed and result transparency without relying on domain expert knowledge.
Smart Images
Figure CN121173525B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of artificial intelligence, specifically relating to an abnormal traffic auxiliary analysis method based on multiple selection of signal features. Background Technology
[0002] Physical sensor signals can be used to record the operating status of network infrastructure, effectively reflecting the generation, scheduling, and anomaly recovery process of data streams during transmission. They have been widely used in various network anomaly analyses, such as DDoS attack detection, port scan identification, link congestion diagnosis, and equipment fault early warning.
[0003] Currently, methods for assisting in anomaly traffic analysis mainly include those based on security expert experience analysis, those based on multi-dimensional feature correlation analysis, and those based on deep learning modeling analysis. Methods based on security expert experience analysis are the primary detection approach, offering high reliability but relatively low efficiency. Methods based on multi-dimensional feature correlation analysis extract time-series and frequency-domain features from signals for judgment, offering strong interpretability but prone to feature redundancy. Methods based on deep learning modeling analysis automatically learn deep patterns in signal sequences to identify anomalies, achieving high accuracy but heavily relying on data quality and annotation completeness.
[0004] In practical applications, it is necessary to complete the auxiliary analysis of abnormal flow in physical sensor signals with high accuracy, high reliability and high interpretability. Therefore, this invention proposes an abnormal flow auxiliary analysis method based on multiple selection of signal features to meet application requirements. It completes the efficient analysis of abnormal flow by selecting significant features with high contribution in a dimensionality reduction manner. Summary of the Invention
[0005] (a) Technical problems to be solved
[0006] The technical problem to be solved by this invention is how to provide an abnormal traffic auxiliary analysis method based on multiple selection of signal features, so as to solve the problems of low efficiency, high accuracy but reliance on a large amount of labeled data in existing abnormal traffic auxiliary analysis methods.
[0007] (II) Technical Solution
[0008] To address the aforementioned technical problems, this invention proposes an abnormal traffic-assisted analysis method based on multiple selection of signal features, which includes the following steps:
[0009] S1. Signal preprocessing and feature extraction: The power frequency interference and baseline drift in the physical sensor signals are preprocessed, and signal features are extracted from the time domain, frequency domain and nonlinear dynamics to form an initial dataset.
[0010] S2. Signal Feature Correlation Selection: Based on the Pearson coefficient and mutual information between signal features and label information, only highly correlated signal features in the initial dataset are retained to form a correlation dataset.
[0011] S3. Signal feature importance selection: Based on the Gini impurity performance of signal features and label information in random forest, only high-importance signal features in the correlation dataset are retained to form an importance dataset;
[0012] S4. Discriminative selection of signal features: Based on the inter-class variance and intra-class variance between signal features and label information, only high-discriminative signal features in the importance dataset are retained to form a discriminative dataset;
[0013] S5. Abnormal Flow Assisted Analysis: The neural network model is trained using a discriminative dataset. After preprocessing the signals from the physical sensors to be screened and extracting the features contained in the discriminative dataset, the auxiliary analysis is completed based on the model output.
[0014] (III) Beneficial Effects
[0015] This invention proposes an abnormal flow-assisted analysis method based on multiple selection of signal features. This method extracts relevant features from physical sensor signals and selects features from three perspectives: correlation, importance, and discriminability. This allows the acquisition of the most informative features in the analysis. Without relying on domain expert knowledge, it can reduce feature computation costs, improve the performance of supervised models, enhance the interpretability of results, and has good practicality.
[0016] The abnormal traffic-assisted analysis method of this invention utilizes multiple selections of multidimensional signal features from three perspectives: correlation, importance, and discriminancy. This effectively reduces redundant features with poor relevance to the analysis task, retaining only significant features that contribute highly to the task for analysis. This method not only effectively improves analysis accuracy but also accelerates screening speed through dimensionality reduction, making it of significant application value in abnormal traffic-assisted discrimination. Attached Figure Description
[0017] Figure 1 This is a flowchart of the abnormal traffic auxiliary analysis method based on multiple selection of signal features according to the present invention. Detailed Implementation
[0018] To make the objectives, contents, and advantages of the present invention clearer, the specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples.
[0019] This invention proposes an anomaly traffic-assisted analysis method based on multiple selection of signal features. It designs a scheme for multiple selection of multidimensional signal features based on correlation, importance, and discriminancy. This method reduces reliance on security expert knowledge, improves the transparency of assisted analysis, and achieves dimensionality reduction through feature selection, thereby enabling efficient anomaly traffic analysis. The method includes the following steps:
[0020] S1. Signal Preprocessing and Feature Extraction. Filtering techniques are used to remove power frequency interference and baseline drift from physical sensor signals during acquisition. By analyzing the signal characteristics, multidimensional signal features in the time domain, frequency domain, and nonlinear dynamics are extracted to form an initial dataset with flow rate labeling information.
[0021] S11. Signal preprocessing. On the one hand, notch filtering can eliminate the superimposed sine wave in the signal, thereby reducing power frequency interference; on the other hand, median filtering can eliminate the slow directional shift of the signal over time, avoiding baseline drift.
[0022] S12. Signal Feature Extraction. Multidimensional signal features related to abnormal flow analysis are extracted from three aspects: time domain, frequency domain, and nonlinear dynamics. These features are then combined with label information to form an initial dataset for supervised model training.
[0023] S2, Selection of signal feature correlation.
[0024] S21. Correlation coefficient calculation. The linear correlation between signal features and tag information is analyzed using the Pearson correlation coefficient, and the nonlinear correlation between signal features and tag information is analyzed using mutual information.
[0025] S22. Relevant Feature Selection. Based on Pearson correlation coefficient analysis and mutual information analysis results, the correlation selection score of all initial signal features is calculated comprehensively. This is then determined according to the correlation threshold T. r Highly relevant features are selected from the initial dataset to form a relevant dataset.
[0026] S3, Selection of the importance of signal features.
[0027] S31. Random Forest Construction. After reasonably setting relevant parameters such as the number of decision trees, maximum depth, and feature sampling ratio, a single decision tree is recursively constructed based on the relevance dataset, and a random forest is constructed according to the termination conditions (such as the number of node samples or reaching the maximum depth).
[0028] S32. Important Feature Selection. For a random forest containing M decision trees, Gini impurity is used to calculate the feature importance score of each tree. By aggregating the calculation results of multiple trees using Gini importance and standardizing the results, the importance selection scores of all highly relevant features are obtained. Based on the importance threshold T... i Highly important features are selected from the relevance dataset to form an importance dataset.
[0029] S4. Signal feature discriminative selection.
[0030] S41. Variance Measure Calculation. Based on the features of highly important signals and label information, calculate the inter-class variance, which reflects the degree of difference in the mean of features among different labels, and the intra-class variance, which reflects the degree of dispersion of features within the same label.
[0031] S42. Discriminant Feature Selection. Based on the inter-class and intra-class variance results, the Fisher discriminant ratio is used to comprehensively calculate the discriminant selection score for all highly important features. The discriminant threshold T is then used as the basis for the selection. d Highly discriminative features are selected from the importance dataset to form a discriminative dataset.
[0032] S5, Abnormal Traffic Assistance Analysis.
[0033] S51. Supervised Model Training. After randomly dividing the discriminative dataset into training, test, and validation sets, a neural network model based on supervised learning is constructed. After model training and validation, the model performance is analyzed based on metrics such as sensitivity and specificity.
[0034] S52. Abnormal Traffic Analysis. After preprocessing the signal to be analyzed, relevant signal features contained in the discriminative dataset are directly extracted, and the trained neural network model is used for abnormal traffic analysis.
[0035] Example 1:
[0036] The specific implementation process of this invention is as follows.
[0037] (1) Signal preprocessing and feature extraction.
[0038] Power frequency interference typically occurs between 50 and 60 Hz and can be processed using a 50 Hz notch filter; baseline drift typically occurs between 0.05 and 2 Hz and can be processed using median filtering. Feature extraction is performed on the preprocessed physical sensor signals from three perspectives: time domain, frequency domain, and nonlinear dynamics, thereby reflecting the intrinsic changes in flow rate.
[0039] Time-domain characteristics can effectively estimate the overall variation of a signal over time. The physical sensor signal is defined as x = {x1, ..., x...}. i ,…,xN}(x i (This represents the amplitude measured and converted by the sensor at the i-th sampling time), and then the signal mean is extracted. Signal standard deviation Features;
[0040] The Discrete Fourier Transform (DFT) can be used to transform a signal from the time domain to the frequency domain (its amplitude spectrum is represented as |X(k)|). The frequency domain characteristics can effectively estimate the periodicity, rhythm, and regularity of the flow, thus allowing the extraction of the spectral centroid. Spectral variance Features;
[0041] Nonlinear dynamics can quantify the complexity, unpredictability, and structure of flow, thus allowing the extraction of features such as sample entropy (SampEn) and Lyapunov exponent.
[0042] After extracting all features, an initial dataset X = {X1, X2, ..., X} is formed. n The corresponding signal flow label information is y.
[0043] (2) Selection of signal feature correlation.
[0044] First, calculate the j-th dimension signal feature X. j The Pearson correlation coefficient between j = 1, 2, ..., n and the label information y Analyze the linear correlation of the features. Where x ij X represents j The i-th sample in the dataset has a specific label y. i , and For X j The mean of y and y, where m is the sample size.
[0045] Secondly, calculate the signal characteristics X. j Mutual information with label information y Analyze the nonlinear correlation of the features. Where p(X) j Let ,y) be the joint probability density, i.e., X j The probability that X and y take the same value at the same time is p(X). j ) and p(y) are the marginal probability densities, i.e., X j Or the probability of a single variable y.
[0046] Then, construct the relevant choice score RS. j =ω1|ρ j |+ω2I(X j ;y), where ω1 and ω2 are weights.
[0047] Finally, based on the relevant threshold T r When RS j ≥T r When considering feature X j These are highly correlated features. This operation is performed on all features in the initial dataset, retaining only the highly correlated features to form a correlated dataset. The corresponding tag information is
[0048] (3) Selection of the importance of signal features.
[0049] Based on correlation datasets and tag information After setting the relevant parameters, a random forest is recursively constructed. For one of the decision trees T, the impurity of Gint is used as the basis for... Importance can be represented as I j (T)=∑ t∈T (ΔGini(t)·II(v(t)=j)), where t is a node in the tree, v(t) represents the splitting characteristic of the node, ΔGini(t) is the reduction in Gini impurity before and after the node split, and II(·) is an exponential function, which is 1 when v(t)=j and 0 otherwise. For a random forest containing M decision trees, Importance is expressed as After normalizing importance, features The important choice score can be expressed as
[0050] Based on the importance threshold T i When IS j ≥T i Time considers features These are high-importance features. This operation is performed on all features in the relevance dataset, retaining only the high-importance features to form the overall importance dataset. The corresponding tag information is
[0051] (4) Signal feature discriminative selection.
[0052] For features and tags Between-class variance can be defined as Where, p c It is the sample proportion of category c (representing whether the traffic is abnormal or not), μ c Features under category c The mean, μ is the characteristic The overall mean.
[0053] Within-class variance can be defined as in n c It is a feature The number of samples belonging to category c. express The i-th sample in the dataset has the following specific label:
[0054] Fisher's discriminant ratio The discriminant selection score can be expressed as Based on the discriminant threshold T d When JS j ≥T d Time considers features These are highly discriminative features. This operation is performed on all features in the importance dataset, retaining only the highly discriminative features to form the discriminative dataset. The corresponding tag information is
[0055] (5) Abnormal traffic-assisted analysis. First, after the network architecture design and key parameter settings are completed, the discriminative dataset is... and label information The dataset is used for training, testing, and validating the performance of the neural network model, and the model parameters are configured through the corresponding optimization function. Secondly, after preprocessing the signal to be analyzed, the discriminative dataset is directly extracted. The relevant signal features are included. Finally, these features are input into the trained model, and the abnormal traffic situation is judged based on the model's output predicted label information, thereby completing the auxiliary analysis.
[0056] Example 2:
[0057] An abnormal traffic-assisted analysis method based on multiple selection of signal features includes the following steps:
[0058] (1) Signal preprocessing and feature extraction. Power frequency interference and baseline drift in physical sensor signals are preprocessed, and signal features are extracted from the time domain, frequency domain and nonlinear dynamics to form an initial dataset.
[0059] (2) Selection of signal feature correlation. Based on the Pearson coefficient and mutual information between signal features and label information, only highly correlated signal features in the initial dataset are retained to form a correlation dataset.
[0060] (3) Selection of signal feature importance. Based on the Gini impurity performance of signal features and label information in random forest, only the high-importance signal features in the correlation dataset are retained to form the importance dataset.
[0061] (4) Discriminative selection of signal features. Based on the inter-class variance and intra-class variance between signal features and label information, only high-discriminative signal features in the importance dataset are retained to form a discriminative dataset.
[0062] (5) Abnormal flow auxiliary analysis. A neural network model is trained using a discriminative dataset. After preprocessing the signals from the physical sensors to be screened and extracting the features contained in the discriminative dataset, auxiliary analysis is completed based on the model output.
[0063] Step (1) of this method includes the following sub-steps:
[0064] (11) Signal preprocessing. Notch filtering and median filtering were used to preprocess power frequency interference with a frequency of 50-60Hz and baseline drift with a frequency of 0.05-2Hz, respectively.
[0065] (12) Signal Feature Extraction. Time-domain features such as VGR and SD, frequency-domain features such as FC and VF, and nonlinear dynamic features such as SampEn and Lyapunov are extracted from the signal. The initial dataset X = {X1, X2, ..., X} is constructed from these features. n The corresponding signal flow label information is y.
[0066] Step (2) of this method includes the following sub-steps:
[0067] (21) Correlation coefficient calculation. Calculate signal characteristic X. j The Pearson correlation coefficient ρ with the label information y j To determine the linear correlation, calculate the signal characteristic X. j Mutual information I(X) with tag information j ;y) to determine the nonlinear correlation.
[0068] (22) Relevant feature selection. For signal feature X... j Construct relevant choice scores RS j =ω1|ρ j |+ω2I(X j ;y), based on the relevant threshold T r When RS j ≥T r When considering feature X j These are highly correlated features. Only all highly correlated features in the initial dataset are retained to form a correlated dataset. The corresponding tag information is
[0069] Step (3) of this method includes the following sub-steps:
[0070] (31) Random forest construction. Based on a correlation dataset. and tag information After setting relevant parameters such as the number of decision trees and the feature sampling ratio, a random forest is recursively constructed based on the termination condition.
[0071] (32) Selection of important features. For signal features... Construct important choice scores Based on the importance threshold T i When IS j ≥T i Time considers features These are high-importance features. Only all high-importance features in the relevance dataset are retained to form the importance dataset. The corresponding tag information is
[0072] Step (4) of this method includes the following sub-steps:
[0073] (41) Calculation of variance metric. Calculation of signal characteristics. With tag information inter-class variance and within-class variance
[0074] (42) Discriminant feature selection. This involves selecting signal features. Constructing a discriminative selection score Based on the discriminant threshold T d When JS j ≥T d Time considers features These are highly discriminative features. Only all highly discriminative features in the most important datasets are retained to form the discriminative dataset. The corresponding tag information is
[0075] Step (5) of this method includes the following sub-steps:
[0076] (51) Supervised model training. After constructing the neural network model NN and setting the key parameters, a discriminative dataset is used. and tag information The model was trained using supervised learning and its performance was validated.
[0077] (52) Abnormal Flow Analysis. After preprocessing the physical sensor signals to be analyzed, the abnormal flow is directly extracted. The features contained therein form a feature set to be screened. Will The input is fed into the trained neural network, and the output is based on the prediction. Determine the results of the auxiliary analysis.
[0078] The abnormal flow-assisted analysis method of the present invention extracts corresponding features from physical sensor signals and selects features from three perspectives: correlation, importance, and discriminability. This method can obtain the most informative features in the analysis, reduce feature computation costs, improve the performance of supervised models, and enhance the interpretability of results without relying on domain expert knowledge, thus demonstrating good practicality.
[0079] The abnormal traffic-assisted analysis method of this invention utilizes multiple selections of multidimensional signal features from three perspectives: correlation, importance, and discriminancy. This effectively reduces redundant features with poor relevance to the analysis task, retaining only salient features that contribute significantly to the task. This method not only effectively improves analysis accuracy but also accelerates analysis speed through dimensionality reduction, making it of significant application value in abnormal traffic-assisted discrimination.
[0080] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. An abnormal traffic auxiliary analysis method based on multiple selection of signal characteristics, characterized in that, The method includes the following steps: S1. Signal preprocessing and feature extraction: The power frequency interference and baseline drift in the physical sensor signals are preprocessed, and signal features are extracted from the time domain, frequency domain and nonlinear dynamics to form an initial dataset. S2, signal feature correlation selection: according to the correlation between the signal features and the label information coefficient and mutual information, only the high correlation signal features in the initial data set are retained to form a correlation data set; S3, signal feature importance selection: according to the signal feature and the label information in the random forest impurity performance, only the high importance signal features in the correlation dataset are reserved to form the importance dataset; S4. Discriminative selection of signal features: Based on the inter-class variance and intra-class variance between signal features and label information, only high-discriminative signal features in the importance dataset are retained to form a discriminative dataset; S5. Abnormal Flow Auxiliary Analysis: The neural network model is trained using a discriminative dataset. After preprocessing the physical sensor signals to be analyzed and extracting the features contained in the discriminative dataset, the auxiliary analysis is completed based on the model output. in, S5 includes: S51. Supervised model training: After randomly dividing the discriminative dataset into training, test and validation sets, a neural network model based on supervised learning is constructed. After model training and validation, the model performance is analyzed based on sensitivity and specificity indicators. S52. Abnormal Flow Analysis: After preprocessing the signal to be analyzed, the relevant signal features contained in the discriminative dataset are directly extracted, and the trained neural network model is used to perform abnormal flow auxiliary analysis. S5 includes: After network architecture design and key parameter setting, the discriminative dataset will be... and label information The dataset is used to train, test, and validate the performance of neural network models, and the model parameters are configured through the corresponding optimization function. After preprocessing the physical sensor signals to be analyzed, the discriminative dataset is directly extracted. The corresponding signal features contained therein; These features are input into the trained model, and the abnormal traffic situation is judged based on the model's output prediction label information, thereby completing the auxiliary analysis.
2. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 1, characterized in that, S1 includes: S11. Signal preprocessing: Notch filtering is used to eliminate the sine wave superimposed on the physical sensor signal, thereby reducing power frequency interference; median filtering is used to eliminate the slow directional shift of the signal over time, avoiding baseline drift. S12. Signal Feature Extraction: Extract multidimensional signal features related to abnormal flow analysis from three aspects: time domain, frequency domain, and nonlinear dynamics. Combine these features with label information to form an initial dataset for supervised model training.
3. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 2, characterized in that, S2 includes: S21. Correlation coefficient calculation: through... Correlation coefficient analysis is used to analyze the linear correlation between signal features and tag information, while mutual information analysis is used to analyze the nonlinear correlation between signal features and tag information. S22, Relevant Feature Selection: Based on Based on the results of correlation coefficient analysis and mutual information analysis, the correlation selection score of all initial signal features is calculated; and based on the correlation threshold... Highly relevant features are selected from the initial dataset to form a relevant dataset.
4. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 3, characterized in that, S3 includes: S31. Random Forest Construction: After reasonably setting the relevant parameters such as the number of decision trees, maximum depth, and feature sampling ratio, a single decision tree is recursively constructed based on the relevance dataset, and a random forest is constructed according to the termination condition. S32. Important Feature Selection: For features containing Random forest of decision trees, using Impurity is used to calculate the feature importance score for a single tree. This is achieved by combining the calculation results from multiple trees. Importance aggregation, after standardization, yields importance selection scores for all highly relevant features; based on importance thresholds... Highly important features are selected from the relevance dataset to form an importance dataset.
5. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 4, characterized in that, S4 includes: S41. Variance Measure Calculation: Based on the features of highly important signals and label information, calculate the inter-class variance, which reflects the degree of difference in the mean of features among different labels, and the intra-class variance, which reflects the degree of dispersion of features within the same label. S42. Discriminant Feature Selection: Based on the inter-class and intra-class variance results, the Fisher discriminant ratio is used to comprehensively calculate the discriminant selection score of all high-importance features, and the selection is based on the discriminant threshold. Highly discriminative features are selected from the importance dataset to form a discriminative dataset.
6. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 1, characterized in that, S1 includes: The frequency of power frequency interference is 50~60 , using 50 The notch filter is used for processing; The frequency of baseline drift is between 0.05 and 2. Median filtering is used for processing; Feature extraction is performed on the preprocessed physical sensor signals from three perspectives: time domain, frequency domain, and nonlinear dynamics, thereby reflecting the intrinsic changes in flow rate; Time-domain features are used to effectively estimate the overall variation of a signal over time. Physical sensor signals are defined as... , Indicates the first The amplitude values measured and converted by the sensor at each sampling time are then used to extract the signal mean. Signal standard deviation , Indicates the total number of samples; The Discrete Fourier Transform (DFT) can be used to transform a signal from the time domain to the frequency domain, and its amplitude spectrum can be represented as follows: Frequency domain features can effectively estimate the periodicity, rhythm, and regularity of traffic flow, thereby extracting the spectral centroid. Spectral variance , Indicates frequency index; Nonlinear dynamic characteristics can quantify the complexity, unpredictability, and structure of flow, thereby extracting sample entropy. Lyapunov index feature; After extracting all features, an initial dataset is formed. The corresponding signal flow label information is .
7. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 6, characterized in that, S2 includes: First, calculate the... 3D signal characteristics With tag information of Correlation coefficient Analyze the linear correlation of features; among them, express The Middle Each sample has a corresponding specific label. , and for and The mean, The number of samples; Secondly, calculate signal characteristics. With tag information mutual information The nonlinear correlation of the characteristics is analyzed; among them, The joint probability density, i.e. and The probability of taking a certain value at the same time and The marginal probability density, i.e. or The probability of a single variable; Then, construct the relevant selection scores. ,in and As weight; Finally, based on the relevant threshold ,when Time considers features Features that are highly correlated; operations are performed on all features in the initial dataset, and only highly correlated features are retained to form a correlated dataset. The corresponding tag information is .
8. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 7, characterized in that, S3 includes: Based on correlation datasets and tag information After setting the relevant parameters, a random forest is recursively constructed; for one of the decision trees... ,based on impurity Importance is expressed as ,in For the nodes of the tree, This indicates the splitting characteristics of a node. It refers to the node before and after splitting. Impurity reduction amount For an exponential function, when The value is 1 if it is true, and 0 otherwise; for those containing Random forest with decision trees Importance is expressed as After normalizing the importance, the features Important choice scores are expressed as ; Based on importance thresholds ,when Time considers features Features of high importance; operations are performed on all features in the relevance dataset, retaining only the high-importance features to form the overall importance dataset. The corresponding tag information is .
9. The abnormal traffic-assisted analysis method based on multiple selection of signal features as described in claim 8, characterized in that, S4 include: For features and tags The variance between classes is defined as ,in, It is a category Sample proportion, category Does this indicate whether the traffic is abnormal? It is a category Lower features The mean, It is a feature The overall mean; Within-class variance is defined as ,in , It is a feature The middle category belongs to The number of samples, express The Middle Each sample has a corresponding specific label. ; Fisher's discriminant ratio The discriminant selection score is represented as Based on the discrimination threshold ,when Time considers features These are highly discriminative features; operations are performed on all features in the important dataset, retaining only the highly discriminative features to form a discriminative dataset. The corresponding tag information is .