Network flow real-time anomaly detection method, equipment and medium

Abstract

The invention discloses a network traffic real-time anomaly detection method and device and a medium, and relates to the field of network security and artificial intelligence, and the method comprises the steps: obtaining communication traffic data in a network in real time, and extracting the multi-dimensional features of the communication traffic data based on a sliding time window; fusing the multi-dimensional features to obtain a standardized feature vector; iteratively generating a traffic behavior anomaly score and a corresponding score explanation weight feature vector through a pre-trained anomaly judgment model; triggering communication traffic data is determined, traffic behavior abnormal scores and score explanation weight feature vectors are associated, and an attack situation map is constructed; updating the attack situation map, and recording the update change of the attack situation map; and according to the update change, determining an attack propagation path of the abnormal traffic to predict a potential risk. While the model outputs an abnormal score, a feature importance weight vector can be synchronously generated, and a clear decision basis is provided for each judgment.

Description

Technical Field

[0001] This application relates to the fields of network security and artificial intelligence technology, specifically to a method, device, and medium for real-time anomaly detection of network traffic. Background Technology

[0002] With the rapid development of informatization and networking, network attack methods are constantly evolving. Attack traffic often has complex temporal behavior, diverse protocol characteristics, and cross-network node propagation patterns, making it difficult for traditional intrusion detection systems (IDS) based on static rules and feature matching to quickly and accurately identify new threats.

[0003] In recent years, artificial intelligence technology, especially deep learning, has been widely applied in the field of network security detection. By establishing a non-linear mapping relationship between traffic characteristics and malicious behavior, it has achieved high detection accuracy. However, existing AI-driven detection systems suffer from significant "black box" problems. The model's judgment results lack interpretability, and security operations personnel cannot clearly understand the basis of the model's decisions, making rapid review and response difficult. Furthermore, even if malicious traffic is detected, most systems can only mark anomalies at the data level, lacking the ability to combine detection results with the overall network structure. Currently, the few visualization platforms available typically rely on static logs to generate attack graphs, which cannot support real-time updates and attack path deduction, thus limiting security situation awareness and proactive defense capabilities.

[0004] Meanwhile, in practical applications, the decision-making process of existing AI-driven detection systems often lacks transparency, making it difficult for security operations personnel to understand the judgment criteria and conduct effective verification and response. At the same time, most systems can only mark abnormal traffic at a single point, lacking the ability to globally correlate and dynamically visualize the attack chain, and cannot reflect the evolution process and propagation path of the attack situation in real time, causing defense measures to often lag behind the actual development of the attack behavior. Summary of the Invention

[0005] To address the aforementioned issues, this application proposes a method for real-time anomaly detection in network traffic, comprising: Real-time acquisition of network communication traffic data; extraction of multi-dimensional features of the communication traffic data based on a sliding time window; the multi-dimensional features include statistical features, time-series features, protocol semantic features, and communication topology features; The multi-dimensional features are fused to obtain the standardized feature vectors corresponding to each time window; Based on the standardized feature vector, the pre-trained anomaly detection model iteratively generates traffic behavior anomaly scores and corresponding score explanation weight feature vectors for each time window. Determine the triggering communication traffic data corresponding to the traffic behavior anomaly score, associate the traffic behavior anomaly score, the score interpretation weight feature vector with the triggering communication traffic data, and construct an attack situation map; The attack situation map is updated based on the iterative updated traffic behavior anomaly score and the corresponding updated score explanation weight feature vector, and the update changes of the attack situation map are recorded. Based on the updated changes, the attack propagation path of abnormal traffic is determined to predict potential risks.

[0006] On the other hand, this application also proposes a real-time network traffic anomaly detection device, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform a method for real-time anomaly detection of network traffic as described in the above example.

[0007] On the other hand, this application also proposes a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as: a real-time network traffic anomaly detection method as described in the above example.

[0008] The method for real-time anomaly detection of network traffic proposed in this application can bring the following beneficial effects: By constructing an inherently interpretable anomaly detection model, the "black box" problem of existing AI detection systems is effectively solved. While outputting anomaly scores, the model simultaneously generates feature importance weight vectors, providing clear decision-making basis for each judgment. This makes the detection results traceable and highly reliable, greatly improving the trust of security operations personnel in automated detection results and enhancing review efficiency.

[0009] Furthermore, by deeply integrating interpretable detection results with the communication topology, an attack situation map is constructed and dynamically updated, achieving a leap from identifying isolated anomalies to recognizing the global attack chain. This method can intuitively display the origin, propagation path, and evolution trend of attacks, and predict potential risks based on the temporal changes in the map, thereby elevating network security protection from passive response to a new level of proactive early warning and precise intervention. Attached Figure Description

[0010] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a flowchart illustrating a real-time network traffic anomaly detection method according to an embodiment of this application. Figure 2 This is a schematic diagram of a real-time network traffic anomaly detection device in an embodiment of this application. Detailed Implementation

[0011] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0013] like Figure 1 As shown in the figure, this application provides a method for real-time anomaly detection of network traffic, including: S101. Real-time acquisition of communication traffic data in the network, and extraction of multi-dimensional features of the communication traffic data based on a sliding time window; the multi-dimensional features include statistical features, time series features, protocol semantic features and communication topology features.

[0014] By deploying a deep packet inspection (DPI) engine at the network boundary or core switching node, all network packets flowing through the network are captured. The captured packets are temporarily stored in a buffer, and a corresponding timestamp is added to each packet to form a continuous raw traffic data stream.

[0015] The window length and sliding step are preset. When a window starts, all data packets with timestamps within the window length range are extracted from the buffer and encapsulated into an independent traffic window segment.

[0016] For each traffic window segment, the OSI network model is used for layer-by-layer decoding, and multi-dimensional features are extracted. For statistical feature extraction, all data packets within the window are aggregated and calculated to generate macro-level traffic metrics, including average packet length, average packet interval, uplink to downlink packet ratio, and packet rate. For temporal feature extraction, dynamic behavior patterns are analyzed based on the timestamp sequence of data packets. Specifically, an inter-frame time difference sequence is generated, and its statistics (such as mean and variance) are calculated. Session persistence metrics are also assessed using session start and end flags. For protocol semantic feature extraction, for the HTTP protocol, request methods and status codes are parsed; for the DNS protocol, query domain name strings and query types are extracted; and for the TLS / SSL protocol, the negotiated protocol version number is identified. For communication topology feature extraction, a network structure context is constructed by analyzing the communication relationships within the window. A temporary communication interaction graph is built, with source and destination IP addresses as host nodes and communication sessions between them as edges. Subsequently, a low-dimensional node embedding vector is generated for each host node using a graph embedding algorithm (such as Node2Vec or simplified graph convolution). This vector implicitly encodes the host's connection pattern and behavioral role in the network.

[0017] It should be noted that the data selection process is as follows: First, communication description completeness. Each layer must contain at least the basic elements that identify the communication identity, direction, and behavior to support cross-layer correlation analysis. For example, MAC addresses and IP addresses can be combined to map physical / logical locations, and ports and flag bits reflect session characteristics. Second, attack identification relevance. Elements that frequently appear in known attack patterns or can distinguish normal from abnormal behavior are selected. For example, abnormal TTL changes reflect hidden jump points, DNS domain entropy identifies generated domains, and TLS certificate cycles detect forged issuance. Third, the decoded data elements are then standardized. Packet loss is interpolated and marked (preserving gap locations and impact information in the time series so that the model can understand the time structure without excessive distortion); duplicate packets are removed by sequence number, and empty packets (length = 0) are discarded directly. Finally, continuous traffic is converted into batch-processable stream segments based on a time-slice partitioning strategy.

[0018] In this embodiment, traffic at the link layer, transport layer, and application layer is extracted in parallel during the data acquisition phase, and a time windowing strategy is used to form standardized traffic segments. Features include statistical features (such as packet length distribution, byte rate, and direction ratio), temporal features (such as inter-frame time difference and session persistence), and contextual features (such as protocol combinations and target port patterns). Furthermore, communication relationships between network entities are embedded as topological features, enabling the detection model to not only perceive the behavior of a single flow but also identify collaborative attack relationships between multiple nodes, forming an input representation with structural semantics, providing a foundation for subsequent model detection and graph generation.

[0019] S102. The multi-dimensional features are fused to obtain the standardized feature vectors corresponding to each time window.

[0020] After completing the multi-dimensional feature extraction, a feature fusion and standardization process is executed to transform heterogeneous features into a unified model input.

[0021] Specifically, the four types of extracted heterogeneous features are uniformly vectorized and encoded. Statistical and temporal features are directly quantized into numerical vectors; protocol semantic features are converted into numerical vectors using one-hot encoding or embedding layer techniques; and communication topology features directly use pre-generated node embedding vectors. This ensures that all features are represented in numerical form, laying the foundation for subsequent fusion.

[0022] Furthermore, the encoded statistical feature vector, temporal feature vector, protocol semantic feature vector, and communication topology feature vector are concatenated end-to-end along the feature dimension to form a high-dimensional joint feature vector. This brings together information distributed across different original feature spaces into a unified vector representation, preserving the complete information of each type of feature.

[0023] The concatenated joint feature vector is standardized. Z-score standardization is used to calculate the mean and standard deviation of each feature dimension across the entire training set, and then the corresponding dimension in the current vector is normalized by subtracting the mean and dividing by the standard deviation. This effectively eliminates biases caused by differences in units and ranges between different feature dimensions, ensuring the stability and convergence speed of model training.

[0024] A fully connected layer linearly transforms the high-dimensional feature vector to a preset lower dimension (e.g., 256 dimensions). The standardized feature vector is then subjected to linear projection for dimensionality reduction, resulting in the final standardized feature vector. This step not only reduces the computational complexity of subsequent models but also achieves automatic weighting and information compression of the original features through the weight parameters during the linear transformation process, providing refined and high-quality input data for the anomaly detection model.

[0025] S103. Based on the standardized feature vector, the pre-trained anomaly detection model is used to iteratively generate traffic behavior anomaly scores and corresponding score explanation weight feature vectors for each time window.

[0026] After obtaining the standardized feature vectors, inference is performed through a pre-trained anomaly detection model, and detection results and their interpretations are generated simultaneously.

[0027] Specifically, the anomaly detection model processes the input standardized feature vector through a temporal convolutional layer. The temporal convolutional layer uses a one-dimensional convolutional kernel that slides along the time dimension to capture local patterns and short-term dynamic features in traffic behavior, such as anomalies such as sudden traffic spikes and periodic access.

[0028] Temporal features are fed into a multi-head attention weight allocation layer. This layer calculates an attention score for each element in the feature vector, generating an attention weight distribution. This mechanism enables the model to dynamically focus on the subset of key features most relevant to potential attacks, achieving adaptive attention to different attack scenarios.

[0029] Furthermore, the features are weighted and fused based on attention weights to generate context-aware feature vectors that reflect the traffic behavior representation after importance calibration, providing refined input for the final classification.

[0030] The fused feature vector is passed through the classification output layer, then through a fully connected layer and a sigmoid activation function to be converted into anomaly scores between 0 and 1. Simultaneously, the anomaly detection model generates a score explanation weight feature vector, which integrates attention weights and gradient information, providing a quantitative basis for the contribution of each input feature to the final score, thus achieving parallel output of detection results and explanation information.

[0031] The pre-training process for the anomaly detection model involves: constructing a large-scale labeled dataset as the training foundation; using publicly available cybersecurity datasets and real network traffic annotated by experts to form a training sample set containing normal traffic and various attack types; and each sample containing a complete multi-dimensional feature vector and corresponding normal and anomaly labels.

[0032] In terms of training architecture design, an end-to-end supervised learning framework is adopted. The standardized feature vectors mentioned above are used as model input, and the loss function is constructed based on the difference between the predictions generated by forward propagation and the true labels. The model parameters are iteratively optimized using the backpropagation algorithm to minimize the overall loss function.

[0033] The loss function consists of three parts: classification cross-entropy loss ensures basic detection accuracy; attention entropy regularization term prevents excessive concentration of attention weights and promotes the model to comprehensively consider various features; graph smoothing constraint term is based on communication topology to strengthen feature continuity between adjacent nodes and avoid isolated misjudgments.

[0034] During training, the initial focus is on improving classification accuracy, while interpretability-related constraints are gradually introduced in the later stages. An adaptive optimization algorithm dynamically adjusts the learning rate, and an early stopping mechanism is employed to prevent overfitting, ultimately resulting in a pre-trained model that combines high detection performance with stable interpretability.

[0035] In this embodiment, the anomaly detection model input comes from the aforementioned multi-dimensional feature modeling module, which includes three branches: temporal features, protocol semantic features, and communication topology features. The anomaly detection model structure consists of three parts: an input encoding layer, a core feature inference layer, and an output interpretation layer.

[0036] First, the input encoding layer aligns multi-source features to a unified representation space through linear embedding mapping. Then, a temporal convolutional layer captures local dynamic changes within the window, identifying anomalous patterns such as short-term bursts and periodic oscillations. The input encoding layer includes: a temporal vector recording packet length, packet interval, and rate sequence within the window; a protocol feature vector containing encoded semantic fields such as HTTP / DNS / TLS; and a topological embedding vector representing host nodes generated from the communication graph. The output is a numerical matrix containing semantic organization, as shown in Table 1.

[0037] Table 1 In addition, to reduce the computational burden and unify the dimensions of subsequent models, a linear projection layer is added: Henc=Linear(280→256).

[0038] Building upon this foundation, a core feature inference layer is introduced. The execution of this layer progresses gradually from shallow to deep, following temporal and data flow. A one-dimensional convolution operation is performed through a temporal convolutional layer, with the convolution kernel sliding along the time axis to extract local communication patterns. The output feature map preserves the temporal order while highlighting instantaneous anomalies in the packet structure. The result enters a multi-head attention layer, where the system generates three vectors (query, key, and value) based on the convolution output. A weighted attention score matrix is ​​obtained through dot product calculation, and the features are then weighted and summed to reconstruct high-weight key regions, enabling the model to automatically focus on attack-related time periods or protocols. Next, the high-dimensional aggregated features output from the attention layer are input into a graph neural network layer. Based on the previously constructed communication topology, the adjacency relationships and feature updates for each node are calculated. Each propagation iteration combines the node's features with neighboring node information for non-linear aggregation, forming a global network context representation used to characterize potential attack propagation paths. Finally, the system merges all nodes and temporal features into a unified vector, outputting the probability of malicious traffic through a classification layer. Simultaneously, during backpropagation, gradient-sensitive weights and attention weights are generated to form a feature contribution matrix, clearly indicating the actual role of each input feature in the current judgment.

[0039] The model ultimately generates both classification results and feature contribution weight matrices through an output interpretation layer, providing quantifiable internal evidence for subsequent interpretable modules. This hierarchical combination design achieves unified modeling of local behavior and overall network relationships while ensuring detection accuracy.

[0040] In this embodiment, to further ensure that the model balances detection performance and interpretation consistency, a multi-objective optimization mechanism is employed during the training phase. The overall loss function consists of three parts: a classification error term, an attention regularization constraint, and a graph smoothing constraint.

[0041] Convergence balance is controlled by weighting coefficients. Classification cross-entropy loss ensures the model's discriminative ability; attention regularization suppresses excessive concentration of attention distribution, ensuring the model has a reasonable attention range in multi-feature scenarios; graph smoothing strengthens the feature continuity between adjacent host nodes, avoiding misjudgments caused by single-point anomalies. To achieve the correspondence between the explained output and the true features, the objective function is optimized as follows: .in For classification cross-entropy loss; This is the attention entropy regularization term; For graph smoothing constraints.

[0042] An explanation consistency loss function is introduced to impose similarity constraints on the distribution of explanation weight matrices for similar samples, thereby establishing a stable mapping between explanation results and input features at the model parameter level.

[0043] In the model inference stage, SHAP and LIME posterior interpretation modules are superimposed to enable quantifiable interpretation of the detection results.

[0044] The SHAP module is based on game theory and calculates a Shapley value for each input feature to accurately measure the marginal contribution of that feature in the current prediction. Based on this, a feature influence vector table is formed, showing the positive or negative effect of each feature on the classification result, thereby revealing the dominant factors in the formation of malicious traffic.

[0045] The LIME module reconstructs a local linear approximation model using locally perturbed samples, generating local interpretations quickly with minimal computation.

[0046] To integrate the advantages of both algorithms, the global explanatory value of SHAP and the local explanatory vector of LIME are aligned by timestamp, and a consistency coefficient is calculated to identify the model's explanatory stability. When the consistency decreases, the system triggers retraining or fine-tuning of some parameters to maintain the long-term availability of explanatory transparency. This fusion mechanism ensures that the model can provide both macro-trend explanations and specific, quantifiable, and verifiable decision-making basis for individual alarms.

[0047] S104. Determine the triggering communication traffic data corresponding to the traffic behavior anomaly score, associate the traffic behavior anomaly score, the score interpretation weight feature vector with the triggering communication traffic data, and construct an attack situation map.

[0048] After obtaining the anomaly detection results, the process of constructing the attack posture map is initiated, transforming discrete security events into visualized, correlated threat intelligence.

[0049] Specifically, a graph data model and storage structure are established. Network entities are defined as graph nodes, including nodes corresponding to source and destination hosts. Node attributes include IP address, device type, and basic risk assessment value. Network interaction behaviors are defined as directed edges, and storage space is reserved for protocol type, time series, and risk evidence in edge attributes. Efficient storage is achieved by combining graph database adjacency lists with time indexes.

[0050] When the anomaly detection model outputs an anomaly score exceeding a threshold, a graph update operation is performed. The five-tuple information, including source IP, destination IP, source port, destination port, and protocol type, is precisely parsed from the original communication traffic that triggered the anomaly and used as the graph element identifier. If the corresponding source or destination node does not exist, a new node is created in the graph and its attributes are initialized.

[0051] Furthermore, directed edges are established or updated between the source and destination nodes. The detected anomaly scores are used as the core risk indicators for the edges, and the risk level attributes of these edges are cumulatively updated. Simultaneously, significant feature terms in the score explanation weight feature vector are transformed into readable descriptions, which are then used as key judgment criteria and associated with the edges.

[0052] Based on the sliding time window principle, the system periodically scans the most recent update timestamp of all edges in the graph, automatically removes edges that have exceeded the preset validity period, and synchronously cleans up the isolated nodes formed after removal, ensuring that the graph reflects the current network status in real time.

[0053] S105. Based on the iterative updated traffic behavior anomaly score and the corresponding updated score explanation weight feature vector, update the attack situation map and record the update changes of the attack situation map.

[0054] Once the attack landscape map is constructed, a dynamic update mechanism ensures that the map reflects the evolution of network threats in real time.

[0055] Specifically, an event-driven real-time update process is established. When the detection engine outputs a new anomaly score in a subsequent time window, the graph module immediately starts the update procedure. The communication data that triggered the anomaly score is parsed, the source and destination entity identifiers are extracted, and the corresponding nodes and edges are queried in the graph.

[0056] For existing attack paths, attribute enhancement updates are performed. Besides accumulating new anomaly scores into the risk level attribute of the edges, the key is to add features that significantly contribute to the explanatory weight feature vector corresponding to this detection to the edge's judgment criterion list. Simultaneously, a trust decay coefficient is applied to decay historical risk values ​​over time, ensuring that the latest threat intelligence has a higher weight.

[0057] A sliding window mechanism is used for dynamic pruning. During each update cycle, the system automatically scans the most recent active timestamps of all edges in the graph. Edges exceeding a preset expiration date are soft-deleted by reducing their weight to zero and then moving them to a deletion queue. For isolated nodes resulting from edge removal, a garbage collection mechanism is initiated to clean them up, maintaining the compactness of the graph structure.

[0058] Furthermore, a complete update log recording system is established simultaneously. Each creation, modification, or deletion operation of a node or edge generates a timestamped change record, including key information such as the change type, involved element identifiers, and the state of attributes before and after the change. These change records are not only used for auditing and tracing but also provide a structured data foundation for subsequent attack evolution analysis, forming a complete transformation of the graph from a static snapshot to a dynamic cinematic experience.

[0059] In this embodiment, communication metadata is extracted from the traffic acquisition and detection module, including source IP, destination IP, transmission port, session timestamp, protocol type, and risk labels and feature importance output by the interpretable model. Based on this, nodes are defined as network communication entities (such as hosts, services, terminals, or security devices), and each node contains an attribute vector: The risk level is mapped from the confidence interval of the model output to three levels (low, medium, and high); directed edges are defined as network interactions or attack behaviors, with attributes including: protocol type, index of key interpretable model features, and edge weight. Timestamp sequence { , ,…,tn}.

[0060] The above relationships are stored using an adjacency list structure and a temporal adjacency index, and the graph is initialized when a malicious session is detected for the first time.

[0061] When the detection engine outputs new malicious traffic events in subsequent time windows, the graph module triggers an event-driven update process.

[0062] If the source and target nodes already exist, only the edge attributes are updated, including increasing risk weight, appending time series, and adjusting the trust decay coefficient; if a new node appears for the first time, a node is created in the graph structure and an initial attribute vector is inserted; if a detection event indicates a potential attack phase transition, the semantic labels of the edges are marked and an association retrieval is triggered.

[0063] The update uses a sliding time window mechanism to deweight or remove expired nodes and low-confidence edges, thus keeping the graph timely.

[0064] To reveal deep attack chains, an attribute propagation algorithm is executed on the updated graph. For each node... Calculate the risk diffusion in its in-degree and out-degree directions: ,in α represents the node's own detection score, and α is the propagation attenuation coefficient.

[0065] S106. Based on the updated changes, determine the attack propagation path of the abnormal traffic in order to predict potential risks.

[0066] Based on the topology of the graph and the risk transmission relationships between nodes, the temporal risk centrality index of each node is calculated. An iterative propagation algorithm is used to simulate the risk diffusion process among network nodes, identifying high-risk node clusters with significantly higher risk concentrations than their surrounding areas. These clusters typically correspond to control nodes or important targets in attack operations.

[0067] We analyze the time-series variation curves of risk level attributes on directed edges and calculate the risk growth slope for each edge. Edges with slopes exceeding a threshold and connecting high-risk nodes are marked as critical connections; these connections represent the most active propagation channels of attack activity. By simultaneously analyzing the score interpretation weight feature vectors associated with the edges, we identify the consistency of attack technique characteristics, thereby confirming that critical connections belong to the same attack chain.

[0068] Based on the identified core nodes and key connections, the complete attack path is reconstructed according to time sequence and causal relationships. By analyzing the timestamp sequence in the graph update record, the stage evolution process of the attack is determined, and key judgment attributes are mapped to each attack stage, forming a complete attack chain model of initial intrusion, lateral movement, and target achievement.

[0069] Based on the constructed attack chain and risk propagation pattern, a graph neural network algorithm is used to predict the possible development direction of the attack. By calculating the risk propagation probability of each path, potential targets most likely to become the next batch of victim nodes are marked, and these prediction results are fed back to the detection module in real time, realizing targeted monitoring and proactive defense of critical paths, forming a complete closed loop from attack identification to predictive defense.

[0070] In this embodiment, structural indicators are periodically calculated on the dynamic graph to assess the attack posture and predict future risks. These structural indicators include: node centrality change rate: reflecting the evolution trend of core attack nodes and used to identify the current control source; edge weight change curve slope: used to measure the acceleration of attack activity; and subgraph density evolution: determining whether the attack has spread or converged.

[0071] By constructing an inherently interpretable anomaly detection model, the "black box" problem of existing AI detection systems is effectively solved. While outputting anomaly scores, the model simultaneously generates feature importance weight vectors, providing clear decision-making basis for each judgment. This makes the detection results traceable and highly reliable, greatly improving the trust of security operations personnel in automated detection results and enhancing review efficiency.

[0072] Furthermore, by deeply integrating interpretable detection results with the communication topology, an attack situation map is constructed and dynamically updated, achieving a leap from identifying isolated anomalies to recognizing the global attack chain. This method can intuitively display the origin, propagation path, and evolution trend of attacks, and predict potential risks based on the temporal changes in the map, thereby elevating network security protection from passive response to a new level of proactive early warning and precise intervention.

[0073] like Figure 2 As shown in the embodiments of this application, a real-time network traffic anomaly detection device is also proposed, comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform a real-time network traffic anomaly detection method as described in any of the above embodiments.

[0074] This application also provides a non-volatile computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured as: a real-time network traffic anomaly detection method as described in any of the above embodiments.

[0075] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the device and medium embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the description of the method embodiments.

[0076] The devices and media provided in this application are one-to-one with the methods. Therefore, the devices and media also have similar beneficial technical effects as their corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the devices and media will not be repeated here.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0079] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0080] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0081] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0082] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0083] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0084] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0085] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A network traffic real-time anomaly detection method, characterized in that, The method comprises the following steps: real-time acquisition of communication traffic data in a network, extraction of multi-dimensional features of the communication traffic data based on a sliding time window; the multi-dimensional features include statistical features, time sequence features, protocol semantic features and communication topology features; fusion of the multi-dimensional features to obtain a standardized feature vector corresponding to each time window; based on the standardized feature vector, through a pre-trained anomaly judgment model, iteratively generating a traffic behavior anomaly score corresponding to each time window and a corresponding score explanation weight feature vector; determining the trigger communication traffic data corresponding to the traffic behavior anomaly score, associating the traffic behavior anomaly score, the score explanation weight feature vector and the trigger communication traffic data, and constructing an attack situation map; based on the updated traffic behavior anomaly score and the corresponding updated score explanation weight feature vector after iteration, updating the attack situation map and recording the update change of the attack situation map; determining the attack propagation path of abnormal traffic according to the update change to predict potential risks.

2. The network traffic real-time anomaly detection method of claim 1, wherein, The method comprises the following steps: parsing the communication traffic data in the time window to extract the corresponding original fields from each network layer, and calculating the statistical features in the time window based on the original fields; the statistical features include packet length distribution, byte rate, packet interval and direction ratio; generating an inter-frame time difference sequence based on the timestamp sequence of the communication traffic data in the time window to form time sequence features; encoding the key attributes of the application layer protocol in the network to form protocol semantic features; based on the communication relationship between the source address and the destination address of the network, constructing a communication interaction graph between the communication host nodes, extracting a node embedding feature vector of the communication interaction graph, and forming communication topology features.

3. The method of claim 2, wherein, The method comprises the following steps: respectively encoding the multi-dimensional features to obtain corresponding numerical vectors; splicing the numerical vectors to form a joint feature vector; standardizing the joint feature vector to obtain a standardized feature vector.

4. The method of claim 1, wherein, The method comprises the following steps: inputting the standardized feature vector corresponding to each time window into the anomaly judgment model, capturing the local communication mode through the time sequence feature extraction layer of the anomaly judgment model; inputting the local communication mode into the attention weight distribution layer of the anomaly judgment model to calculate the attention weight distribution of each feature in the standardized feature vector; based on the attention weight distribution, weighted fusion is performed on the features to obtain a weighted context vector, and based on the weighted context vector, a traffic behavior anomaly score corresponding to a time window is generated through the classification output layer of the anomaly judgment model; Meanwhile, a score explanation weight feature vector corresponding to the traffic behavior anomaly score is generated according to the attention weight distribution and the forward propagation gradient information of each feature.

5. The method of claim 4, wherein, The traffic behavior anomaly score corresponding to the time window is generated by a classification output layer of the anomaly judgment model based on the weighted context vector, and specifically includes: The weighted context vector is input into the classification output layer of the anomaly judgment model, and linear transformation is performed by a fully connected layer in the classification output layer. The weighted context vector after linear transformation is input into an activation function, and mapping is performed in a preset interval to obtain the traffic behavior anomaly score corresponding to the time window.

6. The method of claim 1, wherein, The traffic behavior anomaly score corresponding to the traffic behavior anomaly score is determined, and the traffic behavior anomaly score, the score explanation weight feature vector and the trigger communication traffic data are associated to construct an attack situation map, and specifically includes: The trigger communication traffic data corresponding to the traffic behavior anomaly score is determined, and the source communication entity identifier and the target communication entity identifier of the trigger communication traffic data are parsed. A source node is constructed based on the source communication entity identifier, and a target node is constructed based on the target communication entity identifier. Based on the network interaction behavior corresponding to the source communication entity identifier and the target communication entity identifier, a directed edge is established between the source node and the target node, and the traffic behavior anomaly score is set as a risk level attribute and associated with the directed edge. Based on the features with weight values higher than a preset threshold in the score explanation weight feature vector, a key judgment basis attribute of the directed edge is set and associated with the directed edge to construct the attack situation map.

7. The method of claim 6, wherein, The attack situation map is updated based on the updated traffic behavior anomaly score after iteration and the corresponding updated score explanation weight feature vector, and specifically includes: When the updated traffic behavior anomaly score after iteration exceeds an abnormal score preset threshold, the corresponding update source entity identifier and update target communication entity identifier are parsed from the corresponding trigger update communication traffic data. Based on the update source entity identifier and the update target communication entity identifier, the corresponding update source node and update target node are determined in the attack situation map, and it is judged whether there is a directed edge between the update source node and the update target node. If yes, the risk level attribute of the to-be-updated directed edge is adjusted based on the update traffic behavior anomaly score, and the key judgment basis attribute in the update score explanation weight feature vector is added to the to-be-updated directed edge. If not, new nodes and corresponding directed edges are created based on the update source node and the update target node.

8. The method of claim 6, wherein, The attack propagation path of the abnormal traffic is determined according to the update change The time sequence risk centrality index of each node in the attack situation map is calculated to identify a risk propagation core node. Based on the time sequence change trend of the risk level attribute of the directed edge, a key connection edge of risk diffusion is identified. According to the time sequence connection relationship of the core node and the key connection edge, an attack chain from an attack source node to a potential victim node is constructed. Based on the spatial topology and time evolution sequence of the attack chain, an attack propagation path is generated and visualized.

9. A network traffic real-time anomaly detection device, characterized in that, Comprise: At least one processor; And, The memory is in communication with the at least one processor; wherein, The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform a network traffic real-time anomaly detection method as claimed in any one of claims 1-8.

10. A non-volatile computer storage medium storing computer-executable instructions, characterized in that, The computer executable instructions are configured to perform a network traffic real-time anomaly detection method as claimed in any one of claims 1-8.

Images