Computer network data flow monitoring system and method

Abstract

The invention relates to the technical field of network monitoring, in particular to a computer network data flow monitoring system and method, and the system comprises a data flow collection module, a protocol layer analysis module, a time sequence feature extraction module, a defect compensation reconstruction module and a monitoring result output module. According to the method, a continuous difference track can be formed by extracting protocol fields and marking change time points in data stream acquisition, a cross-layer synchronization index is generated by calculating the interval and the sequence of adjacent fields, so that a cross-layer relationship is quantized in a dynamic process, quantile regression is adopted in feature processing to unify a numerical interval, and the accuracy of the cross-layer relationship is improved. Compared with the prior art, the method guarantees the comparability under different time scales, can rapidly identify an abnormal section when cross-layer synchronization is broken, deduces a potential mode in combination with feature values before and after abnormity, reconstructs defect information in a probability mode, enables the result to have the abnormity recognition precision and the flow monitoring integrity, and improves the network management efficiency and safety.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network monitoring, in particular to a computer network data flow monitoring system and method. BACKGROUND

[0002] The technical field of network monitoring involves identifying, collecting, counting and analyzing data flow transmitted in a computer network. The core tasks of this technical field include capturing data packets to extract source and destination address information, classifying data streams to distinguish the flow characteristics of different communication protocols, recording traffic to understand the use of network resources, and identifying abnormal traffic for security management and troubleshooting. This field as a whole covers the systematic technical basis of network data acquisition, data feature extraction, and traffic statistical analysis.

[0003] Among them, the traditional computer network data flow monitoring system refers to deploying special collection equipment at network nodes to capture transmitted data packets, using protocol analysis rules to analyze the captured data packets layer by layer to obtain the basic attributes of communication, combining pre-set classification rules to distinguish and count different types of network traffic, and relying on storage recording means to save traffic information for subsequent analysis.

[0004] Traditional flow monitoring relies on data packet capture and static attribute analysis, which is difficult to reveal the dynamic evolution between fields in the case of rapid communication changes, resulting in a lack of cross-layer dependency, making it difficult to accurately perceive when the anomaly is in a short period or the cross-layer synchronization is destroyed. The storage information is biased towards static recording and lacks dynamic sequence supplementation, making the monitoring result prone to information gaps, causing abnormal positioning delay and data segment loss, and more likely to occur in complex scenarios. Flow anomalies are covered up or missed. SUMMARY

[0005] In order to solve the technical problems of traditional flow monitoring relying on data packet capture and static attribute analysis, which is difficult to reveal the dynamic evolution between fields in the case of rapid communication changes, resulting in a lack of cross-layer dependency, making it difficult to accurately perceive when the anomaly is in a short period or the cross-layer synchronization is destroyed. The storage information is biased towards static recording and lacks dynamic sequence supplementation, making the monitoring result prone to information gaps, causing abnormal positioning delay and data segment loss, and more likely to occur in complex scenarios. Flow anomalies are covered up or missed, the present application provides a computer network data flow monitoring system and method. The technical solution is as follows: On the one hand, a computer network data flow monitoring system is provided, which comprises: A data stream acquisition module acquires real-time data packet flow through a network interface, acquires protocol layer field and timestamp information, detects field differences between consecutive sampling points, records change time points, generates a flow field change record table, and delivers the table to a protocol layer analysis module; A protocol layer analysis module receives the flow field change record table, calculates adjacent protocol layer field change time intervals, detects field change sequence, accumulates a synchronous state number and a total comparison number ratio, generates a protocol synchronization metric value, and delivers the value to a time sequence feature extraction module; A time sequence feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps to a unified numerical interval through a quantile regression algorithm, detects cross-layer synchronization continuity identification abnormal sections, records feature values before and after the abnormal sections, generates a flow anomaly monitoring result, and delivers the result to a loss compensation reconstruction module; A loss compensation reconstruction module receives the flow anomaly monitoring result, determines a calculation interval according to the feature values before and after the abnormal sections, calculates an intersection with a protocol standard field, evaluates flow mode consistency using a Markov chain Monte Carlo algorithm, generates complete flow monitoring data, and delivers the data to a monitoring result output module.

[0006] As a further scheme of the application, the flow field change record table includes change types, time distribution, and impact range, the protocol synchronization metric value includes interval distribution, sequence consistency, and synchronization ratio, the flow anomaly monitoring result includes abnormal section position, continuity index, and offset degree, and the complete flow monitoring data includes a calculation interval range, a field intersection result, and a consistency evaluation value.

[0007] As a further scheme of the application, the data stream acquisition module includes: A data stream receiving submodule acquires real-time data packet flow through a network interface, analyzes data packet structure and extracts protocol layer field content, matches and stores fields and data packet timestamps one by one, calls a buffer area to sequentially write field sequences and mark sampling positions, and generates field time sequence values; A field difference detection submodule, based on the field time sequence values, calls field values and timestamp content in adjacent sampling points, compares adjacent field values one by one and detects difference amplitudes, calculates interval lengths according to field difference results and adjacent timestamps, and obtains a field difference time point set; A change record generation submodule, according to the field difference time point set, calls field value change positions and corresponding time information, linearly arranges them in time sequence and establishes an index table, adds change amplitude labels to multiple records in the index table, and generates a flow field change record table.

[0008] As a further scheme of the application, the protocol layer analysis module includes: A field sequence acquisition submodule parses the flow field change record table, detects the change of the field in the transmission link, extracts the time label and change identifier, arranges and fits the event sequence, calls the event sequence to integrate the changes of the fields at different levels, and obtains the protocol layer field change time sequence; A protocol field calculation submodule performs difference operation on the time labels of adjacent protocol layer fields based on the protocol layer field change time sequence, establishes a time interval matrix, calls the interval value to perform sequential comparison and record sorting, and generates the field change sequence; A synchronization metric generation submodule calls the field change sequence and the time interval matrix, compares the sequence of the protocol layer fields and the time interval value, calculates the cumulative number of synchronization states and performs ratio operation on the total number of comparisons, and generates the protocol synchronization metric value.

[0009] As a further scheme of the application, the timing feature extraction module comprises: A timing data acquisition submodule acquires the protocol synchronization metric value as input data, sets a fixed-length sliding time window for segmentation, arranges each segment of the synchronization metric value in time sequence as a continuous sequence, and generates a timing feature value; A quantile mapping submodule extracts the median of each time segment data vector as a distribution position parameter based on the timing feature value, inputs the parameter into a quantile regression algorithm and performs difference comparison with a preset quantile reference value, calculates the normalized mapping according to the difference comparison result and performs arrangement, and obtains a normalized interval sequence; A cross-layer anomaly detection submodule calculates the difference value of adjacent time segments according to the normalized interval sequence and performs comparison with a preset difference threshold, determines the difference value exceeding the threshold as an abnormal interval and records the index, simultaneously extracts the adjacent numerical features before and after the abnormal interval for aggregation, and generates a flow anomaly monitoring result.

[0010] As a further scheme of the application, the defect compensation reconstruction module comprises: A feature segment estimation submodule acquires the abnormal segment data in the flow anomaly monitoring result, performs difference calculation on the feature values before and after the abnormal segment and interpolates the missing part, calls the boundary point to determine the extension range, and generates an estimated interval range value; A field intersection calculation submodule calls a protocol standard field set based on the estimated interval range value, compares the interval range data field with the protocol standard field in the same index dimension, establishes a field coincidence record according to the numerical overlap and integrates it into an intersection coefficient set, and obtains a protocol field intersection coefficient; The flow mode evaluation submodule adopts a Markov chain Monte Carlo algorithm to calculate a transition probability distribution sequence according to the protocol field intersection coefficient, performs random sampling and records results, extracts a stable trend, and calculates a consistency degree of an initial flow mode corresponding to real-time data packet flow, to obtain complete flow monitoring data.

[0011] As a further scheme of the present application, the estimated interval range value is an interval data set obtained by differentiating and calculating characteristic values before and after an abnormal section, interpolating and completing a missing part, and combining with boundary point extension; The protocol field intersection coefficient is a set of field overlap records established by comparing the estimated interval range value with the protocol standard field set in the same index dimension.

[0012] As a further scheme of the present application, the monitoring result output module receives the complete flow monitoring data, compares the difference degree of the abnormal area and the normal mode based on the original data statistics, analyzes the protocol boundary position information, extracts the flow characteristic data, arranges the protocol boundary and the characteristics according to time, and generates a structured monitoring result. The structured monitoring result includes the difference degree, the boundary position information, and the time characteristics.

[0013] As a further scheme of the present application, the monitoring result output module includes: The sequence difference measurement submodule obtains the complete flow monitoring data, arranges the data packets in the time sequence, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal mode distribution value based on the original data statistics, and generates a difference measurement value. The protocol boundary positioning submodule analyzes the data packets arranged in the time sequence based on the difference measurement value, detects the field length change rule and numbers to establish a time index, compares the continuous field interval with the division reference interval value, and obtains a protocol boundary index table. The characteristic sequence construction submodule extracts the boundary section flow characteristic value according to the protocol boundary index table, arranges the characteristic value and the time stamp in pairs, and integrates them into a unified structure according to the section order, to obtain a structured monitoring result.

[0014] On the other hand, a computer network data flow monitoring method is executed based on the above computer network data flow monitoring system, including the following steps: S1: Collect real-time data packet flow through a network interface, obtain protocol layer field information and time stamp data, detect protocol field changes between adjacent sampling points, record field change time and change amplitude, and generate a flow field change record table. S2: Calculate protocol layer field change time difference value based on the flow field change record table, sort and analyze the field change sequence, detect the field change sequence, accumulate the synchronization state number and total comparison number ratio, and generate protocol synchronization metric value; S3: Call the protocol synchronization metric value setting time window length parameter, map the numerical value to a unified interval through quantile regression algorithm, detect the cross-protocol layer synchronization continuity breakpoint, identify the abnormal period start and end position, record the abnormal section boundary feature value, and generate traffic anomaly monitoring result; S4: According to the abnormal section boundary feature value in the traffic anomaly monitoring result, determine the data reconstruction range, calculate the overlap part of the reconstruction interval and the standard protocol field, input the traffic mode parameter into the Markov chain Monte Carlo algorithm for consistency evaluation, and generate complete traffic monitoring data; S5: Receive the complete traffic monitoring data, compare the difference degree of abnormal area and normal mode, analyze the protocol boundary position information, extract the traffic feature data, arrange the protocol boundary and features according to time, and generate structured monitoring result.

[0015] The technical scheme provided by the embodiment of the application has at least the following beneficial effects: In data stream collection, protocol fields are extracted and change time points are marked, a continuous difference trajectory can be formed, cross-layer synchronization indicators are generated by calculating the interval and sequence of adjacent fields, the cross-layer relationship is quantified in a dynamic process, the quantile regression is used in feature processing to unify the numerical value interval, the comparability under different time scales is ensured, when the cross-layer synchronization is broken, the abnormal section can be quickly identified, and the potential mode is deduced combined with the feature values before and after the abnormal section, the missing information is reconstructed in a probabilistic way, and the result has both abnormal recognition accuracy and traffic monitoring integrity. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical scheme in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0017] Figure 1 It is a system schematic diagram of the application; Figure 2 It is a system framework schematic diagram of the application; Figure 3 It is a flowchart of the data stream collection module in the application; Figure 4 It is a flowchart of the protocol layer analysis module in the application; Figure 5This is a flowchart of the temporal feature extraction module in this invention; Figure 6 This is a flowchart of the defect compensation and reconstruction module in this invention; Figure 7 This is a flowchart of the monitoring result output module in this invention; Figure 8 This is a flowchart of the method of the present invention. Detailed Implementation

[0018] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0019] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0020] In the embodiments of this invention, the terms "image" and "picture" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning. Similarly, the terms "of," "corresponding (relevant)," and "corresponding" may sometimes be used interchangeably. It should be noted that, without emphasizing the distinction between them, they convey the same meaning.

[0021] In this embodiment of the invention, sometimes a subscript such as W1 may be written in a non-subscript form such as W1. When the difference is not emphasized, the meaning they express is the same.

[0022] To make the technical problems, technical solutions and advantages of the present invention clearer, a detailed description will be given below in conjunction with the accompanying drawings and specific embodiments.

[0023] This invention provides a computer network data traffic monitoring system, such as... Figures 1-2 The diagram shown illustrates a computer network data traffic monitoring system, which includes: The data stream acquisition module obtains real-time data packet traffic through the network interface, collects protocol layer fields and timestamp information, detects field differences between consecutive sampling points, records the time points of change, generates a traffic field change record table, and transmits it to the protocol layer parsing module. The protocol layer parsing module receives the traffic field change record table, calculates the time interval between changes in adjacent protocol layer fields, detects the order of field changes, accumulates the ratio of the number of synchronization states to the total number of comparisons, generates a protocol synchronization metric, and transmits it to the timing feature extraction module. The timing feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps it to a unified numerical range through a quantile regression algorithm, detects cross-layer synchronization continuity, identifies abnormal segments, records the feature values ​​before and after the abnormal segment, generates traffic anomaly monitoring results, and transmits them to the loss compensation and reconstruction module. The defect compensation and reconstruction module receives the traffic anomaly monitoring results, determines the estimation interval based on the characteristic values ​​before and after the anomaly segment, calculates the intersection with the protocol standard fields, uses the Markov chain Monte Carlo algorithm to evaluate the consistency of the traffic pattern, generates complete traffic monitoring data, and transmits it to the monitoring result output module. The monitoring result output module receives complete traffic monitoring data, compares the degree of difference between abnormal areas and normal patterns obtained from statistics based on raw data, parses protocol boundary location information, extracts traffic feature data, arranges protocol boundaries and features by time, and generates structured monitoring results. The traffic field change record table includes change type, time distribution and impact range; the protocol synchronization metric includes interval distribution, sequence consistency and synchronization ratio; the traffic anomaly monitoring results include the location of the abnormal segment, continuity index and offset degree; the complete traffic monitoring data includes the estimated interval range, field intersection results and consistency assessment value; and the structured monitoring results include the degree of difference, boundary location information and time characteristics.

[0024] Specifically, such as Figure 2 , 3 As shown, the data stream acquisition module includes: The data stream receiving submodule obtains real-time data packet traffic through the network interface, parses the data packet structure and extracts the protocol layer field content, matches and stores the fields with the timestamps of the data packets one by one, calls the buffer to write the field sequence sequentially and marks the sampling position, and generates the field time series value; The data stream receiving submodule acquires real-time data packet traffic through the physical network interface eth0 located on the mirror port of the network switch. Specifically, it continuously listens for and copies data packets passing through this port. For the first received data packet, the system records its arrival timestamp as 1789532401.153256 seconds, parses its Ethernet frame header, identifies the type field as 0x0800 indicating that the upper layer is the IP protocol, then parses the IP protocol header, extracting the source IP address as "192.168.1.50" and the destination IP address as "210.45". The ".118.90" field with a protocol field of 6 indicates that the transport layer is TCP. Continuing to parse the TCP header, the source port number is extracted as 58010, the destination port number as 443, and the TCP sequence number as 2534910731. The packet length is calculated to be 60 bytes. Then, the extracted fields "192.168.1.50", "210.45.118.90", 58010, 443, 2534910731, 60, are compared with the packet's timestamp 1789532401.15325. 6. Matching is performed to construct a structured record {timestamp: 1789532401.153256, source IP: "192.168.1.50", destination IP: "210.45.118.90", source port: 58010, destination port: 443, sequence number: 2534910731, length: 60}. This record is sent to a circular buffer of fixed size 4096 records and is sequentially written to index position 0. Since the system sampling interval is set to 100, that is, every 99 data packets are selected. The 100th data packet is used as the sampling point, so the sampling position of this record is marked as 0. Subsequent data packets will be written to positions 1, 2, 3, etc., until the 100th data packet arrives. Its timestamp is 1789532401.298871 and its length is 1514 bytes. The record of this data packet is written to the buffer index position 99 and marked as sampling position 1. This process continues, constantly filling the buffer, forming the field sequence fragments as shown in Table 1. Finally, the set of records marked with sampling positions in the buffer is extracted to generate the field time series value.

[0025] Table 1: Example Table of Field Sequence Fragments As shown in Table 1, this table lists some data packet field information captured and parsed over a period of time, including timestamps accurate to microseconds, IP addresses and ports of both communicating parties, and the effective payload length of the data packets.

[0026] The field difference detection submodule, based on the field time series value, calls the field values ​​and timestamps in adjacent sampling points, compares the adjacent field values ​​one by one and detects the difference magnitude, and calculates the interval duration based on the field difference results and adjacent timestamps to obtain the field difference time point set; The field difference detection submodule, based on the set of records marked with sampling positions in the cache, first retrieves the first pair of adjacent sampling points from this set, namely the two records at sampling positions 0 and 1. Record 0 contains {timestamp: 1789532401.153256, source IP: "192.168.1.50", length: 60}, and record 1 contains {timestamp: 1789532401.298871, source IP: "210.45.118.90", length: 1514}. Next, it compares the field values ​​in these two records item by item. Comparing the source IP address field, it finds that "192.168.1.50" and "210.45.118.90" are different, indicating a difference. Then, it compares the length field and calculates the absolute difference between the two values, i.e., the difference magnitude. The bytes are then used to extract the timestamps of the two records, 1789532401.153256 and 1789532401.298871, based on the difference between these two fields. The interval between them is then calculated. The calculation process is as follows: If at least one field is detected to be different, the system combines the timestamp of the second sampling point (1789532401.298871), the field names "Source IP" and "Length" that are different, the difference magnitude (1454), and the interval duration (0.145615 seconds) into a single difference information. Then, it continues to call the next pair of adjacent sampling points, namely the records of sampling position 1 and sampling position 2, and repeats the above comparison and calculation process until it traverses the adjacent sampling point pairs. Finally, it summarizes the recorded difference information to obtain the set of field difference time points.

[0027] The change record generation submodule, based on the set of field difference time points, calls the position of field value change and the corresponding time information, arranges them linearly in chronological order and creates an index table, adds change magnitude markers to multiple records in the index table, and generates a flow field change record table. The change record generation submodule, based on the sets {Time Point: 1789532401.298871, Field: "Length", Amplitude: 1454}, {Time Point: 1789532401.601234, Field: "Length", Amplitude: 1206}, and {Time Point: 1789532401.456789, Field: "Source IP", Amplitude: N / A}, first retrieves the position of the field value change in each difference information, i.e., the index of the sample point where the change occurred, and the corresponding time information, i.e., the timestamp of that sample point. Then, the difference information is linearly arranged strictly according to the timestamp values ​​in ascending order. The sorted order is the record of time point 1789532401.298871. The first record is 1789532401.456789, followed by 1789532401.601234. A numerical index table starting from 0 is created for this ordered list, where index 0 corresponds to the first changed record, index 1 to the second, and so on. Next, a change magnitude marker is added to each record in the index table that involves a numerical change. The range for this magnitude marker is pre-defined, referencing historical traffic data from one week of normal network operation. Specifically, it calculates the mean and standard deviation of the packet length difference between adjacent sampling points. The mean is 150 bytes, and the standard deviation is 450 bytes. Therefore, the threshold for a "high" change magnitude is set to the mean plus twice the standard deviation. The range of "lower" variation is set to less than the average, i.e., 0 to 150 bytes. For the record at index 0, the variation is 1454 bytes. A comparison is then performed. The result is true, so a "high" amplitude marker is added. For the record at index 2, the change amplitude is 1206 bytes, and a comparison is performed. If the result is true, a "high" amplitude marker is added. After marking, a record table of changes in the flow field is finally generated.

[0028] Specifically, such as Figure 2 , 4 As shown, the protocol layer parsing module includes: The field sequence acquisition submodule parses the traffic field change record table, detects the changes of fields in the transmission link, extracts time stamps and change identifiers, arranges and fits the event sequence, and calls the event sequence to integrate the changes of fields at different levels to obtain the protocol layer field change time series. The field sequence acquisition submodule first parses the traffic field change record table line by line. This table contains entries such as {Time: 1789532401.298871, Field: "Length", Amplitude Marker: "High"} and {Time: 1789532401.456789, Field: "Source IP", Amplitude Marker: N / A}. The system detects that the fields that have changed in the transmission link are "Length" and "Source IP". Then, it extracts the timestamp 1789532401.29 from the first record. The second record contains the timestamp 1789532401.456789 seconds and the change identifier "source IP". Subsequent records are processed similarly, with the extracted timestamps and change identifiers paired to form a sequence of event tuples, such as (1789532401.298871, "length"), (1789532401.456789, "source IP"), (1789532401.6012... 34, “Length”), and strictly arrange them in ascending order of time tag values ​​to fit an initial event sequence. Then, the system calls this event sequence and integrates the changes of fields at different levels according to the preset field-protocol layer mapping rules. This rule maps fields such as “source IP”, “destination IP”, and “length” to the network layer, and fields such as “source port” and “destination port” to the transport layer. For example, for the event (1789532401.456789, “source IP”), the system... Based on the mapping rules, the "source IP" belongs to the network layer, so the event is integrated into (1789532401.456789, "source IP", "network layer"). For another fictitious event (1789532401.554321, "destination port"), it will be integrated into (1789532401.554321, "destination port", "transport layer"). By performing this mapping and integration operation on each event in the initial event sequence, the time series of protocol layer field changes is obtained.

[0029] The protocol field calculation submodule performs difference calculations on the time tags of adjacent protocol layer fields based on the time series of protocol layer field changes, establishes a time interval matrix, calls the interval values ​​for sequential comparison and records the sorting, and generates the field change order. The protocol field calculation submodule, based on the sequence event A (1789532401.456789, "Source IP", "Network Layer"), followed by event B (1789532401.554321, "Destination Port", "Transport Layer"), and then event C (1789532401.601234, "Source IP", "Network Layer"), first performs a difference calculation on the timestamps of adjacent protocol layer field change events to calculate the time interval between event B and event A. Seconds represent the time elapsed from a change in the network layer's "source IP" field to a change in the transport layer's "destination port" field. Similarly, the time interval between event C and event B is calculated as follows: Next, based on the calculation results, a time interval matrix is ​​created, as shown in Table 2. The rows and columns of this matrix represent different protocol layers, and the elements in the matrix store a list of specific time interval values ​​from the change of the protocol layer represented by the row to the change of the protocol layer represented by the column. For example, the calculated 0.097532 seconds is stored in the cell where the "Network Layer" row and the "Transport Layer" column intersect in the matrix, and 0.046913 seconds is stored in the cell where the "Transport Layer" row and the "Network Layer" column intersect. This process will continue to traverse the entire time series and continuously fill the matrix. Then, the system calls the interval values ​​in the matrix for sequential comparison. For each pair of adjacent events, such as event A and event B, the system records the order of their changes, that is, the "Network Layer" changes before the "Transport Layer", and records this order pair ("Network Layer", "Transport Layer"). By processing the entire event sequence in sequence, the order of field changes is generated.

[0030] Table 2: Example Table of Protocol Layer Change Time Interval Matrix As shown in Table 2, this matrix records the continuous time intervals between changes in fields between different protocol layers. For example, it takes 0.097532 seconds from the change in a network layer field to the next change in a transport layer field.

[0031] The synchronization metric generation submodule calls the field change order and time interval matrix, compares the order of fields in the protocol layer with the time interval values, calculates the cumulative number of synchronization states and performs a ratio operation with the total number of comparisons, and generates the protocol synchronization metric value. The synchronization measurement generation submodule calls the field change order, such as the sequence [("Network Layer", "Transport Layer"), ("Transport Layer", "Network Layer")], and a time interval matrix containing specific interval values. The system first sets a time interval threshold for synchronization determination. This threshold is set with reference to the original interval data recorded in the time interval matrix. The specific calculation process is as follows: extract the interval values ​​from the matrix, such as 0.097532 seconds, 0.046913 seconds, and 0.144445 seconds, and calculate the average value. The time interval is calculated to be seconds, and its standard deviation is 0.040251 seconds. The synchronization time threshold is then set accordingly. Set to the mean plus 0.5 times the standard deviation, i.e. Next, the system compares the order of the protocol layer fields with the time interval values, iterating through each sequence pair in the field change order. For the first sequence pair ("network layer", "transport layer"), the system retrieves the corresponding first interval value of 0.097532 seconds from the time interval matrix and performs a judgment. If the result is true, this state is determined to be a "synchronization state," and the synchronization state count counter changes from 0 to 1. Then, the second sequence pair ("transport layer," "network layer") is processed, the corresponding interval value of 0.046913 seconds is retrieved, and a judgment is performed. The result is true, which is also considered a "synchronization state". The synchronization state count counter changes from 1 to 2. After traversing the sequence pairs, the final synchronization state count of 2 is compared with the total number of comparisons of 2. The calculation process is as follows: Generate protocol synchronization metrics.

[0032] Specifically, such as Figure 2 , 5 As shown, the time-series feature extraction module includes: The time-series data acquisition submodule obtains the protocol synchronization metric value as input data, sets a fixed-length sliding time window to segment the data, arranges each segment of synchronization metric value into a continuous sequence according to time order, and generates time-series feature values. The time-series data acquisition submodule calls the protocol to synchronize the metric value, which is a scalar that changes over time. The system continuously receives the metric value; for example, the sequence received within ten consecutive time units is [1.0, 0.8, 0.9, 0.2, 0.3, 0.85, 0.95, 1.0, 0.7, 0.75]. Then, a sliding time window with a fixed length of 5 and a sliding unit with a step size of 1 is set. The window length of 5 is based on the fact that short-term bursts of network traffic exhibit complete fluctuation characteristics within 5 sampling periods, while the step size of 1 is set to capture the most subtle changes between consecutive windows. This sliding window is then applied to the input metric value sequence for segmentation. In the first segmentation operation, the window covers the first to fifth data points of the sequence, extracting the first data segment [1.0, 0.8, 0.9, 0.2, 0.3]. Then, the window slides forward one step unit, covering the 2nd to 6th data points of the sequence, extracting the second data segment [0.8, 0.9, 0.2, 0.3, 0.85]. This sliding and segmentation process continues until the window slides to the end of the input sequence. For example, the third data segment is [0.9, 0.2, 0.3, 0.85, 0.95], the fourth is [0.2, 0.3, 0.85, 0.95, 1.0], the fifth is [0.3, 0.85, 0.95, 1.0, 0.7], and the sixth is [0.85, 0.95, 1.0, 0.7, 0.75]. After the segmentation operation is completed, each segmented data segment, that is, the five synchronization metrics within each segment, is arranged strictly according to its time order in the original sequence, forming a set composed of multiple continuous sequences. This set is the generated time series feature value.

[0033] The quantile mapping submodule extracts the median of the data vector for each time period as the distribution location parameter based on the time series feature value. The parameter is input into the quantile regression algorithm and compared with the preset quantile benchmark value. The normalized mapping is calculated and arranged according to the difference comparison result to obtain the normalized interval sequence. The quantile mapping submodule forms a set containing multiple time-series feature values, such as [[1.0, 0.8, 0.9, 0.2, 0.3], [0.8, 0.9, 0.2, 0.3, 0.85], [0.9, 0.2, 0.3, 0.85, 0.95], [0.2, 0.3, 0.85, 0.95, 1.0]]. First, it extracts the distribution location parameter from the data vector of each time period. Here, the median is chosen as this parameter. The first vector [1.0, 0.8, 0.9, 0.2, 0.3] is sorted in ascending order to obtain [0.2, 0.3, 0.8, 0.9, 1.0]. The value 0.8 in the middle position is the median of this vector. The second vector [0.8, 0.9, 0.2, 0.3, 0.85] is sorted to obtain [0.2, 0.3, 0.9 ... The median of the first vector [0.8, 0.85, 0.9] is 0.8. The median of the third vector [0.9, 0.2, 0.3, 0.85, 0.95] is [0.2, 0.3, 0.85, 0.9, 0.95], with a median of 0.85. The median of the fourth vector [0.2, 0.3, 0.85, 0.95, 1.0] is [0.2, 0.3, 0.85, 0.95, 1.0], with a median of 0.85. Next, the calculated parameters, i.e., the median sequence [0.8, 0.8, 0.85, 0.85], are compared with a preset quantile benchmark value. This benchmark value is set with reference to the median set of ten thousand data vectors collected during the system's continuous 24-hour normal operation. The mean of this set is calculated to be 0.9, which is used as the benchmark value. Then, the difference is calculated, and the first difference is... The second one is The third one is The fourth one is Then, based on the difference comparison result, a normalized mapping is calculated. The normalization method is to divide the difference by the largest absolute difference that appears in the historical data, which is 0.5. The first mapping value is then obtained. The second one is The third one is The fourth one is Finally, the normalized mapping values ​​are arranged in chronological order according to their corresponding time periods to obtain the normalized interval sequence.

[0034] The cross-layer anomaly detection submodule calculates the difference value between adjacent time periods based on the normalized interval sequence and compares it with the preset difference threshold. It determines the difference value exceeding the threshold as an abnormal interval and records the marked index. At the same time, it extracts the adjacent numerical features before and after the abnormal interval and aggregates them to generate traffic anomaly monitoring results. The cross-layer anomaly detection submodule, based on a longer normalized interval sequence, such as [-0.2, -0.2, -0.1, -0.1, 0.3, -0.8, -0.7, 0.1], first calculates the difference between adjacent time intervals, that is, calculates the absolute difference between two adjacent values ​​in the sequence. The first difference value is... The second one is The third one is The fourth one is The fifth one is The sixth one is The seventh one is The resulting difference value sequence [0.0, 0.1, 0.0, 0.4, 1.1, 0.1, 0.8] is then compared to a preset difference threshold. This threshold is set to 0.6, based on the 98th percentile of the difference values ​​arranged from largest to smallest under normal operating conditions. Each difference value is then compared individually, and those exceeding the threshold of 0.6 are considered abnormal. A difference value of 1.1, greater than 0.6, is also considered abnormal, with an index of 4 in the difference value sequence. This corresponds to the value pair (0.3, -0.8) with indices 4 and 5 in the original normalized interval sequence. Therefore, it is recorded as an anomaly. Index 5 is recorded. The difference value 0.8 is greater than 0.6, which is considered an anomaly. Its index is 6, corresponding to the value pair (-0.7, 0.1) with indices 6 and 7 in the original sequence. The record is marked with index 7. At the same time, the system extracts and aggregates the numerical features of adjacent values ​​before and after each anomaly interval. For the anomaly point marked with index 5, its value is -0.8, its preceding value is 0.3, and its following value is -0.7. For the anomaly point marked with index 7, its value is 0.1, its preceding value is -0.7, and its following value is recorded as non-existent due to the end of the sequence. The information is aggregated and organized to generate the traffic anomaly monitoring results shown in Table 3.

[0035] Table 3: Results of Traffic Anomaly Monitoring As shown in Table 3, this table records the detected traffic anomaly events. The “anomaly index” refers to the position of the anomaly point in the normalized interval sequence, while the “difference magnitude” quantifies the degree of change of this time point compared to the previous time point.

[0036] Specifically, such as Figure 2 , 6 As shown, the defect compensation and reconstruction module includes: The feature segment estimation submodule obtains abnormal segment data from the traffic anomaly monitoring results, performs differential calculation on the feature values ​​before and after the abnormal segment and interpolates to fill in the missing parts, calls the boundary points to determine the extension range, and generates the estimation interval range value. The feature segment estimation submodule retrieves abnormal segment data from the traffic anomaly monitoring result table. For example, the abnormal record with index 5 contains a normalized value of -0.8 for the abnormal time point, 0.3 for the previous time point, and -0.7 for the next time point. The system performs difference calculations on the feature values ​​before and after this abnormal segment, calculating the difference between the abnormal point and its preceding point as... Calculate the difference between it and the subsequent point. If there are missing values ​​at later time points, such as the abnormal record at index 7, the system will use linear interpolation to complete the data. Specifically, it will call the two consecutive, non-abnormal normalized values ​​preceding the abnormal point, assuming they are -0.7 and 0.1, and calculate their slope. Based on this, a virtual subsequent point value is calculated. After completing the data completion, the system calls the anomaly point and its adjacent points as boundary points to determine the extended range of the inference. The rule for determining the extended range is to trace back two index positions from the anomaly point index and extend it forward two index positions to form a complete feature segment. For the anomaly at index 5, its original sequence is […-0.1, 0.3, -0.8, -0.7, 0.1…], and its extended range covers indices 3 to 7, containing the numerical sequence [-0.1, 0.3, -0.8, -0.7, 0.1]. This sequence is regarded as a complete numerical profile of the anomaly event. Finally, the numerical sequences extended from the anomaly point are collected to generate the inference range value.

[0037] The field intersection calculation submodule calls the protocol standard field set based on the estimated interval range value, compares the interval range data field with the protocol standard field in the same index dimension, establishes overlapping field records based on numerical overlap and integrates them into an intersection coefficient set to obtain the protocol field intersection coefficient; The field intersection calculation submodule, based on an anomaly event sequence of length 5 [-0.1, 0.3, -0.8, -0.7, 0.1], calls a standard pattern from a pre-set set of protocol standard fields. This set stores typical normalized interval sequences of known network attacks or anomalies, as shown in Table 4. Then, the system compares the captured anomaly event sequence with each standard sequence in the protocol standard field set one by one along the same index dimension. For example, [-0.1, 0.3, -0.8, -0.7, 0.1]... The sequence [0.7, 0.1] is compared with the standard sequence [0.0, 0.4, -0.9, -0.6, 0.2] for "DDoS attack mode A". During the comparison, the system establishes field overlap records based on the numerical overlap. The criterion for judging numerical overlap is a preset overlap tolerance threshold, which is set by calculating the standard deviation of the normalized interval sequence under the original normal traffic. The set value is 0.15. Specifically, the comparison process is to calculate the absolute difference of the values ​​at the corresponding index positions of the two sequences. The difference at the first position is... If the value is less than 0.15, it is considered an overlap. One instance of overlap is recorded, and the difference between the second position is... If the difference is less than 0.15, record the overlap again, and the difference at the third position is... If the difference is less than 0.15, the records overlap, and the difference at the fourth position is [value missing]. If the difference is less than 0.15, the records overlap, and the difference at the fifth position is [value missing]. If the value is less than 0.15, the records overlap. After comparing with "DDoS attack mode A", the system performs a ratio calculation between the number of overlapping records (5) and the total sequence length (5) to obtain the intersection coefficient. Similarly, after comparing it with the "port scan mode B" sequence, assuming the intersection coefficient is 0.2, the calculated coefficients are integrated into a set of intersection coefficients to obtain the protocol field intersection coefficients.

[0038] Table 4: Example Table of Protocol Standard Field Patterns As shown in Table 4, this table lists some preset traffic patterns used for comparison and their corresponding ideal normalized interval sequences.

[0039] The traffic pattern evaluation submodule calculates the transition probability distribution sequence using the Markov chain Monte Carlo algorithm based on the intersection coefficient of the protocol fields, performs random sampling and records the results, extracts stable trends and calculates the consistency with the initial traffic pattern corresponding to the real-time data packet traffic, and obtains complete traffic monitoring data. The traffic pattern evaluation submodule, based on the intersection coefficients of protocol fields such as {DDoS attack mode A: 1.0, port scanning mode B: 0.2, normal browsing mode C: 0.1}, first uses the coefficient values ​​as initial weights for different states, and then performs normalization processing to calculate the initial probability distribution. The total weight is... Then the initial probability of pattern A is The initial probability of pattern B is The initial probability of pattern C is Next, the system performs a random sampling process involving 10,000 iterations. In each iteration, the system generates a random number between 0 and 1 and compares this random number with the cumulative probability intervals. The first interval is greater than or equal to 0 and less than 0.769, the second interval is greater than or equal to 0.769 and less than 0.923, and the third interval is [0.923, 1.0]. If the random number is 0.543, it falls within the first interval, and the system records that "DDoS attack mode A" has been sampled once. If the random number is 0.810, it records that "port scan mode B" has been sampled once. After completing all 10,000 samplings, the system counts the frequency of the recorded results. For example, the frequency of mode A is 7701 times, mode B is 1535 times, and mode C is 764 times. This frequency distribution is considered a stable trend. Finally, the system extracts the trend with the highest frequency, i.e., mode A, and calculates its frequency. As a measure of the consistency of the input traffic pattern, this result is integrated with the corresponding pattern name to obtain complete traffic monitoring data.

[0040] Specifically, such as Figure 2 , 7 As shown, the monitoring result output module includes: The sequence difference measurement submodule acquires complete traffic monitoring data, arranges data packets in the time series of the collection, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal pattern distribution value obtained based on the statistics of the original data, and generates the difference measurement value. The sequence difference measurement submodule acquires complete traffic monitoring data, which indicates that the current traffic pattern is "DDoS attack mode A" and is associated with the original data packet collection time series during the period of the anomaly. The system first arranges the data packets under this time series and calculates the field length distribution value from them. Specifically, it extracts the length field of the data packets in the sequence to obtain a set of length values, such as { , , , , , , , } bytes, calculate the mean of the set. bytes, standard deviation is Next, the system calculates a sequence consistency metric, which involves statistically analyzing the diversity of source IP addresses in the sequence and identifying any discrepancies. There are two different source IP addresses, while the destination IP address has only one. The source-to-destination IP ratio is calculated as follows: Then, the system will compare the distribution values ​​calculated in the abnormal area with the preset distribution values ​​in "Normal Browsing Mode C". The distribution values ​​in this normal mode are predetermined by statistical analysis of a week's worth of normal network traffic, and their average field length is [value missing]. bytes, standard deviation is bytes, source-destination IP ratio is Finally, the system generates a difference metric by weighted summation of the normalized differences of the above parameters. The weight coefficients are set based on the parameters' ability to distinguish abnormal patterns, with the length mean and standard deviation both weighted at a certain value. The weight of the IP ratio is set to The normalized difference of the mean length is calculated as The normalized difference of the standard deviation is The normalized difference in IP ratio is The final difference measure is calculated as follows: .

[0041] The protocol boundary location submodule analyzes the data packets arranged in time series based on the difference metric value, detects the field length change pattern and establishes a time index by numbering, calculates the interval of continuous fields and compares it with the division benchmark interval value to obtain the protocol boundary index table. Protocol boundary positioning submodule, based on The difference metric is used to analyze data packets arranged in a time series. First, it detects the changing patterns in field lengths within the series, revealing that data packet lengths exhibit a pattern of variation within {... , } bytes and { , The phenomenon of alternating occurrences within these two ranges of bytes will cause the system to classify bytes shorter than a certain length as less than a certain length. Bytes of data packets are marked as type (Small package), length greater than The byte is marked as type (Large packet), and create a time index with a timestamp for each packet in the sequence, for example, packet The timestamp is , type data packets The timestamp is , type data packets The timestamp is , type data packets The timestamp is , type Subsequently, the system calculates the interval between consecutive fields, i.e., the calculation type changes from... Become And from Become The time interval, the first The interval is: Second; The first The interval is: Second; And so on, the calculated interval is then compared with a preset dividing baseline interval value. This baseline interval value is set with reference to the heartbeat or short polling cycle of common application layer protocols, and is set to... The system makes a judgment within seconds because Therefore, the timestamp It is marked as a protocol boundary point because Therefore, the timestamp It is also marked as a protocol boundary point. By traversing the entire time series, a protocol boundary index table that records the timestamps of the protocol boundary points is finally obtained.

[0042] The feature sequence construction submodule extracts the flow feature values ​​of the boundary segment according to the protocol boundary index table, pairs and arranges the feature values ​​with timestamps, and integrates them into a unified structure according to the segment order to obtain structured monitoring results. The feature sequence construction submodule, based on the timestamps of the recorded boundary points, and The protocol boundary index table first divides the original data packet sequence into multiple boundary segments based on the boundary points. The first segment is from the start to the timestamp. The previous data packet, the second segment is the timestamp. arrive The data packets between them are then processed, and traffic feature values ​​are extracted from each boundary segment. For the first segment, it is assumed that it contains only one data packet of length [length missing]. For data packets of bytes, the average packet length is bytes, total traffic is bytes, number of data packets For the second segment, suppose it contains a segment of length... For data packets of bytes, the average packet length is bytes, total traffic is bytes, number of data packets The extracted feature values ​​are then paired and arranged with the start timestamp of the segment to form a feature vector. For example, the feature vector of the first segment is {start timestamp:} Average package length: Total flow: Quantity of packages: The feature vector of the second segment is {start timestamp:} Average package length: Total flow: Quantity of packages: Finally, the feature vectors generated by the boundary segments are strictly integrated according to the time order of the segments to form a unified structure, as shown in Table 5. This table is then used as the structured monitoring result.

[0043] Table 5: Structured Monitoring Results As shown in Table 5, this table transforms the original, continuous data packet stream into structured data with statistical characteristics, segmented by protocol boundaries. Each row represents a traffic segment with independent statistical characteristics.

[0044] Please see Figure 8 The computer network data traffic monitoring method is based on the aforementioned computer network data traffic monitoring system and includes the following steps: S1: Collect real-time data packet traffic through the network interface, obtain protocol layer field information and timestamp data, detect changes in protocol fields between adjacent sampling points, record the time and magnitude of field changes, and generate a traffic field change record table. S2: Calculate the time difference of field changes between protocol layers based on the traffic field change record table, sort and analyze the field change sequence, detect the order of field changes, accumulate the number of synchronization states to the total number of comparisons, and generate protocol synchronization metric values. S3: Call the protocol synchronization metric to set the time window length parameter, map the value to a unified range through quantile regression algorithm, detect cross-protocol layer synchronization continuity breakpoints, identify the start and end positions of abnormal periods, record the boundary feature values ​​before and after the abnormal segment, and generate traffic anomaly monitoring results. S4: Determine the data reconstruction range based on the boundary feature values ​​of the abnormal section in the traffic anomaly monitoring results, calculate the overlapping part between the reconstruction interval and the standard protocol field, input the traffic pattern parameters into the Markov chain Monte Carlo algorithm for consistency evaluation, and generate complete traffic monitoring data; S5: Receive complete traffic monitoring data, compare the degree of difference between abnormal areas and normal patterns, parse protocol boundary location information, extract traffic feature data, arrange protocol boundaries and features by time, and generate structured monitoring results.

[0045] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A computer network data traffic monitoring system, characterized in that, The system includes: The data stream acquisition module acquires real-time data packet traffic through the network interface, collects protocol layer fields and timestamp information, detects field differences between consecutive sampling points, records the time points of change, generates a traffic field change record table, and transmits it to the protocol layer parsing module. The protocol layer parsing module receives the traffic field change record table, calculates the time interval between changes in adjacent protocol layer fields, detects the order of field changes, accumulates the ratio of the number of synchronization states to the total number of comparisons, generates a protocol synchronization metric, and transmits it to the time series feature extraction module. The timing feature extraction module receives the protocol synchronization metric value, sets a sliding time window, maps it to a unified numerical range through a quantile regression algorithm, detects cross-layer synchronization continuity to identify abnormal segments, records feature values ​​before and after the abnormal segment, generates traffic anomaly monitoring results, and transmits them to the defect compensation and reconstruction module. The defect compensation and reconstruction module receives the traffic anomaly monitoring results, determines the estimation interval based on the feature values ​​before and after the anomaly segment, calculates the intersection with the protocol standard fields, uses the Markov chain Monte Carlo algorithm to evaluate the consistency of the traffic pattern, generates complete traffic monitoring data, and transmits it to the monitoring result output module.

2. The computer network data traffic monitoring system according to claim 1, characterized in that, The traffic field change record table includes change type, time distribution and impact range; the protocol synchronization metric includes interval distribution, sequence consistency and synchronization ratio; the traffic anomaly monitoring results include abnormal segment location, continuity index and offset degree; and the complete traffic monitoring data includes estimated interval range, field intersection results and consistency evaluation value.

3. The computer network data traffic monitoring system according to claim 1, characterized in that, The data stream acquisition module includes: The data stream receiving submodule obtains real-time data packet traffic through the network interface, parses the data packet structure and extracts the protocol layer field content, matches and stores the fields with the timestamps of the data packets one by one, calls the buffer to write the field sequence sequentially and marks the sampling position, and generates the field time series value; The field difference detection submodule, based on the field time series value, calls the field values ​​and timestamps in adjacent sampling points, compares the adjacent field values ​​one by one and detects the difference magnitude, and calculates the interval duration based on the field difference results and adjacent timestamps to obtain the field difference time point set. The change record generation submodule, based on the set of time points of field differences, calls the position of field value change and the corresponding time information, arranges them linearly in chronological order and creates an index table, adds change magnitude markers to multiple records in the index table, and generates a flow field change record table.

4. The computer network data traffic monitoring system according to claim 1, characterized in that, The protocol layer parsing module includes: The field sequence acquisition submodule parses the traffic field change record table, detects the changes of fields in the transmission link, extracts time stamps and change identifiers, arranges and fits the event sequence, and calls the event sequence to integrate the changes of fields at different levels to obtain the protocol layer field change time sequence. The protocol field calculation submodule performs difference calculations on the time tags of adjacent protocol layer fields based on the time series of changes in the protocol layer fields, establishes a time interval matrix, calls the interval values ​​for sequential comparison and records the sorting, and generates the field change order. The synchronization metric generation submodule calls the field change order and time interval matrix, compares the order of fields in the protocol layer with the time interval values, calculates the cumulative number of synchronization states and performs a ratio operation with the total number of comparisons to generate the protocol synchronization metric value.

5. The computer network data traffic monitoring system according to claim 1, characterized in that, The temporal feature extraction module includes: The time-series data acquisition submodule obtains the protocol synchronization metric value as input data, sets a fixed-length sliding time window to segment the data, arranges each segment of synchronization metric value into a continuous sequence according to time order, and generates time-series feature values. The quantile mapping submodule extracts the median of the data vector for each time period as the distribution location parameter based on the time series feature value. The parameter is input into the quantile regression algorithm and compared with the preset quantile benchmark value. The normalized mapping is calculated and arranged according to the difference comparison result to obtain the normalized interval sequence. The cross-layer anomaly detection submodule calculates the difference value between adjacent time periods based on the normalized interval sequence and compares it with a preset difference threshold. The difference value exceeding the threshold is determined as an abnormal interval and recorded as a marker index. At the same time, the adjacent numerical features before and after the abnormal interval are extracted and aggregated to generate traffic anomaly monitoring results.

6. The computer network data traffic monitoring system according to claim 1, characterized in that, The defect compensation and reconstruction module includes: The feature segment estimation submodule obtains abnormal segment data from the traffic anomaly monitoring results, performs differential calculation on the feature values ​​before and after the abnormal segment and interpolates and fills in the missing parts, calls the boundary points to determine the extension range, and generates the estimation interval range value. The field intersection calculation submodule calls the protocol standard field set based on the calculated interval range value, compares the interval range data field with the protocol standard field in the same index dimension, establishes overlapping field records based on numerical overlap and integrates them into an intersection coefficient set to obtain the protocol field intersection coefficient; The traffic pattern evaluation submodule calculates the transition probability distribution sequence using the Markov chain Monte Carlo algorithm based on the intersection coefficient of the protocol fields, performs random sampling and records the results, extracts stable trends and calculates the consistency of the initial traffic pattern corresponding to the real-time data packet traffic, and obtains complete traffic monitoring data.

7. The computer network data traffic monitoring system according to claim 6, characterized in that, The estimated interval range value is a set of interval data obtained by calculating the difference of feature values ​​before and after the abnormal segment, interpolating and filling the missing parts, and combining the boundary point extension. The intersection coefficient of the protocol fields is the set of overlapping records established by comparing the calculated interval range value with the protocol standard field set in the same index dimension.

8. The computer network data traffic monitoring system according to claim 1, characterized in that, The monitoring result output module receives the complete traffic monitoring data, compares the degree of difference between abnormal areas and normal patterns obtained based on the statistics of the original data, parses the protocol boundary location information, extracts traffic feature data, arranges the protocol boundaries and features by time, and generates structured monitoring results. The structured monitoring results include the degree of difference, boundary location information, and temporal characteristics.

9. The computer network data traffic monitoring system according to claim 8, characterized in that, The monitoring result output module includes: The sequence difference measurement submodule acquires the complete traffic monitoring data, arranges the data packets in the collection time series, calculates the field length distribution value and the sequence consistency measurement value, compares the abnormal area distribution value with the normal pattern distribution value obtained based on the original data statistics, and generates the difference measurement value. The protocol boundary positioning submodule analyzes the data packets arranged in time series based on the difference metric value, detects the field length change pattern and establishes a time index by numbering, calculates the interval between consecutive fields and compares it with the division benchmark interval value to obtain the protocol boundary index table. The feature sequence construction submodule extracts the boundary segment traffic feature values ​​according to the protocol boundary index table, pairs and arranges the feature values ​​with timestamps, and integrates them into a unified structure according to the segment order to obtain structured monitoring results.

10. A method for monitoring computer network data traffic, characterized in that, The computer network data traffic monitoring system according to any one of claims 1-9 comprises the following steps: S1: Collect real-time data packet traffic through the network interface, obtain protocol layer field information and timestamp data, detect changes in protocol fields between adjacent sampling points, record the time and magnitude of field changes, and generate a traffic field change record table. S2: Calculate the time difference of field changes between protocol layers based on the traffic field change record table, sort and analyze the field change sequence, detect the order of field changes, accumulate the number of synchronization states to the total number of comparisons, and generate a protocol synchronization metric. S3: Call the protocol synchronization metric value to set the time window length parameter, map the value to a unified range through quantile regression algorithm, detect cross-protocol layer synchronization continuity breakpoints, identify the start and end positions of abnormal time periods, record the boundary feature values ​​before and after the abnormal segment, and generate traffic anomaly monitoring results. S4: Determine the data reconstruction range based on the boundary feature values ​​of the abnormal section in the traffic anomaly monitoring results, calculate the overlapping part of the reconstruction interval and the standard protocol field, input the traffic pattern parameters into the Markov chain Monte Carlo algorithm for consistency evaluation, and generate complete traffic monitoring data. S5: Receive the complete traffic monitoring data, compare the degree of difference between abnormal areas and normal modes, parse the protocol boundary location information, extract traffic feature data, arrange the protocol boundaries and features by time, and generate structured monitoring results.

Images