Network traffic anomaly detection system based on deep learning

Abstract

The invention relates to the technical field of network traffic detection, in particular to a network traffic anomaly detection system based on deep learning. According to the entropy change-based time window adaptive adjustment method, the window length is dynamically adjusted according to the entropy of traffic characteristics in a window, and the flexibility of time segmentation and the sensitivity to abnormal traffic abrupt change are improved; meanwhile, importance weighting, irrelevant dimensionality control and key dimensionality enhancement of each dimensionality feature are achieved on an original input feature vector by combining multi-category feature gating, a model is helped to more effectively pay attention to abnormal related signal features, and deep analysis of network flow complex time sequence context is achieved by combining a self-attention mechanism; mahalanobis distance secondary detection of a normal detection template is introduced, statistical distribution is taken as a basis, the discrimination capability of a boundary sample is enhanced, the false alarm and missing report rate is reduced, and an anomaly detection system which accurately senses complex behavior fluctuation, adaptively adjusts analysis granularity, fuses multiple types of features and has robust discrimination capability is constructed.

Description

Technical Field

[0001] This invention relates to the field of network traffic detection technology, and more specifically to a network traffic anomaly detection system based on deep learning. Background Technology

[0002] Existing network traffic anomaly detection methods generally suffer from problems such as rigid fixed-time-window design, coarse-grained feature processing, lack of model context awareness, and insufficient ability to identify boundary samples. In most traditional methods, a fixed-length time window is used to divide network traffic data. This approach is difficult to adapt to drastic fluctuations in network conditions. Sudden anomalies are easily averaged out, while stable traffic can lead to computational redundancy. In addition, network traffic contains a variety of heterogeneous information, such as statistical features (e.g., packet length, arrival interval), protocol features (e.g., TTL, Flags), and behavioral features (e.g., IP repetition rate, direction switching rate). Most existing methods mix these features into the model, ignoring the essential differences in semantics and distribution patterns of different categories of features, which can easily lead to interference between features and affect the model's discrimination performance. Meanwhile, cyberattacks often exhibit a continuous characteristic across time periods. Traditional models make independent judgments in each time slice, making it difficult to capture the attack evolution process in context, leading to missed detections and false positives. When the output probability is on the boundary between abnormal and normal, deep learning models are easily affected by training fluctuations and become unstable in their judgments. Existing solutions usually lack redundant detection designs to address this problem, thus limiting the accuracy, robustness, and industrial adaptability of detection systems in complex network environments. Summary of the Invention

[0003] To address the aforementioned shortcomings of existing technologies, this invention provides a deep learning-based network traffic anomaly detection system, which can effectively solve the problem of low accuracy in network traffic anomaly detection caused by the inability to adapt to complex and ever-changing network traffic characteristics in existing technologies.

[0004] To achieve the above objectives, the present invention provides the following technical solution: This invention provides a deep learning-based network traffic anomaly detection system, comprising at least: The traffic acquisition and control module samples network traffic through a sliding window to obtain network traffic records, obtains the probability of the destination port appearing, calculates the destination port entropy, dynamically adjusts the time window length based on the entropy difference, and outputs the corresponding time window. The categorical feature extraction module extracts categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. The traffic detection module establishes a temporal context sequence centered on the suppressed feature vector, introduces a self-attention mechanism, extracts contextual behavior patterns related to the behavior of the feature vector, calculates attention weights, and outputs contextual fusion features and the final feature vector. The final feature vector outputs the anomaly detection probability through the output layer. The secondary verification module collects accurate network traffic data to establish a structural feature vector, calculates the mean vector, and establishes a covariance matrix from the two. It then performs a secondary verification of the traffic based on Mahalanobis distance.

[0005] The method for adjusting the time window length is as follows: Normalize the frequency of the destination port to obtain the probability of its occurrence; Calculate the destination port entropy based on the occurrence probability, and calculate the difference in destination port entropy between adjacent time points; Compare the entropy difference with the threshold and output the corresponding time window length.

[0006] Statistical characteristics include: average packet size in bytes, average time between arrival of two adjacent packets, standard deviation of packet length, maximum and minimum packet length within the current time window, number of connections per second, and number of packets per second. Protocol-related characteristics include: average TTL value and frequency of each flag type; Behavioral features include: IP duplication rate, destination port entropy, and direction switching rate.

[0007] The method for suppressing the input feature vector is as follows: The three types of features are established as feature vectors, and multiple sub-vectors are obtained by grouping, including: Statistical feature vectors, protocol feature vectors, and behavioral feature vectors; For multiple sub-vectors corresponding to different categories, a linear transformation is performed on the sub-vector based on the weight matrix and bias peak corresponding to the category, and the Sigmoid activation function is input to output a gated weight vector; Multiple sets of gated weight vectors are concatenated to obtain the concatenated result; Based on the weight matrix and bias term of the fusion layer, a linear transformation is performed on the splicing result, the input is the Sigmoid activation function, and the output is the fusion gate weight vector; The fusion gated weight vector performs gated suppression on the input feature vector through element-wise multiplication.

[0008] The method for outputting the final feature vector is as follows: Extract contextual behavior patterns related to feature vector behavior, including: Define queries, key-value projections; Calculate attention weights; Output context fusion features based on attention weights and value matrices; The context-fused features and the feature vector after gating suppression are used to output the final feature vector based on the residual mechanism and layer normalization.

[0009] Furthermore, the method for determining whether network traffic is abnormal based on the anomaly detection probability is as follows: If the probability of an anomaly detection is greater than the upper limit of the threshold, then the network traffic is abnormal and anomaly control needs to be implemented. If the probability of an anomaly detection is less than the lower threshold, the network traffic is normal and no anomaly control is required. If the anomaly detection probability is between the upper and lower bounds of the threshold, a secondary traffic inspection needs to be performed.

[0010] Furthermore, the specific method for performing secondary flow rate verification based on Mahalanobis distance is as follows: Create a normal detection template: The normal detection template is constructed from historical network traffic data that has been marked as having no anomalies. By dividing this type of data according to a preset time window and extracting statistical, protocol, and behavioral features, a structural feature vector is formed. Calculate the mean vector and covariance matrix as parameters of the normal distribution; The method for determining the covariance matrix is ​​as follows: The mean vector is calculated as the difference between all structural feature vectors and the mean vector; Construct the outer product of the differences, sum the outer product terms over all samples and then take the average to obtain the covariance matrix between each feature dimension; Based on the new network traffic time window, feature vectors consistent with the normal detection template are extracted, and then compared with the mean vector and covariance matrix to calculate Mahalanobis distance; Based on the comparison between Mahalanobis distance and distance threshold, the network traffic detection results are output, and the secondary traffic verification is completed.

[0011] A network traffic anomaly detection method, applied to the deep learning-based network traffic anomaly detection system, includes the following steps: Sampling of network traffic through a sliding window yields network traffic records, the probability of destination port occurrence is obtained, and the destination port entropy is calculated. The time window length is dynamically adjusted based on the entropy difference, and the corresponding time window is output. Extracting categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. Centered on the suppressed feature vector, a temporal context sequence is established, a self-attention mechanism is introduced, and context behavior patterns related to the behavior of the feature vector are extracted. By calculating the attention weight, the context fusion feature and the final feature vector are output. The final feature vector outputs the anomaly detection probability through the output layer. The system constructs a structural feature vector from the collected network traffic data, calculates the mean vector, and establishes a covariance matrix from the two. Then, it performs a secondary verification of the traffic based on Mahalanobis distance.

[0012] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the system.

[0013] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system.

[0014] The technical solution provided by this invention has the following advantages compared with the known prior art: An adaptive time window partitioning strategy is constructed by using destination port entropy and entropy difference to quickly respond to sudden network states and optimize computational resources for stable states. At the same time, network features are subdivided into three categories: statistical, protocol, and behavioral. Each category is modeled and a group gating mechanism is introduced. Independent sub-networks learn the weight distribution of each type of feature, and the model is weighted by fusing the gating weight vector to enhance the model's ability to perceive key feature dimensions. During traffic detection, a time context sequence centered on the current window is constructed, and the attention mechanism is used to dynamically focus on relevant windows to improve the model's ability to model the evolution of abnormal behavior contexts and avoid the risk of misjudgment caused by single-window arbitrariness. For samples with anomaly detection probabilities in the critical range, a Mahalanobis distance quadratic test mechanism based on historical normal detection templates is introduced. This enhances the anomaly detection capability of boundary samples based on statistical distribution, reduces false positive and false negative rates, and constructs an anomaly detection system that accurately perceives complex behavioral fluctuations, adaptively adjusts the analysis granularity, integrates multiple features, and has robust discrimination capabilities. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is an overall module block diagram of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0018] The present invention will be further described below with reference to embodiments.

[0019] Example 1 (see Figure 1 A deep learning-based network traffic anomaly detection system includes at least the following: In network traffic, certain standard service ports appear frequently (such as 80, 443), usually indicating normal browsing behavior. However, a large number of non-standard service ports (such as 4444, 1337, 9000) also appear, typically indicating probing or attacks. Therefore, the entropy used by the destination port (IP) is used to measure changes in network behavior complexity, thereby dynamically adjusting the time window segmentation strategy and improving the sensitivity of the detection system to sudden anomalies. This includes: The traffic acquisition and control module performs sliding window sampling of network traffic within each fixed time period, obtaining multiple network traffic records containing the destination port field, and statistically analyzing the frequency of the destination port to form a frequency table. ; in, Indicates the first One observed destination port, This indicates the number of times the corresponding destination port appears within that time period. Indicates the number of types of destination ports; Normalize the frequency of each destination port to obtain its probability of occurrence. ; in, This indicates the total number of records at the destination port within that time period. This represents the Laplace smoothing factor, preventing certain destination ports from having a frequency of 0 within a certain window. The previous category represents all possible destination port types; Calculate the destination port entropy Entropy measures the degree of uncertainty / chaos in the distribution of the state of the destination port within a fixed time period. Calculate the entropy difference It is used to detect the magnitude of behavioral changes in order to determine whether the time window should be adjusted; Dynamically adjust the time window length: in, This indicates the dynamically adjusted time window length. Indicates the minimum window length. Indicates the maximum window length. Indicates a high volatility threshold. Indicates the low volatility threshold. Represents the exponential smoothing coefficient. This represents the global average window length, specifically the average window length across all historical windows.

[0020] Therefore, the aforementioned adaptive mechanism avoids the existence of a fixed time window: To address situations where excessively coarse segmentation during sudden events leads to the loss of details, or excessively fine segmentation during stable flow results in excessive noise, we can improve detection accuracy by obtaining short time windows in abnormally high fluctuation regions and reduce computational redundancy by using long time windows in stable and normal regions.

[0021] The category feature extraction module, based on the adjusted This will allow you to output the corresponding time window sequence. Specifically: Set flow time series Each It is a network data packet with a total quantity of L and a timestamp; Set an initial time point, based on the current window length. Starting from the initial time point, select the option that satisfies: of , express timestamp, This indicates the start time of the current window, forming the first time window. ; Then slide the initial time point by a fixed step. Obtain the new starting time point Then, according to the corresponding new time window Constructing a time window Furthermore, the time window sequence can be obtained by analogy. .

[0022] Each time window Extract the following category features: Statistical features (numerical): Average packet size in bytes, average time between arrival of two adjacent packets, standard deviation of packet length, maximum and minimum packet length within the current time window; Connections per second, packets per second (the ratio of data packets to time), etc. Protocol-related features (the following features are encoded using one-hot encoding): The average TTL (TTL is a field in the IP packet header that indicates the maximum number of hops a packet can be forwarded in the network; the average is the average of the TTL values ​​of all packets collected within a time window) and the frequency of each Flag type (each packet header has a set of flags that indicate the current connection or communication status; common Flag types include SYN, ACK, FIN, etc., which will not be elaborated further). Behavioral characteristics: IP duplication rate (the proportion of duplicate source IPs within a window; source IP refers to the IP address of the device that initiated the connection or sent data), destination port entropy (destination port entropy within the current window), and direction switching rate (the ratio of the frequency of switching between external IPs and local IPs to the total number of connections; external IPs connecting to local IPs, for example, during an attack; local IPs connecting to external IPs, such as when browsing web pages). Because these three types of features differ significantly in semantics and numerical distribution, directly mixing the inputs would make it difficult for subsequent models to distinguish the roles of different features, and could easily lead to inter-class interference, reducing sensitivity to key features. Therefore, a three-part feature vector is constructed. Specifically: Represents the statistical feature vector. Represents the feature sub-vector of the protocol class. Represents behavioral feature sub-vectors (all processed by normalization or standardization); By dividing the vector into multiple sub-vectors and processing each sub-vector separately, grouped feature vectors are formed.

[0023] Dynamic changes in network traffic cause fluctuations in the importance of different feature groups across different time windows. A uniform gating system may not accurately adapt to changes in various features. Independent sub-network design can specifically capture the dynamics of features within each category, while controlling computational overhead and training stability, maintaining a smooth and trainable model. Therefore, for each sub-vector, the gating weight vector is calculated using linear transformation and the sigmoid activation function, resulting in: Category ( Represents statistical features. Indicates protocol class characteristics, (Representing behavioral features,) establish a gating weight vector : Represents the weight matrix. Indicates the offset top. This represents the Sigmoid activation function, which outputs a gating weight vector. Therefore, the gating weight vector for the corresponding class can be output. ; Group gating improves selection accuracy within categories, but features between categories are correlated, and processing them individually may lead to ignoring cross-category information. Therefore, the three gating weight vectors are combined... Concatenate to form the initial fusion vector ; Based on the initial fusion vector, a fusion-gated weight vector is output. Then, the original input feature vector is multiplied element-wise using the fusion-gated weight vector to weight the importance of features in each dimension. This controls irrelevant dimensions, strengthens key dimensions, and helps the model focus more effectively on anomaly-related signal features. This represents the final fusion gating weight vector. This represents the weight matrix of the fusion layer. Indicates the bias term of the fusion layer; This represents the gated feature vector. This indicates element-wise multiplication.

[0024] The traffic detection module addresses the issue that many anomalous behaviors in network traffic (such as scanning and DDoS attacks) are not isolated events but rather continuous patterns spanning multiple time slices. Traditional methods make independent decisions within each time window, easily overlooking temporal dependencies. Therefore, a temporal attention mechanism is introduced to provide context awareness for each current window, improving the sensitivity and accuracy of anomalous behavior identification. This includes: The feature vector after input gating And taking this as the center, extract the total number of elements before and after it. A sequence of adjacent gated feature vectors forms a temporal context sequence. , This represents the dimension of each gated feature vector.

[0025] Input self-attention mechanism, extraction and The most relevant contextual behavioral patterns are: Define queries, key-value projections: in, Represents the query vector. This represents the query weight matrix. express Dimensions Represents the key matrix. Represents the weights of the key matrix. Represents a value matrix, Represents the weights of the value matrix. express The dimension; Calculate attention weights : in, This represents the transpose, and the dot product of the query vector and the key matrix is ​​calculated by dividing by . Scaling is performed to prevent the inner product result from being too large, which could lead to gradient vanishing or oversaturation. Then, the result is normalized to a weight distribution using the Softmax function, representing the importance of the current feature extraction window to its neighboring windows. Computational context fusion features

[0026] Perform residual connections and layer normalization: Representation layer normalization; Residual connections can preserve the original local information in the current gated feature vector, preventing it from being overly smoothed by the attention mechanism; while layer normalization is used to alleviate the internal covariate shift, improve training stability, and make the feature distributions between different time windows more aligned.

[0027] The final feature vector The input-output layer (fully connected layer) obtains the predicted probabilities: , Indicates the first Time window The probability of anomaly detection. This represents the weight matrix of the output layer. This represents the bias vector of the output layer, which is used to perform detection and judgment based on the anomaly detection probability of the output: If the probability of abnormal detection If it is greater than the upper bound of the threshold, then it means that the first... Time window The network traffic is abnormal and abnormal control measures need to be implemented. If the probability of abnormal detection If it is less than the lower bound of the threshold, then it means that the first... Time window The network traffic is normal and no abnormal control measures are required. If the probability of abnormal detection If the value is between the upper and lower bounds of the threshold, it is impossible to accurately determine the first threshold. Time window The status of network traffic requires secondary traffic verification.

[0028] The secondary verification module is used to perform secondary verification of the flow rate. The specific method is as follows: Establish a normal detection template and set a collection time window, such as 5 seconds or 100 data packets per window; collect multiple categories of features from a database of network traffic data without anomalies, namely the statistical features, protocol features and behavioral features mentioned above, and concatenate them into a structural feature vector (which needs to be z-score standardized or normalized). The structural feature vectors are averaged to obtain the mean vector. Construct the covariance matrix based on the mean vector and structural eigenvectors. : in, Indicates the number of time windows. Represents structural feature vectors. Represents the mean vector. Represents the regularization coefficient. Represents the identity matrix. This is to prevent the covariance matrix from becoming irreversible or numerically unstable.

[0029] Based on the current arrival time window Re-collect the above three types of features (statistical, protocol, and behavioral) and construct new feature vectors. And based on this, a secondary flow test is performed using Mahalanobis distance (the degree of deviation of the new feature vector sample from the center of the normal detection template row in the multidimensional statistical space): in, This represents the Mahalanobis distance. The Mahalanobis distance can be compared with a preset distance threshold to determine if it is greater than the threshold. If it is greater, it indicates that the network traffic is abnormal and abnormal control measures need to be implemented (such as notifying the administrator / system center and suspending the connection, limiting the speed, or placing it in an isolation zone). Otherwise, no control measures are required.

[0030] Therefore, a normal detection template is constructed based on historical normal traffic samples. By calculating its mean vector and covariance matrix, a distribution representation of normal behavior is formed. Mahalanobis distance is then used to measure the deviation of the current new feature vector from the normal distribution, thereby enhancing the anomaly detection of boundary samples. This phased joint detection strategy effectively compensates for the decrease in recognition accuracy of neural networks in the probabilistic critical region, improves the stability and robustness of the model in anomaly detection, and reduces the false positive and false negative rates caused by unstable model output.

[0031] Also includes: A network traffic anomaly detection method, applied to the deep learning-based network traffic anomaly detection system, includes the following steps: Sampling of network traffic through a sliding window yields network traffic records, the probability of destination port occurrence is obtained, and the destination port entropy is calculated. The time window length is dynamically adjusted based on the entropy difference, and the corresponding time window is output. Extracting categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. Centered on the suppressed feature vector, a temporal context sequence is established, a self-attention mechanism is introduced, and context behavior patterns related to the behavior of the feature vector are extracted. By calculating the attention weight, the context fusion feature and the final feature vector are output. The final feature vector outputs the anomaly detection probability through the output layer. The system constructs a structural feature vector from the collected network traffic data, calculates the mean vector, and establishes a covariance matrix from the two. Then, it performs a secondary verification of the traffic based on Mahalanobis distance.

[0032] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the system.

[0033] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system.

[0034] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A deep learning based network traffic anomaly detection system, characterized in that, The method comprises the following steps: a traffic collection and control module, which samples a network traffic sliding window to obtain a network traffic record, obtains a destination port occurrence probability, calculates a destination port entropy, dynamically adjusts a time window length according to the entropy difference, and outputs a corresponding time window; a category feature extraction module, which extracts category features under the time window, including: statistical category features, protocol category features and behavior category features, and outputs corresponding sub-vectors; a linear transformation and an activation function are used to output a gate weight vector of each sub-vector, a plurality of sets of gate weight vectors form an initial fusion vector, and a fusion gate weight vector is calculated to suppress an input feature vector through dynamic weighting; a traffic detection module, which takes the suppressed feature vector as the center to establish a time context sequence, introduces a self-attention mechanism, extracts a context behavior pattern related to the feature vector behavior, calculates attention weights, and outputs a context fusion feature and a final feature vector, and the final feature vector is output through an output layer to output an anomaly detection probability; a secondary inspection module, which collects error-free network traffic data to establish a structure feature vector, calculates a mean vector, establishes a covariance matrix from the two, and performs network traffic secondary inspection according to Mahalanobis distance. 2.The deep learning based network traffic anomaly detection system of claim 1, wherein, The method for adjusting the time window length comprises the following steps: normalizing the frequency of occurrence of the destination port to obtain the occurrence probability of the destination port; calculating the destination port entropy according to the occurrence probability, and calculating the destination port entropy difference between adjacent time points; comparing the entropy difference with a threshold value to output a corresponding time window length. 3.The deep learning based network traffic anomaly detection system of claim 1, wherein, The statistical category features are: average packet byte size, average time between arrivals of adjacent two packets, packet length standard deviation, maximum and minimum packet lengths in the current time window, connection times per second, and packet numbers per second; the protocol category features are: TTL mean value and frequency of each Flag type; the behavior category features are: IP repetition rate, destination port entropy and direction switching rate. 4.The deep learning based network traffic anomaly detection system of claim 1, wherein, The method for suppressing the input feature vector comprises the following steps: the three types of features are established as a feature vector, a plurality of sub-vectors are obtained by grouping, including: statistical category feature sub-vectors, protocol category feature sub-vectors and behavior category feature sub-vectors; a linear transformation is performed on the sub-vectors corresponding to different categories according to a weight matrix and a bias corresponding to the category, and a Sigmoid activation function is inputted to output a gate weight vector; a plurality of sets of gate weight vectors are spliced to obtain a splicing result; a linear transformation is performed on the splicing result according to a weight matrix and a bias item of a fusion layer, a Sigmoid activation function is inputted, and a fusion gate weight vector is outputted; the fusion gate weight vector performs gate suppression on the input feature vector through element-wise multiplication. 5.The deep learning based network traffic anomaly detection system of claim 1, wherein, The method for outputting the final feature vector comprises the following steps: extracting a context behavior pattern related to the feature vector behavior, including: defining a query, a key and a value projection; calculating attention weights; outputting a context fusion feature according to the attention weights and a value matrix; the context fusion feature and the feature vector after gate suppression output a final feature vector according to a residual mechanism and layer normalization.

6. The deep learning based network traffic anomaly detection system of claim 1, wherein, The method for judging whether the network traffic is abnormal according to the anomaly detection probability comprises the following steps: If the anomaly detection probability is greater than the upper threshold, the network traffic is abnormal, and anomaly control needs to be performed; If the anomaly detection probability is less than the lower threshold, the network traffic is normal, and anomaly control does not need to be performed; If the anomaly detection probability is between the upper threshold and the lower threshold, secondary traffic inspection needs to be performed.

7. The deep learning based network traffic anomaly detection system of claim 6, wherein, The specific method of the secondary traffic inspection according to the Mahalanobis distance is: Establish a normal detection template: The normal detection template is constructed by network traffic data that is marked as normal in history, the data is divided according to a preset time window, and statistical, protocol and behavior features are extracted to form a structure feature vector; Calculate the mean vector and covariance matrix as normal distribution parameters; The determination method of the covariance matrix is: The mean vector calculates the difference between all structure feature vectors and the mean vector; The outer product of the difference is constructed, and the outer product term is summed over all samples to obtain the covariance matrix between each feature dimension; According to the new network traffic time window, the feature vector consistent with the normal detection template is extracted, and then compared with the mean vector and the covariance matrix, and the Mahalanobis distance is calculated; According to the comparison of the Mahalanobis distance and the distance threshold, the network traffic detection result is output, and the secondary traffic inspection is completed.

8. The network traffic anomaly detection method applied to the deep learning based network traffic anomaly detection system of any one of claims 1-7, characterized in that, The method comprises the following steps: Sampling the network traffic sliding window to obtain network traffic records, obtaining the probability of the destination port appearing, and calculating the destination port entropy, dynamically adjusting the time window length according to the entropy difference, and outputting the corresponding time window; Extracting category features under the time window, including: Statistical features, protocol features, and behavior features, and outputting corresponding sub-vectors, Outputting the gate weight vector of each sub-vector through linear transformation and activation function, forming an initial fusion vector with multiple groups of gate weight vectors, and calculating a fusion gate weight vector to suppress the input feature vector through the dynamic weighting of the fusion gate weight vector; Taking the suppressed feature vector as the center, establishing a time context sequence, introducing a self-attention mechanism, extracting a context behavior pattern related to the feature vector behavior, calculating the attention weight, and outputting the context fusion feature and the final feature vector, and outputting the anomaly detection probability through the output layer of the final feature vector; Collecting error-free network traffic data to establish a structure feature vector, calculating a mean vector, and establishing a covariance matrix from the two, and performing secondary traffic inspection according to the Mahalanobis distance. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to realize the system of any one of claims 1 to 7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to realize the system of any one of claims 1 to 7.

Images