Deep learning based switch traffic anomaly real-time detection system

Abstract

The application relates to the technical field of network flow monitoring, in particular to a switch flow anomaly real-time detection system based on deep learning. The system collects flow characteristics of switch ports and flows in real time, constructs multi-scale time sequence fingerprints, and uses a lightweight deep learning model embedded in the data plane of the switch to perform real-time anomaly scoring and uncertainty quantification. Based on the model output, the system dynamically adjusts the sampling strategy, realizes high-value flow priority analysis, and identifies cross-flow and cross-port collaborative anomaly patterns through line card-level aggregation analysis. The system further combines dynamic threshold judgment and closed-loop strategy optimization mechanism to realize real-time triggering and adaptive adjustment of flow control, flow limiting and alarm, and finally forms a full-process closed loop of detection, decision, execution and feedback. The application improves the real-time performance, accuracy and resource efficiency of anomaly detection, and guarantees network health and performance stability.

Description

Technical Field

[0001] This invention relates to the field of network traffic monitoring technology, specifically to a real-time detection system for abnormal switch traffic based on deep learning. Background Technology

[0002] With the continuous expansion of network scale and the increasing complexity of business, modern data centers and cloud environments place higher demands on the real-time performance and reliability of network traffic. Traditional traffic anomaly detection methods mostly rely on fixed thresholds or offline analysis mechanisms, which are difficult to effectively cope with highly dynamic and low-latency network environments, and have certain limitations in terms of real-time performance, accuracy, and resource efficiency. In recent years, the integration of artificial intelligence technology with the network data plane has provided new ideas for real-time traffic analysis. The industry has begun to explore embedding lightweight deep learning models into network devices to achieve efficient and intelligent traffic perception and control.

[0003] Chinese invention patent CN119071052B discloses a method and system for network anomaly monitoring of a network switch. The method includes: collecting historical network traffic data from the network switch and preprocessing it to obtain preprocessed network traffic data; performing multi-scale feature extraction and feature dimensionality reduction on the preprocessed network traffic data to obtain a fused feature vector; training a switch-level model and a central model based on the fused feature vector; performing anomaly detection on real-time network traffic data using the switch-level model to obtain preliminary anomaly detection results, and combining these with the central model for in-depth analysis to obtain deep anomaly detection results; performing spatiotemporal correlation analysis and multi-source data fusion on the preliminary and deep anomaly detection results to obtain a comprehensive anomaly analysis report; generating an adaptive defense strategy based on the comprehensive anomaly analysis report, and executing the adaptive defense strategy in the network switch.

[0004] However, existing solutions still have certain shortcomings in terms of real-time inference efficiency, multi-dimensional feature fusion, sampling strategy optimization, and closed-loop control capabilities. There is an urgent need for an intelligent solution that can balance real-time detection accuracy and system overhead. Summary of the Invention

[0005] The purpose of this invention is to address the problems existing in the background technology by proposing a real-time detection system for abnormal switch traffic based on deep learning.

[0006] The technical solution of this invention: A real-time detection system for abnormal switch traffic based on deep learning, comprising:

[0007] The traffic feature acquisition and time series fingerprint construction module is used to collect traffic features of switch ports and five-tuple flows in real time, and to perform multi-dimensional normalization processing and time series fingerprint construction on the collected data.

[0008] The micro-model real-time inference and uncertainty-driven sampling module is used to embed lightweight deep learning micro-models into switch line cards to achieve real-time anomaly scoring and uncertainty quantification for each flow, and dynamically adjust the sampling frequency and sampling objects according to the model output.

[0009] The line card aggregation analysis and dynamic anomaly judgment module is used to receive the flow-level anomaly score, prediction uncertainty and comprehensive value index output by the micro-model, perform multi-dimensional aggregation analysis on all flows within the line card, achieve collaborative anomaly detection through inter-flow similarity calculation and pattern mining, and perform real-time anomaly judgment in combination with dynamic thresholds.

[0010] The closed-loop dynamic strategy triggering and adaptive optimization module is used to calculate the strategy priority and trigger control actions based on the line card global anomaly score, anomaly mode and flow anomaly flag, while monitoring the strategy effect and feeding back the control effect score, so as to complete the adaptive optimization of strategy parameters, sampling frequency and model weights.

[0011] Preferably, the traffic feature acquisition and time-series fingerprint construction module is specifically used for:

[0012] Collect data packet length, data packet arrival time, TCP flag vector, and packet sequence number within the sliding time window;

[0013] Calculate the average packet length, standard deviation of packet length, autocorrelation coefficient of arrival interval, TCP flag entropy, and number of local burst bytes within the window, and construct a statistical feature vector accordingly.

[0014] By introducing short-term and long-term windows, the statistical feature vectors within the short-term and long-term windows are weighted and combined to generate a multi-scale feature representation that takes into account both micro-bursts and long-term trends.

[0015] The multi-scale feature representation is mapped to a compact flow fingerprint using a lightweight temporal contrast encoder.

[0016] Preferably, the traffic feature acquisition and time-series fingerprint construction module is also used for:

[0017] Maintain a historical fingerprint buffer window at both the port and flow levels to cache the most recent compact flow fingerprints;

[0018] Calculate the cosine similarity between the newly generated compact flow fingerprint and all historical fingerprints in the historical fingerprint buffer window, and generate an uncertainty index based on this similarity to indicate the degree of deviation between the current behavior and the historical pattern.

[0019] Preferably, the lightweight deep learning micro-model used in the micro-model real-time inference and uncertainty-driven sampling module is MicroNet;

[0020] MicroNet takes as input a combined feature vector composed of multi-scale feature representation and compact flow fingerprint concatenation;

[0021] MicroNet consists of two separable convolutional layers for processing statistical features, a single-layer Transformer encoder for processing temporal fingerprints, and a fusion layer for concatenating the convolutional outputs with the Transformer outputs and forming a streaming representation vector through a fully connected layer.

[0022] Preferably, the micro-model real-time inference and uncertainty-driven sampling module is specifically used for:

[0023] Based on the flow representation vector output by the micro-model, a continuous flow anomaly score is generated through a fully connected layer and a learnable weight vector.

[0024] Prediction uncertainty is generated by calculating the entropy value of the multi-class anomaly prediction probability vector output by the micro-model.

[0025] A comprehensive value index is calculated by combining flow anomaly scores, prediction uncertainty, and uncertainty indicators obtained from historical fingerprint buffer windows.

[0026] The comprehensive value index is mapped to a preset upper and lower limit range of sampling frequency to determine the dynamic sampling frequency of each stream.

[0027] Preferably, the line card aggregation analysis and dynamic anomaly detection module is specifically used for:

[0028] The sampled and reported stream-level data are aggregated online at the card level to construct a multi-dimensional feature matrix that includes anomaly scoring, prediction uncertainty, comprehensive value index, and sampling frequency;

[0029] The multidimensional feature matrix is ​​subjected to mean-variance normalization.

[0030] Based on the normalized feature matrix, the synergy matrix between flows is calculated using weighted cosine similarity.

[0031] Spectral clustering algorithm is used to perform cluster analysis on the synergy matrix to identify a set of anomalous patterns with highly coordinated behavior.

[0032] Preferably, the line card aggregation analysis and dynamic anomaly detection module is also used for:

[0033] For each identified anomalous pattern, calculate the mean and standard deviation of the anomalous scores for all flows within that pattern;

[0034] Based on the mean and standard deviation, combined with an adjustable threshold adjustment coefficient, the dynamic judgment threshold for this abnormal pattern is dynamically calculated.

[0035] The anomaly score of each flow within the pattern is compared with a dynamic judgment threshold to generate a binary flow anomaly judgment label;

[0036] Based on the anomaly detection flags of all flows and their weights in the global score, a weighted summary is generated to produce a line card-level global anomaly score.

[0037] Preferably, the closed-loop dynamic strategy triggering and adaptive optimization module is specifically used for:

[0038] The strategy priority for each flow is obtained by combining the global anomaly score at the line card level, the flow anomaly judgment mark, and the comprehensive value index, and by introducing weight coefficients for calculation.

[0039] Based on the set priority threshold, the policy priority is mapped to a specific set of control actions, including flow control, port rate limiting, and alarms.

[0040] Preferably, the closed-loop dynamic strategy triggering and adaptive optimization module is also used for:

[0041] The policy priority is mapped to a specific flow restriction level through a flow control adjustment coefficient;

[0042] The available bandwidth of the flow is adjusted in real time according to the rate limiting range, and port-level rate limiting is implemented on the ports where multiple flows are concentrated in the abnormal mode.

[0043] Preferably, the closed-loop dynamic strategy triggering and adaptive optimization module is also used for:

[0044] The effectiveness of flow control strategies is quantitatively evaluated by combining changes in abnormal scores, actual bandwidth changes, and changes in flow latency or packet loss that reflect network performance, and by introducing weighting coefficients to calculate the control effectiveness score.

[0045] Based on the control effect score and abnormal mode evolution information, the weight coefficients, flow control adjustment coefficients and micro-model parameters in the strategy calculation are dynamically adjusted, while the historical fingerprint database and sampling strategy are updated.

[0046] Compared with the prior art, the above-mentioned technical solution of the present invention has the following beneficial technical effects:

[0047] This invention designs a real-time switch traffic anomaly detection system based on deep learning. Through a lightweight deep learning model embedded in the switch's data plane, it achieves real-time acquisition of traffic characteristics and construction of multi-scale temporal fingerprints, effectively improving the accuracy and timeliness of anomaly detection. Utilizing an uncertainty-driven adaptive sampling mechanism, the system can dynamically adjust its sampling strategy, prioritizing high-value traffic, significantly reducing computational overhead and transmission latency, while ensuring keen perception of key abnormal behaviors. The line card-level aggregation analysis module enhances cross-flow and cross-port anomaly detection capabilities through multi-dimensional feature fusion and collaborative anomaly pattern recognition. Combined with a dynamic threshold determination mechanism, it further improves detection accuracy and real-time response capabilities.

[0048] In addition, the system has constructed a complete closed-loop control and adaptive optimization system, which can dynamically trigger flow control, flow limiting or alarm strategies based on real-time detection results, and realize online optimization and self-adjustment of model parameters, sampling strategies and control rules through continuous feedback and evaluation of the strategy execution effect. This mechanism not only improves the system's resource utilization efficiency and response speed, but also enhances its adaptability and long-term stability to new anomalies and complex network environments.

[0049] Overall, this invention demonstrates significant advantages in terms of real-time performance, accuracy, system overhead control, and adaptability in anomaly detection, and is suitable for high-throughput, low-latency network environments. Attached Figure Description

[0050] Figure 1 This is a system architecture diagram of a real-time detection system for abnormal switch traffic based on deep learning proposed in this invention.

[0051] Figure 2 This is a flowchart illustrating the workflow of a real-time switch traffic anomaly detection system based on deep learning proposed in this invention. Detailed Implementation

[0052] Example 1, as Figure 1 As shown, the present invention proposes a real-time detection system for switch traffic anomalies based on deep learning, comprising: a traffic feature acquisition and time-series fingerprint construction module, a micro-model real-time inference and uncertainty-driven sampling module, a line card aggregation analysis and dynamic anomaly judgment module, and a closed-loop dynamic strategy triggering and adaptive optimization module.

[0053] The traffic feature acquisition and time series fingerprint construction module is mainly deployed on the switch chip and controller. It is responsible for collecting traffic features of each port and flow in real time, including but not limited to packet rate, packet type, port occupancy, historical flow behavior information, and performing multi-dimensional normalization processing and time series fingerprint construction on the collected data. It serializes the traffic features in different time windows to form a structured input that can be used for deep learning model training and inference.

[0054] The micro-model real-time inference and uncertainty-driven sampling module embeds a lightweight deep learning micro-model into the switch line card to achieve real-time anomaly scoring and uncertainty quantification for each flow, continuously judges the probability of traffic anomalies, and dynamically adjusts the sampling frequency and sampling objects according to the model uncertainty, so as to focus on sampling high-value flows and reduce sampling of low-risk flows, thereby reducing system computational overhead and latency.

[0055] The line card aggregation analysis and dynamic anomaly judgment module receives the flow-level anomaly score, prediction uncertainty and comprehensive value index output by the micro-model, performs multi-dimensional aggregation analysis on all flows within the line card, realizes cross-flow and cross-port collaborative anomaly detection through inter-flow similarity calculation, pattern mining and anomaly pattern recognition, and performs real-time anomaly judgment in combination with dynamic thresholds, while generating a global anomaly score for the line card.

[0056] The closed-loop dynamic strategy triggering and adaptive optimization module calculates the flow strategy priority based on the line card's global anomaly score, anomaly mode, and flow anomaly flag, maps it to specific control actions such as flow control, port current limiting, and alarms, and implements the current limiting strategy in real time. At the same time, it monitors the strategy effect and provides feedback on the control effect score. Through the historical fingerprint database and feedback data, it adaptively optimizes the strategy parameters, sampling frequency, and model weights to achieve closed-loop self-learning and optimization of the strategy and model.

[0057] Example 2, as Figure 2 As shown, the present invention proposes a real-time switch traffic anomaly detection system based on deep learning, the specific workflow of which is as follows:

[0058] S1. By collecting real-time multi-dimensional traffic features from switch ports and 5-tuple flows, combined with short-time and long-time multi-scale coding, and using contrastive learning to generate compact temporal fingerprints, and by calculating uncertainties through historical fingerprint buffering, accurate characterization of micro-bursts and long-term trend anomalies is achieved. Specifically:

[0059] S11. Within the sliding time window, collect statistical features such as packet length, arrival interval, TCP flags, and local burst volume to form a multi-dimensional feature vector, characterizing traffic size, volatility, protocol behavior diversity, and micro-burst patterns. Specifically:

[0060] For switch ports or 5-tuple flows f in the sliding window W tThe system collects raw packet information, including: packet length L. i Arrival time t i TCP flag vector F i and package number;

[0061] Calculate the average packet length within the window ;

[0062] Calculate the standard deviation of package length ;

[0063] Calculate the autocorrelation coefficient of the arrival interval ;

[0064] Calculate TCP flag entropy ;

[0065] Calculate the number of bytes in a local burst. ;

[0066] Based on this, a statistical feature vector is constructed. ;

[0067] Among them, L i The length (in bytes) of the i-th data packet is directly obtained from the switch port / flow data collection and is used to measure the traffic volume; N represents the number of packets within the sliding window. The autocorrelation coefficient represents the correlation between data sequences at different time delays. p represents the arrival time interval between the i-th packet and the (i+1)-th packet; j This indicates the percentage of TCP flag type j appearing within the window, derived from window statistics, which counts the frequency of each TCP flag type; b indicates the local window length (number of packets).

[0068] S12. The statistical features of short-term and long-term windows are weighted and combined to generate a multi-scale feature representation that takes into account both micro-bursts and long-term trends, thus completing the unified encoding of instantaneous fluctuations and slow changes in traffic. Specifically:

[0069] To capture dynamic changes in traffic, a short-time window W is introduced. s and long window W l These are used for micro-burst and slow trend analysis, respectively;

[0070] Calculate multi-scale weighted features: ;

[0071] in, Represents the short-time window W s The statistical feature vector within the vector mainly reflects micro-burst behavior; Represents a long-term window W l Statistical feature vectors within the data to capture slow trends; This represents the short-time weighting coefficient, with a value between 0 and 1, which controls the importance of short-time features in multi-scale representation; This represents the weighted multi-scale feature vector, which serves as the input to the TCF, taking into account both short-term bursts and long-term trends.

[0072] S13. A lightweight temporal contrastive encoder is used to map multi-scale features into compact stream fingerprints. This is then trained using InfoNCE contrastive loss to ensure similar fingerprints across different time windows within the same stream and clear distinction between fingerprints from different streams, thus achieving a sensitive characterization of anomalous patterns. Specifically:

[0073] Multiscale features z f (t) Input timing comparison encoder Generate compact flow fingerprints:

[0074] ;

[0075] The encoder training objective uses contrastive loss:

[0076] ;

[0077] in, This represents the time-series comparison encoder (a lightweight Transformer is used in this embodiment), where θ is the model weight parameter, obtained from training with historical normal traffic. The Stream Fingerprint Vector (TCF) is a compact representation of the multi-scale temporal features of a stream, used for subsequent anomaly detection. Represents the fingerprints of positive samples from the same stream at different time windows, used for comparative learning and training; This represents the similarity function (cosine similarity), used to measure the similarity between fingerprint vectors; This represents the temperature coefficient, controlling the sensitivity of contrast loss to similarity differences, and is derived from InfoNCE theory; L TCF This represents the InfoNCE loss function, which aims to maximize positive sample similarity and minimize negative sample similarity.

[0078] S14. Maintain a historical fingerprint buffer window at the port / stream level and calculate the uncertainty index of the similarity between the current fingerprint and historical fingerprints to complete end-to-end closed-loop feature representation and high-value data selection, specifically:

[0079] The most recent N TCF vectors in the port / stream buffer This forms a historical window into the popular phenomenon;

[0080] The newly generated fingerprint is updated using a sliding method, while its similarity to historical fingerprints is calculated for micro-model anomaly scoring and uncertainty estimation.

[0081] ;

[0082] in, This indicates the size of the historical fingerprint buffer window, which retains the most recent fingerprints. One fingerprint is used for short-term memory; Represents the historical fingerprint, specifically the TCF vector at the i-th historical time point; An indicator representing the uncertainty of the flow, used for adaptive sampling and micro-model input priority determination; This represents the cosine similarity between the current fingerprint and historical fingerprints, used to measure the degree of deviation between the current behavior and historical patterns.

[0083] S2. Embed a lightweight micro-model MicroNet into the switch data plane to perform real-time inference on the multi-scale traffic features and time-series fingerprints generated in step 1, outputting flow anomaly scores and uncertainty indicators. Based on uncertainty-driven port / flow-level sampling and priority reporting strategies, high-value traffic priority analysis and end-to-end closed-loop optimization are completed, specifically:

[0084] S21. Multi-scale statistical features and temporal fingerprints are concatenated into a combined vector and input into the micro-model MicroNet. MicroNet uses convolution to process statistical features, Transformer to process fingerprints, and fuses the output stream-level representation, while generating anomaly scores and prediction uncertainties. Specifically:

[0085] MicroNet, a micro-model, features multi-scale characteristics of each stream. and time-series fingerprints As input, construct a combined feature vector. : ;

[0086] in, The vector concatenation operation integrates real-time features and historical fingerprints into a joint representation.

[0087] The lightweight deep neural network MicroNet is constructed, including:

[0088] Convolutional layers: Two layers of separable convolutions. Statistical characteristics are used to extract local flow patterns;

[0089] Single-layer Transformer encoder: processing The temporal fingerprint is used to complete behavior modeling across time windows;

[0090] Fusion layer: The convolutional output and the Transformer output are concatenated and then passed through a fully connected layer to form a stream representation r. f (t) (i.e., the micromodel output stream representation vector), used for anomaly scoring and uncertainty calculation;

[0091] S22. The micro-model outputs anomaly scores and prediction uncertainties based on fused features, respectively quantifying whether a flow is abnormal and the reliability of the model's judgment. The anomaly score provides a continuous probability output, and the uncertainty quantification captures the model's signals for complex or unknown anomalies, completing real-time risk assessment at the port / flow level. Specifically:

[0092] Generate continuous flow anomaly score : ;

[0093] Where w represents the weight vector of the fully connected layer of the micro-model, a learnable parameter that maps the flow representation to anomaly probability; b1 represents the bias term, which is learnable and adjusts the anomaly score output.

[0094] Calculate prediction uncertainty : ;

[0095] in, This represents a multi-class anomaly prediction probability vector, used to represent the prediction probability distribution of each anomaly class when calculating uncertainty using the entropy method;

[0096] S23. Combine the anomaly score with the predicted uncertainty and historical uncertainty to generate a comprehensive value index, and map it to a dynamic sampling frequency, specifically:

[0097] Calculate the comprehensive value index:

[0098] ;

[0099] in, This represents a comprehensive value indicator, combined with anomaly scoring. Forecast uncertainty With historical uncertainty This characterizes the current importance and sampling priority of the flow; This indicates the weight of abnormal scores, adjusting the magnitude of the impact of abnormal scores on the overall value; This indicates the weight of forecast uncertainty, adjusting the proportion of current uncertainty and historical uncertainty to the overall value;

[0100] Mapping dynamic sampling frequency: ;

[0101] in, Indicates the stream sampling frequency, derived from comprehensive value. A higher mapping value indicates that the stream is more worthy of priority sampling. , These represent the upper and lower limits of the sampling frequency, respectively, to ensure that even low-value streams maintain basic sampling and prevent information loss;

[0102] High comprehensive value indicators Stream → Sampling frequency close Prioritize retaining critical traffic;

[0103] Low comprehensive value index Stream → Sampling frequency close This saves computation and bandwidth.

[0104] S24. Perform port / stream-level sampling based on comprehensive value indicators and sampling frequency. High-value streams are collected and uploaded first, while low-value streams are sampled periodically to save resources. At the same time, feedback is provided to update historical uncertainties, forming a closed-loop adaptive optimization.

[0105] S3. Using the sampled data reported in step S2 through line card aggregation analysis, multi-dimensional fusion and pattern mining are performed on the flow-level anomaly score, prediction uncertainty, and comprehensive value. Thresholds are dynamically calculated to determine port / flow anomalies, and a global anomaly score and event reporting are generated. This completes multi-level real-time anomaly judgment and closed-loop adaptive optimization, taking into account both local traffic and cross-port collaborative anomalies. Specifically:

[0106] S31. Summarize the online card-level sampling data from step S2 to construct a multidimensional feature matrix, including anomaly score, uncertainty, comprehensive value, and sampling frequency. Perform mean-variance normalization on the matrix to ensure consistency in the dimensions of different indicators, providing a unified basis for multidimensional pattern analysis. Specifically:

[0107] Summary of line card level data: ;

[0108] And perform normalization: ;

[0109] in, This represents the multidimensional feature matrix of all sample streams managed by line card p at time t; This represents the normalized feature matrix of the line card; and F represents the mean and standard deviation of the characteristic matrix of the line card p, respectively; p This represents the set of all sampled streams managed by line card p;

[0110] S32. Construct a port / flow similarity matrix using a normalized matrix, and identify high-cooperational anomaly patterns using weighted cosine similarity and clustering algorithms to form an anomaly pattern set, specifically:

[0111] A1, Based on normalized feature matrix Coordination matrix between computational flows :

[0112] ; ;

[0113] in, The flow coordination matrix represents the degree of cooperation of line card p at time t; This represents the similarity between flow i and flow j; This represents the normalized multidimensional eigenvector of stream i at time t; Let represent the normalized multidimensional eigenvectors of flow j at time t;

[0114] A2. Using the synergy matrix Cluster ports / streams to identify potential clusters of cooperative anomalies:

[0115] Spectral clustering is used to discover potential clustering structures through Laplace matrix decomposition. During the clustering process, flows with high coherence are classified into the same anomalous pattern, while flows with low coherence are classified into individual patterns or noise.

[0116] Based on this, output the abnormal mode set. Each mode M k It contains several highly coordinated flows / ports, representing potential abnormal group behavior;

[0117] A3. Further extract pattern-level features for each abnormal pattern for subsequent dynamic threshold determination:

[0118] ;

[0119] ;

[0120] in, and Representing mode M respectively k Mean and standard deviation of internal abnormality scores;

[0121] S33. For each abnormal pattern, a threshold is dynamically calculated. A flow / port determination label is generated by combining the mean and standard deviation within the pattern. This label is then binarized to represent the abnormal or normal state. Specifically, the threshold is dynamically generated based on the statistical characteristics of the pattern, combined with anomaly scoring and comprehensive value, while also considering group collaboration information. This ensures the accuracy of critical traffic detection and improves the real-time performance and accuracy of anomaly determination.

[0122] Calculate the internal dynamic threshold of the mode: ;

[0123] in, This represents the dynamic threshold of the abnormal pattern m at time t; This represents the threshold adjustment coefficient, which is adjusted based on historical traffic behavior and security policies.

[0124] Stream / port anomaly detection: ;

[0125] in, This indicates an anomaly flag for flow f, where 1 indicates an anomaly and 0 indicates normal operation.

[0126] S34. The flow level determination and pattern coordination information are weighted and aggregated to generate a line card-level global anomaly score. Simultaneously, a high-risk event is reported to the network control system to trigger flow control, port rate limiting, or alarms. This involves forming a global score through multi-level information fusion, achieving end-to-end closed-loop adaptive optimization, and supporting policy triggering and long-term behavior learning. Specifically:

[0127] Calculate the global anomaly score for the line card: ;

[0128] Global anomaly score for line card Flows or ports exceeding the set threshold trigger flow control, port rate limiting, or alarms. The reported information includes abnormal patterns, critical flows, port information, and comprehensive value, supporting subsequent policy optimization and long-term behavior learning.

[0129] in, This represents the global anomaly score of line card p, ranging from [0,1]; w f This represents the weight of flow f in the global score.

[0130] S4. A closed-loop adaptive control system for switch traffic anomaly detection was constructed. By converting the global anomaly score, anomaly mode, and flow anomaly tag output in step S3 into executable policies, real-time flow control, port rate limiting, and anomaly alarms are achieved. Combined with control effect feedback and historical fingerprint updates, the sampling strategy, anomaly scoring model, and rate limiting strategy are dynamically optimized to achieve end-to-end adaptive protection and long-term network health maintenance. Specifically:

[0131] S41. Based on the comprehensive line card global score, flow anomaly marking, and overall value calculation, the policy priority for each flow is prioritized and mapped to a set of control actions, including flow control, rate limiting, alarms, or ignoring. This ensures rapid response to local anomalies while maintaining overall network health. Priorities are dynamically adjusted to adapt to changes in network behavior. Specifically:

[0132] Calculate strategy priority: ;

[0133] in, This indicates the policy priority of flow f at time t; a higher value indicates that more immediate intervention is needed. , and These represent the weighting coefficients used in priority calculations, corresponding to line card score, flow anomaly marker, and flow comprehensive value, respectively.

[0134] Therefore: Priority P f (t) is mapped to the set of control actions. ;

[0135] Based on the set high-priority, medium-priority, and low-priority thresholds, flow levels are divided: high-priority flows trigger rate limiting or alarms, medium-priority flows trigger mild flow control, and low-priority flows remain normal.

[0136] It should be noted that the mapping rules can be dynamically adjusted based on the historical effects of policies and the security policy library;

[0137] S42. Based on the policy mapping results, adjust the available bandwidth of the flow in real time, and implement port-level rate limiting on ports with concentrated multi-flows in abnormal modes. Through multi-level flow control, it balances anomaly elimination and performance maintenance, realizes coordinated control of ports and flows, ensures rapid mitigation of sudden anomalies, and optimizes network resource allocation and system real-time performance. That is, it directly maps policy priority to dynamic rate limiting amplitude.

[0138] ;

[0139] in, This represents the actual available bandwidth of stream f at time t; Indicates the default available bandwidth for stream f; This represents the flow control adjustment coefficient, which maps the policy priority to the actual flow restriction level.

[0140] S43. Quantitatively evaluate the effectiveness of the flow control strategy, calculate the control effect score by combining anomaly score changes and flow limiting amplitude, compare the evaluation results with historical strategies to form feedback, provide a basis for strategy adjustment, and simultaneously consider the anomaly elimination effect and network performance impact to achieve closed-loop real-time monitoring and policy effect visualization, that is: simultaneously quantify anomaly mitigation, flow limiting amplitude, and network performance to form multi-dimensional control effect indicators:

[0141] ;

[0142] in, The score represents the control effect of flow f, which measures the impact of the flow limiting strategy on anomaly mitigation and performance. This indicates the change in the flow f anomaly score between the current and previous moments; This indicates the actual bandwidth change. ; This indicates changes in stream delay or packet loss, reflecting the impact of control on performance; , and Indicates the weighting coefficient;

[0143] S44. Based on control effect feedback and abnormal pattern evolution information, dynamically optimize strategy weights, current limiting coefficients, and abnormal scoring model parameters, while updating the historical fingerprint database and sampling strategy. This achieves long-term adaptability and continuous learning capability of the system, maintains a high recognition rate for novel anomalies, and forms an end-to-end closed-loop adaptive optimization mechanism, specifically as follows:

[0144] Update historical anomaly patterns, flow anomaly markers, and control effect scores to form a long-term behavioral fingerprint for the next round of pattern recognition, dynamic threshold generation, and sampling strategy optimization.

[0145] Based on feedback Adjust weights , , and flow control adjustment coefficient Online fine-tuning of lightweight AI models enhances their ability to identify new anomalies;

[0146] Increase sampling frequency for high-risk flows This reduces the sampling of long-term stable flows, lowering system overhead; and it coordinates flow control and sampling strategies to achieve optimal resource allocation.

[0147] The results of adaptive optimization directly affect the execution of the next round of steps S1 to S4, realizing an end-to-end closed loop of detection-decision-execution-evaluation-optimization.

[0148] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A real-time detection system for abnormal switch traffic based on deep learning, characterized in that, include: The traffic feature acquisition and time series fingerprint construction module is used to collect traffic features of switch ports and five-tuple flows in real time, and to perform multi-dimensional normalization processing and time series fingerprint construction on the collected data. The micro-model real-time inference and uncertainty-driven sampling module is used to embed lightweight deep learning micro-models into switch line cards to achieve real-time anomaly scoring and uncertainty quantification for each flow, and dynamically adjust the sampling frequency and sampling objects according to the model output. Specifically, the micro-model real-time inference and uncertainty-driven sampling module is used for: Based on the flow representation vector output by the micro-model, a continuous flow anomaly score is generated through a fully connected layer and a learnable weight vector. Prediction uncertainty is generated by calculating the entropy value of the multi-class anomaly prediction probability vector output by the micro-model. A comprehensive value index is calculated by combining flow anomaly scores, prediction uncertainty, and uncertainty indicators obtained from historical fingerprint buffer windows. The comprehensive value index is mapped to a preset upper and lower limit range of sampling frequency to determine the dynamic sampling frequency of each stream. The line card aggregation analysis and dynamic anomaly judgment module is used to receive the flow-level anomaly score, prediction uncertainty and comprehensive value index output by the micro-model, perform multi-dimensional aggregation analysis on all flows within the line card, achieve collaborative anomaly detection through inter-flow similarity calculation and pattern mining, and perform real-time anomaly judgment in combination with dynamic thresholds. The closed-loop dynamic strategy triggering and adaptive optimization module is used to calculate the strategy priority and trigger control actions based on the line card global anomaly score, anomaly mode and flow anomaly flag, while monitoring the strategy effect and feeding back the control effect score, so as to complete the adaptive optimization of strategy parameters, sampling frequency and model weights.

2. The real-time detection system for abnormal switch traffic based on deep learning according to claim 1, characterized in that, The traffic feature acquisition and time-series fingerprint construction module is specifically used for: Collect data packet length, data packet arrival time, TCP flag vector, and packet sequence number within the sliding time window; Calculate the average packet length, standard deviation of packet length, autocorrelation coefficient of arrival interval, TCP flag entropy, and number of local burst bytes within the window, and construct a statistical feature vector accordingly. By introducing short-term and long-term windows, the statistical feature vectors within the short-term and long-term windows are weighted and combined to generate a multi-scale feature representation that takes into account both micro-bursts and long-term trends. The multi-scale feature representation is mapped to a compact flow fingerprint using a lightweight temporal contrast encoder.

3. The real-time detection system for abnormal switch traffic based on deep learning according to claim 2, characterized in that, The traffic feature acquisition and time-series fingerprint construction module is also used for: Maintain a historical fingerprint buffer window at both the port and flow levels to cache the most recent compact flow fingerprints; Calculate the cosine similarity between the newly generated compact flow fingerprint and all historical fingerprints in the historical fingerprint buffer window, and generate an uncertainty index based on this similarity to indicate the degree of deviation between the current behavior and the historical pattern.

4. The real-time detection system for abnormal switch traffic based on deep learning according to claim 2, characterized in that, The lightweight deep learning micro-model used in the real-time inference and uncertainty-driven sampling module of the micro-model is MicroNet; MicroNet takes as input a combined feature vector composed of multi-scale feature representation and compact flow fingerprint concatenation; MicroNet consists of two separable convolutional layers for processing statistical features, a single-layer Transformer encoder for processing temporal fingerprints, and a fusion layer for concatenating the convolutional outputs with the Transformer outputs and forming a streaming representation vector through a fully connected layer.

5. The real-time detection system for abnormal switch traffic based on deep learning according to claim 4, characterized in that, The line card aggregation analysis and dynamic anomaly detection module is specifically used for: The sampled and reported stream-level data are aggregated online at the card level to construct a multi-dimensional feature matrix that includes anomaly scoring, prediction uncertainty, comprehensive value index, and sampling frequency; The multidimensional feature matrix is ​​subjected to mean-variance normalization. Based on the normalized feature matrix, the synergy matrix between flows is calculated using weighted cosine similarity. Spectral clustering algorithm is used to perform cluster analysis on the synergy matrix to identify a set of anomalous patterns with highly coordinated behavior.

6. The real-time detection system for abnormal switch traffic based on deep learning according to claim 5, characterized in that, The line card aggregation analysis and dynamic anomaly detection module is also used for: For each identified anomalous pattern, calculate the mean and standard deviation of the anomalous scores for all flows within that pattern; Based on the mean and standard deviation, combined with an adjustable threshold adjustment coefficient, the dynamic judgment threshold for this abnormal pattern is dynamically calculated. The anomaly score of each flow within the pattern is compared with a dynamic judgment threshold to generate a binary flow anomaly judgment label; Based on the anomaly detection flags of all flows and their weights in the global score, a weighted summary is generated to produce a line card-level global anomaly score.

7. The real-time detection system for abnormal switch traffic based on deep learning according to claim 6, characterized in that, The closed-loop dynamic strategy triggering and adaptive optimization module is specifically used for: The strategy priority for each flow is obtained by combining the global anomaly score at the line card level, the flow anomaly judgment mark, and the comprehensive value index, and by introducing weight coefficients for calculation. Based on the set priority threshold, the policy priority is mapped to a specific set of control actions, including flow control, port rate limiting, and alarms.

8. The real-time detection system for abnormal switch traffic based on deep learning according to claim 7, characterized in that, The closed-loop dynamic strategy triggering and adaptive optimization module is also used for: The policy priority is mapped to a specific flow restriction level through a flow control adjustment coefficient; The available bandwidth of the flow is adjusted in real time according to the rate limiting range, and port-level rate limiting is implemented on the ports where multiple flows are concentrated in the abnormal mode.

9. A real-time detection system for abnormal switch traffic based on deep learning according to claim 1, characterized in that, The closed-loop dynamic strategy triggering and adaptive optimization module is also used for: The effectiveness of flow control strategies is quantitatively evaluated by combining changes in abnormal scores, actual bandwidth changes, and changes in flow latency or packet loss that reflect network performance, and by introducing weighting coefficients to calculate the control effectiveness score. Based on the control effect score and abnormal mode evolution information, the weight coefficients, flow control adjustment coefficients and micro-model parameters in the strategy calculation are dynamically adjusted, while the historical fingerprint database and sampling strategy are updated.

Images