Intelligent SDN (Software Defined Network) abnormal traffic detection method and system

Abstract

The invention relates to an intelligent SDN network abnormal flow detection method and system, and the method comprises the steps: collecting network flow data through an SDN switch, carrying out the preprocessing, and generating a standardized time sequence feature vector; performing multi-scale feature extraction on the standardized time sequence feature vector based on a multi-scale one-dimensional expansion convolutional neural network and a channel attention mechanism, capturing a context dependency relationship of abnormal traffic in combination with a bidirectional long-short-term memory network, and outputting a high-dimensional abnormal feature vector; and adopting a full connection layer and a Softmax activation function to classify the high-dimensional abnormal feature vector, optimizing the model performance through a composite loss function, and generating the classification probability of the abnormal traffic. According to the method, the detection precision of a complex attack mode is improved through multi-scale expansion convolution and a channel attention mechanism, and the robustness is enhanced by capturing time sequence dependence in combination with a bidirectional long-short-term memory network; the classification performance is optimized by adopting a composite loss function, and the false alarm rate is reduced; and realizing millisecond attack blocking based on a dynamic flow table rule of a classification probability.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a method and system for detecting abnormal traffic in intelligent SDN networks. Background Technology

[0002] With the large-scale deployment of software-defined networks in cloud computing, the Internet of Things, and other fields, abnormal network traffic detection has become a core technology for ensuring network security. Traditional detection methods have significant limitations when dealing with complex network environments: conventional convolutional neural network models can only capture features within a fixed time window, making it difficult to adapt to multi-scale and multi-granularity traffic patterns, resulting in a decrease in the detection rate of low-frequency anomalies; while bidirectional long short-term memory networks can model long-term temporal dependencies, they lack sensitivity to local burst patterns; in addition, traditional detection schemes only output classification results and do not work in conjunction with SDN controllers to achieve proactive defense, requiring manual intervention to adjust strategies and making it difficult to block attack paths in real time.

[0003] To address the aforementioned problems, this invention proposes an intelligent SDN network anomaly traffic detection method. This method expands the receptive field through dilated convolution while preserving local details, enhancing the learning ability for multi-scale features. It introduces a bidirectional long short-term memory network and channel attention mechanism to dynamically adjust feature weights and strengthen the learning of key temporal patterns. Furthermore, it combines network topology and traffic analysis to achieve synergy between anomaly tracing and policy optimization. This invention provides an innovative solution for efficient and accurate anomaly detection in SDN environments and offers a robust and adaptive proactive defense mechanism against network attacks. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent SDN network abnormal traffic detection method and system to solve the problems of low detection accuracy, insufficient real-time performance, and lack of automated source tracing and path optimization capabilities of existing SDN network abnormal traffic detection methods under complex attack modes.

[0005] To achieve one of the above-mentioned objectives, one embodiment of the present invention provides a method for detecting abnormal traffic in an intelligent SDN network, the method comprising:

[0006] Network traffic data is collected through an SDN switch and preprocessed to generate standardized time-series feature vectors.

[0007] Multi-scale feature extraction is performed on the standardized temporal feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism. The bidirectional long short-term memory network is combined to capture the contextual dependencies of abnormal traffic and output a high-dimensional abnormal feature vector.

[0008] The high-dimensional abnormal feature vector is classified using a fully connected layer and a softmax activation function. The model performance is optimized by a composite loss function to generate the classification probability of abnormal traffic.

[0009] As a further improvement to one embodiment of the present invention, the method further includes, the preprocessing comprising,

[0010] Delete packets containing empty records, invalid IP addresses, or protocol field errors to remove invalid data;

[0011] By using linear interpolation, missing data are filled in based on the weighted average of adjacent valid data, thus generating a continuous time-series dataset.

[0012] By balancing the impact of recent and long-term data using the exponential smoothing method, noise smoothing is applied to the time-series dataset to generate smoothed traffic data.

[0013] The smoothed traffic data is divided into overlapping time segments according to a fixed time window. Each segment has a fixed length and is formatted as an input vector suitable for a one-dimensional convolutional neural network.

[0014] By using the fast gradient sign method, perturbations are added to the time-series segments to generate adversarial examples, thereby enhancing the robustness of the model.

[0015] As a further improvement to one embodiment of the present invention, the method further includes, the multi-scale feature extraction comprising,

[0016] A multi-scale one-dimensional dilated convolution kernel is used to extract local features of network traffic data, where convolution kernels with different dilation rates correspond to different receptive fields; the formula for calculating the receptive field is as follows:

[0017]

[0018] in, The receptive field represents the number of time steps that the convolutional kernel covers on the time-series data, k is the kernel size, and r is the dilation rate, used to capture short-term, medium-term, and long-term traffic patterns.

[0019] By concatenating the channels, the local features output by the convolutional kernels from different receptive fields are integrated into a high-dimensional feature vector, represented as:

[0020]

[0021] in, Here, T represents the number of time steps, and D represents the total number of channels;

[0022] Channel attention mechanism is used to enhance feature representation capability. Global average pooling is used to process the high-dimensional feature vector F to generate channel-level feature vectors, as shown in the formula:

[0023]

[0024] The channel attention weights are calculated using a structure that includes two layers of linear transformation and a nonlinear activation function, as shown in the formula:

[0025]

[0026] in, Let be a vector of channel attention weights, representing the importance of each channel to the feature representation. For learnable weight matrix, The Sigmoid activation function is used, and ReLU is the rectified linear unit activation function.

[0027] The channel attention weights are multiplied element-wise by the high-dimensional feature vector to generate weighted features, as shown in the formula:

[0028]

[0029] in, For weighted features, ⊙ represents element-wise multiplication.

[0030] As a further improvement to one embodiment of the present invention, the method further includes, the context dependency of capturing abnormal traffic includes,

[0031] By using forward and backward time series modeling, contextual dependencies are captured, and anomalous feature vectors are generated, specifically including...

[0032] The formula for deciding which historical information to discard using the forget gate is:

[0033]

[0034] in, The output of the forget gate represents the proportion of information retained. and For weights and biases, This is the hidden state from the previous time step. Input for the current time step;

[0035] The cell state is updated collaboratively using an input gate and a forget gate. The input gate generates candidate cell states and an input gating vector, as shown in the following formula:

[0036]

[0037]

[0038] in, Let be the candidate cell state vector, representing information that may be updated. The input gate output represents the update ratio. Here is the weight matrix of the input gate. Here, is the bias of the input gate, and tanh is the hyperbolic tangent activation function;

[0039] The formula for updating cell state is:

[0040]

[0041] in, The current cell state, This refers to the previous cell state;

[0042] The hidden state is generated using the output gate, with the following formula:

[0043]

[0044]

[0045] in, The output of the output gate represents the proportion of the output information. Here are the weight matrix and bias of the output gate. The hidden state represents the anomalous feature vector.

[0046] As a further improvement to one embodiment of the present invention, the method further includes, the classification probability of the generated abnormal traffic includes,

[0047] The outlier feature vectors are mapped to class probabilities using a fully connected layer and a softmax function, as shown in the formula:

[0048]

[0049] in, Here, represents the category probability, indicating the probability that the sample is abnormal traffic. and For the weight matrix and bias;

[0050] The cross-entropy loss is calculated to measure the difference between the predicted probability and the true label. The formula is as follows:

[0051]

[0052] in, For cross-entropy loss, Let i be the true label of the i-th sample. Let N be the predicted probability of the i-th sample, and N be the total number of samples.

[0053] The temporal consistency loss is calculated to ensure the stability of prediction results at adjacent time steps. The formula is as follows:

[0054]

[0055] in, For time-series consistency loss, The time window length, Let be the predicted probability at time step t. The square of the L2 norm;

[0056] Construct a composite loss function to optimize model performance; the formula is as follows:

[0057]

[0058] in, The total loss is represented by α and β, which are hyperparameters.

[0059] As a further improvement to one embodiment of the present invention, the method further includes dynamically generating SDN flow table rules based on classification probabilities, and distributing them to the switch via the OpenFlow protocol to achieve real-time attack blocking, specifically including...

[0060] Response levels are determined based on classification probability.

[0061] When the classification probability is lower than the first threshold, log the event and trigger a low-priority alarm.

[0062] When the classification probability is between the first threshold and the second threshold, the rate limiting action of the OpenFlow protocol is applied;

[0063] When the classification probability is higher than the second threshold, malicious traffic is blocked by dropping it using the OpenFlow protocol.

[0064] The generated flow table rules are distributed to the SDN switch via the OpenFlow protocol to perform real-time attack blocking.

[0065] As a further improvement to one embodiment of the present invention, the method further includes locating the anomaly source and optimizing the network path through multi-source data correlation analysis, specifically including:

[0066] Construct a network topology graph with switches as nodes, physical connections as edges, and traffic characteristics as weights. Locate the abnormal source host or infected network segment by calculating the contribution of abnormal traffic to nodes and analyzing time series similarity.

[0067] Based on the source tracing results, adaptive adjustments are performed, including:

[0068] If the source host of the anomaly is located, an isolation rule is issued;

[0069] If core link congestion is identified, the optimal alternative path is calculated.

[0070] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides an intelligent SDN network abnormal traffic detection system, the system comprising a data acquisition module, a time series modeling module, and an anomaly classification module;

[0071] The data acquisition module is used to collect network traffic data through an SDN switch, and perform preprocessing to generate standardized time-series feature vectors.

[0072] The time series modeling module is used to extract multi-scale features from the standardized time series feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism, and to capture the contextual dependencies of abnormal traffic by combining a bidirectional long short-term memory network, and output a high-dimensional abnormal feature vector.

[0073] The anomaly classification module is used to classify the high-dimensional anomaly feature vector using a fully connected layer and a composite loss function, and to optimize model performance by adjusting weights to generate the classification probability of anomaly traffic.

[0074] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the intelligent SDN network abnormal traffic detection method described above.

[0075] To achieve one of the above-mentioned objectives, an embodiment of the present invention also provides a storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps in the intelligent SDN network abnormal traffic detection method described above.

[0076] Compared with existing technologies, this invention provides an intelligent SDN network abnormal traffic detection method and system. It improves the detection accuracy of complex attack patterns through multi-scale dilated convolution and channel attention mechanisms, enhances robustness by combining bidirectional long short-term memory networks to capture temporal dependencies, optimizes classification performance using a composite loss function to reduce false alarm rate, achieves millisecond-level attack blocking based on dynamic flow table rules of classification probability, and accurately locates abnormal sources and optimizes network paths through multi-source data correlation analysis, realizing full automation from detection to response, significantly improving the security, real-time performance, and efficiency of SDN networks. Attached Figure Description

[0077] Figure 1 This is an overall flowchart of the intelligent SDN network abnormal traffic detection method described in this invention.

[0078] Figure 2 This is a schematic diagram of the overall structure of the convolutional neural network in the intelligent SDN network abnormal traffic detection method described in this invention.

[0079] Figure 3 This is a diagram of the internal structure of the bidirectional long short-term memory network module in the intelligent SDN network abnormal traffic detection method described in this invention.

[0080] Figure 4 This is a structural diagram of the bidirectional long short-term memory network module of the intelligent SDN network abnormal traffic detection method described in this invention.

[0081] Figure 5 This is a schematic diagram of the architecture of the intelligent SDN network abnormal traffic detection system described in this invention. Detailed Implementation

[0082] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0083] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0084] In Embodiment 1 of the present invention, the present invention provides a method for detecting abnormal traffic in an intelligent SDN network, such as... Figure 1 , 2 As shown, the method includes,

[0085] S1: Collect network traffic data through an SDN switch, perform preprocessing, and generate standardized time-series feature vectors;

[0086] S2: Multi-scale feature extraction is performed on the standardized temporal feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism. The bidirectional long short-term memory network is combined to capture the contextual dependencies of abnormal traffic and output a high-dimensional abnormal feature vector.

[0087] S3: The high-dimensional abnormal feature vector is classified using a fully connected layer and a Softmax activation function. The model performance is optimized by a composite loss function to generate the classification probability of abnormal traffic.

[0088] In one specific embodiment of the present invention, the preprocessing specifically includes...

[0089] Delete packets containing empty records, invalid IP addresses, or protocol field errors to remove invalid data;

[0090] By using linear interpolation, missing data are filled in based on the weighted average of adjacent valid data, thus generating a continuous time-series dataset.

[0091] By balancing the impact of recent and long-term data using the exponential smoothing method, noise smoothing is applied to the time-series dataset to generate smoothed traffic data.

[0092] The smoothed traffic data is divided into overlapping time segments according to a fixed time window. Each segment has a fixed length and is formatted as an input vector suitable for a one-dimensional convolutional neural network.

[0093] By using the fast gradient sign method, perturbations are added to the time-series segments to generate adversarial examples, thereby enhancing the robustness of the model.

[0094] Further, missing data handling is performed. Data packets containing empty records, invalid IP addresses, or protocol field errors in network traffic are deleted to remove invalid data. Missing values ​​are then filled using linear interpolation, calculated as follows:

[0095]

[0096] in, For missing values ​​to be filled, and The missing value is represented by the two adjacent valid values. and This represents the distance between the missing value and its left and right adjacent valid values.

[0097] Furthermore, noise smoothing is employed. Exponential smoothing is used, assigning higher weights to recent data and decreasing the weights of older data exponentially to balance the influence of historical data and current observations, thereby reducing the impact of noise. The calculation formula is as follows:

[0098]

[0099] Among them, S t X represents the smoothed value at time t; t The actual observed value at time t; α represents the smoothing constant used to control data weights, which is taken as 0.8 in one implementation scenario of this invention; S t-1 The smoothed value represents time t-1.

[0100] Furthermore, sliding window segmentation is employed. The original network traffic data is divided into overlapping temporal segments with a fixed window length, preserving temporal continuity. The segmented sequence segments have a fixed length, and each segment constitutes a training sample for the model, satisfying the input requirements of the convolutional neural network. Specifically, this is represented as follows:

[0101]

[0102]

[0103] Where X(i) represents the i-th time segment, and N is the length of the original data.

[0104] Furthermore, adversarial example generation is employed. The Fast Gradient Sign Method (FGSM) is used to generate adversarial examples, improving the model's robustness. The calculation formula is as follows:

[0105]

[0106] Where ϵ is the perturbation intensity, J(x,y) is the loss function, and y is the target label.

[0107] In one specific embodiment of the present invention, multi-scale feature extraction specifically includes...

[0108] A multi-scale one-dimensional dilated convolution kernel is used to extract local features of network traffic data, where convolution kernels with different dilation rates correspond to different receptive fields; the formula for calculating the receptive field is as follows:

[0109]

[0110] in, The receptive field represents the number of time steps that the convolutional kernel covers on the time-series data, k is the kernel size, and r is the dilation rate, used to capture short-term, medium-term, and long-term traffic patterns.

[0111] By concatenating the channels, the local features output by the convolutional kernels from different receptive fields are integrated into a high-dimensional feature vector, represented as:

[0112]

[0113] in, Here, T represents the number of time steps, and D represents the total number of channels;

[0114] Channel attention mechanism is used to enhance feature representation capability. Global average pooling is used to process the high-dimensional feature vector F to generate channel-level feature vectors, as shown in the formula:

[0115]

[0116] The channel attention weights are calculated using a structure that includes two layers of linear transformation and a nonlinear activation function, as shown in the formula:

[0117]

[0118] in, Let be a vector of channel attention weights, representing the importance of each channel to the feature representation. For learnable weight matrix, The Sigmoid activation function is used, and ReLU is the rectified linear unit activation function.

[0119] The channel attention weights are multiplied element-wise by the high-dimensional feature vector to generate weighted features, as shown in the formula:

[0120]

[0121] in, For weighted features, ⊙ represents element-wise multiplication.

[0122] It should be noted that by performing multi-scale feature extraction, local features of short-term, medium-term, and long-term traffic patterns can be extracted to generate optimized high-dimensional feature representations that are suitable for the input requirements of subsequent time series modeling.

[0123] Furthermore, by employing multi-scale convolution, multi-level temporal features of normal and abnormal traffic are extracted, enhancing the model's ability to perceive complex network behaviors. This invention extracts diverse temporal features of network traffic through multi-scale one-dimensional dilated convolution kernels, enhancing the perception of normal and abnormal traffic patterns and providing rich local features for subsequent feature integration. By using multiple sets of one-dimensional convolution kernels and configuring different dilation rates to form various receptive fields, short-term receptive fields capture instantaneous traffic changes (such as burst packets in normal traffic or high-frequency attacks in abnormal traffic), medium-term receptive fields capture periodic patterns (such as periodic transmission of normal traffic or periodic scanning of abnormal traffic), and long-term receptive fields capture persistent patterns (such as persistent traffic in DDoS attacks). Each convolution kernel generates a local feature map representing the temporal characteristics of normal and abnormal traffic. In one implementation scenario of this invention, the system applies multiple sets of one-dimensional dilated convolution operations to the standardized temporal feature vector, sets multiple sets of convolution kernels, processes data in parallel, and generates multiple sets of local feature maps representing normal traffic (such as stable bandwidth) and abnormal traffic (such as sudden attack bursts).

[0124] Furthermore, through concatenation operations, short-term, medium-term, and long-term features are integrated to form a unified feature representation, supporting subsequent attention mechanism optimization. This invention integrates local features from different receptive fields through channel-dimensional concatenation operations to generate a high-dimensional feature vector F, providing a unified feature representation for the channel attention mechanism. By concatenating the local feature maps generated by multi-scale dilated convolutions along the channel dimension, a high-dimensional feature vector F is generated. F contains multi-scale features of normal traffic (such as periodic transmission) and abnormal traffic (such as high-frequency data packets), preserving the temporal information of each receptive field. In one implementation scenario of this invention, the system uses matrix concatenation operations to connect the feature maps of each convolution kernel along the channel dimension, generating a feature vector F of dimension T×D, which is stored in matrix format to adapt to channel attention mechanism processing.

[0125] Furthermore, by employing a channel attention mechanism, the feature representation is dynamically optimized to highlight channel features related to normal traffic (e.g., stable transmission) and abnormal traffic (e.g., attack patterns), thereby improving model robustness. This invention enhances key channel features relevant to normal and abnormal traffic detection and suppresses irrelevant channels by dynamically adjusting channel weights, thus improving the specificity and robustness of feature expression. By applying global average pooling (GAP) to the high-dimensional feature vector F, channel-level feature vectors are generated, representing the average feature strength of each channel in the time dimension and characterizing the contribution of normal and abnormal traffic patterns. Channel attention weights are generated by processing Z through two layers of linear transformation and a nonlinear activation function, representing the importance of each channel to feature expression. By multiplying the weights s element-wise with F, a weighted feature F' is generated, enhancing key channel features related to normal and abnormal traffic and suppressing redundant information.

[0126] In one specific embodiment of the present invention, capturing the contextual dependencies of abnormal traffic specifically involves:

[0127] By using forward and backward time series modeling, contextual dependencies are captured, and anomalous feature vectors are generated, specifically including...

[0128] The formula for deciding which historical information to discard using the forget gate is:

[0129]

[0130] in, The output of the forget gate represents the proportion of information retained. and For weights and biases, This is the hidden state from the previous time step. Input for the current time step;

[0131] The cell state is updated collaboratively using an input gate and a forget gate. The input gate generates candidate cell states and an input gating vector, as shown in the following formula:

[0132]

[0133]

[0134] in, Let be the candidate cell state vector, representing information that may be updated. The input gate output represents the update ratio. Here is the weight matrix of the input gate. Here, is the bias of the input gate, and tanh is the hyperbolic tangent activation function;

[0135] The formula for updating cell state is:

[0136]

[0137] in, The current cell state, This refers to the previous cell state;

[0138] The hidden state is generated using the output gate, with the following formula:

[0139]

[0140]

[0141] in, The output of the output gate represents the proportion of the output information. Here are the weight matrix and bias of the output gate. The hidden state represents the anomalous feature vector.

[0142] It should be noted that, as Figure 3 As shown, by capturing the contextual dependencies of abnormal traffic, we can ensure that the contextual dependencies of network traffic data are captured through forward and backward time-series modeling, and generate abnormal feature vectors suitable for subsequent classification.

[0143] Furthermore, this invention employs a bidirectional LSTM network to process the weighted feature vector. .like Figure 4 As shown, the forward LSTM processes the data in time steps 1 to T, capturing contextual dependencies and generating a forward hidden state sequence; the backward LSTM processes the data in time steps T to 1, capturing contextual dependencies and generating a backward hidden state sequence. Finally, the forward and backward states are concatenated to generate an anomaly feature vector. The input is a fully connected layer. The formulas for the forward and backward hidden states are:

[0144]

[0145]

[0146]

[0147] in, The input at the current time step represents the feature vector input into the forward LSTM at time step t. Let be the parameter set of the forward LSTM, and let represent the learnable weight matrix of the forward LSTM network, containing the weights for the forget gate, input gate, output gate, and cell state update. Used for forward time series modeling; This represents the input at the reverse time step, indicating the input feature vector at time step Tt in the reverse LSTM processing, reflecting the input of the reverse time series. Let be the parameter set of the inverse LSTM, and let represent the learnable weight matrix of the inverse LSTM network, containing the weights for the forget gate, input gate, output gate, and cell state update. , used for reverse timing modeling; These represent the forward and reverse hidden states, respectively.

[0148] In one implementation scenario of this invention, the system initializes the parameters (weight matrices) of the forward and backward LSTMs. and bias The input features F' (dimension T×D, where T is the number of time steps and D is the number of channels) are processed in parallel to generate forward and backward hidden states, which are then concatenated to generate the final hidden state. To adapt to subsequent classification modules.

[0149] Furthermore, this invention employs a forget gate mechanism to filter historical features related to the current traffic pattern and discard irrelevant information, thereby enhancing the model's ability to capture dynamic changes in normal and abnormal traffic. This invention uses the forget gate to filter historical information, focusing on temporal features related to normal and abnormal traffic patterns, thus enhancing the model's adaptability to dynamic traffic changes. The forget gate weights the hidden state from the previous time step and the current input, generating a forget gate output that determines the proportion of historical information to retain or discard. This is achieved through a formula... The forget gate dynamically filters historical information related to normal traffic (such as periodic transmissions) and abnormal traffic (such as sudden attacks) through linear combination and nonlinear activation. In one embodiment of the invention, the system performs matrix operations on the input weighted feature vector F' and the hidden state of the previous time step, and applies the Sigmoid activation function to generate... It controls cell state updates and preserves temporal characteristics associated with normal and abnormal flow patterns.

[0150] Furthermore, this invention integrates the temporal features of normal traffic (such as stable bandwidth) and abnormal traffic (such as high-frequency data packets) through an input gate mechanism, enhancing the model's ability to remember and represent complex traffic patterns. This invention updates cell states through an input gate, fusing normal and abnormal traffic features from the current time step with historical states, thus enhancing the model's ability to remember traffic time series. The input gate generates candidate cell state vectors and an input gate output, respectively calculating the possible updated information content and update ratio. This is achieved through formulas... and The input gate updates the cell state to characterize the flow pattern by fusing the current input (containing normal and abnormal flow features) with historical states. In one embodiment of the invention, the system computes candidate cell states and input gate outputs in parallel, and processes them through matrix operations and activation functions. and ,generate and ,renew To reflect the latest patterns of normal and abnormal traffic.

[0151] Furthermore, through an output gate mechanism, key timing information is filtered to generate data containing characteristics of both normal and abnormal traffic. This invention supports subsequent classification to distinguish between two types of traffic. It generates feature vectors containing contextual dependencies of normal and abnormal traffic through an output gate, providing high-quality input for subsequent classification. The output gate generates its output, determining the output ratio at the current time step, and combines this with the updated cell state to generate the hidden state. This is achieved through a formula... The hidden states of the forward and reverse LSTMs are concatenated to generate a complete temporal context. In one embodiment of this invention, the system... and Perform weighted calculations and apply the Sigmoid activation function to generate... , and the updated Element-wise multiplication generates This provides input for the classification step.

[0152] In one specific embodiment of the present invention, the classification probability of generating abnormal traffic is specifically as follows:

[0153] The outlier feature vectors are mapped to class probabilities using a fully connected layer and a softmax function, as shown in the formula:

[0154]

[0155] in, Here, represents the category probability, indicating the probability that the sample is abnormal traffic. and For the weight matrix and bias;

[0156] The cross-entropy loss is calculated to measure the difference between the predicted probability and the true label. The formula is as follows:

[0157]

[0158] in, For cross-entropy loss, Let i be the true label of the i-th sample. Let N be the predicted probability of the i-th sample, and N be the total number of samples.

[0159] The temporal consistency loss is calculated to ensure the stability of prediction results at adjacent time steps. The formula is as follows:

[0160]

[0161] in, For time-series consistency loss, The time window length, Let be the predicted probability at time step t. The square of the L2 norm;

[0162] Construct a composite loss function to optimize model performance; the formula is as follows:

[0163]

[0164] in, For the total loss, and This is a hyperparameter.

[0165] It should be noted that by classifying high-dimensional abnormal feature vectors, abnormal traffic classification probabilities are generated to ensure the accuracy and temporal stability of the classification results, and to generate classification probabilities suitable for subsequent dynamic responses.

[0166] Furthermore, the high-dimensional abnormal feature vector is transformed into classification probabilities through a fully connected layer, providing a quantitative basis for the subsequent response mechanism and distinguishing between normal and abnormal traffic. This invention utilizes a fully connected layer to perform a linear transformation on the input abnormal feature vector. Through weighted operations with weight matrices and biases, unnormalized category scores are generated. Subsequently, the scores are normalized into a probability distribution using the Softmax activation function, representing the probability that each sample is abnormal traffic. In one implementation scenario, the system applies fully connected layer operations to the input abnormal feature vector, generating category scores through matrix multiplication and bias addition. The Softmax function is then used to convert the scores into probability vectors, ensuring that the sum of the probabilities is 1.

[0167] Furthermore, by minimizing the cross-entropy loss, the accuracy of the classification model is optimized, ensuring that the predicted probability is close to the true label and improving the detection accuracy of abnormal traffic. This invention calculates the cross-entropy loss by comparing the predicted probability with the true label, quantifying the prediction error of the classification model. The cross-entropy loss is calculated by performing a logarithmic operation on the predicted probability and the true label for each sample, summing the results, and taking the average to generate the overall classification error. In one implementation scenario of this invention, the system calculates the cross-entropy loss for each sample based on the probability vector output by the fully connected layer and the pre-labeled true label, and uses the average as the optimization target for classification performance.

[0168] Furthermore, by minimizing the temporal consistency loss, abrupt changes in prediction results between adjacent time steps are reduced, ensuring the smoothness of classification results in time-series data and adapting to dynamic changes in network traffic. This invention quantifies the volatility of temporal prediction results by calculating the L2 norm squared difference of prediction probabilities between adjacent time steps, generating the temporal consistency loss. The loss value reflects the model's stability over time series by summing and averaging the probability differences between adjacent time steps. In one implementation scenario of this invention, the system calculates the probability difference between adjacent time steps pairwise based on the probability sequence output by the fully connected layer, applies the L2 norm squared operation, and averages the results to generate the temporal consistency loss.

[0169] Furthermore, by optimizing the composite loss function, both classification accuracy and temporal stability are improved, ensuring the robustness and reliability of the model in complex network environments. This invention constructs a composite loss function by weightedly combining cross-entropy loss and temporal consistency loss, where the weight parameters are dynamically adjusted to balance classification accuracy and temporal stability. The composite loss function comprehensively considers the contributions of both types of losses to model optimization through linear combination. In one implementation scenario of this invention, the system uses preset hyperparameters to weight and sum the cross-entropy loss and temporal consistency loss. and Set them to 0.4 and 0.6 respectively to generate the overall loss, which will guide the optimization of model parameters.

[0170] In one specific embodiment of the present invention, SDN flow table rules are dynamically generated based on classification probabilities and distributed to switches via the OpenFlow protocol to achieve real-time attack blocking. Specifically,

[0171] Response levels are determined based on classification probability.

[0172] When the classification probability is lower than the first threshold, log the event and trigger a low-priority alarm.

[0173] When the classification probability is between the first threshold and the second threshold, the rate limiting action of the OpenFlow protocol is applied;

[0174] When the classification probability is higher than the second threshold, malicious traffic is blocked by dropping it using the OpenFlow protocol.

[0175] The generated flow table rules are distributed to the SDN switch via the OpenFlow protocol to perform real-time attack blocking.

[0176] It should be noted that this invention achieves real-time attack blocking by distributing the OpenFlow protocol to the switch, thereby ensuring a graded response based on classification probability and rapid deployment of flow table rules, effectively addressing abnormal network traffic.

[0177] Furthermore, through a tiered response mechanism, differentiated processing strategies are adopted based on the risk level of abnormal traffic to balance network resource utilization and security protection needs, thereby improving response efficiency. This invention sets multiple threshold intervals to classify response levels based on the classification probability output by the anomaly classification module. When the classification probability is below the first threshold, it is determined to be low-risk traffic, and only relevant information is recorded and a low-priority alarm is triggered. When the classification probability is between the first and second thresholds, it is determined to be medium-risk traffic, and a flow table rule for rate limiting is generated. When the classification probability is above the second threshold, it is determined to be high-risk malicious traffic, and a flow table rule for discarding traffic is generated. In one implementation scenario of this invention, the system receives the classification probability, compares it based on the preset threshold intervals, and generates corresponding response instructions, including logging instructions, rate-limiting flow table rules, or discarding flow table rules.

[0178] Furthermore, by rapidly deploying flow table rules, millisecond-level attack blocking is achieved, reducing the impact of malicious traffic on network performance and ensuring network security. This invention utilizes the OpenFlow protocol interface of the SDN controller to transmit generated flow table rules (such as rate limiting or packet dropping actions) to the target SDN switch. Flow table rules include matching fields (such as source IP, destination IP, and protocol type) and action fields (such as bandwidth limiting or packet dropping), ensuring that the switch can process abnormal traffic in real time. In one implementation scenario, the system generates flow table entries conforming to the OpenFlow protocol through the SDN controller, encapsulates them into protocol messages, and sends them to the designated switch. The switch processes the traffic in real time according to the rules, completing the attack blocking.

[0179] In one specific embodiment of the present invention, anomaly sources are located and network paths are optimized through multi-source data correlation analysis. Specifically,

[0180] Construct a network topology graph with switches as nodes, physical connections as edges, and traffic characteristics as weights. Locate the abnormal source host or infected network segment by calculating the contribution of abnormal traffic to nodes and analyzing time series similarity.

[0181] Based on the source tracing results, adaptive adjustments are performed, including:

[0182] If the source host of the anomaly is located, an isolation rule is issued;

[0183] If core link congestion is identified, the optimal alternative path is calculated.

[0184] It should be noted that this invention locates the source of anomalies and optimizes network paths through multi-source data correlation analysis, thereby ensuring accurate location of the source of anomalies and dynamically adjusting network configuration to improve network security and transmission efficiency.

[0185] Furthermore, by associating anomaly source data with multiple sources, the source of abnormal traffic (such as malicious hosts or infected network segments) can be accurately located, providing a basis for subsequent isolation or path optimization, reducing misjudgments and improving source tracing efficiency. This invention utilizes multi-source data (including flow table statistics, port traffic, and classification probabilities) collected by the SDN controller to construct a network topology map, where nodes represent SDN switches, edges represent physical connections, and weights are based on traffic characteristics (such as traffic rate and packet frequency). By analyzing the abnormal traffic contribution of each node (i.e., the proportion of abnormal traffic associated with the node) and time series similarity (i.e., the temporal correlation of traffic patterns), the source host or network segment of the abnormal traffic is identified. In one implementation scenario of this invention, the system extracts traffic features from the flow tables of the SDN switch, constructs a weighted topology map, calculates the abnormal traffic contribution of each node, and compares traffic patterns using time series analysis algorithms (such as Pearson correlation coefficient) to determine the identification information (such as IP address or network segment range) of the abnormal source host or network segment.

[0186] Furthermore, through adaptive adjustments, malicious traffic sources can be quickly isolated or congested links optimized, reducing the impact of network attacks and improving data transmission efficiency, thus ensuring network stability and security. This invention generates targeted network adjustment strategies based on the anomaly source location results. For identified anomaly source hosts, the system generates isolation flow table rules containing source IP address matching conditions to restrict their traffic transmission. For scenarios where core link congestion is detected (e.g., bandwidth usage exceeds a preset threshold), the system calculates alternative paths based on the topology graph, prioritizing paths with low bandwidth utilization and low latency. In one implementation scenario of this invention, the system generates isolation flow table rules through the SDN controller and distributes them to the switches based on the source tracing results. For congested links, the shortest path algorithm or a weighted path optimization algorithm is used to calculate alternative paths and update the flow table rules, ensuring traffic redistribution.

[0187] In a second embodiment of the present invention, the present invention provides an intelligent SDN network abnormal traffic detection system, such as... Figure 5 As shown, the system includes a data acquisition module 1, a time series modeling module 2, and an anomaly classification module 3;

[0188] The data acquisition module 1 is used to collect network traffic data through an SDN switch, and perform preprocessing to generate a standardized time-series feature vector.

[0189] The time series modeling module 2 is used to extract multi-scale features from the standardized time series feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism, and to capture the contextual dependencies of abnormal traffic by combining a bidirectional long short-term memory network, and output a high-dimensional abnormal feature vector.

[0190] The anomaly classification module 3 is used to classify the high-dimensional anomaly feature vector using a fully connected layer and a Softmax activation function, optimize the model performance through a composite loss function, and generate the classification probability of the anomaly traffic.

[0191] In a third embodiment of the present invention, the present invention provides an electronic device, including a memory and a processor, characterized in that the memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the intelligent SDN network abnormal traffic detection method as described above.

[0192] In Embodiment 4 of the present invention, the present invention provides a storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps in the intelligent SDN network abnormal traffic detection method as described above.

[0193] In summary, the intelligent SDN network anomaly traffic detection method and system provided by this invention improves the detection accuracy of complex attack patterns through multi-scale dilated convolution and channel attention mechanisms, enhances robustness by combining bidirectional bidirectional long short-term memory networks to capture temporal dependencies, optimizes classification performance using composite loss functions to reduce false alarm rates, achieves millisecond-level attack blocking through dynamic flow table rules based on classification probabilities, and accurately locates anomaly sources and optimizes network paths through multi-source data correlation analysis, realizing full automation from detection to response, significantly improving the security, real-time performance, and efficiency of SDN networks.

[0194] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the modules described above can be referred to the corresponding process in the aforementioned method implementation, and will not be repeated here.

[0195] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0196] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or in a combination of hardware and software functional modules.

[0197] The integrated modules implemented as software functional modules described above can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer system (which may be a personal computer, server, or network system, etc.) or processor to execute some steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0198] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting abnormal traffic in an intelligent SDN network, characterized in that: include, Network traffic data is collected through an SDN switch and preprocessed to generate standardized time-series feature vectors. Multi-scale feature extraction is performed on the standardized temporal feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism. The bidirectional long short-term memory network is combined to capture the contextual dependencies of abnormal traffic and output a high-dimensional abnormal feature vector. The high-dimensional abnormal feature vector is classified using a fully connected layer and a softmax activation function. The model performance is optimized by a composite loss function to generate the classification probability of abnormal traffic.

2. The intelligent SDN network abnormal traffic detection method according to claim 1, characterized in that: The preprocessing includes, Delete packets containing empty records, invalid IP addresses, or protocol field errors to remove invalid data; By using linear interpolation, missing data are filled in based on the weighted average of adjacent valid data, thus generating a continuous time-series dataset. By balancing the impact of recent and long-term data using the exponential smoothing method, noise smoothing is applied to the time-series dataset to generate smoothed traffic data. The smoothed traffic data is divided into overlapping time segments according to a fixed time window. Each segment has a fixed length and is formatted as an input vector suitable for a one-dimensional convolutional neural network. By using the fast gradient sign method, perturbations are added to the time-series segments to generate adversarial examples, thereby enhancing the robustness of the model.

3. The intelligent SDN network abnormal traffic detection method according to claim 2, characterized in that: The multi-scale feature extraction includes, A multi-scale one-dimensional dilated convolution kernel is used to extract local features of network traffic data, where convolution kernels with different dilation rates correspond to different receptive fields; the formula for calculating the receptive field is as follows: ; in, The receptive field represents the number of time steps that the convolutional kernel covers on the time-series data, k is the kernel size, and r is the dilation rate, used to capture short-term, medium-term, and long-term traffic patterns. By concatenating the channels, the local features output by the convolutional kernels from different receptive fields are integrated into a high-dimensional feature vector, represented as: ; in, Here, T represents the number of time steps, and D represents the total number of channels; Channel attention mechanism is used to enhance feature representation capability. Global average pooling is used to process the high-dimensional feature vector F to generate channel-level feature vectors, as shown in the formula: ; The channel attention weights are calculated using a structure that includes two layers of linear transformation and a nonlinear activation function, as shown in the formula: ; in, Let be a vector of channel attention weights, representing the importance of each channel to the feature representation. For learnable weight matrix, The Sigmoid activation function is used, and ReLU is the rectified linear unit activation function. The channel attention weights are multiplied element-wise by the high-dimensional feature vector to generate weighted features, as shown in the formula: ; in, For weighted features, ⊙ represents element-wise multiplication.

4. The intelligent SDN network abnormal traffic detection method according to claim 3, characterized in that: The contextual dependencies for capturing abnormal traffic include, By using forward and backward time series modeling, contextual dependencies are captured, and anomalous feature vectors are generated, specifically including... The formula for deciding which historical information to discard using the forget gate is: ; in, The output of the forget gate represents the proportion of information retained. and For weights and biases, This is the hidden state from the previous time step. Input for the current time step; The cell state is updated collaboratively using an input gate and a forget gate. The input gate generates candidate cell states and an input gating vector, as shown in the following formula: ; ; in, Let be the candidate cell state vector, representing information that may be updated. The input gate output represents the update ratio. Here is the weight matrix of the input gate. Here, is the bias of the input gate, and tanh is the hyperbolic tangent activation function; The formula for updating cell state is: ; in, The current cell state, This refers to the previous cell state; The hidden state is generated using the output gate, with the following formula: ; ; in, The output of the output gate represents the proportion of the output information. Here are the weight matrix and bias of the output gate. The hidden state represents the anomalous feature vector.

5. The intelligent SDN network abnormal traffic detection method according to claim 4, characterized in that: The classification probabilities of the generated abnormal traffic include, The outlier feature vectors are mapped to class probabilities using a fully connected layer and a softmax function, as shown in the formula: ; in, Here, represents the category probability, indicating the probability that the sample is abnormal traffic. and For the weight matrix and bias; The cross-entropy loss is calculated to measure the difference between the predicted probability and the true label. The formula is as follows: ; in, For cross-entropy loss, Let i be the true label of the i-th sample. Let N be the predicted probability of the i-th sample, and N be the total number of samples. The temporal consistency loss is calculated to ensure the stability of prediction results at adjacent time steps. The formula is as follows: ; in, For time-series consistency loss, The time window length, Let be the predicted probability at time step t. The square of the L2 norm; Construct a composite loss function to optimize model performance; the formula is as follows: ; in, The total loss is represented by α and β, which are hyperparameters.

6. The intelligent SDN network abnormal traffic detection method according to claim 1, characterized in that: It also includes, SDN flow table rules are dynamically generated based on classification probabilities and distributed to switches via the OpenFlow protocol to achieve real-time attack blocking. Specifically, this includes... Response levels are determined based on classification probability. When the classification probability is lower than the first threshold, log the event and trigger a low-priority alarm. When the classification probability is between the first threshold and the second threshold, the rate limiting action of the OpenFlow protocol is applied; When the classification probability is higher than the second threshold, malicious traffic is blocked by dropping it using the OpenFlow protocol. The generated flow table rules are distributed to the SDN switch via the OpenFlow protocol to perform real-time attack blocking.

7. The intelligent SDN network abnormal traffic detection method according to claim 6, characterized in that: This also includes locating anomaly sources and optimizing network paths through multi-source data correlation analysis, specifically including: Construct a network topology graph with switches as nodes, physical connections as edges, and traffic characteristics as weights. Locate the abnormal source host or infected network segment by calculating the contribution of abnormal traffic to nodes and analyzing time series similarity. Based on the source tracing results, adaptive adjustments are performed, including: If the source host of the anomaly is located, an isolation rule is issued; If core link congestion is identified, the optimal alternative path is calculated.

8. An intelligent SDN network abnormal traffic detection system, characterized in that: It includes a data acquisition module, a time series modeling module, and an anomaly classification module; The data acquisition module is used to collect network traffic data through an SDN switch, and perform preprocessing to generate standardized time-series feature vectors. The time series modeling module is used to extract multi-scale features from the standardized time series feature vector based on a multi-scale one-dimensional dilated convolutional neural network and a channel attention mechanism, and to capture the contextual dependencies of abnormal traffic by combining a bidirectional long short-term memory network, and output a high-dimensional abnormal feature vector. The anomaly classification module is used to classify the high-dimensional anomaly feature vector using a fully connected layer and a Softmax activation function, optimize model performance through a composite loss function, and generate the classification probability of anomaly traffic.

9. An electronic device, comprising a memory and a processor, characterized in that: The memory stores a computer program that can run on the processor, and when the program is executed on the processor, it implements the steps in the intelligent SDN network abnormal traffic detection method as described in any one of claims 1-7.

10. A storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the steps in the intelligent SDN network abnormal traffic detection method as described in any one of claims 1-7.

Images