Network security protection system and method based on deep analysis and abnormal behavior recognition

Abstract

The invention provides a network security protection system and method based on deep analysis and abnormal behavior recognition, and relates to the technical field of data processing. The system comprises a data processing module, a multi-dimensional feature extraction module, a dynamic weighted fusion analysis module, an anomaly comparison and judgment module and an anomaly decision generation module. Performing standardization processing on the network flow data to obtain a standardized data flow of the network flow data; performing feature extraction on the standardized data flow to obtain a spatial feature vector and a time sequence feature vector of the network flow data; performing dynamic weighted fusion on the spatial feature vector and the time sequence feature vector to obtain an abnormal score of the network flow data; performing anomaly comparison on the anomaly score and a preset anomaly judgment threshold to obtain an anomaly condition of the network flow data; and when the abnormal condition is that the network traffic data is abnormal, generating an abnormal decision of the network traffic data. According to the invention, security protection requirements in a complex network environment can be met, and the protection rate of network security is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a network security protection system and method based on deep analysis and abnormal behavior recognition. Background Technology

[0002] Current network security protection systems generally suffer from incomplete data standardization when processing network traffic data. They fail to fully optimize the entire process of protocol parsing, invalid data cleaning, and normalization, resulting in noise interference or inconsistent formats in the underlying data upon which subsequent feature extraction relies. Furthermore, most systems extract features only from a single dimension of network traffic, either emphasizing spatial features while ignoring temporal series features, or vice versa. This fails to comprehensively capture the security-related information contained within network traffic, leading to insufficient representativeness of the extracted feature vectors. This directly limits the basic accuracy of abnormal behavior identification and makes it difficult to accurately detect potential network security risks.

[0003] In the feature fusion, anomaly detection, and decision-making stages, the shortcomings of existing technologies become increasingly apparent. On the one hand, existing systems often employ fixed-weight feature fusion methods, failing to dynamically adjust the weight ratio of spatial and temporal features based on the real-time feature distribution of network traffic data. This results in a significant discrepancy between the generated anomaly score and the actual degree of anomaly, easily leading to misjudgments or missed detections. On the other hand, some systems, after determining the presence of anomalies, fail to accurately match the specific characteristics of the anomaly with a predefined response strategy library, generating only generalized protection decisions. This makes it difficult to implement targeted protection for different types and levels of network anomalies, ultimately resulting in insufficient response efficiency and protection accuracy for network security, failing to meet the security protection needs in complex network environments. Therefore, improving the protection rate of network security has become an urgent problem to be solved. Summary of the Invention

[0004] The purpose of this invention is to provide a network security protection system and method based on deep analysis and abnormal behavior recognition, which can implement targeted protection against different types and levels of network anomalies, meet the security protection needs in complex network environments, and improve the network security protection rate.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a network security protection system based on deep analysis and abnormal behavior recognition, including a data processing module, a multi-dimensional feature extraction module, a dynamic weighted fusion analysis module, an anomaly comparison and judgment module, and an anomaly decision generation module; The data processing module is used to standardize network traffic data to obtain a standardized data stream of network traffic data; The multi-dimensional feature extraction module is used to extract spatial features from the standardized data stream to obtain the spatial feature vector of the network traffic data, and to extract time series features from the standardized data stream to obtain the time series feature vector of the network traffic data. The dynamic weighted fusion analysis module is used to dynamically weight and fuse spatial feature vectors and time series feature vectors to obtain anomaly scores for network traffic data. The anomaly comparison and judgment module is used to compare the anomaly score with the preset anomaly judgment threshold to obtain the anomaly status of the network traffic data. The anomaly decision generation module is used to generate anomaly decisions for network traffic data when an anomaly is detected.

[0006] According to the present invention, a network security protection system based on deep analysis and abnormal behavior identification is provided, wherein the data processing module is specifically used for: Protocol parsing is performed on network traffic data to obtain network traffic data packets; The invalid data in the data packets is cleaned to obtain denoised data packets; The denoised data packets are normalized to obtain a standardized data stream of network traffic data.

[0007] According to the present invention, a network security protection system based on deep analysis and abnormal behavior recognition extracts spatial features from standardized data streams to obtain spatial feature vectors of network traffic data, including: The standardized data stream is truncated according to a preset window size and step size to obtain a subsequence of the standardized data stream; Convolutional feature extraction is performed on the subsequences to obtain their local spatial features; Pooling is performed on local spatial features to obtain pooled features of local spatial features; By mapping the pooled features to a fully connected layer, we obtain the spatial feature vector of the network traffic data.

[0008] According to the network security protection system based on deep analysis and abnormal behavior recognition provided by the present invention, convolutional feature extraction is performed on subsequences to obtain local spatial features of the subsequences, including: Multi-scale convolution is performed on the subsequence to obtain the feature values ​​in the multi-scale feature map of the subsequence. The formula for calculating the feature values ​​in the multi-scale feature map is as follows: ; In the formula, For the first At the first scale, the first Location in each feature map eigenvalues ​​at that location For scale indexing, For feature map indexing, To output the spatial location coordinates in the feature map, To output the height dimension coordinates of the feature map, To output the coordinates of the width dimension of the feature map, For the first The kernel size corresponding to each scale , This refers to the index variable inside the convolution kernel. For the first At each scale, the convolution kernel is located at... The weight value at that location, To round up, This is the offset of the convolution kernel center. For the first The weight matrix of each feature map. The height coordinates of the input data. The width coordinates of the input data; The distribution of eigenvalues ​​in the multi-scale feature map is standardized to obtain the standardized feature representation of the eigenvalues ​​in the multi-scale feature map. By applying nonlinear activation to the standardized feature representation, we obtain the activation feature map of the standardized feature representation; The activation feature map is refined to obtain the local spatial features of the subsequence.

[0009] According to the present invention, a network security protection system based on deep analysis and abnormal behavior recognition extracts time-series features from standardized data streams to obtain time-series feature vectors of network traffic data, including: Divide the standardized data stream into time windows to obtain time series segments of the standardized data stream; Extracting time-dependent features from time series segments; The time-dependent features are compressed using a fully connected layer to obtain the time-series feature vector of network traffic data; The extraction of time-dependent features from time series segments includes: Temporal structure analysis is performed on time series segments to obtain temporal feature representations of the time series segments; A bidirectional state evolution is performed on the temporal feature representation to obtain the forward and backward state variables of the temporal feature representation; The forward and backward state variables are fused to obtain the fused feature representation of the forward and backward state variables; Attention weights are assigned to the fused feature representations to obtain the time-dependent features of time series segments.

[0010] According to the network security protection system based on deep analysis and abnormal behavior recognition provided by the present invention, the dynamic weighted fusion analysis module is specifically used for: Dynamic weights are derived from spatial feature vectors and time series feature vectors to obtain dynamic weight coefficients for spatial feature vectors and time series feature vectors. The dynamic weight coefficients include spatial dimension weight coefficients and time dimension weight coefficients. The spatial feature vectors are weighted and fused based on the spatial dimension weight coefficients to obtain the weighted spatial features of the spatial feature vectors. The time series feature vectors are weighted and fused based on the time dimension weight coefficients to obtain the weighted time features of the time series feature vectors; The weighted spatial features and weighted temporal features are concatenated to obtain the concatenated features; A fully connected transformation is performed on the spliced ​​features to obtain anomaly scores for the network traffic data. The formula for calculating the anomaly score is as follows: ; In the formula, For abnormal scoring, For activation function, This is the weight matrix of the fully connected layer. This is the transpose of the matrix. For feature concatenation function, For spatial feature vectors, For time series feature vectors, The spatial dimension weighting coefficient. The time dimension weighting coefficient, For element-wise multiplication, This is a bias term.

[0011] According to the network security protection system based on deep analysis and abnormal behavior recognition provided by the present invention, the abnormal comparison and determination module is specifically used for: The anomaly score and the preset anomaly judgment threshold are quantitatively compared to obtain the comparison results of the anomaly score and the anomaly judgment threshold. When the comparison result indicates that the anomaly score is greater than the anomaly determination threshold, an anomaly determination signal is generated; The anomaly detection signal is output as an anomaly in the network traffic data. According to the present invention, a network security protection system based on deep analysis and abnormal behavior recognition generates an abnormality determination signal when the comparison result indicates that the abnormality score is greater than the abnormality determination threshold, including: The comparison results are analyzed to obtain the numerical difference information. An anomaly flag signal is generated when the numerical difference is greater than zero. By labeling the anomaly identification signals, anomaly determination signals for network traffic data are obtained.

[0012] According to the network security protection system based on deep analysis and abnormal behavior recognition provided by the present invention, the abnormal decision generation module is specifically used for: The anomaly detection signal is analyzed to obtain the anomaly characteristic information of the anomaly detection signal; The abnormal feature information and the predefined response strategy library are subjected to feature matching processing to obtain the target response strategy corresponding to the abnormal feature information; Anomaly decisions based on target response strategies to generate network traffic data. Secondly, the present invention provides a network security protection method based on deep analysis and abnormal behavior recognition, applied to the network security protection system based on deep analysis and abnormal behavior recognition in the first aspect, the method comprising: Network traffic data is standardized to obtain a standardized data stream of network traffic data; Spatial feature extraction is performed on the standardized data stream to obtain the spatial feature vector of the network traffic data, and time series feature extraction is performed on the standardized data stream to obtain the time series feature vector of the network traffic data. Anomaly scores for network traffic data are obtained by dynamically weighting and fusing spatial feature vectors and time-series feature vectors. Anomaly scores are compared with preset anomaly detection thresholds to identify anomalies in network traffic data. When an anomaly is detected, an anomaly decision is made to generate network traffic data.

[0013] Compared with the prior art, the present invention has at least the following technical effects: This invention provides a network security protection system and method based on deep analysis and abnormal behavior recognition. The data processing module performs protocol parsing, invalid data cleaning, and normalization—a standardized process that eliminates noise interference in network traffic data, unifies data formats, and provides high-quality foundational data for subsequent stages, preventing data quality issues from affecting analysis results. The multi-dimensional feature extraction module simultaneously extracts spatial and temporal features. Spatial feature extraction combines multi-scale convolution, pooling, and fully connected mapping to accurately capture local spatial information. Temporal feature extraction uses bidirectional state evolution and attention weight allocation to uncover temporal dependencies, making feature vectors more comprehensive and improving the basic accuracy of abnormal behavior recognition. The dynamic weighted fusion analysis module adjusts spatial and temporal feature weights through dynamic weight derivation, combined with feature concatenation and fully connected transformation, generating anomaly scores that better reflect the actual degree of anomaly. The anomaly comparison and judgment module uses quantitative comparison and type labeling to accurately identify anomalies. The anomaly decision generation module matches anomaly features to a predefined response strategy library, generating targeted protection decisions that effectively improve protection response efficiency and accuracy, ultimately significantly enhancing the overall network security protection effect. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0015] In the attached diagram: Figure 1 This is an architecture diagram of the network security protection system based on deep analysis and abnormal behavior recognition, as presented in this invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0017] The following detailed description of some embodiments of the present invention will be provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0018] Please see Figure 1This is an architecture diagram of a network security protection system based on deep analysis and abnormal behavior recognition, provided in an embodiment of the present invention. The network security protection system 100 based on deep analysis and abnormal behavior recognition of the present invention can be set up in a cloud server. In terms of implementation, it can be implemented as one or more service devices, or as an application installed in the cloud (e.g., a mobile service operator's server, server cluster, etc.), or it can be developed as a website. Depending on the implemented functions, the network security protection system 100 based on deep analysis and abnormal behavior recognition of the present invention may include a data processing module 101, a multi-dimensional feature extraction module 102, a dynamic weighted fusion analysis module 103, an anomaly comparison and judgment module 104, and an anomaly decision generation module 105. These modules of the present invention can also be referred to as units, which refer to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0019] In this embodiment of the invention, each module of the network security protection system based on deep analysis and abnormal behavior recognition can be implemented independently and can call other modules. This "calling" can be understood as one module connecting to multiple modules of another type and providing corresponding services to those connected modules. In the network security protection system based on deep analysis and abnormal behavior recognition provided by this embodiment of the invention, the applicability of the network security protection system architecture based on deep analysis and abnormal behavior recognition can be adjusted by adding modules and directly calling them without modifying the program code, achieving cluster-based horizontal expansion to quickly and flexibly expand the network security protection system based on deep analysis and abnormal behavior recognition. In practical applications, the above modules can be set in the same device or different devices, or they can be set in virtual devices, such as service instances in a cloud server.

[0020] It should be noted that the server-side device deployed in the network security protection system based on deep analysis and abnormal behavior recognition of this invention may consist of one or more devices. This network security protection system based on deep analysis and abnormal behavior recognition can be implemented as: a business instance, a virtual machine, or a hardware device. For example, this network security protection system based on deep analysis and abnormal behavior recognition can be implemented as a business instance deployed on one or more devices in a cloud node. Simply put, this network security protection system based on deep analysis and abnormal behavior recognition can be understood as software deployed on a cloud node, used to provide network security protection based on deep analysis and abnormal behavior recognition to various user terminals. Alternatively, this network security protection system based on deep analysis and abnormal behavior recognition can also be implemented as a virtual machine deployed on one or more devices in a cloud node. The virtual machine contains application software for managing various user terminals. Alternatively, this network security protection system based on deep analysis and abnormal behavior recognition can also be implemented as a server composed of numerous identical or different types of hardware devices, with one or more hardware devices configured to provide network security protection based on deep analysis and abnormal behavior recognition to various user terminals.

[0021] In terms of implementation, the network security protection system based on deep analysis and abnormal behavior recognition and the user terminal are mutually adaptable. That is, if the network security protection system based on deep analysis and abnormal behavior recognition is implemented as an application installed on a cloud service platform, then the user terminal is implemented as a client that establishes a communication connection with the application; or if the network security protection system based on deep analysis and abnormal behavior recognition is implemented as a website, then the user terminal is implemented as a webpage; or if the network security protection system based on deep analysis and abnormal behavior recognition is implemented as a cloud service platform, then the user terminal is implemented as a mini-program in an instant messaging application.

[0022] The following describes, with reference to specific embodiments, each component and specific workflow of the network security protection system based on deep analysis and abnormal behavior recognition of the present invention: Data processing module 101 is used to standardize network traffic data to obtain a standardized data stream of network traffic data; In this embodiment of the invention, when the data processing module 101 performs standardization processing on network traffic data to obtain a standardized data stream of network traffic data, it is specifically used for: Protocol parsing is performed on network traffic data to obtain network traffic data packets; The invalid data in the data packets is cleaned to obtain denoised data packets; The denoised data packets are normalized to obtain a standardized data stream of network traffic data.

[0023] Specifically, the network traffic data standardization process takes continuous byte streams transmitted by protocols such as TCP, IP, and UDP as its object. Through three interconnected steps—protocol parsing, invalid data cleaning, and normalization processing—it transforms the original unstructured and noisy data into a standardized data stream with a unified format, validity, and regular timing, providing a high-quality data foundation for subsequent network security protection operations.

[0024] Furthermore, during protocol parsing, the raw data byte stream of network traffic data is first obtained, and the data header information is extracted from the beginning of the raw data byte stream. The data header is the start identifier part of each protocol unit.

[0025] Furthermore, locate the protocol identification field in the data header, such as the "protocol number" field in the IP protocol header and the "protocol type" identifier in the TCP protocol header. By reading the specific value of this field, determine the protocol type (such as TCP, UDP, IP, etc.) to which the current data unit belongs.

[0026] Furthermore, based on the determined protocol type, the corresponding protocol's structural specifications are invoked to clarify the location and length of the core fields under that protocol. The core fields include the source port number, destination port number, and sequence number for TCP, and the source IP address, destination IP address, and version number for IP.

[0027] Furthermore, in accordance with the protocol structure specifications, the specific values ​​of each core field are extracted sequentially from the data header to ensure that the extraction position and length of each field are consistent with the specifications, without any misalignment or omission.

[0028] Furthermore, after extracting the core fields, the remaining part after the data header is separated out as the data payload of the protocol unit. The data payload is the actual content part transmitted by the protocol.

[0029] Furthermore, check the integrity of the entire protocol unit, verify whether there are any missing core fields (such as whether the source IP address is missing), whether the field values ​​conform to the protocol's specified range (such as whether the port number is between 0 and 65535), and whether the lengths of the data header and data payload match, to confirm that the unit structure is complete.

[0030] Furthermore, abnormal units discovered during the inspection (such as units with missing fields or out-of-range values) are directly removed from the dataset, retaining only protocol units with complete structure and compliant fields.

[0031] Furthermore, all protocol units that pass the integrity check are collected and arranged in the order of their transmission in the original byte stream. The resulting set is the data packet of network traffic data.

[0032] Furthermore, when cleaning invalid data, the criteria for judging three types of invalid data packets should be clarified first: Format error packets refer to packets with missing core fields, values ​​out of range, or header checksums that do not match the content; Duplicate transmission packets refer to packets with the same source IP, destination IP, source port, destination port, protocol type, and data payload, and a reception time interval of less than 100 milliseconds; Empty packets refer to packets that only contain a header and have a data payload length of 0.

[0033] Furthermore, each protocol unit in the data packet is read one by one. First, it is checked whether it is a packet with an incorrect format. Then, the protocol format verification tool is called to compare the integrity of the core fields of the unit and the compliance of the values. Units that do not conform to the standard are marked.

[0034] Furthermore, for units that pass the format check, an index table containing combined information such as source IP, destination IP, source port, destination port, protocol type, and data payload is established. The combined information of the current unit is compared with the records in the index table. If there are identical records and the time interval is less than 100 milliseconds, it is marked as a duplicate transmission packet.

[0035] Furthermore, the data payload length field of each protocol unit is read; if the length is 0, it is marked as an empty packet.

[0036] Furthermore, all units marked as malformed packets, duplicate transmission packets, or empty packets are completely removed from the data packet set, leaving no invalid units.

[0037] Furthermore, a simple verification is performed on the data packet set after removing invalid units. A portion of the units are randomly selected to check again for the presence of invalid packets. Once it is confirmed that no invalid units remain, the resulting set is the denoised data packet.

[0038] Furthermore, when implementing normalization, the data types of each field in the denoised data packet are first distinguished, and the fields are divided into numeric types (such as port number and data packet length) and character types (such as protocol type name "TCP").

[0039] Furthermore, for numeric fields, if the original value is in hexadecimal (such as the storage format of some protocol headers), it is converted to a decimal integer; if it is in binary, it is converted to a decimal integer, ensuring that all numeric fields are uniformly represented in decimal.

[0040] Furthermore, character fields are processed by converting all character data to UTF-8 encoding format to ensure that character information from different protocol units uses a consistent encoding standard.

[0041] Furthermore, range mapping is performed on the converted numeric fields. The maximum and minimum values ​​of each numeric field in the denoised data packet are counted. The values ​​of each field are mapped to the range of 0-1 through linear transformation, while maintaining the relative size relationship between the values.

[0042] Furthermore, the received timestamp of each denoised data packet unit is read, and all units are rearranged in chronological order of the timestamps to form a continuous sequence.

[0043] Furthermore, check whether the arranged sequence contains all the denoised data packet units and whether the timestamp order is disordered (e.g., the later received unit is not placed before the earlier received unit) to ensure that the sequence is complete and the timing is correct.

[0044] Furthermore, the continuous, regular, and uniformly formatted sequence formed after the above processing is the standardized data stream of network traffic data.

[0045] In summary, this process, through a progressive approach of "deconstructing structured data → eliminating invalid data → unifying data features," effectively eliminates the chaos and discrepancies in the original data. The standardized data stream output provides precise support for subsequent multi-dimensional feature extraction and anomaly identification, thereby improving the accuracy and efficiency of network security protection.

[0046] The multi-dimensional feature extraction module 102 is used to extract spatial features from the standardized data stream to obtain the spatial feature vector of the network traffic data, and to extract time series features from the standardized data stream to obtain the time series feature vector of the network traffic data. In this embodiment of the invention, when the multi-dimensional feature extraction module performs spatial feature extraction on the standardized data stream to obtain the spatial feature vector of the network traffic data, it is specifically used for: The standardized data stream is truncated according to a preset window size and step size to obtain a subsequence of the standardized data stream; Convolutional feature extraction is performed on the subsequences to obtain their local spatial features; Pooling is performed on local spatial features to obtain pooled features of local spatial features; By mapping the pooled features to a fully connected layer, we obtain the spatial feature vector of the network traffic data.

[0047] The multi-dimensional feature extraction module, when performing convolutional feature extraction on sub-sequences to obtain the local spatial features of the sub-sequences, is specifically used for: Multi-scale convolution is performed on the subsequence to obtain the feature values ​​in the multi-scale feature map of the subsequence. The formula for calculating the feature values ​​in the multi-scale feature map is as follows: ; In the formula, For the first At the first scale, the first Location in each feature map eigenvalues ​​at that location For scale indexing, For feature map indexing, To output the spatial location coordinates in the feature map, To output the height dimension coordinates of the feature map, To output the coordinates of the width dimension of the feature map, For the first The kernel size corresponding to each scale , This refers to the index variable inside the convolution kernel. For the first At each scale, the convolution kernel is located at... The weight value at that location, To round up, This is the offset of the convolution kernel center. For the first The weight matrix of each feature map. The height coordinates of the input data. The width coordinates of the input data; The distribution of eigenvalues ​​in the multi-scale feature map is standardized to obtain the standardized feature representation of the eigenvalues ​​in the multi-scale feature map. By applying nonlinear activation to the standardized feature representation, we obtain the activation feature map of the standardized feature representation; The activation feature map is refined to obtain the local spatial features of the subsequence.

[0048] The multi-dimensional feature extraction module, when performing time-series feature extraction on standardized data streams to obtain time-series feature vectors of network traffic data, is specifically used for: Divide the standardized data stream into time windows to obtain time series segments of the standardized data stream; Extracting time-dependent features from time series segments; The time-dependent features are compressed using a fully connected layer to obtain the time-series feature vector of network traffic data.

[0049] Specifically, the multi-dimensional feature extraction module is used to extract time-dependent features from time series segments: Temporal structure analysis is performed on time series segments to obtain temporal feature representations of the time series segments; A bidirectional state evolution is performed on the temporal feature representation to obtain the forward and backward state variables of the temporal feature representation; The forward and backward state variables are fused to obtain the fused feature representation of the forward and backward state variables; Attention weights are assigned to the fused feature representations to obtain the time-dependent features of time series segments.

[0050] Specifically, the process uses standardized data streams as the core for feature extraction, and includes two parallel branches: spatial feature extraction and time series feature extraction. The final outputs are spatial feature vectors and time series feature vectors of network traffic data, respectively. Both branches take standardized data streams as input and process them step by step according to preset steps. The outputs strictly correspond to the output requirements of each stage.

[0051] Specifically, spatial feature extraction begins with subsequence processing: first, the standardized data stream is truncated to obtain subsequences; then, feature values ​​in the multi-scale feature maps of the subsequences are obtained through multi-scale convolution operations; standardized feature representations are obtained through distribution standardization; activated feature maps are obtained through nonlinear activation; local spatial features are obtained through feature refinement; pooled features are obtained through pooling operations; and finally, spatial feature vectors are obtained through fully connected layer mapping. Each step is sequentially connected and the product is clearly defined.

[0052] Specifically, time series feature extraction starts with time window division: first, the standardized data stream is cut to obtain time series segments, then time series feature representation is obtained through time series structure parsing, forward and backward state variables are obtained through bidirectional state evolution, fused feature representation is obtained through state fusion, time-dependent features are obtained through attention weight allocation, and finally time series feature vector is obtained through fully connected layer compression. Each step proceeds in an orderly manner and the output strictly matches the set product.

[0053] Furthermore, when performing spatial feature extraction, the window size and step size for extracting subsequences are first determined. The window size is a pre-set fixed data length, and the step size is the distance the window moves after each extraction. Both are pre-configured based on the length and feature distribution of the standardized data stream.

[0054] Furthermore, the first capture window is set starting from the beginning of the standardized data stream, with the starting point of the window aligned with the starting point of the data stream, and the ending point of the window being the starting point plus the position corresponding to the window size.

[0055] Furthermore, a segment of the standardized data stream covered by the current window, which contains all the data from the start point to the end point, is extracted and stored as the first subsequence.

[0056] Furthermore, the window is moved according to a preset step size, so that the starting point of the new window is the starting point of the previous window plus the step size, and the ending point of the new window is moved back accordingly, ensuring that the window movement is regular and continuous. During the movement, an overlapping processing method can be used to retain the correlation between adjacent subsequences by partially overlapping data, thus avoiding the loss of boundary information.

[0057] Furthermore, the truncation operation is repeated, and each time the window is moved, the corresponding data segment is truncated as a new subsequence until the window moves to the end of the standardized data stream, ensuring that all subsequences can cover different local areas of the data stream without any data omissions.

[0058] Furthermore, after the subsequence is truncated, multi-scale convolution operations are prepared. Various convolution kernels of different sizes are selected to adjust the number of feature channels to reduce computational parameters and to capture local feature associations at different distances in the subsequence. The size differences of these convolution kernels are determined according to the length of the subsequence and the feature detail requirements to ensure that local features of different ranges can be captured.

[0059] Furthermore, for each size of convolutional kernel, it is initialized as a matrix with fixed values. The number of rows and columns of the matrix are consistent with the size of the convolutional kernel, and the values ​​are preset according to the feature extraction requirements. At the same time, a corresponding bias term is configured for each convolutional kernel, and the value of the bias term is pre-calibrated according to the feature distribution range of the network traffic data.

[0060] Furthermore, for each subsequence, a sliding scan is performed using a convolution kernel of the first size. Starting from the beginning of the subsequence, the convolution kernel is aligned with the local region at the corresponding position in the subsequence. During alignment, it is ensured that the center of the convolution kernel coincides with the center of the local region. If the edge region of the subsequence cannot completely match the size of the convolution kernel, zero padding can be used to supplement the edge data so that the convolution operation covers the entire subsequence.

[0061] Furthermore, the product of the subsequence elements within the aligned region and the convolution kernel elements is calculated. After summing all the product results, the bias term corresponding to the convolution kernel is added. The final value obtained is the feature value at the current position. The addition of the bias term is used to adjust the overall distribution range of the feature values ​​and avoid feature value shift due to convolution operations.

[0062] Furthermore, the convolution kernel is moved with a fixed stride, the stride size of which is set according to the subsequence length and feature density requirements. The operations of alignment, multiplication and summation and the addition of bias terms are repeated on the subsequence until the convolution kernel has scanned the entire subsequence, thus obtaining all feature values ​​corresponding to the convolution kernel of this size. This ensures that the number of output feature values ​​is known in advance to match the input requirements of subsequent processing steps.

[0063] Furthermore, by using convolution kernels of different sizes, the same sliding scan, multiplication and summation, and bias term operations are performed on the same subsequence to obtain the feature values ​​corresponding to each size of convolution kernel. The number of feature values ​​obtained by different sizes of convolution kernels may be different, and the feature value sequence corresponding to each size needs to be recorded separately.

[0064] Furthermore, the feature values ​​obtained from all convolution kernels of different sizes are classified and organized according to the kernel size. For the differences in the number of feature values ​​caused by different sizes, an appropriate method is used to adjust them to a uniform length. All feature values ​​together form the feature values ​​in the multi-scale feature map of the subsequence.

[0065] Furthermore, when standardizing the distribution of feature values ​​in a multi-scale feature map, all feature values ​​in the multi-scale feature map are first extracted and summarized into a set containing all feature values ​​to ensure that no feature value is missed. At the same time, outliers in the set can be preprocessed, and extreme values ​​can be removed using appropriate criteria to avoid outliers affecting the standardization results.

[0066] Furthermore, the total number of feature values ​​in the set is counted to determine the number of feature values ​​contained in the set. This serves as the basis for subsequent calculations. During the count, it is necessary to distinguish the number of feature values ​​corresponding to different convolution kernel sizes in order to verify the accuracy of subsequent calculations.

[0067] Furthermore, the sum of all eigenvalues ​​is calculated by adding each eigenvalue in the set sequentially to obtain the cumulative result of all eigenvalues. High-precision calculation is used in the accumulation process to avoid deviation in the sum due to loss of numerical precision.

[0068] Furthermore, the sum of the eigenvalues ​​is divided by the total number of eigenvalues ​​to obtain the mean of all eigenvalues. This mean reflects the overall average level of the eigenvalues. After calculation, the specific value of the mean needs to be recorded for subsequent deviation calculation.

[0069] Furthermore, the difference between each eigenvalue and the mean is calculated, and the mean obtained earlier is subtracted from each eigenvalue in the set to obtain a series of deviation values. The sign of the deviation value reflects the direction of the eigenvalue's offset from the mean.

[0070] Furthermore, each deviation value is squared. The difference between each characteristic value and the mean is multiplied by itself to obtain the squared result of each deviation value. The squaring operation is used to eliminate the positive and negative effects of the deviation value and highlight the degree of deviation.

[0071] Furthermore, the sum of these squared results is calculated by summing the squares of all deviation values ​​in turn, resulting in a sum of squares. The magnitude of the sum of squares reflects the overall degree to which all characteristic values ​​deviate from the mean.

[0072] Furthermore, dividing the sum of squares by the total number of eigenvalues ​​yields the variance of all eigenvalues. This variance reflects the dispersion of the eigenvalues. After calculating the variance, the standard deviation can be calculated to verify the degree of centrality of the eigenvalue distribution.

[0073] Furthermore, each original feature value is standardized by subtracting the mean from each feature value and then dividing the result by the variance to obtain the standardized result of each feature value. The standardization process ensures that the overall distribution of the feature values ​​satisfies a standard normal distribution with a mean of 0 and a variance of 1.

[0074] Furthermore, all standardized results are arranged in order of their original positions in the multi-scale feature map to form a new feature set, which is the standardized feature representation of the feature values ​​in the multi-scale feature map.

[0075] Furthermore, the standardized feature set is examined to confirm that it exhibits a distribution with a mean of 0 and a variance of 1. This can be verified by calculating the sample mean and sample variance through random sampling to ensure that the magnitude differences of the feature values ​​are eliminated and to avoid affecting subsequent processing.

[0076] Furthermore, when performing nonlinear activation on the standardized feature representation, the activation function used is explicitly the ReLU function. The processing rule of this function is to retain non-negative feature values ​​and convert negative feature values ​​to 0. The ReLU function can effectively suppress redundant features in one-dimensional feature processing, highlight the expressive power of effective features, and avoid the gradient vanishing problem.

[0077] Furthermore, all feature values ​​contained in the standardized feature representation are extracted and listed in order of their arrangement in the original feature representation to form an ordered sequence of feature values. The order of the sequence must strictly correspond to the spatial location of the multi-scale feature map to ensure that the spatial correlation of the features is not destroyed.

[0078] Furthermore, starting from the first element of the feature value sequence, feature values ​​are selected one by one for processing to ensure that each feature value is checked and transformed individually. During the processing, the original value and transformation result of each feature value need to be recorded to facilitate subsequent backtracking verification.

[0079] Furthermore, for the currently selected feature value, it is compared with 0 to determine whether the feature value is less than 0. When comparing, attention should be paid to the numerical precision. For tiny values ​​close to 0, they should be uniformly treated as 0.

[0080] Furthermore, if the comparison result shows that the feature value is less than 0, then the value of the feature value is modified to 0 to replace the original value. After modification, it is necessary to confirm whether the value update is correct in order to avoid loss of feature value due to operational errors.

[0081] Furthermore, if the comparison result shows that the feature value is greater than or equal to 0, then the original value of the feature value is kept unchanged without any modification, ensuring that the original information of the effective feature is not altered.

[0082] Furthermore, following the same method, each feature value in the feature value sequence is processed sequentially until all feature values ​​have been checked and transformed. After processing, the number of feature values ​​set to 0 needs to be counted, and the proportion of redundant features needs to be evaluated.

[0083] Furthermore, all the processed feature values ​​are recombined according to their position order in the original standardized feature representation to form a new feature set.

[0084] Furthermore, this new set of features is the activation feature map of the standardized feature representation. Through this non-linear transformation, valuable feature information is highlighted, the expressive power of the features is enhanced, and the computational complexity of subsequent processing is reduced.

[0085] Furthermore, the activation feature map is refined by setting a feature importance threshold, the threshold value of which is predetermined based on the feature importance distribution of network traffic data. Feature elements with values ​​greater than the threshold in the activation feature map are selected, and redundant feature elements with values ​​less than the threshold are removed. Only key features that are valuable in reflecting local spatial information are retained, thus obtaining the local spatial features of the subsequence.

[0086] Furthermore, pooling operations are performed on the local spatial features using the max pooling method. The local spatial features are divided into multiple non-overlapping local regions, and the region size is set according to the feature dimension and subsequent processing requirements. The feature value with the largest value in each local region is selected as the representative value of that region. The selection of the representative value must ensure that it can reflect the core features of the region. This downsampling method reduces the feature dimension while retaining local key information, resulting in pooled features of the local spatial features, ensuring that the output dimension of the pooling operation meets expectations.

[0087] Furthermore, the pooling features are mapped to a fully connected layer. The pooling features are input into the fully connected layer, and each neuron in the fully connected layer establishes a connection with all elements of the pooling features. The connection weights are preset according to the network training results and adjusted by weighted summation and bias. When performing weighted summation, it is necessary to traverse the connection weights between each neuron and all pooling feature elements, calculate the sum of the products, and then add the bias term of the neuron to convert the pooling features into a fixed-length one-dimensional vector. This vector is the spatial feature vector of the network traffic data.

[0088] Furthermore, time series feature extraction is carried out: First, the standardized data stream is divided into time windows, and a fixed time interval is set as the window length. The time interval is preset according to the time resolution and time series feature period of the network traffic data. The standardized data stream is cut into multiple continuous and non-overlapping segments in chronological order. Each segment contains all the data in the corresponding time window, thus obtaining the time series segments of the standardized data stream. During the cutting process, the continuity of timestamps must be ensured to avoid the loss of time information due to window division.

[0089] Furthermore, the time series segments are analyzed to extract the order of occurrence of data points, the time interval between adjacent data points, and the trend of data value changes within each time series segment. The extraction of time intervals requires calculating the difference between the timestamps of adjacent data points, and the trend of changes is obtained by calculating the difference between data values. These time series-related information are transformed into a structured feature form to obtain the time series feature representation of the time series segment.

[0090] Furthermore, bidirectional state evolution is performed on the temporal feature representation. The state quantity is calculated point by point from the start position to the end position of the time series segment. During the calculation, the state quantity of the previous moment and the feature value of the current moment need to be combined, and the state quantity is updated using a recursive formula to obtain the forward state quantity that reflects the positive temporal sequence pattern. At the same time, the state quantity is calculated point by point from the end position to the start position of the time series segment. The calculation method is the same as the forward but in the opposite direction to obtain the backward state quantity that reflects the reverse temporal sequence pattern. Through bidirectional calculation, the temporal information is fully captured, avoiding the omission of temporal information caused by unidirectional calculation.

[0091] Furthermore, state fusion is performed on the forward and backward state variables. The forward and backward state variables are concatenated element by element at corresponding positions. During concatenation, each element of the forward state variable is combined with the corresponding element of the backward state variable to form a new feature pair. This allows the fused feature to contain both forward and backward temporal information, resulting in a fused feature representation of the forward and backward state variables, ensuring that the bidirectional temporal information is completely preserved.

[0092] Furthermore, attention weights are assigned to the fused feature representation, and the contribution of each feature element in the fused feature representation to reflecting the time dependency is calculated. The contribution is obtained by calculating the similarity between the feature element and the overall feature mean. The higher the similarity, the greater the contribution. Feature elements with high contribution are assigned larger weight values, and feature elements with low contribution are assigned smaller weight values. Key time series information is highlighted through weighted processing. During weighting, each feature element is multiplied by its corresponding weight value to obtain the time dependency features of the time series segment.

[0093] Furthermore, the time-dependent features are compressed using a fully connected layer. The time-dependent features are input into the fully connected layer, and the number of neurons in the fully connected layer is set according to the length of the target feature vector. The neurons in the fully connected layer compress the dimensionality of the time-dependent features and integrate the information. During the compression process, the high-dimensional time-dependent features are mapped to the low-dimensional space through the weight matrix, and the feature distribution is adjusted by superimposing a bias term, which is converted into a fixed-length one-dimensional vector. This vector is the time series feature vector of the network traffic data.

[0094] In summary, spatial feature extraction involves a series of operations such as multi-scale convolution, standardization, activation, and refinement. The multi-scale convolution step combines the advantages of convolution kernels of different sizes and adjusts the bias term. The pooling operation uses max pooling and precisely controls the output dimension, transforming the subsequence into a spatial feature vector that reflects the local spatial distribution pattern, thus comprehensively capturing the spatial dimensional information of the data.

[0095] In summary, time series feature extraction involves processing through time series analysis, bidirectional evolution, fusion, and attention allocation. The time series analysis stage extracts time intervals and trends as sub-features, while the bidirectional evolution stage uses recursive calculations to cover both positive and negative time series information, transforming time series fragments into time series feature vectors that reflect the patterns of time change, thus fully preserving the time dimension information of the data.

[0096] In summary, the entire process involves the collaborative processing of two major branches: spatial and temporal. The spatial branch incorporates multi-scale convolutional channel adjustment and edge detection capabilities, while the temporal branch combines the temporal partitioning specification of sliding windows and the key information highlighting mechanism of attention. This extracts key features of network traffic data from both spatial distribution and temporal evolution dimensions, providing a comprehensive and accurate feature foundation for subsequent dynamic fusion analysis and abnormal behavior identification, ensuring that the features can fully reflect the multidimensional attributes of the data.

[0097] The dynamic weighted fusion analysis module 103 is used to dynamically weight and fuse spatial feature vectors and time series feature vectors to obtain anomaly scores for network traffic data. In this embodiment of the invention, when the dynamic weighted fusion analysis module performs dynamic weighted fusion of spatial feature vectors and time series feature vectors to obtain anomaly scores for network traffic data, it is specifically used for: Dynamic weights are derived from spatial feature vectors and time series feature vectors to obtain dynamic weight coefficients for spatial feature vectors and time series feature vectors. The dynamic weight coefficients include spatial dimension weight coefficients and time dimension weight coefficients. The spatial feature vectors are weighted and fused based on the spatial dimension weight coefficients to obtain the weighted spatial features of the spatial feature vectors. The time series feature vectors are weighted and fused based on the time dimension weight coefficients to obtain the weighted time features of the time series feature vectors; The weighted spatial features and weighted temporal features are concatenated to obtain the concatenated features of the weighted spatial features and weighted temporal features; A fully connected transformation is performed on the spliced ​​features to obtain anomaly scores for the network traffic data. The formula for calculating the anomaly score is as follows: ; In the formula, For abnormal scoring, For activation function, This is the weight matrix of the fully connected layer. This is the transpose of the matrix. For feature concatenation function, For spatial feature vectors, For time series feature vectors, The spatial dimension weighting coefficient. The time dimension weighting coefficient, For element-wise multiplication, This is a bias term.

[0098] Specifically, the inputs to this process are spatial feature vectors and time-series feature vectors of network traffic data. The spatial feature vectors are obtained from the spatial feature extraction branch, which is processed through steps such as subsequence truncation, multi-scale convolution, distribution normalization, nonlinear activation, feature refinement, pooling operation, and fully connected layer mapping. The time-series feature vectors are obtained from the time-series feature extraction branch, which is processed through steps such as time window division, temporal structure analysis, bidirectional state evolution, state fusion, attention weight allocation, and fully connected layer compression. The core of the process is to fuse the two features through multiple steps and quantify them into anomaly scores.

[0099] Specifically, the process includes four key steps: dynamic weight derivation, weighted fusion, feature splicing, and fully connected transformation. Each step has a clear output, gradually advancing the transformation from features to quantitative results.

[0100] Specifically, dynamic weight derivation is responsible for outputting spatial dimension weight coefficients and temporal dimension weight coefficients, weighted fusion generates weighted spatial features and weighted temporal features, feature splicing produces spliced ​​features, and fully connected transformation finally yields the anomaly score.

[0101] Furthermore, when performing dynamic weight derivation on spatial feature vectors and time series feature vectors, the information entropy of both is first calculated. To calculate the information entropy, the frequency of occurrence of each element in the spatial feature vector is counted, and the frequency of occurrence of each element is divided by the total number of elements in the vector to obtain the probability of occurrence of each element. Similarly, the frequency of occurrence of each element in the time series feature vector is counted, and the probability of occurrence of each element is calculated. Then, for each feature vector, the probability of occurrence of each element is multiplied by the logarithm of that probability, and the negative values ​​of all multiplication results are summed. The result is the information entropy of that feature vector. Feature vectors with lower information entropy have higher discriminative power and are initially assigned higher weights.

[0102] Furthermore, the historical anomaly identification database is retrieved. This database stores anomaly identification cases corresponding to different network traffic types (such as HTTP and TCP) and the contribution ratio of spatial features and time series features in each case. Based on the current network traffic type, similar cases of the same type in the database are matched. The initial weights are adjusted by referring to the contribution ratio of spatial features and time series features in similar cases. If the current spatial feature has a high similarity with the high-contribution spatial features in similar cases, the initial weight of the spatial feature vector is increased. If the current time series feature has a high similarity with the high-contribution time series features in similar cases, the initial weight of the time series feature vector is increased.

[0103] Furthermore, the adjusted weights are normalized by first adding the adjusted spatial feature vector weights and time series feature vector weights to obtain the total weights; then dividing the adjusted spatial feature vector weights by the total weights to obtain the spatial dimension weight coefficients; and finally dividing the adjusted time series feature vector weights by the total weights to obtain the time dimension weight coefficients, ensuring that the sum of the spatial dimension weight coefficients and the time dimension weight coefficients is 1, thus obtaining the dynamic weight coefficients.

[0104] Furthermore, when weighting and fusing spatial feature vectors based on spatial dimension weight coefficients, each element of the spatial feature vector is multiplied by the weight coefficient. That is, starting from the first element of the spatial feature vector, each element is multiplied by the spatial dimension weight coefficient until all elements have been multiplied.

[0105] Furthermore, following the original element order of the spatial feature vector, all the multiplied values ​​are combined, that is, according to the original arrangement order of the elements in the spatial feature vector, the result of multiplying each element with the spatial dimension weight coefficient is arranged in turn to form a new vector, which is the weighted spatial feature.

[0106] Furthermore, when weighting and fusing time series feature vectors based on time dimension weight coefficients, each element is also multiplied by the weight coefficient. Starting from the first element of the time series feature vector, each element is multiplied by the time dimension weight coefficient until all elements have been multiplied.

[0107] Furthermore, the weighted time features are obtained by multiplying the values ​​of the time series feature vectors in their original order, that is, by arranging each element in the original order of the elements in the time series feature vectors and multiplying it with the time dimension weight coefficient.

[0108] Furthermore, when performing feature concatenation on weighted spatial features and weighted temporal features, the elements of the weighted spatial features are first arranged in their original order, that is, the original arrangement order of the elements in the weighted spatial features is kept unchanged, and all elements are listed in sequence.

[0109] Furthermore, the elements of the weighted temporal features are appended to them in their original order. That is, according to the original arrangement order of the elements in the weighted temporal features, all the elements are arranged sequentially after the elements of the weighted spatial features, forming a new vector with a length equal to the sum of the number of elements in the weighted spatial features and the number of elements in the weighted temporal features. This is called the spliced ​​feature.

[0110] Furthermore, when performing a fully connected transformation on the spliced ​​features, a single-output fully connected network is first constructed. The number of input nodes of this network is the same as the number of elements in the spliced ​​features. Each input node corresponds to one element of the spliced ​​features, and the number of output nodes is 1, which is used to output a single numerical result.

[0111] Furthermore, each element of the spliced ​​feature is multiplied by its corresponding preset weight. The preset weight is learned in advance through the training data. There is a preset weight between each input node and the output node. Each element of the spliced ​​feature is multiplied by its corresponding preset weight. Then, all the products are summed. The sum of the results of multiplying each element by its corresponding preset weight is obtained. Finally, a preset bias value is added. The preset bias value is also learned in advance through the training data. The sum is added to the preset bias value to obtain the final linear calculation result.

[0112] Furthermore, the summation result is mapped to the 0-1 interval by using the Sigmoid activation function. First, the negative exponent of the linear calculation result is calculated, that is, the value of the negative value of the linear calculation result with the natural constant as the base is calculated. Then, 1 is added to the negative exponent value to obtain the denominator. Finally, 1 is divided by the denominator to obtain the value, which is the anomaly score of the network traffic data.

[0113] In summary, dynamic weight derivation combines information entropy with historical experience. It determines feature discrimination by calculating information entropy, adjusts weights by referring to historical cases, and then normalizes the weights to adapt to the current network scenario, avoiding the limitations of fixed weights.

[0114] In summary, weighted fusion, by multiplying each element of the feature vector by its corresponding weight coefficient and combining them in the original order, highlights key elements in spatial and temporal features, ensuring that core information is not obscured.

[0115] In summary, feature concatenation arranges weighted spatial features in their original order followed by weighted temporal features, thus fully integrating multidimensional features without losing information in either the spatial or temporal dimensions.

[0116] In summary, the fully connected transformation constructs a single-output fully connected network, and through element-wise weight multiplication, summation and bias addition, and Sigmoid activation mapping, transforms high-dimensional features into single-valued anomaly scores, providing an intuitive quantitative basis for subsequent anomaly detection.

[0117] The anomaly comparison and judgment module 104 is used to compare the anomaly score with the preset anomaly judgment threshold to obtain the anomaly status of the network traffic data. In some embodiments, when the anomaly comparison and determination module 104 performs anomaly comparison between the anomaly score and a preset anomaly determination threshold to determine the anomaly status of the network traffic data, it is specifically used for: The anomaly score and the preset anomaly judgment threshold are quantitatively compared to obtain the comparison results of the anomaly score and the anomaly judgment threshold. When the comparison result indicates that the anomaly score is greater than the anomaly determination threshold, an anomaly determination signal is generated; The anomaly detection signal is output as an anomaly in the network traffic data.

[0118] Furthermore, when the anomaly comparison and determination module generates an anomaly determination signal when the comparison result indicates that the anomaly score is greater than the anomaly determination threshold, it is specifically used for: The comparison results are analyzed to obtain the numerical difference information. An anomaly flag signal is generated when the numerical difference is greater than zero. By labeling the anomaly identification signals, anomaly determination signals for network traffic data are obtained.

[0119] Specifically, the process takes the comparison results as input and goes through three stages: parsing and processing, anomaly identification signal generation, and type marking, to finally obtain anomaly judgment signals for network traffic data. Each stage is sequentially connected and the products are strictly corresponding.

[0120] Specifically, the comparison result is the result of comparing the anomaly score of network traffic data with the preset anomaly judgment threshold. The process revolves around extracting numerical difference information from the result, generating anomaly identification signals, and marking the type.

[0121] Specifically, the parsing and processing stage outputs numerical difference information, the signal generation stage outputs an anomaly identification signal, and the type marking stage outputs an anomaly determination signal, forming a complete anomaly determination chain.

[0122] Furthermore, when parsing the comparison results, the comparison results are a record of the anomaly score and the anomaly determination threshold. The parsing process is to calculate the difference between the anomaly score and the anomaly determination threshold.

[0123] Furthermore, the calculated difference is used as the quantification result, which is the numerical difference information of the comparison result. The numerical difference information can be positive or negative, and directly reflects the degree of deviation between the anomaly score and the anomaly judgment threshold.

[0124] Furthermore, when the numerical difference information is greater than zero, it indicates that the anomaly score exceeds the anomaly judgment threshold. At this time, a signal is generated to identify the existence of an anomaly, which is the anomaly identification signal.

[0125] Furthermore, if the numerical difference information is less than or equal to zero, it means that the abnormal score has not exceeded the abnormal judgment threshold, so no abnormal identification signal is generated and the record of no abnormal status is maintained.

[0126] Furthermore, when categorizing abnormal identification signals, the abnormality type classification criteria are first determined, including preset types such as traffic overload, protocol abnormality, and address spoofing.

[0127] Furthermore, based on the magnitude of the numerical difference information, the corresponding anomaly type is associated (e.g., a large difference corresponds to traffic overload, and a medium difference corresponds to protocol anomaly), and this type information is appended to the anomaly identification signal.

[0128] Furthermore, the anomaly identification signal after adding type information is the anomaly determination signal for network traffic data, which includes an anomaly presence identifier and specific type information.

[0129] In summary, the analysis and processing stage transforms the comparison results into quantified numerical difference information by calculating the difference, providing a clear basis for subsequent judgment.

[0130] In summary, the anomaly identification signal generation process uses threshold judgment to accurately filter out abnormal situations and generate corresponding signals, ensuring that no anomalies are missed.

[0131] In summary, the type labeling step adds a specific anomaly type to the anomaly identification signal, making the anomaly judgment results more instructive and providing a clear direction for the formulation of subsequent handling measures.

[0132] In summary, the entire process, from comparing results to identifying anomalies with specific types, achieves a complete transformation from anomaly discovery to classification, providing precise input for the response phase of network security protection.

[0133] The anomaly decision generation module 105 is used to generate anomaly decisions for network traffic data when an anomaly is detected. In this embodiment of the invention, when the anomaly decision generation module performs anomaly decision-making to generate network traffic data when an anomaly is identified as existing, it is specifically used for: The anomaly detection signal is analyzed to obtain the anomaly characteristic information of the anomaly detection signal; The abnormal feature information and the predefined response strategy library are subjected to feature matching processing to obtain the target response strategy corresponding to the abnormal feature information; Anomaly decisions based on target response strategies to generate network traffic data.

[0134] Specifically, the process takes anomaly detection signals as input, and through three consecutive steps—signal analysis, feature matching processing, and anomaly decision generation—it ultimately obtains anomaly decisions for network traffic data. The products of each step are strictly corresponding and passed on sequentially.

[0135] Specifically, the signal parsing stage extracts key information from the anomaly detection signal, the feature matching processing stage associates it with a predefined response strategy library, and the anomaly decision generation stage transforms the strategy into specific execution content, forming a complete link from signal to decision.

[0136] Specifically, the outputs of the process are, in sequence, abnormal feature information, target response strategy, and abnormal decision. Each product is generated based on the results of the previous stage, ensuring logical coherence.

[0137] Furthermore, when parsing the anomaly detection signal, the anomaly detection signal contains an anomaly presence identifier and specific type information (such as traffic overload or protocol anomaly). Parsing involves extracting the anomaly details.

[0138] Furthermore, the extracted details include the timestamp of the anomaly, the source / destination IP addresses involved, port numbers, traffic fluctuation amplitude, and other specific characteristics. These information together constitute the anomaly characteristic information of the anomaly determination signal.

[0139] Furthermore, when performing feature matching processing on abnormal feature information and a predefined response strategy library, the predefined response strategy library stores the mapping relationship between various abnormal features and corresponding processing strategies (such as "traffic overload" corresponding to "temporary rate limiting", and "protocol anomaly" corresponding to "session blocking").

[0140] Furthermore, the core features in the abnormal feature information (such as the abnormal type and the address involved) are compared one by one with the feature entries in the policy library to find the policy entries that completely match the features. The processing policy corresponding to the entry is the target response policy corresponding to the abnormal feature information.

[0141] Furthermore, when generating abnormal network traffic data decisions based on the target response strategy, the target response strategy is a principle-based handling plan (such as "implementing rate limiting for abnormal IPs"), and the generated decision clarifies the specific execution parameters of this plan.

[0142] Furthermore, specific execution parameters include rate limiting, blocking duration, and notification targets. These parameters are combined with the target response strategy to form directly executable instructions, which are the abnormal decision-making for network traffic data.

[0143] In summary, the signal analysis stage extracts specific features from the anomaly detection signal, providing a clear basis for comparison in subsequent matching and ensuring that the feature information is complete and accurate.

[0144] In summary, the feature matching process compares the abnormal features with a predefined response strategy library to achieve a precise mapping from abnormal features to response strategies, thus avoiding blind responses.

[0145] In summary, the anomaly decision generation process transforms strategies into specific, executable instructions, making the response measures operable and ensuring that anomaly handling is accurately implemented.

[0146] In summary, the entire process, from anomaly signal analysis to decision generation, transforms the process from "detecting anomalies" to "how to handle them," providing clear and specific action guidelines for the execution of network security protection.

[0147] Based on the same inventive concept, another embodiment of the present invention provides a network security protection method based on deep analysis and abnormal behavior recognition, applied to the network security protection system based on deep analysis and abnormal behavior recognition in the aforementioned embodiment. The method includes: Network traffic data is standardized to obtain a standardized data stream of network traffic data; Spatial feature extraction is performed on the standardized data stream to obtain the spatial feature vector of the network traffic data, and time series feature extraction is performed on the standardized data stream to obtain the time series feature vector of the network traffic data. Anomaly scores for network traffic data are obtained by dynamically weighting and fusing spatial feature vectors and time-series feature vectors. Anomaly scores are compared with preset anomaly detection thresholds to identify anomalies in network traffic data. When an anomaly is detected, an anomaly decision is made to generate network traffic data.

[0148] It should be noted that this invention can acquire and process relevant data based on artificial intelligence technology. Artificial intelligence refers to the theories, methods, technologies, and application systems that utilize digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results.

[0149] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. It should be understood that the invention is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A network security protection system based on deep analysis and abnormal behavior recognition, characterized in that, It includes a data processing module, a multi-dimensional feature extraction module, a dynamic weighted fusion analysis module, an anomaly comparison and judgment module, and an anomaly decision generation module; The data processing module is used to standardize the network traffic data to obtain a standardized data stream of the network traffic data; The multi-dimensional feature extraction module is used to extract spatial features from the standardized data stream to obtain the spatial feature vector of the network traffic data, and to extract time series features from the standardized data stream to obtain the time series feature vector of the network traffic data. The dynamic weighted fusion analysis module is used to dynamically weight and fuse the spatial feature vector and the time series feature vector to obtain the anomaly score of the network traffic data. The anomaly comparison and determination module is used to compare the anomaly score with a preset anomaly determination threshold to obtain the anomaly status of the network traffic data. The anomaly decision generation module is used to generate anomaly decisions for the network traffic data when the anomaly situation is that an anomaly exists.

2. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, The data processing module is specifically used for: The network traffic data is parsed to obtain the network traffic data packets; The data packet is cleaned of invalid data to obtain a denoised data packet; The denoised data packets are normalized to obtain a standardized data stream of the network traffic data.

3. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, Spatial feature extraction is performed on the standardized data stream to obtain the spatial feature vector of the network traffic data, including: The standardized data stream is truncated according to a preset window size and step size to obtain a subsequence of the standardized data stream; Convolutional feature extraction is performed on the subsequence to obtain the local spatial features of the subsequence; The local spatial features are pooled to obtain the pooled features of the local spatial features; The pooled features are mapped using a fully connected layer to obtain the spatial feature vector of the network traffic data.

4. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 3, characterized in that, Convolutional feature extraction is performed on the subsequence to obtain the local spatial features of the subsequence, including: Multi-scale convolution operations are performed on the subsequence to obtain feature values ​​in the multi-scale feature map of the subsequence. The formula for calculating the feature values ​​in the multi-scale feature map is as follows: ； In the formula, For the first At the first scale, the first Location in each feature map eigenvalues ​​at that location For scale indexing, For feature map indexing, To output the spatial location coordinates in the feature map, The coordinates of the height dimension of the output feature map. The coordinates of the width dimension of the output feature map. For the first The kernel size corresponding to each scale , This refers to the index variable inside the convolution kernel. For the first At each scale, the convolution kernel is located at... The weight value at that location, To round up, This is the offset of the convolution kernel center. For the first The weight matrix of each feature map. The height coordinates of the input data. The width coordinates of the input data; The distribution of the feature values ​​in the multi-scale feature map is standardized to obtain the standardized feature representation of the feature values ​​in the multi-scale feature map. The standardized feature representation is nonlinearly activated to obtain the activated feature map of the standardized feature representation; The activation feature map is refined to obtain the local spatial features of the subsequence.

5. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, Time series feature extraction is performed on the standardized data stream to obtain the time series feature vector of the network traffic data, including: The standardized data stream is divided into time windows to obtain time series segments of the standardized data stream; Extract the time-dependency features of the time series segments; The time-dependent features are compressed using a fully connected layer to obtain the time-series feature vector of the network traffic data; The extraction of time-dependent features from the time series segments includes: The time series segment is subjected to temporal structure parsing to obtain the temporal feature representation of the time series segment; The temporal feature representation is subjected to bidirectional state evolution to obtain the forward state quantity and the backward state quantity of the temporal feature representation; The forward state and the backward state are fused to obtain a fused feature representation of the forward state and the backward state. Attention weights are assigned to the fused feature representation to obtain the time-dependent features of the time series segment.

6. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, The dynamic weighted fusion analysis module is specifically used for: Dynamic weight derivation is performed on the spatial feature vector and the time series feature vector to obtain the dynamic weight coefficients of the spatial feature vector and the time series feature vector, wherein the dynamic weight coefficients include: spatial dimension weight coefficients and time dimension weight coefficients; The spatial feature vector is weighted and fused based on the spatial dimension weight coefficient to obtain the weighted spatial features of the spatial feature vector; The time series feature vector is weighted and fused based on the time dimension weight coefficient to obtain the weighted time feature of the time series feature vector; The weighted spatial features and the weighted temporal features are concatenated to obtain the concatenated features; A fully connected transformation is performed on the spliced ​​features to obtain the anomaly score of the network traffic data, wherein the calculation formula for the anomaly score is as follows: ； In the formula, For abnormal scoring, For activation function, This is the weight matrix of the fully connected layer. This is the transpose of the matrix. For feature concatenation function, For spatial feature vectors, For time series feature vectors, The spatial dimension weighting coefficient. The time dimension weighting coefficient, For element-wise multiplication, This is a bias term.

7. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, The anomaly comparison and determination module is specifically used for: The anomaly score and the preset anomaly determination threshold are quantitatively compared to obtain the comparison result of the anomaly score and the anomaly determination threshold; When the comparison result indicates that the anomaly score is greater than the anomaly determination threshold, an anomaly determination signal is generated; The anomaly detection signal is output as an anomaly in the network traffic data.

8. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 7, characterized in that, When the comparison result indicates that the anomaly score is greater than the anomaly determination threshold, an anomaly determination signal is generated, including: The comparison results are parsed to obtain the numerical difference information of the comparison results; An anomaly identification signal is generated when the numerical difference information is greater than zero; The anomaly identification signal is categorized to obtain the anomaly determination signal for the network traffic data.

9. The network security protection system based on deep analysis and abnormal behavior recognition as described in claim 1, characterized in that, The anomaly decision generation module is specifically used for: The anomaly determination signal is analyzed to obtain the anomaly feature information of the anomaly determination signal; The abnormal feature information and the predefined response strategy library are subjected to feature matching processing to obtain the target response strategy corresponding to the abnormal feature information; Anomaly decisions are generated based on the target response strategy to generate the network traffic data.

10. A network security protection method based on deep analysis and abnormal behavior recognition, characterized in that, Applied to the network security protection system based on deep analysis and abnormal behavior recognition as described in any one of claims 1-9, the method includes: The network traffic data is standardized to obtain a standardized data stream of the network traffic data; Spatial feature extraction is performed on the standardized data stream to obtain the spatial feature vector of the network traffic data; time series feature extraction is performed on the standardized data stream to obtain the time series feature vector of the network traffic data. The spatial feature vector and the time series feature vector are dynamically weighted and fused to obtain the anomaly score of the network traffic data; The anomaly score is compared with a preset anomaly detection threshold to obtain the anomaly status of the network traffic data; When the abnormal situation is that an anomaly exists, an anomaly decision is generated for the network traffic data.

Images