Deep learning based network traffic anomaly detection system

Abstract

The application relates to the technical field of network flow detection, in particular to a network flow anomaly detection system based on deep learning. A time window adaptive adjustment method based on entropy change dynamically adjusts the window length according to the entropy of the flow characteristics in the window, improves the flexibility of time division and the sensitivity to abnormal flow mutation; meanwhile, the importance of each dimension feature is weighted by combining a multi-class feature gate to realize the original input feature vector, irrelevant dimensions are controlled, key dimensions are strengthened, the model is helped to pay more attention to abnormal related signal features, and a self-attention mechanism is combined to realize deep analysis of the complex time sequence context of network flow; the Mahalanobis distance secondary test of a normal detection template is introduced, the discrimination ability of boundary samples is enhanced based on statistical distribution, the false alarm and missed alarm rates are reduced, and an abnormal detection system with the functions of accurately perceiving complex behavior fluctuation, adaptively adjusting analysis granularity, fusing multi-class features and having robust discrimination ability is constructed.

Description

Technical Field

[0001] This invention relates to the field of network traffic detection technology, and more specifically to a network traffic anomaly detection system based on deep learning. Background Technology

[0002] Existing network traffic anomaly detection methods generally suffer from problems such as rigid fixed-time-window design, coarse-grained feature processing, lack of model context awareness, and insufficient ability to identify boundary samples. In most traditional methods, a fixed-length time window is used to divide network traffic data. This approach is difficult to adapt to drastic fluctuations in network conditions. Sudden anomalies are easily averaged out, while stable traffic can lead to computational redundancy. In addition, network traffic contains a variety of heterogeneous information, such as statistical features (e.g., packet length, arrival interval), protocol features (e.g., TTL, Flags), and behavioral features (e.g., IP repetition rate, direction switching rate). Most existing methods mix these features into the model, ignoring the essential differences in semantics and distribution patterns of different categories of features, which can easily lead to interference between features and affect the model's discrimination performance. Meanwhile, cyberattacks often exhibit a continuous characteristic across time periods. Traditional models make independent judgments in each time slice, making it difficult to capture the attack evolution process in context, leading to missed detections and false positives. When the output probability is on the boundary between abnormal and normal, deep learning models are easily affected by training fluctuations and become unstable in their judgments. Existing solutions usually lack redundant detection designs to address this problem, thus limiting the accuracy, robustness, and industrial adaptability of detection systems in complex network environments. Summary of the Invention

[0003] To address the aforementioned shortcomings of existing technologies, this invention provides a deep learning-based network traffic anomaly detection system, which can effectively solve the problem of low accuracy in network traffic anomaly detection caused by the inability to adapt to complex and ever-changing network traffic characteristics in existing technologies.

[0004] To achieve the above objectives, the present invention provides the following technical solution: This invention provides a deep learning-based network traffic anomaly detection system, comprising at least: The traffic acquisition and control module samples network traffic through a sliding window to obtain network traffic records, obtains the probability of the destination port appearing, calculates the destination port entropy, dynamically adjusts the time window length based on the entropy difference, and outputs the corresponding time window. The categorical feature extraction module extracts categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. The traffic detection module establishes a temporal context sequence centered on the suppressed feature vector, introduces a self-attention mechanism, extracts contextual behavior patterns related to the behavior of the feature vector, calculates attention weights, and outputs contextual fusion features and the final feature vector. The final feature vector outputs the anomaly detection probability through the output layer. The secondary verification module collects accurate network traffic data to establish a structural feature vector, calculates the mean vector, and establishes a covariance matrix from the two. It then performs a secondary verification of the traffic based on Mahalanobis distance.

[0005] The method for adjusting the time window length is as follows: Normalize the frequency of the destination port to obtain the probability of its occurrence; Calculate the destination port entropy based on the occurrence probability, and calculate the difference in destination port entropy between adjacent time points; Compare the entropy difference with the threshold and output the corresponding time window length.

[0006] Statistical characteristics include: average packet size in bytes, average time between arrival of two adjacent packets, standard deviation of packet length, maximum and minimum packet length within the current time window, number of connections per second, and number of packets per second. Protocol-related characteristics include: average TTL value and frequency of each flag type; Behavioral features include: IP duplication rate, destination port entropy, and direction switching rate.

[0007] The method for suppressing the input feature vector is as follows: The three types of features are established as feature vectors, and multiple sub-vectors are obtained by grouping, including: Statistical feature vectors, protocol feature vectors, and behavioral feature vectors; For multiple sub-vectors corresponding to different categories, a linear transformation is performed on the sub-vector based on the weight matrix and bias peak corresponding to the category, and the Sigmoid activation function is input to output a gated weight vector; Multiple sets of gated weight vectors are concatenated to obtain the concatenated result; Based on the weight matrix and bias term of the fusion layer, a linear transformation is performed on the splicing result, the input is the Sigmoid activation function, and the output is the fusion gate weight vector; The fusion gated weight vector performs gated suppression on the input feature vector through element-wise multiplication.

[0008] The method for outputting the final feature vector is as follows: Extract contextual behavior patterns related to feature vector behavior, including: Define queries, key-value projections; Calculate attention weights; Output context fusion features based on attention weights and value matrices; The context-fused features and the feature vector after gating suppression are used to output the final feature vector based on the residual mechanism and layer normalization.

[0009] Furthermore, the method for determining whether network traffic is abnormal based on the anomaly detection probability is as follows: If the probability of an anomaly detection is greater than the upper limit of the threshold, then the network traffic is abnormal and anomaly control needs to be implemented. If the probability of an anomaly detection is less than the lower threshold, the network traffic is normal and no anomaly control is required. If the anomaly detection probability is between the upper and lower bounds of the threshold, a secondary traffic inspection needs to be performed.

[0010] Furthermore, the specific method for performing secondary flow rate verification based on Mahalanobis distance is as follows: Create a normal detection template: The normal detection template is constructed from historical network traffic data that is marked as having no anomalies. By dividing this type of data according to a preset time window and extracting statistical, protocol, and behavioral features, a structural feature vector is formed. Calculate the mean vector and covariance matrix as parameters of the normal distribution; The method for determining the covariance matrix is ​​as follows: The mean vector is calculated as the difference between all structural feature vectors and the mean vector; Construct the outer product of the differences, sum the outer product terms over all samples and then take the average to obtain the covariance matrix between each feature dimension; Based on the new network traffic time window, feature vectors consistent with the normal detection template are extracted, and then compared with the mean vector and covariance matrix to calculate Mahalanobis distance; Based on the comparison between Mahalanobis distance and distance threshold, the network traffic detection results are output, and the secondary traffic verification is completed.

[0011] A network traffic anomaly detection method, applied to the deep learning-based network traffic anomaly detection system, includes the following steps: Sampling of network traffic through a sliding window yields network traffic records, the probability of destination port occurrence is obtained, and the destination port entropy is calculated. The time window length is dynamically adjusted based on the entropy difference, and the corresponding time window is output. Extracting categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. Centered on the suppressed feature vector, a temporal context sequence is established, a self-attention mechanism is introduced, and context behavior patterns related to the behavior of the feature vector are extracted. By calculating the attention weight, the context fusion feature and the final feature vector are output. The final feature vector outputs the anomaly detection probability through the output layer. The system constructs a structural feature vector from the collected network traffic data, calculates the mean vector, and establishes a covariance matrix from the two. Then, it performs a secondary verification of the traffic based on Mahalanobis distance.

[0012] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the system.

[0013] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system.

[0014] The technical solution provided by this invention has the following advantages compared with the known prior art: An adaptive time window partitioning strategy is constructed by using destination port entropy and entropy difference to quickly respond to sudden network states and optimize computational resources for stable states. At the same time, network features are subdivided into three categories: statistical, protocol, and behavioral. Each category is modeled and a group gating mechanism is introduced. Independent sub-networks learn the weight distribution of each type of feature, and the model is weighted by fusing the gating weight vector to enhance the model's ability to perceive key feature dimensions. During traffic detection, a time context sequence centered on the current window is constructed, and the attention mechanism is used to dynamically focus on relevant windows to improve the model's ability to model the evolution of abnormal behavior contexts and avoid the risk of misjudgment caused by single-window arbitrariness. For samples with anomaly detection probabilities in the critical range, a Mahalanobis distance quadratic test mechanism based on historical normal detection templates is introduced. This enhances the anomaly detection capability of boundary samples based on statistical distribution, reduces false positive and false negative rates, and constructs an anomaly detection system that accurately perceives complex behavioral fluctuations, adaptively adjusts the analysis granularity, integrates multiple features, and has robust discrimination capabilities. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without any creative effort.

[0016] Figure 1 This is an overall module block diagram of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0018] The present invention will be further described below with reference to embodiments.

[0019] Example 1 (see Figure 1 A deep learning-based network traffic anomaly detection system includes at least the following: In network traffic, certain standard service ports appear frequently (such as 80, 443), usually indicating normal browsing behavior. However, a large number of non-standard service ports (such as 4444, 1337, 9000) also appear, typically indicating probing or attacks. Therefore, the entropy used by the destination port (IP) is used to measure changes in network behavior complexity, thereby dynamically adjusting the time window segmentation strategy and improving the sensitivity of the detection system to sudden anomalies. This includes: The traffic acquisition and control module performs sliding window sampling of network traffic within each fixed time period, obtaining multiple network traffic records containing the destination port field, and statistically analyzing the frequency of the destination port to form a frequency table. ; in, Indicates the first One observed destination port, This indicates the number of times the corresponding destination port appears within that time period. Indicates the number of types of destination ports; Normalize the frequency of each destination port to obtain its probability of occurrence. ; in, This indicates the total number of records at the destination port within that time period. This represents the Laplace smoothing factor, preventing certain destination ports from having a frequency of 0 within a certain window. The previous category represents all possible destination port types; Calculate the destination port entropy Entropy measures the degree of uncertainty / chaos in the distribution of the state of the destination port within a fixed time period. Calculate the entropy difference It is used to detect the magnitude of behavioral changes in order to determine whether the time window should be adjusted; Dynamically adjust the time window length: in, This indicates the dynamically adjusted time window length. Indicates the minimum window length. Indicates the maximum window length. Indicates a high volatility threshold. Indicates the low volatility threshold. Represents the exponential smoothing coefficient. This represents the global average window length, specifically the average window length across all historical windows.

[0020] Therefore, the aforementioned adaptive mechanism avoids the existence of a fixed time window: To address situations where excessively coarse segmentation during sudden events leads to the loss of details, or excessively fine segmentation during stable flow results in excessive noise, we can improve detection accuracy by obtaining short time windows in abnormally high fluctuation regions and reduce computational redundancy by using long time windows in stable and normal regions.

[0021] The category feature extraction module, based on the adjusted This will allow you to output the corresponding time window sequence. Specifically: Set flow time series Each It is a network data packet with a total quantity of L and a timestamp; Set an initial time point, based on the current window length. Starting from the initial time point, select the option that satisfies: of , express timestamp, This indicates the start time of the current window, forming the first time window. ; Then slide the initial time point by a fixed step. Obtain a new starting time point Then, according to the corresponding new time window Constructing a time window Furthermore, the time window sequence can be obtained by analogy. .

[0022] Each time window Extract the following category features: Statistical features (numerical): Average packet size in bytes, average time between arrival of two adjacent packets, standard deviation of packet length, maximum and minimum packet length within the current time window; Connections per second, packets per second (the ratio of data packets to time), etc. Protocol-related features (the following features are encoded using one-hot encoding): The average TTL (TTL is a field in the IP packet header that indicates the maximum number of hops a packet can be forwarded in the network; the average is the average of the TTL values ​​of all packets collected within a time window) and the frequency of each Flag type (each packet header has a set of flags that indicate the current connection or communication status; common Flag types include SYN, ACK, FIN, etc., which will not be elaborated further). Behavioral characteristics: IP duplication rate (the proportion of duplicate source IPs within a window; source IP refers to the IP address of the device that initiated the connection or sent data), destination port entropy (destination port entropy within the current window), and direction switching rate (the ratio of the frequency of switching between external IPs and local IPs to the total number of connections; external IPs connecting to local IPs, for example, during an attack; local IPs connecting to external IPs, such as when browsing web pages). Because these three types of features differ significantly in semantics and numerical distribution, directly mixing the inputs would make it difficult for subsequent models to distinguish the roles of different features, and could easily lead to inter-class interference, reducing sensitivity to key features. Therefore, a three-part feature vector is constructed. Specifically: Represents the statistical feature vector. Represents the feature sub-vector of the protocol class. Represents behavioral feature sub-vectors (all processed by normalization or standardization); By dividing the vector into multiple sub-vectors and processing each sub-vector separately, grouped feature vectors are formed.

[0023] Dynamic changes in network traffic cause fluctuations in the importance of different feature groups across different time windows. A uniform gating system may not accurately adapt to changes in various features. Independent sub-network design can specifically capture the dynamics of features within each category, while controlling computational overhead and training stability, maintaining a smooth and trainable model. Therefore, for each sub-vector, the gating weight vector is calculated using linear transformation and the sigmoid activation function, resulting in: Category ( Represents statistical features. Indicates protocol class characteristics, (Representing behavioral features,) establish a gating weight vector : Represents the weight matrix. Indicates the offset top. This represents the Sigmoid activation function, which outputs a gating weight vector. Therefore, the gating weight vector for the corresponding class can be output. ; Group gating improves selection accuracy within categories, but features between categories are correlated, and processing them individually may lead to ignoring cross-category information. Therefore, the three gating weight vectors are combined... Concatenate to form the initial fusion vector ; Based on the initial fusion vector, a fusion-gated weight vector is output. Then, the original input feature vector is multiplied element-wise using the fusion-gated weight vector to weight the importance of features in each dimension. This controls irrelevant dimensions, strengthens key dimensions, and helps the model focus more effectively on anomaly-related signal features. This represents the final fusion gating weight vector. This represents the weight matrix of the fusion layer. Indicates the bias term of the fusion layer; This represents the gated feature vector. This indicates element-wise multiplication.

[0024] The traffic detection module addresses the issue that many anomalous behaviors in network traffic (such as scanning and DDoS attacks) are not isolated events but rather continuous patterns spanning multiple time slices. Traditional methods make independent decisions within each time window, easily overlooking temporal dependencies. Therefore, a temporal attention mechanism is introduced to provide context awareness for each current window, improving the sensitivity and accuracy of anomalous behavior identification. This includes: The feature vector after input gating And taking this as the center, extract the total number of elements before and after it. A sequence of adjacent gated feature vectors forms a temporal context sequence. , This represents the dimension of each gated feature vector.

[0025] Input self-attention mechanism, extraction and The most relevant contextual behavioral patterns are: Define queries, key-value projections: in, Represents the query vector. This represents the query weight matrix. express Dimensions Represents the key matrix. Represents the weights of the key matrix. Represents a value matrix, Represents the weights of the value matrix. express The dimension; Calculate attention weights : in, This represents the transpose, and the dot product of the query vector and the key matrix is ​​calculated by dividing by . Scaling is performed to prevent the inner product result from being too large, which could lead to gradient vanishing or oversaturation. Then, the result is normalized to a weight distribution using the Softmax function, representing the importance of the current feature extraction window to its neighboring windows. Computational context fusion features

[0026] Perform residual connections and layer normalization: Representation layer normalization; Residual connections can preserve the original local information in the current gated feature vector, preventing it from being overly smoothed by the attention mechanism; while layer normalization is used to alleviate the internal covariate shift, improve training stability, and make the feature distributions between different time windows more aligned.

[0027] The final feature vector The input-output layer (fully connected layer) obtains the predicted probabilities: , Indicates the first Time window The probability of anomaly detection. This represents the weight matrix of the output layer. This represents the bias vector of the output layer, which is used to perform detection and judgment based on the anomaly detection probability of the output: If the probability of abnormal detection If it is greater than the upper bound of the threshold, then it means that the first... Time window The network traffic is abnormal and abnormal control measures need to be implemented. If the probability of abnormal detection If it is less than the lower bound of the threshold, then it means that the first... Time window The network traffic is normal and no abnormal control measures are required. If the probability of abnormal detection If the value is between the upper and lower bounds of the threshold, it is impossible to accurately determine the first threshold. Time window The status of network traffic requires secondary traffic verification.

[0028] The secondary verification module is used to perform secondary verification of the flow rate. The specific method is as follows: Establish a normal detection template and set a collection time window, such as 5 seconds or 100 data packets per window; collect multiple categories of features from a database of network traffic data without anomalies, namely the statistical features, protocol features and behavioral features mentioned above, and concatenate them into a structural feature vector (which needs to be z-score standardized or normalized). The structural feature vectors are averaged to obtain the mean vector. Construct the covariance matrix based on the mean vector and structural eigenvectors. : in, Indicates the number of time windows. Represents structural feature vectors. Represents the mean vector. Represents the regularization coefficient. Represents the identity matrix. This is to prevent the covariance matrix from becoming irreversible or numerically unstable.

[0029] Based on the current arrival time window Re-collect the above three types of features (statistical, protocol, and behavioral) and construct new feature vectors. And based on this, a secondary flow test is performed using Mahalanobis distance (the degree of deviation of the new feature vector sample from the center of the normal detection template row in the multidimensional statistical space): in, This represents the Mahalanobis distance. The Mahalanobis distance can be compared with a preset distance threshold to determine if it is greater than the threshold. If it is greater, it indicates that the network traffic is abnormal and abnormal control measures need to be implemented (such as notifying the administrator / system center and suspending the connection, limiting the speed, or placing it in an isolation zone). Otherwise, no control measures are required.

[0030] Therefore, a normal detection template is constructed based on historical normal traffic samples. By calculating its mean vector and covariance matrix, a distribution representation of normal behavior is formed. Mahalanobis distance is then used to measure the deviation of the current new feature vector from the normal distribution, thereby enhancing the anomaly detection of boundary samples. This phased joint detection strategy effectively compensates for the decrease in recognition accuracy of neural networks in the probabilistic critical region, improves the stability and robustness of the model in anomaly detection, and reduces the false positive and false negative rates caused by unstable model output.

[0031] Also includes: A network traffic anomaly detection method, applied to the deep learning-based network traffic anomaly detection system, includes the following steps: Sampling of network traffic through a sliding window yields network traffic records, the probability of destination port occurrence is obtained, and the destination port entropy is calculated. The time window length is dynamically adjusted based on the entropy difference, and the corresponding time window is output. Extracting categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. Centered on the suppressed feature vector, a temporal context sequence is established, a self-attention mechanism is introduced, and context behavior patterns related to the behavior of the feature vector are extracted. By calculating the attention weight, the context fusion feature and the final feature vector are output. The final feature vector outputs the anomaly detection probability through the output layer. The system constructs a structural feature vector from the collected network traffic data, calculates the mean vector, and establishes a covariance matrix from the two. Then, it performs a secondary verification of the traffic based on Mahalanobis distance.

[0032] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the system.

[0033] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the system.

[0034] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network traffic anomaly detection system based on deep learning, characterized in that, include: The traffic acquisition and control module samples network traffic through a sliding window to obtain network traffic records, obtains the probability of the destination port appearing, calculates the destination port entropy, dynamically adjusts the time window length based on the entropy difference, and outputs the corresponding time window. Calculate the entropy difference ; Dynamically adjust the time window length: in, This indicates the dynamically adjusted time window length. Indicates the minimum window length. Indicates the maximum window length. Indicates a high volatility threshold. Indicates the low volatility threshold. Represents the exponential smoothing coefficient. Indicates the global average window length; The categorical feature extraction module extracts categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. The method for suppressing the input feature vector is as follows: The three types of features are established as feature vectors, and multiple sub-vectors are obtained by grouping, including: Statistical feature vectors, protocol feature vectors, and behavioral feature vectors; For multiple sub-vectors corresponding to different categories, a linear transformation is performed on the sub-vector based on the weight matrix and bias term corresponding to the category, and the Sigmoid activation function is input to output a gated weight vector; Multiple sets of gated weight vectors are concatenated to obtain the concatenated result; Based on the weight matrix and bias term of the fusion layer, a linear transformation is performed on the splicing result, the input is the Sigmoid activation function, and the output is the fusion gate weight vector; The fusion gated weight vector performs gated suppression on the input feature vector through element-wise multiplication; The traffic detection module establishes a temporal context sequence centered on the suppressed feature vector, introduces a self-attention mechanism, extracts contextual behavior patterns related to the behavior of the feature vector, calculates attention weights, and outputs contextual fusion features and the final feature vector. The final feature vector outputs the anomaly detection probability through the output layer. Input gated feature vector And taking this as the center, extract the total number of elements before and after it. A sequence of adjacent gated feature vectors forms a temporal context sequence. , This represents the dimension of each gated feature vector; Input self-attention mechanism, extraction and The most relevant contextual behavioral patterns are: Define queries, key-value projections: in, Represents the query vector. This represents the query weight matrix. express Dimensions Represents the key matrix, Represents the weights of the key matrix. Represents a value matrix, Represents the weights of the value matrix. express The dimension; Calculate attention weights : in, This represents the transpose, and the dot product of the query vector and the key matrix is ​​calculated by dividing by . Scaling is performed to prevent the inner product result from being too large, which could lead to gradient vanishing or oversaturation. Then, the result is normalized to a weight distribution using the Softmax function, representing the importance of the current feature extraction window to its neighboring windows. Computational context fusion features ; Perform residual connections and layer normalization: , Representation layer normalization; This is the final feature vector; The secondary verification module collects accurate network traffic data to establish a structural feature vector, calculates the mean vector, and establishes a covariance matrix from the two. It then performs a secondary verification of the traffic based on Mahalanobis distance.

2. The deep learning-based network traffic anomaly detection system according to claim 1, characterized in that, The method for adjusting the time window length is as follows: Normalize the frequency of the destination port to obtain the probability of its occurrence; Calculate the destination port entropy based on the occurrence probability, and calculate the difference in destination port entropy between adjacent time points; Compare the entropy difference with the threshold and output the corresponding time window length.

3. The deep learning-based network traffic anomaly detection system according to claim 1, characterized in that, The statistical features are: average byte size of data packets, average time between the arrival of two adjacent data packets, standard deviation of data packet length, maximum and minimum length of data packets within the current time window, number of connections per second, and number of packets per second. Protocol-related characteristics include: average TTL value and frequency of each flag type; Behavioral features include: IP duplication rate, destination port entropy, and direction switching rate.

4. The deep learning-based network traffic anomaly detection system according to claim 1, characterized in that, The method for determining whether network traffic is abnormal based on the aforementioned anomaly detection probability is as follows: If the probability of an anomaly detection is greater than the upper limit of the threshold, then the network traffic is abnormal and anomaly control needs to be implemented. If the probability of an anomaly detection is less than the lower threshold, the network traffic is normal and no anomaly control is required. If the anomaly detection probability is between the upper and lower bounds of the threshold, a secondary traffic inspection needs to be performed.

5. The deep learning-based network traffic anomaly detection system according to claim 4, characterized in that, The specific method for secondary flow rate verification based on Mahalanobis distance is as follows: Create a normal detection template: The normal detection template is constructed from historical network traffic data that is marked as having no anomalies. By dividing this type of data according to a preset time window and extracting statistical, protocol, and behavioral features, a structural feature vector is formed. Calculate the mean vector and covariance matrix as parameters of the normal distribution; The method for determining the covariance matrix is ​​as follows: The mean vector is calculated as the difference between all structural feature vectors and the mean vector; Construct the outer product of the differences, sum the outer product terms over all samples and then take the average to obtain the covariance matrix between each feature dimension; Based on the new network traffic time window, feature vectors consistent with the normal detection template are extracted, and then compared with the mean vector and covariance matrix to calculate Mahalanobis distance; Based on the comparison between Mahalanobis distance and distance threshold, the network traffic detection results are output, and the secondary traffic verification is completed.

6. A network traffic anomaly detection method, applied to the deep learning-based network traffic anomaly detection system according to any one of claims 1-5, characterized in that, Includes the following steps: Sampling of network traffic through a sliding window yields network traffic records, the probability of destination port occurrence is obtained, and the destination port entropy is calculated. The time window length is dynamically adjusted based on the entropy difference, and the corresponding time window is output. Extracting categorical features within a time window, including: Statistical features, protocol features, and behavioral features are identified, and corresponding sub-vectors are output. The gating weight vector of each sub-vector is output through linear transformation and activation function. Multiple sets of gating weight vectors form an initial fusion vector, and the fusion gating weight vector is calculated. The fusion gating weight vector is used to suppress the input feature vector through dynamic weighting. Centered on the suppressed feature vector, a temporal context sequence is established, a self-attention mechanism is introduced, and context behavior patterns related to the behavior of the feature vector are extracted. By calculating the attention weight, the context fusion feature and the final feature vector are output. The final feature vector outputs the anomaly detection probability through the output layer. The system constructs a structural feature vector from the collected network traffic data, calculates the mean vector, and establishes a covariance matrix from the two. Then, it performs a secondary verification of the traffic based on Mahalanobis distance.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of claim 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of claim 6.

Images