Flow anomaly detection method and device based on multiple time scales and online incremental learning, equipment and medium

Abstract

The invention relates to the technical field of industrial network security, and provides a traffic anomaly detection method and device based on multiple time scales and online incremental learning, equipment and a medium. The core of the method is that metadata are generated by collecting and analyzing the network traffic of the industrial control system; constructing and dynamically optimizing a network traffic behavior baseline model by combining data packet aggregation, short-term and long-term multi-window collaboration and an incremental updating mechanism; and finally, performing multi-dimensional anomaly detection on the real-time traffic by using the model. Through a multi-window cooperation mechanism, second-level instantaneous flow sudden change and hour-level long-term service trend in an industrial control network are synchronously captured, and the problem that a single detection window is poor in adaptability to a complex industrial control flow mode is effectively solved; through an incremental updating mechanism, low-overhead and self-adaptive dynamic evolution of the baseline model is realized, and the false alarm rate and the maintenance cost are remarkably reduced, so that the robustness, the accuracy and the efficiency of industrial network traffic anomaly detection are comprehensively improved.

Description

Technical Field

[0001] This invention relates to the field of industrial network security technology, specifically to a method, apparatus, device, and medium for detecting traffic anomalies based on multi-timescale and online incremental learning. In particular, this invention aims to solve the core problem of how to achieve accurate and adaptive detection of traffic anomalies, especially hybrid threats with both instantaneous and long-term latency characteristics, in complex and dynamic industrial network environments. Background Technology

[0002] The deep integration of the Industrial Internet is driving the digital transformation of industries, but it has also significantly expanded its attack surface, making industrial control systems high-value targets for cyberattacks. The traffic carried by industrial control networks exhibits complex dynamic characteristics such as significant temporal correlation, periodicity, and business determinism. Traditional network anomaly detection paradigms often rely on static baselines based on historical statistics or threshold detection within preset fixed time windows. These methods have inherent limitations: First, the model representation capability is insufficient; static baselines cannot characterize the evolution of legitimate traffic under normal operating condition switching and production plan adjustments, leading to high false positives. Second, the time scale is singular; fixed windows cannot simultaneously capture instantaneous malicious traffic injections and low-frequency, slow penetration attacks, resulting in high false negatives. Third, adaptive capabilities are lacking; model updates often rely on costly periodic forced reconstruction, failing to achieve online, progressive model learning and imposing a heavy operational burden.

[0003] Therefore, existing technologies lack an anomaly detection mechanism that can jointly characterize industrial control network traffic across multiple time scales and possess online adaptive learning capabilities, in order to achieve highly robust and accurate security monitoring with low false alarms in dynamic industrial environments. Summary of the Invention

[0004] This invention aims to overcome the shortcomings of existing traffic detection paradigms in terms of time series representation and adaptive learning, and provides a traffic anomaly detection method, device, equipment and medium based on multi-time scale and online incremental learning. This method integrates multi-resolution time series analysis with lightweight online learning algorithms, enabling multi-scale dynamic perception and online incremental learning anomaly analysis and detection of industrial control network traffic. It achieves accurate modeling and continuous tracking of the dynamic behavior of industrial control traffic, and solves the problems of high false alarm rate and high false negative rate caused by rigid models and single time perspective.

[0005] In a first aspect, the present invention provides a traffic anomaly detection method based on multi-timescale and online incremental learning, comprising: Collect network traffic in industrial control systems; The collected network traffic is subjected to in-depth analysis and session correlation to extract key communication features and generate formatted data. The formatted data is preprocessed to generate metadata, which is then stored. Based on the aforementioned metadata, an initial network traffic behavior baseline model is established by utilizing a data grouping and aggregation mechanism and combining multi-window collaborative analysis of short-term and long-term detection windows. The network traffic behavior baseline model is dynamically adjusted and optimized using a sliding window-based incremental update mechanism. The dynamically adjusted and optimized network traffic behavior baseline model is used to perform anomaly analysis and detection on real-time network traffic in industrial control systems.

[0006] In a preferred embodiment, establishing an initial network traffic behavior baseline model includes: For metadata, the average number of bytes of traffic, network traffic detection threshold, and network traffic detection cycle of communication groups with the same source IP address, destination IP address, and application protocol are statistically calculated using a data grouping and aggregation mechanism. Based on the multi-window collaboration mechanism, the traffic statistics of the short-term and long-term windows are initialized for short-term traffic mutation detection and long-term traffic trend analysis, including the window sum and the window square sum. Based on the calculated average number of bytes per second, network traffic detection threshold, network traffic detection period, and initialized traffic statistics, a baseline model of network traffic behavior is constructed to characterize the communication link behavior of specific process services.

[0007] In a preferred embodiment, the step of using a data packet aggregation mechanism to statistically calculate the average number of bytes of traffic, the network traffic detection threshold, and the network traffic detection period for communication groups with the same source IP address, destination IP address, and application protocol includes: Extract metadata for the sampling period from a distributed database; Using an aggregation algorithm, the extracted metadata is grouped according to the source IP address, destination IP address, and application protocol. Each group corresponds to a communication link and contains multiple metadata F={f1,f2}. 2, ...,f n}; Calculate each metadata f within the same group i Average data throughput in bytes per second (y) i , where y i =z i / t i , z i t represents the number of bytes in the traffic. i Session duration; Take the maximum average number of bytes of traffic across all metadata within this group as the network traffic detection threshold for this link: th=max(y1,y2,...,y iThe maximum session duration is taken as the network traffic detection period t=max(t1,t2…t). i ).

[0008] In a preferred embodiment, the step of initializing traffic statistics for the short-term and long-term windows based on the multi-window collaboration mechanism includes: Based on the aggregation grouping results, a unique ID is assigned to each communication link, and short-term and long-term windows of different durations are set according to its network traffic detection cycle. For the set short-term and long-term windows, a sliding window model is used to initialize and calculate the sum S and sum of squares SQ for each window: The calculation and update cycle of subsequent windows is determined based on the period length of the short-term and long-term windows, respectively.

[0009] In a preferred embodiment, constructing a baseline model of network traffic behavior characterizing the communication link behavior of a specific process includes: Each piece of metadata is assigned a unique identifier (ID) based on its source IP address, destination IP address, and application protocol. The metadata set with the ID, along with the calculated network traffic detection threshold, average traffic bytes, network traffic detection cycle, window calculation update cycle, long-term window sum and long-term window sum of squares, short-term window sum and short-term window sum of squares, are persistently stored in a distributed database to form a baseline model of network traffic behavior.

[0010] In a preferred embodiment, the step of dynamically adjusting and optimizing the network traffic behavior baseline model using a sliding window-based incremental update mechanism includes: The update cycle is calculated based on a preset window, triggering a sliding update of the window; when the window is updated, the newly inflowing network traffic x is used as the basis for the update. n and the old network traffic that was moved out x n-1 Update the current window sum using an incremental calculation method. and window sum of squares Based on the updated window sum S n and window square SQ n Calculate the mean μ and standard deviation σ of the window flow, and determine whether the current window flow is abnormal based on the mean μ and standard deviation σ; If the traffic is normal, then synchronously update the network traffic behavior baseline model: re-aggregate network traffic within the window, according to th=max(y1,y2,...,y i ,th old ) and t=max(t1,t2,...,t i ,t oldFollowing the principle of updating the network traffic detection threshold and network traffic detection cycle of the communication link, adaptive optimization of the network traffic behavior baseline model is achieved.

[0011] In a preferred embodiment, the step of using a network traffic behavior baseline model to perform anomaly analysis and detection on real-time network traffic includes: Abnormal network communication behavior detection: By comparing the communication characteristics of real-time traffic with the normal communication links recorded in the network traffic behavior baseline model, behaviors such as unauthorized access, unauthorized external connections, and asset impersonation can be identified. Instantaneous time-scale traffic detection: Compare the average byte rate of real-time traffic with the network traffic detection threshold in the network traffic behavior baseline model to detect sudden traffic anomalies; Traffic detection at a unit time scale: By combining the network traffic detection threshold and network detection period in the network traffic behavior baseline model, abnormal sessions that continuously exceed the threshold or have no traffic for a long time are detected. Abnormal traffic alert: An alert mechanism is automatically triggered when any of the above abnormalities are detected.

[0012] Secondly, the present invention provides a traffic anomaly detection device based on multi-timescale and online incremental learning, comprising: The network traffic acquisition module is used to collect network traffic in industrial control systems. The industrial network traffic analysis module is used to perform deep analysis and session correlation on the collected network traffic, extract key communication features, and generate formatted data. The data preprocessing module is used to preprocess the formatted data, generate metadata, and store it. The baseline model building module is used to establish an initial network traffic behavior baseline model based on the metadata, using a data grouping and aggregation mechanism, and combining multi-window collaborative analysis of short-term and long-term detection windows. The baseline dynamic adjustment module is used to dynamically adjust and optimize the network traffic behavior baseline model using a sliding window-based incremental update mechanism. The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time network traffic using the dynamically adjusted and optimized network traffic behavior baseline model.

[0013] Thirdly, the present invention also provides an electronic device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the method described above.

[0014] Fourthly, the present invention also provides a computer-readable storage medium for storing instructions that, when executed, cause the above-described method to be implemented.

[0015] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: 1. Deep perception capability through multi-window collaboration: By establishing short-term windows at the second level and long-term windows at the hour level, this invention can simultaneously perceive instantaneous changes and long-term trend changes in network traffic. The short-term window ensures a rapid response to sudden attacks, while the long-term window effectively identifies deep-seated anomalies such as slow attacks and business model drift, solving the problem of missed detections in complex industrial control scenarios using a single window.

[0016] 2. Incremental Update-Driven Adaptive Evolution: This invention abandons the traditional method of reconstructing models from full data and adopts an incremental update algorithm. During window sliding, window statistics (sum and sum of squares) only need to be updated based on the new and old traffic values, resulting in low computational complexity and minimal resource consumption. This enables the baseline model to achieve near real-time dynamic adjustment with extremely low overhead, adapting to normal changes in the network environment and business requirements, thereby significantly reducing false alarms and decreasing reliance on manual adjustments, thus lowering maintenance costs.

[0017] 3. Overall Enhancement of Synergistic Effect: The multi-window mechanism in this invention provides rich traffic views with different time granularities for incremental updates, while incremental updates ensure that multi-window statistics can be kept up-to-date efficiently and in real time. The close integration of these two aspects enables the detection system provided by this invention to possess both detection sensitivity, comprehensive coverage, and economical operation and maintenance, thereby improving the robustness and practicality of industrial network traffic anomaly detection as a whole. Attached Figure Description

[0018] Figure 1 The flowchart illustrates a traffic anomaly detection method based on multi-timescale and online incremental learning, provided for embodiments of the present invention.

[0019] Figure 2 This is a flowchart illustrating the initial establishment of the network traffic behavior baseline model in an embodiment of the present invention.

[0020] Figure 3 This is a flowchart illustrating the dynamic update of the network traffic behavior baseline model in an embodiment of the present invention.

[0021] Figure 4 This is a schematic diagram of a traffic anomaly detection device based on multi-timescale and online incremental learning, provided in an embodiment of the present invention.

[0022] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0024] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0025] like Figure 1 As shown, this embodiment of the invention provides a traffic anomaly detection method based on multiple time scales and online incremental learning, including the following steps: S100 collects network traffic in industrial control systems; S200 performs in-depth analysis and session correlation on the collected network traffic, extracts key communication features, and generates formatted data. S300, the formatted data is preprocessed to generate metadata and stored; S400, based on the aforementioned metadata, using a data grouping and aggregation mechanism, and combining multi-window collaborative analysis of short-term and long-term detection windows, an initial network traffic behavior baseline model is established. S500 utilizes a sliding window-based incremental update mechanism to dynamically adjust and optimize the network traffic behavior baseline model; The S600 uses the dynamically adjusted and optimized network traffic behavior baseline model to perform anomaly analysis and detection on real-time network traffic in industrial control systems.

[0026] Further, in step S200, network traffic containing industrial protocols is filtered out through deep parsing. Based on this, according to the characteristics of the communication quintuple, the traffic containing industrial protocols is subjected to session association and reconstruction. Key network features, including source IP address, destination IP address, source MAC address, destination MAC address, destination port, application protocol type, transport protocol type, total number of traffic bytes, and session duration, are systematically extracted to generate session-level formatted data with a unified format.

[0027] Furthermore, in step S300, preprocessing the formatted data includes: removing duplicate records, correcting abnormal timestamps, and filtering invalid sessions. Subsequently, standardized metadata is constructed and persistently stored in a distributed database, providing a high-quality data foundation for baseline modeling of network traffic behavior.

[0028] Further, in step S400, establishing the initial network traffic behavior baseline model includes: S410, for metadata, utilizes a data grouping and aggregation mechanism to statistically calculate the average number of bytes of traffic, network traffic detection threshold, and network traffic detection period for communication groups with the same source IP address, destination IP address, and application protocol. Specifically: historical metadata within a specified sampling period is extracted from a distributed database. Using an aggregation algorithm, the extracted metadata is grouped using source IP address, destination IP address, and application protocol as composite key features. Each group represents a specific communication link. For the metadata set F={f1,f2,...,f...} within each group... n}, calculate each metadata f i Average data throughput in bytes per second (y) i , where y i =z i / t i , z i t represents the number of bytes in the traffic. i This represents the session duration. It also represents the average number of bytes per second (y) of all metadata within the group. i The maximum value is established as the initial network traffic detection threshold th = max(y1, y2, ..., y i ), and the session duration t of all metadata i The maximum value is set to the initial network traffic detection period t = max(t1, t2, ... t). i ); S420, based on a multi-window collaborative mechanism, initializes the traffic statistics for short-term and long-term windows, including the window sum and window sum of squares, for short-term traffic mutation detection and long-term traffic trend analysis, respectively. Specifically, based on the aggregated packets obtained by S410, a unique ID is assigned to each communication link. Traffic detection for the same network period is statistically analyzed according to the ID. Short-term windows (second-level, based on a session duration of 60 seconds, capturing short-term traffic mutations) and long-term windows (hour-level, 1-12 hours, capturing long-term trend changes) are set according to different network traffic detection periods. For the set short-term and long-term windows, a sliding window is used to statistically analyze the window sum and window sum of squares per unit time. For each configured short-term and long-term window, its traffic statistics are initialized: window sum S (i.e., total traffic within the window) and window sum of squares SQ (i.e., the sum of squares of traffic within the window). The calculation formulas are as follows: Window sum S of short-term and long-term windows: The sum of squares (SQ) of short-term and long-term windows: .in Let be the network traffic observation value of the i-th window; n is the number of windows. During the initialization phase, it is recommended that the maximum number of samples for a second-level window be 1000, and the maximum number of samples for an hour-level window be 100. Finally, the total sum of long-term windows S after initialization is obtained. l-init and long-term window sum of squares SQ l-init Short-term window sum S s-init and short-term window sum of squares SQ s-init Simultaneously, based on the periodic characteristics of different windows, the window calculation update period t required for subsequent incremental calculations is determined. w .

[0029] S430, based on the calculated average traffic bytes, network traffic detection threshold, network traffic detection period, and initialized traffic statistics, constructs a baseline model of network traffic behavior characterizing the communication link behavior of specific process services. Specifically: for each piece of metadata after calculation, its source IP address, destination IP address, and application protocol are concatenated and then subjected to encrypted hashing to generate a globally unique service link identification number (ID). All feature information, calculation parameters, and statistics associated with this ID (including source IP address, destination IP address, application protocol, source MAC, destination MAC, destination port, transport protocol, network traffic detection threshold th, average traffic bytes y, network traffic detection period t, and window calculation update period t) are then used to construct a baseline model of network traffic behavior characterizing the communication link behavior of specific process services. w The long-term window sum and long-term window sum of squares, short-term window sum and short-term window sum of squares) are integrated into a complete baseline model instance and persistently stored in a distributed database, thereby forming a queryable and updatable network traffic behavior baseline model.

[0030] Further, in step S500, the step of dynamically adjusting and optimizing the network traffic behavior baseline model using a sliding window-based incremental update mechanism includes: S510 calculates the update cycle based on a preset window and triggers a window sliding update; when the window is updated, it updates based on the newly incoming network traffic x. n and the old network traffic that was moved out x n-1 The current window sum is updated using an incremental calculation method. Specifically: the update period t is calculated based on the window set in S420. w This triggers the sliding window update event. When a long-term or short-term window reaches its window calculation update period, all network protocol sessions within that window range are counted, and the corresponding current network traffic is retrieved from the distributed database based on their communication link IDs. Subsequently, an incremental calculation method is used to efficiently refresh the window's traffic statistics: the current window summation... Current window sum of squares Where n is the current window number, This represents the current window's network traffic observation. Then, based on the updated window total S... n and window square SQ n Calculate the mean μ and standard deviation σ of the window flow, and determine whether the current window flow is abnormal based on the mean μ and standard deviation σ. Specifically, calculate the mean of the window sum. with total standard deviation To avoid negative standard deviation, If we set the sensitivity coefficient k for anomaly detection (based on the characteristics of normal distribution, k is usually set to 3), then the judgment condition for abnormal flow is: or When the current window network traffic Falling at the threshold If the data is outside the specified range, it indicates abnormal traffic within the current period. In this case, the window threshold will not be updated by sliding, and the sum of the previous window will be retained. Sum of squares of the previous window When the current window network traffic Falling at the threshold If the data is within the specified range, it indicates that the network traffic within this window is normal. Update the window detection threshold and sum the current window data. With the current window sum of squares As a new window threshold.

[0031] S520, if traffic is normal, then synchronously update the network traffic behavior baseline model. Specifically: count all network protocol sessions that need adjustment within the current window, regroup them according to the aggregation algorithm described in S410, and re-aggregate the network traffic within the window. Calculate the average number of bytes per second (y) of each metadata element in the same group within the current window. i Based on the ID generated from the current window traffic (based on the source IP address, destination IP address, and application protocol of the current window traffic), the corresponding network traffic detection threshold th is retrieved from the distributed database. old Network traffic detection period t old The new network traffic detection threshold for each group is th=max( , ,..., ,th old The new network traffic detection period is t=max(t1,t2…t). i ,t old The new network traffic detection threshold and network traffic detection cycle are updated and written into the distributed database to achieve adaptive optimization of the network traffic behavior baseline model.

[0032] Further, in step S600, the step of using the dynamically adjusted and optimized network traffic behavior baseline model to perform anomaly analysis and detection on real-time network traffic in the industrial control system includes: S610, Abnormal Network Communication Behavior Detection: By comparing the communication characteristics (IP-MAC-port-protocol) of real-time traffic with the normal communication links recorded in the network traffic behavior baseline model, abnormal network communication behavior is identified. (1) Communication requests with unknown source IP addresses indicate a risk of abnormal asset access; (2) When a new IP address is detected as the destination IP, it indicates a risk of unauthorized external asset connections; (3) By comparing the consistency of IP address and MAC address, the authenticity and integrity of network assets can be ensured. If they are inconsistent, there is a risk of asset counterfeiting. (4) Check the usage of different destination ports under the transmission protocol and the use of unauthorized destination ports to identify potential risks of unauthorized business access.

[0033] S620, Instantaneous Time-Scale Traffic Detection: Compares the average byte rate of real-time traffic with the network traffic detection threshold in the network traffic behavior baseline model to detect sudden traffic anomalies. Specifically, based on the preset network traffic detection threshold th for each communication link in the network traffic behavior baseline model, the average number of bytes of real-time network traffic is calculated and compared in real-time with the corresponding network traffic detection threshold th, thereby quickly detecting abnormal behaviors such as sudden changes in traffic rate caused by scanning or storm attacks in industrial control networks. S630, Unit Time Scale Traffic Detection: Combining the network traffic detection threshold th and the network traffic detection period t in the network traffic behavior baseline model, abnormal sessions that continuously exceed the threshold or have no traffic for extended periods are detected in real-time. Detection includes: whether real-time network traffic continuously exceeds the network traffic detection threshold th of its communication link. If multiple sessions exist within the same network traffic detection period t, the sessions are merged, and the average number of bytes of traffic is calculated to determine if the limit has been exceeded. Simultaneously, it monitors whether real-time network traffic shows no packets for multiple consecutive (e.g., 3 or more) network traffic detection periods t. Such silent behavior may indicate communication interruption, device disconnection, or specific malicious infiltration behavior.

[0034] S640, Abnormal Traffic Alarm: When real-time network traffic violates the normal behavior rules defined by the network traffic behavior baseline model in any detection, the integrated response alarm mechanism is automatically triggered to generate structured alarm information.

[0035] Based on the same technical concept, the present invention also provides a traffic anomaly detection device based on multiple time scales and online incremental learning, comprising: The network traffic acquisition module is used to collect network traffic in industrial control systems. The industrial network traffic analysis module is used to perform deep analysis and session correlation on the collected network traffic, extract key communication features, and generate formatted data. The data preprocessing module is used to preprocess the formatted data, generate metadata, and store it. The baseline model building module is used to establish an initial network traffic behavior baseline model based on the metadata, using a data grouping and aggregation mechanism, and combining multi-window collaborative analysis of short-term and long-term detection windows. The baseline dynamic adjustment module is used to dynamically adjust and optimize the network traffic behavior baseline model using a sliding window-based incremental update mechanism. The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time network traffic using the dynamically adjusted and optimized network traffic behavior baseline model.

[0036] The working principle of each functional module in the above device can be referred to the description in the foregoing method embodiments, and will not be repeated here.

[0037] Based on the same technical concept, embodiments of this application also provide an electronic device that can implement the traffic anomaly detection method based on multi-timescale and online incremental learning provided in the above embodiments of this application. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 5 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment, the specific connection medium between the processor and the memory is not limited. Figure 5 The example used is the connection between the processor and memory via a bus. The bus... Figure 5 The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 5 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0038] In this embodiment of the application, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute the traffic anomaly detection method based on multiple time scales and online incremental learning discussed above.

[0039] The processor is the control center of the device. It can connect to various parts of the control device through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the device's various functions and process data, thereby enabling overall monitoring of the device.

[0040] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0041] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the traffic anomaly detection method based on multi-timescale and online incremental learning disclosed in the embodiments of this application can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0042] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited to this. The memory in the embodiments of this application can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0043] By designing and programming the processor, the code corresponding to the traffic anomaly detection method based on multi-timescale and online incremental learning described in the foregoing embodiments can be embedded into the chip. This enables the chip to perform the steps of the traffic anomaly detection method based on multi-timescale and online incremental learning described in the foregoing embodiments during operation. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated here.

[0044] Based on the same inventive concept, embodiments of this application also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a traffic anomaly detection method based on multiple time scales and online incremental learning as described above.

[0045] In some alternative implementations, this application also provides a method for detecting traffic anomalies based on multiple time scales and online incremental learning, which can also be implemented as a program product including program code. When the program product is run on a device, the program code is used to cause the control device to perform the steps in a traffic anomaly detection method based on multiple time scales and online incremental learning according to various exemplary embodiments of this application as described above.

[0046] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0047] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0048] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0049] Program code for performing the operations of this application can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0050] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0051] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0052] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0053] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A traffic anomaly detection method based on multi-timescale and online incremental learning, characterized in that, include: Collect network traffic in industrial control systems; The collected network traffic is subjected to in-depth analysis and session correlation to extract key communication features and generate formatted data. The formatted data is preprocessed to generate metadata, which is then stored. Based on the aforementioned metadata, an initial network traffic behavior baseline model is established by utilizing a data grouping and aggregation mechanism and combining multi-window collaborative analysis of short-term and long-term detection windows. The network traffic behavior baseline model is dynamically adjusted and optimized using a sliding window-based incremental update mechanism. The dynamically adjusted and optimized network traffic behavior baseline model is used to perform anomaly analysis and detection on real-time network traffic in industrial control systems.

2. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 1, characterized in that, The establishment of the initial network traffic behavior baseline model includes: For metadata, the average number of bytes of traffic, network traffic detection threshold, and network traffic detection cycle of communication groups with the same source IP address, destination IP address, and application protocol are statistically calculated using a data grouping and aggregation mechanism. Based on the multi-window collaboration mechanism, the traffic statistics of the short-term and long-term windows are initialized for short-term traffic mutation detection and long-term traffic trend analysis, including the window sum and the window square sum. Based on the calculated average number of bytes per second, network traffic detection threshold, network traffic detection period, and initialized traffic statistics, a baseline model of network traffic behavior is constructed to characterize the communication link behavior of specific process services.

3. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 2, characterized in that, The method of utilizing data packet aggregation mechanism to statistically calculate the average number of bytes of traffic, network traffic detection threshold, and network traffic detection period for communication groups with the same source IP address, destination IP address, and application protocol includes: Extract metadata for the sampling period from a distributed database; Using an aggregation algorithm, the extracted metadata is grouped according to the source IP address, destination IP address, and application protocol. Each group corresponds to a communication link and contains multiple metadata F={f1,f2}. 2, ...,f n }; Calculate each metadata f within the same group i Average data throughput in bytes per second (y) i , where y i =z i / t i , z i t represents the number of bytes in the traffic. i Session duration; Take the maximum average number of bytes of traffic across all metadata within this group as the network traffic detection threshold for this link: th=max(y1,y2,...,y i The maximum session duration is taken as the network traffic detection period t=max(t1,t2…t). i ).

4. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 3, characterized in that, The multi-window collaborative mechanism initializes the traffic statistics for the short-term and long-term windows for short-term traffic mutation detection and long-term traffic trend analysis, including: Based on the aggregation grouping results, a unique ID is assigned to each communication link, and short-term and long-term windows of different durations are set according to its network traffic detection cycle. For the set short-term and long-term windows, a sliding window model is used to initialize and calculate the window sum S and window sum of squares SQ for each short-term and long-term window: The calculation and update cycle of subsequent windows is determined based on the period length of the short-term and long-term windows, respectively.

5. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 4, characterized in that, The construction of a baseline model for network traffic behavior characterizing the communication link behavior of specific processes includes: Each piece of metadata is assigned a unique identifier (ID) based on its source IP address, destination IP address, and application protocol. The metadata set with the ID, along with the calculated network traffic detection threshold, average traffic bytes, network traffic detection cycle, window calculation update cycle, long-term window sum and long-term window sum of squares, short-term window sum and short-term window sum of squares, are persistently stored in a distributed database to form a baseline model of network traffic behavior.

6. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 5, characterized in that, The method of dynamically adjusting and optimizing the network traffic behavior baseline model using a sliding window-based incremental update mechanism includes: The update cycle is calculated based on a preset window, triggering a sliding update of the window; when the window is updated, the newly inflowing network traffic x is used as the basis for the update. n and the old network traffic that was moved out x n-1 Update the current window sum using an incremental calculation method. and window sum of squares Based on the updated window sum S n and window square SQ n Calculate the mean μ and standard deviation σ of the window flow, and determine whether the current window flow is abnormal based on the mean μ and standard deviation σ; If the traffic is normal, then synchronously update the network traffic behavior baseline model: re-aggregate network traffic within the window, according to th=max(y1,y2,...,y i ,th old ) and t=max(t1,t2,...,t i ,t old Following the principle of updating the network traffic detection threshold and network traffic detection cycle of the communication link, adaptive optimization of the network traffic behavior baseline model is achieved.

7. The traffic anomaly detection method based on multi-timescale and online incremental learning according to claim 1, characterized in that, The method of using a network traffic behavior baseline model to perform anomaly analysis and detection on real-time network traffic includes: Abnormal network communication behavior detection: By comparing the communication characteristics of real-time traffic with the normal communication links recorded in the network traffic behavior baseline model, behaviors such as unauthorized access, unauthorized external connections, and asset impersonation can be identified. Instantaneous time-scale traffic detection: Compare the average byte rate of real-time traffic with the network traffic detection threshold in the network traffic behavior baseline model to detect sudden traffic anomalies; Traffic detection on a unit time scale: Combines network traffic detection thresholds with network detection cycles to detect abnormal sessions that continuously exceed the threshold or have no traffic for a long time; Abnormal traffic alert: An alert mechanism is automatically triggered when any of the above abnormalities are detected.

8. A traffic anomaly detection device based on multi-timescale and online incremental learning, characterized in that, include: The network traffic acquisition module is used to collect network traffic in industrial control systems. The industrial network traffic analysis module is used to perform deep analysis and session correlation on the collected network traffic, extract key communication features, and generate formatted data. The data preprocessing module is used to preprocess the formatted data, generate metadata, and store it. The baseline model building module is used to establish an initial network traffic behavior baseline model based on the metadata, using a data grouping and aggregation mechanism, and combining multi-window collaborative analysis of short-term and long-term detection windows. The baseline dynamic adjustment module is used to dynamically adjust and optimize the network traffic behavior baseline model using a sliding window-based incremental update mechanism. The real-time traffic access and detection module is used to perform anomaly analysis and detection on real-time network traffic using the dynamically adjusted and optimized network traffic behavior baseline model.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-7 to be implemented.

Images