Traffic anomaly detection method and device, computer device, and storage medium

By generating dynamic heterogeneous graphs and combining them with prototypes of normal communication behavior in neural memory networks, the shortcomings of traditional methods in encrypted traffic detection are addressed, enabling accurate anomaly detection and threat localization of traffic in complex network relationships.

CN121644238BActive Publication Date: 2026-06-05HANGZHOU DPTECH TECH
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
HANGZHOU DPTECH TECH
Filing Date
2026-02-03
Publication Date
2026-06-05

AI Technical Summary

Technical Problem

Traditional network security detection methods struggle to effectively detect complex attack patterns when faced with encrypted traffic, especially deep packet inspection methods, which fail. Methods based on traffic statistics also struggle to capture complex attack patterns, and traditional methods are difficult to effectively model and provide interpretability in complex network relationships.

Method used

By generating a dynamic heterogeneous graph of the target communication network, encoding it using a pre-trained encoding model, and combining it with normal communication behavior prototypes learned by neural memory networks, the traffic anomaly detection results are determined based on attention weights and differential information.

Benefits of technology

It enables accurate anomaly detection of traffic in complex network relationships, improves the effectiveness and interpretability of detection, and can quickly identify abnormal traffic and locate the root cause of threats.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121644238B_ABST
    Figure CN121644238B_ABST
Patent Text Reader

Abstract

The present disclosure provides an abnormality detection method and device of traffic, a computer device and a storage medium, the method comprising: generating a dynamic heterogeneous graph of a target communication network; using a pre-trained encoding model to perform encoding processing on the dynamic heterogeneous graph to obtain node encoding features corresponding to each node in the dynamic heterogeneous graph; based on normal behavior prototypes of multiple normal communication behaviors learned by a neural memory network, performing addressing operation on the node encoding features corresponding to each node to obtain attention weights corresponding to each node and different normal behavior prototypes, respectively, and performing reconstruction processing on the node encoding features corresponding to each node according to the attention weights to obtain node reconstruction features corresponding to each node; and determining a traffic abnormality detection result corresponding to each node based on the difference information between the node reconstruction features and the node encoding features, and the attention dispersion degree corresponding to the node determined based on the attention weights.
Need to check novelty before this filing date? Find Prior Art