A Deep Learning-Based Method and System for Detecting East-West Traffic Anomalies in Data Centers

Abstract

This invention provides a method and system for detecting anomalies in east-west traffic in data centers based on deep learning, belonging to the field of network security technology. The method includes collecting east-west traffic data and extracting feature vectors; learning temporal dependencies through a deep neural network to obtain multi-time-granular temporal features and constructing a traffic behavior baseline; extracting service session identifiers and service call link information to form enhanced features; identifying abnormal traffic by calculating deviation metrics and link consistency checks; and tracing bidirectionally along the service call link to determine the initial abnormal node and the abnormal injection point, constructing an anomaly propagation causal graph. This method achieves accurate detection and source tracing of east-west traffic anomalies.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting anomalies in east-west traffic in data centers based on deep learning. Background Technology

[0002] With the rapid development of cloud computing and big data technologies, data centers have become the core infrastructure for enterprises' critical business and data processing. In modern data center architectures, east-west traffic (i.e., horizontal communication traffic between servers) has surpassed north-south traffic (i.e., communication traffic between servers and external networks), accounting for more than 70% of the total traffic within the data center. This east-west traffic mainly originates from service calls between distributed applications, inter-component communication in microservice architectures, and data synchronization and replication operations.

[0003] Most existing methods rely on static rules or simple statistical models for detection, making it difficult to effectively identify complex temporal dependencies and behavioral patterns. They also lack sufficient expressive power for high-dimensional east-west traffic with time-varying characteristics, easily leading to high false positive and false negative rates. Existing anomaly detection methods often analyze traffic in isolation, ignoring the call relationships and business semantics between services within the data center. They fail to utilize the contextual information of service call chains in microservice architectures for comprehensive judgment, resulting in detection results lacking business relevance interpretation. Summary of the Invention

[0004] This invention provides a method and system for detecting anomalies in east-west traffic in data centers based on deep learning, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a deep learning-based method for detecting anomalies in east-west traffic in data centers, comprising:

[0006] East-west traffic data is collected from network switching nodes in the data center, and traffic feature vectors are extracted.

[0007] The traffic feature vector is input into a deep neural network, and the temporal dependency relationship of the traffic feature vector is learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities.

[0008] Based on the aforementioned temporal features, normal traffic patterns are encoded to construct a traffic behavior baseline. The business session identifier and service call link information to which the traffic to be detected belongs are extracted and associated with each other to obtain enhanced features containing business semantics.

[0009] Calculate the deviation metric between the enhanced feature and the traffic behavior baseline. Simultaneously, based on the traffic status of the preceding node and the traffic status of the subsequent node in the service call link information, perform link consistency verification on the traffic to be detected. When the deviation metric exceeds a preset deviation threshold or the link consistency verification fails, mark the traffic to be detected as abnormal traffic.

[0010] For the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the first abnormal node and the abnormal injection point on the abnormal propagation path; based on the first abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of abnormal impact is quantified to generate east-west traffic abnormal information of the data center.

[0011] The traffic feature vector is input into a deep neural network, and the temporal dependency relationship of the traffic feature vector is learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities, including:

[0012] In the deep neural network, the traffic feature vector is organized into a time series according to timestamp information. A sliding time window is applied to the time series to obtain multiple time window segments. A Fourier transform is performed on the traffic feature vector in each time window segment to decompose the time series into frequency spectrum coefficients. According to a preset frequency threshold, the frequency spectrum coefficients with frequency values ​​greater than the frequency threshold are classified as fast-changing frequency bands, and the frequency spectrum coefficients with frequency values ​​less than the frequency threshold are classified as slow-changing frequency bands.

[0013] Transient flow change features are extracted from the rapidly changing frequency bands, and flow trend evolution features are extracted from the slowly changing frequency bands to obtain multi-band time-series features;

[0014] Using the timestamps of the traffic feature vectors as nodes and time adjacency and feature similarity as edges, a traffic temporal dependency graph structure is constructed. A graph neural network is then used to perform message propagation and node feature aggregation on the traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships.

[0015] Calculate the correlation strength between different frequency bands in the multi-band time series features and different nodes in the graph embedding features. Based on the correlation strength, perform cross-domain feature alignment and fusion on the multi-band time series features and the graph embedding features to obtain time series features containing multiple time granularities.

[0016] Using the timestamps of the traffic feature vectors as nodes and temporal adjacency and feature similarity as edges, a traffic temporal dependency graph structure is constructed. A graph neural network is then used to perform message propagation and node feature aggregation on this traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships, including:

[0017] For each timestamp of the traffic feature vector, the time interval between the timestamp and other timestamps is calculated, and time adjacency edges are established between timestamp pairs whose time interval is less than a preset time threshold. At the same time, the feature distance between different timestamps of the traffic feature vector is calculated, and feature similarity edges are established between timestamp pairs whose feature distance is less than a preset similarity threshold. The traffic time-series dependency graph structure containing time adjacency edges and feature similarity edges is constructed.

[0018] In the aforementioned traffic temporal dependency graph structure, each node is initialized with a traffic feature vector corresponding to the timestamp. Through the multi-layer message propagation mechanism of the graph neural network, the feature information of temporally continuous neighboring nodes is aggregated along the temporal adjacency edge of each node, and the feature information of feature-similar neighboring nodes is aggregated along the feature similarity edge, so as to obtain the node update feature that integrates temporal continuity and feature similarity.

[0019] The number of temporally adjacent edges and the number of feature-similar edges connected to each node in the traffic temporal dependency graph structure are counted. The topological centrality of the node is calculated based on the number of edges as the importance weight of the node in the temporal sequence. The node update features of all nodes in the traffic temporal dependency graph structure are weighted and aggregated according to the importance weight to obtain the graph embedding features containing the temporal topological relationship.

[0020] Based on the aforementioned temporal characteristics, normal traffic patterns are encoded to construct a traffic behavior baseline. The service session identifier and service call link information to which the traffic to be detected belongs are extracted and associated with each other, resulting in enhanced features containing business semantics, including:

[0021] The time-series features are projected onto a low-dimensional representation space, and the feature similarity between different time-series features is calculated in the low-dimensional representation space. Based on the feature similarity, the time-series features are divided into multiple traffic pattern clusters.

[0022] Calculate the cluster center feature vector and intra-cluster feature dispersion of the traffic pattern cluster, use the cluster center feature vector as the encoding representation of the traffic pattern cluster, and use the intra-cluster feature dispersion as the boundary of the normal variation range of the traffic pattern cluster to construct the traffic behavior baseline;

[0023] Extract the service session identifier to which the traffic to be detected belongs. The service session identifier contains a unique session identifier. Use the unique session identifier to trace the service call link information of the traffic to be detected in the data center.

[0024] Record the service call chain information corresponding to each business session identifier, as well as the business role attributes of each node in the service call chain information, to form a mapping table; based on the mapping table, encode the business session identifier, the service call chain information, and the business role attributes into a business semantic feature vector, and concatenate the business semantic feature vector with the temporal features of the traffic to be detected to obtain an enhanced feature containing business semantics.

[0025] Calculating the deviation metric between the enhanced feature and the traffic behavior baseline, and simultaneously performing link consistency verification on the traffic to be detected based on the preceding node traffic status and subsequent node traffic status in the service call link information, including:

[0026] The feature space distance between the enhanced feature and the cluster center feature vector is calculated as the baseline deviation distance. At the same time, it is calculated whether the enhanced feature exceeds the normal variation range boundary of the flow pattern cluster. The deviation metric value is obtained based on the comparison result of the baseline deviation distance and the normal variation range boundary.

[0027] Based on the service call link information, the traffic state vectors of the preceding nodes, the traffic state vectors of the following nodes, and the enhanced features in the business session corresponding to the traffic to be detected are concatenated into a link traffic state tensor according to the service call order; the link traffic state tensor is subjected to temporal convolution transformation to extract the temporal evolution pattern features of the traffic within the link; the matching degree between the temporal evolution pattern features and each preset normal link evolution pattern is calculated; and the normal link evolution pattern with the highest matching degree is taken as the link reference pattern.

[0028] The influence weight distribution of the deviation metric on the traffic state vector of the preceding node and the traffic state vector of the subsequent node is analyzed by the gradient backpropagation mechanism. When the difference between the influence weight distribution and the normal influence weight distribution in the link reference mode exceeds the preset link consistency threshold, it is determined that the traffic to be detected has a link consistency anomaly, and the link consistency verification result is obtained.

[0029] For the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the initial abnormal node and the abnormal injection point on the abnormal propagation path, including:

[0030] Extract the complete service call node sequence from the service call chain information, construct a directed call topology graph based on the call order relationship of each node in the service call node sequence, and mark the position of the node corresponding to the abnormal traffic in the directed call topology graph;

[0031] Backtrack upstream along the reverse edge of the directed call topology graph, query the historical traffic status of each level of predecessor nodes corresponding to the abnormal traffic node in turn, calculate the deviation between the historical traffic status of each level of predecessor nodes and the baseline of normal traffic behavior, and mark the predecessor node whose deviation first exceeds the abnormal judgment threshold as the first abnormal node.

[0032] Starting from the first abnormal node, downstream tracing is performed along the positive edges of the directed call topology graph to obtain the complete propagation path from the first abnormal node to the node corresponding to the abnormal traffic. The traffic state transition records of each intermediate node on the propagation path are extracted, the gain contribution of each intermediate node to the traffic abnormality characteristics is analyzed, and the intermediate node whose gain contribution exceeds the contribution threshold is identified as the abnormal injection point.

[0033] Based on the initial abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of the abnormal impact is quantified. This generates abnormal east-west traffic information for the data center, including:

[0034] Using the first abnormal node as the root node, the abnormal injection point as the intermediate propagation node, and the node corresponding to the abnormal traffic as the termination node, the abnormal propagation causal graph is constructed.

[0035] Starting from the root node, a breadth-first search is performed along the directed causal edge on the anomaly propagation causal graph to identify all service call nodes reachable from the root node as the directly affected node set. The business session connection relationship of each node in the directly affected node set is queried. Service call nodes that have business session connections with nodes in the directly affected node set are marked as the indirectly affected node set. The anomaly propagation distance of each node in the directly affected node set is calculated.

[0036] Based on the abnormal propagation distance, for each node in the set of directly affected nodes, the shortest abnormal propagation path from the root node to the target node is obtained. The propagation attenuation weights corresponding to all directed causal edges on the shortest abnormal propagation path are extracted and multiplied to obtain the abnormal impact attenuation coefficient. The impact level is divided based on the abnormal impact attenuation coefficient.

[0037] The abnormal propagation causal graph, the set of directly affected nodes, the set of indirectly affected nodes, and the impact level are integrated to generate the east-west traffic anomaly information of the data center.

[0038] A second aspect of the present invention provides a deep learning-based east-west traffic anomaly detection system for data centers, comprising:

[0039] The first unit is used to collect east-west traffic data from the network switching nodes of the data center and extract traffic feature vectors;

[0040] The second unit is used to input the traffic feature vector into a deep neural network, and learn the temporal dependency relationship of the traffic feature vector through a multi-layer neural network structure to obtain temporal features containing multiple time granularities.

[0041] The third unit is used to encode the normal traffic pattern based on the time-series features, construct a traffic behavior baseline, extract the business session identifier and service call link information to which the traffic to be detected belongs and perform association mapping to obtain enhanced features containing business semantics.

[0042] The fourth unit is used to calculate the deviation metric between the enhanced feature and the traffic behavior baseline. At the same time, based on the traffic status of the preceding node and the traffic status of the subsequent node in the service call link information, the unit performs link consistency verification on the traffic to be detected. When the deviation metric exceeds the preset deviation threshold or the link consistency verification fails, the traffic to be detected is marked as abnormal traffic.

[0043] The fifth unit is used to perform bidirectional tracing along the service call link information for the abnormal traffic, identify the first abnormal node and the abnormal injection point on the abnormal propagation path; based on the first abnormal node and the abnormal injection point, construct an abnormal propagation causal graph and quantify the scope of abnormal impact, and generate east-west traffic abnormal information of the data center.

[0044] A third aspect of the present invention,

[0045] An electronic device is provided, comprising:

[0046] processor;

[0047] Memory used to store processor-executable instructions;

[0048] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0049] Fourth aspect of the embodiments of the present invention,

[0050] A computer-readable storage medium is provided, having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0051] The beneficial effects of this application are as follows:

[0052] By learning the temporal dependencies of traffic feature vectors through deep neural networks, temporal features with multiple time granularities are obtained, effectively capturing the complex dynamic change patterns of east-west traffic and improving the accuracy of anomaly detection. Enhanced features incorporating business semantics are constructed by extracting business session identifiers and service call chain information and performing associated mapping, making anomaly detection more aligned with actual business scenarios and reducing false positive rates. A dual judgment mechanism combining deviation metric evaluation and chain consistency verification not only focuses on single-point traffic anomalies but also considers the contextual relationships of the service call chain, improving the comprehensiveness and accuracy of detection. It can perform bidirectional tracing along the service call chain, accurately identifying the initial anomaly node and anomaly injection point, realizing the location from the anomaly phenomenon to the root cause, which helps to quickly troubleshoot and resolve problems. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the deep learning-based method for detecting anomalies in east-west traffic in data centers, as described in an embodiment of the present invention.

[0054] Figure 2 This is a schematic diagram of the temporal dependency learning process in a deep neural network. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0057] Figure 1 This is a flowchart illustrating the deep learning-based east-west traffic anomaly detection method for data centers according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0058] East-west traffic data is collected from network switching nodes in the data center, and traffic feature vectors are extracted.

[0059] The traffic feature vector is input into a deep neural network, and the temporal dependency relationship of the traffic feature vector is learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities.

[0060] Based on the aforementioned temporal features, normal traffic patterns are encoded to construct a traffic behavior baseline. The business session identifier and service call link information to which the traffic to be detected belongs are extracted and associated with each other to obtain enhanced features containing business semantics.

[0061] Calculate the deviation metric between the enhanced feature and the traffic behavior baseline. Simultaneously, based on the traffic status of the preceding node and the traffic status of the subsequent node in the service call link information, perform link consistency verification on the traffic to be detected. When the deviation metric exceeds a preset deviation threshold or the link consistency verification fails, mark the traffic to be detected as abnormal traffic.

[0062] For the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the first abnormal node and the abnormal injection point on the abnormal propagation path; based on the first abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of abnormal impact is quantified to generate east-west traffic abnormal information of the data center.

[0063] In one optional implementation, the traffic feature vector is input into a deep neural network, and the temporal dependencies of the traffic feature vector are learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities, including:

[0064] In the deep neural network, the traffic feature vector is organized into a time series according to timestamp information. A sliding time window is applied to the time series to obtain multiple time window segments. A Fourier transform is performed on the traffic feature vector in each time window segment to decompose the time series into frequency spectrum coefficients. According to a preset frequency threshold, the frequency spectrum coefficients with frequency values ​​greater than the frequency threshold are classified as fast-changing frequency bands, and the frequency spectrum coefficients with frequency values ​​less than the frequency threshold are classified as slow-changing frequency bands.

[0065] Transient flow change features are extracted from the rapidly changing frequency bands, and flow trend evolution features are extracted from the slowly changing frequency bands to obtain multi-band time-series features;

[0066] Using the timestamps of the traffic feature vectors as nodes and time adjacency and feature similarity as edges, a traffic temporal dependency graph structure is constructed. A graph neural network is then used to perform message propagation and node feature aggregation on the traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships.

[0067] Calculate the correlation strength between different frequency bands in the multi-band time series features and different nodes in the graph embedding features. Based on the correlation strength, perform cross-domain feature alignment and fusion on the multi-band time series features and the graph embedding features to obtain time series features containing multiple time granularities.

[0068] like Figure 2 As shown, the method includes:

[0069] Traffic feature vectors are organized into time-series data according to timestamp information, where each vector contains traffic-related metrics such as bandwidth utilization, number of data packets, and number of connections. For example, in a network traffic monitoring scenario, traffic features every 10 seconds can be aggregated into a feature vector, including dimensional features such as source IP address distribution, destination port distribution, and protocol type proportion, forming continuous time-series data.

[0070] Set the time window size to T (e.g., T=60 minutes) and the sliding step size to S (e.g., S=10 minutes). By sliding this window over the original time series, a series of overlapping time segments are generated. This process ensures that each window contains the changes in flow characteristics within a certain time range, making it easier to capture short-term fluctuations and periodic patterns.

[0071] A Fourier transform is performed on the flow characteristic vector in each time window segment, converting the time-domain signal into a frequency-domain representation, yielding a series of frequency components and their corresponding amplitude and phase information. The resulting frequency spectrum coefficients after the Fourier transform reflect the energy distribution of the flow characteristics at different frequencies, enabling the differentiation between rapidly changing and slowly changing components in the flow.

[0072] Based on preset frequency thresholds, frequency spectral coefficients are divided into two categories: those with frequencies greater than the threshold are classified as rapidly changing frequency bands, while those with frequencies less than the threshold are classified as slowly changing frequency bands. The frequency threshold can be set by analyzing the spectral characteristics of historical traffic data; for example, it can be set to 0.01 Hz, indicating that changes with a period greater than 100 seconds are considered slowly changing.

[0073] By applying inverse Fourier transform to the spectral coefficients of the high-frequency component, rapidly changing components in the time series can be reconstructed. Statistical characteristics of these rapidly changing components, such as variance, peak value, and mutation rate, are calculated to capture short-term behavioral features in traffic, such as sudden events and abnormal peaks. For example, in network security monitoring scenarios, rapidly changing characteristics reflect DDoS attacks or sudden network failures.

[0074] For slowly changing frequency bands, low-frequency signals are reconstructed through inverse Fourier transform, and then trend features such as growth rate, periodic pattern strength, and trend stability are extracted. These features reflect the long-term trend and pattern of traffic changes, such as the daytime fluctuations of business load and long-term patterns such as weekend effects.

[0075] Using the timestamps of traffic feature vectors as nodes, a traffic temporal dependency graph structure is constructed. For any two time nodes i and j, if their time difference is less than a preset threshold (e.g., 1 hour), a temporal adjacency edge is established between these two nodes; if the similarity (e.g., cosine similarity or Euclidean distance) between the traffic feature vectors corresponding to these two time points is greater than a preset threshold, a feature similarity edge is established. This constructed graph structure preserves temporal information while capturing the similarity relationships between discontinuous time points.

[0076] Each node's features are initialized as the traffic feature vector at the corresponding time point. Graph Attention Network (GAT) or Graph Convolutional Network (GCN) is applied for multiple rounds of message passing. In each round, the node's features are updated based on the information of its neighboring nodes. After multiple iterations, the feature representation of each node integrates its temporal context information and information from similar nodes, resulting in graph embedding features that include temporal topological relationships.

[0077] Calculate the correlation strength between different frequency bands in multi-band time-series features and different nodes in graph embedding features. Specifically, for each frequency band feature and each graph node embedding, calculate the correlation coefficient or mutual information value between them, construct the correlation matrix, and consider the frequency band features and node embeddings with high correlation strength as having strong semantic relationship and should obtain higher weight in feature fusion.

[0078] An attention mechanism is employed to achieve feature alignment, assigning dynamic weights to each frequency band feature and graph embedding feature, and then fusing them into a unified feature representation through weighted summation or nonlinear mapping. This fusion method can adaptively integrate feature information at different temporal granularities while preserving key patterns in each frequency band and graph structure.

[0079] Ultimately, this yields time-series features with multiple time granularities. These features integrate transient changes, long-term trends, and temporal dependencies in traffic data, providing rich feature representations for subsequent tasks such as traffic analysis, anomaly detection, and traffic prediction. For example, in network security applications, these multi-granularity time-series features can be used to identify complex attack behavior patterns; in network resource scheduling, they can be used to predict future changes in traffic demand and achieve intelligent resource allocation.

[0080] In one optional implementation, a traffic temporal dependency graph structure is constructed using the timestamps of the traffic feature vectors as nodes and temporal adjacency and feature similarity as edges. A graph neural network is then used to perform message propagation and node feature aggregation on this traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships, including:

[0081] For each timestamp of the traffic feature vector, the time interval between the timestamp and other timestamps is calculated, and time adjacency edges are established between timestamp pairs whose time interval is less than a preset time threshold. At the same time, the feature distance between different timestamps of the traffic feature vector is calculated, and feature similarity edges are established between timestamp pairs whose feature distance is less than a preset similarity threshold. The traffic time-series dependency graph structure containing time adjacency edges and feature similarity edges is constructed.

[0082] In the aforementioned traffic temporal dependency graph structure, each node is initialized with a traffic feature vector corresponding to the timestamp. Through the multi-layer message propagation mechanism of the graph neural network, the feature information of temporally continuous neighboring nodes is aggregated along the temporal adjacency edge of each node, and the feature information of feature-similar neighboring nodes is aggregated along the feature similarity edge, so as to obtain the node update feature that integrates temporal continuity and feature similarity.

[0083] The number of temporally adjacent edges and the number of feature-similar edges connected to each node in the traffic temporal dependency graph structure are counted. The topological centrality of the node is calculated based on the number of edges as the importance weight of the node in the temporal sequence. The node update features of all nodes in the traffic temporal dependency graph structure are weighted and aggregated according to the importance weight to obtain the graph embedding features containing the temporal topological relationship.

[0084] To construct temporal adjacency edges, calculate the time interval Δt = |t_i - t_j| between any two timestamps t_i and t_j. Set a time threshold τ_t; when Δt < τ_t, establish a temporal adjacency edge between the nodes corresponding to these two timestamps. The choice of the time threshold τ_t can be determined based on the data sampling frequency and application scenario. For example, in network traffic analysis, it can be set to 5 minutes or 10 minutes to capture correlations in traffic changes over a short period.

[0085] To construct feature-similar edges, the feature distance d(f_i, f_j) between the feature vectors f_i and f_j corresponding to timestamps t_i and t_j is calculated. The feature distance can be Euclidean distance, cosine similarity, or other distance metrics suitable for specific application scenarios. A similarity threshold τ_s is set; when d(f_i, f_j) < τ_s, feature-similar edges are established between the corresponding nodes. Feature-similar edges reflect the similarity of traffic patterns at different time points, helping to capture periodic or recurring traffic patterns.

[0086] The constructed traffic temporal dependency graph contains two types of edges: temporally adjacent edges and feature-similar edges. This dual connection method allows the graph structure to retain both temporal continuity and capture similarity relationships in the feature space, providing rich structural information for subsequent graph neural network learning.

[0087] A multi-layer graph convolutional network (GCN) or graph attention network (GAT) is used as the base model. Assuming an L-layer graph neural network is used, for the l-th layer, the feature of each node v is h. 0 _v represents the original traffic feature vector corresponding to the timestamp. During message passing at layer l (l ranges from 1 to L), node v aggregates information from both the set of neighboring nodes connected by time-adjacent edges (N_t(v)) and the set of neighboring nodes connected by feature-similar edges (N_s(v)). Edge type weights α_t and α_s can be introduced to control the influence of time-adjacent information and feature-similar information, respectively. These weights can be learned through the model training process.

[0088] In the propagation of each layer of the graph neural network, the node feature update is divided into three steps: aggregating the information of temporally adjacent neighbors, aggregating the information of feature-similar neighbors, and fusing the two types of information with the node's own information and performing a nonlinear transformation to obtain the updated node features.

[0089] To further distinguish the importance of nodes in the time sequence graph, node topological centrality calculation is introduced. For each node v, the number of temporally adjacent edges n_t(v) and the number of feature-similar edges n_s(v) are calculated. The topological centrality of node v can be expressed as: c(v) = β·n_t(v) + (1-β)·n_s(v), where β is a coefficient that weighs the importance of temporally adjacent edges and feature-similar edges, which can be set according to the application scenario or determined by optimization through validation set.

[0090] Nodes with high topological centrality indicate that they occupy an important position in the temporal dependency at that point in time, representing a critical moment of traffic pattern change or a typical representative of a stable traffic pattern. Based on the calculated node topological centrality c(v), the features of all nodes output by the L-layer graph neural network are weighted and aggregated: g = ∑(v∈V) c(v)·h L _v / ∑(v∈V)c(v), where g is the final graph embedding feature, which contains the temporal topological relationship information in the traffic time series data.

[0091] In one optional implementation, based on the temporal characteristics, normal traffic patterns are encoded to construct a traffic behavior baseline. The service session identifier and service call link information to which the traffic to be detected belongs are extracted and associated with each other, resulting in enhanced features containing business semantics, including:

[0092] The time-series features are projected onto a low-dimensional representation space, and the feature similarity between different time-series features is calculated in the low-dimensional representation space. Based on the feature similarity, the time-series features are divided into multiple traffic pattern clusters.

[0093] Calculate the cluster center eigenvector and the within-cluster feature dispersion of the traffic pattern clusters, use the cluster center eigenvector as the encoded representation of the traffic pattern clusters, use the within-cluster feature dispersion as the boundary of the normal variation range of the traffic pattern clusters, and construct the traffic behavior baseline;

[0094] Extract the service session identifier to which the traffic to be detected belongs. The service session identifier contains a session unique identifier, and trace the service call link information of the traffic to be detected within the data center according to the session unique identifier;

[0095] Record the service call link information corresponding to each service session identifier, as well as the business role attributes of each node in the service call link information, to form a mapping relation table; Based on the mapping relation table, encode the service session identifier, the service call link information, and the business role attributes into a business semantic eigenvector, and splice the business semantic eigenvector with the time series features of the traffic to be detected to obtain an enhanced feature containing business semantics.

[0096] Use the principal component analysis (PCA) technique to perform dimensionality reduction on the original high-dimensional time series features, and project the time series features into a low-dimensional representation space. In the data center network environment, traffic time series features usually include multiple dimensions such as bandwidth occupancy rate, packet size distribution, and connection duration. Through the PCA algorithm, calculate the eigenvalues and eigenvectors of the feature covariance matrix, select the top k eigenvectors with the largest contribution rate to form a projection matrix, and project the original d-dimensional eigenvector into a k-dimensional space (where k < d). This dimensionality reduction method can retain the main information of the original data while reducing the computational complexity.

[0097] In the low-dimensional representation space, use the cosine similarity as the measurement standard for the similarity between eigenvectors. For any two low-dimensional eigenvectors v1 and v2, their similarity is calculated as the dot product of the two vectors divided by the product of their respective norms. Based on the calculated similarity matrix, apply the spectral clustering algorithm to divide the time series features into multiple traffic pattern clusters. The spectral clustering constructs a feature similarity graph, calculates the Laplacian matrix of the graph, and uses the eigenvectors of this matrix for K-means clustering to obtain multiple traffic pattern clusters with similar behavior characteristics.

[0098] For each traffic pattern cluster, the cluster center eigenvector is obtained by calculating the mean of all eigenvectors within the cluster, representing the typical features of this type of traffic pattern. The within-cluster feature dispersion uses the Mahalanobis distance to calculate the distance distribution of each point within the cluster to the center, and takes the upper bound value of the 95% confidence interval as the boundary of the normal variation range. In this way, each traffic pattern cluster is jointly characterized by its center eigenvector and the feature dispersion threshold, forming a traffic behavior baseline library.

[0099] During the detection phase, the business session identifier to which the traffic to be detected belongs is extracted. In HTTP / HTTPS protocols, cookies or session IDs can be used as unique session identifiers; in microservice architectures, distributed tracing identifiers such as X-Request-ID or Trace ID can be used. Based on these unique session identifiers, the complete service call chain information of the traffic to be detected within the data center is traced by analyzing network traffic logs and service call records.

[0100] Establish a mapping table between business session identifiers and service call chain information, including fields such as session ID, service call chain sequence, and business role attributes of each node. By recording this information, a complete mapping database is formed.

[0101] A sequence encoding method is employed, based on a mapping table, to encode business session identifiers, service call chain information, and business role attributes into business semantic feature vectors. Each service node in the service call chain is mapped to an embedding vector, and these vectors are aggregated through an attention mechanism to generate a feature representation reflecting business semantics. Specifically, for each service node, different weights are assigned according to its business role attributes, with important business nodes receiving higher attention.

[0102] The business semantic feature vector is concatenated with the temporal features of the traffic to be detected to obtain enhanced features that include business semantics. Then, feature fusion technology is used to connect the temporal feature vector and the business semantic feature vector along the feature dimension to form an enhanced feature vector. This fusion method preserves the statistical properties of the original temporal features while introducing semantic information from the business level, enabling subsequent anomaly detection to consider both traffic behavior patterns and business semantic context.

[0103] In practical applications, such as security monitoring of financial transaction systems, a baseline of normal transaction traffic can be established first using the methods described above. This baseline includes traffic characteristic patterns under different business scenarios such as queries, transfers, and payments. When suspicious traffic is detected, its business session identifier (such as a transaction session ID) is extracted, and the service call path of this traffic within the system (such as user authentication → account query → transaction execution → notification service) is traced. This information is encoded as business semantic features and analyzed in conjunction with traffic temporal features. This approach not only detects anomalies in traffic statistical characteristics but also identifies attack behaviors that appear normal in terms of traffic characteristics but exhibit abnormal business call chains, significantly improving detection accuracy.

[0104] In one optional implementation, calculating the deviation metric between the enhanced feature and the traffic behavior baseline, and simultaneously performing link consistency verification on the traffic to be detected based on the preceding node traffic status and subsequent node traffic status in the service call link information, includes:

[0105] The feature space distance between the enhanced feature and the cluster center feature vector is calculated as the baseline deviation distance. At the same time, it is calculated whether the enhanced feature exceeds the normal variation range boundary of the flow pattern cluster. The deviation metric value is obtained based on the comparison result of the baseline deviation distance and the normal variation range boundary.

[0106] Based on the service call link information, the traffic state vectors of the preceding nodes, the traffic state vectors of the following nodes, and the enhanced features in the business session corresponding to the traffic to be detected are concatenated into a link traffic state tensor according to the service call order; the link traffic state tensor is subjected to temporal convolution transformation to extract the temporal evolution pattern features of the traffic within the link; the matching degree between the temporal evolution pattern features and each preset normal link evolution pattern is calculated; and the normal link evolution pattern with the highest matching degree is taken as the link reference pattern.

[0107] The influence weight distribution of the deviation metric on the traffic state vector of the preceding node and the traffic state vector of the subsequent node is analyzed by the gradient backpropagation mechanism. When the difference between the influence weight distribution and the normal influence weight distribution in the link reference mode exceeds the preset link consistency threshold, it is determined that the traffic to be detected has a link consistency anomaly, and the link consistency verification result is obtained.

[0108] The Euclidean distance is used to calculate the distance between the enhanced feature vector and the cluster center feature vector. For example, suppose the enhanced feature vector is E=(e1, e2, ..., e...). n The cluster center eigenvector is C = (c1, c2, ..., c...). n If ), then the Euclidean distance can be calculated as: (Σ(e i -c i ) 2 ) 1 / 2 .

[0109] The process determines whether the enhanced feature exceeds the normal variation range boundary of the traffic pattern cluster. This normal variation range boundary can be obtained based on historical data statistics and is typically expressed as a multiple of the standard deviation of each dimension of the features within the cluster. If the enhanced feature deviates from the preset boundary (e.g., 3 times the standard deviation) in any dimension, it is considered to exceed the normal variation range. The baseline deviation distance is compared with the normal variation range boundary. If the deviation distance is greater than the boundary threshold, the deviation metric is increased accordingly; otherwise, it is smaller. This comparison result can be converted into a standardized deviation metric between 0 and 1 for easier subsequent anomaly detection.

[0110] Construct a link traffic state tensor, which represents the traffic state vector P = (p1, p2, ..., p) of the preceding nodes in the service session corresponding to the traffic to be detected. m), enhanced feature E, and the flow state vector N=(n1, n2, ..., n) of subsequent nodes. k The data is concatenated according to the service call order to form a link traffic state tensor T=[P; E; N]. This traffic state vector includes metrics such as the number of requests, response time, and error rate of each node.

[0111] Temporal convolutional transformations are applied to the link traffic state tensor. Temporal convolutional networks can effectively capture the temporal dependencies of traffic states in a link. In practice, multiple one-dimensional convolutional layers can be designed, with each layer using convolutional kernels of different sizes to extract temporal features at different scales. For example, the first layer can use a 3×1 convolutional kernel to capture short-term dependencies, and the second layer can use a 5×1 convolutional kernel to capture medium-term dependencies. In this way, the link traffic state tensor is transformed into temporal evolution pattern features F.

[0112] After obtaining the temporal evolution pattern features, calculate the matching degree between them and each preset normal link evolution pattern. Assume there are k preset normal link evolution patterns M1, M2, ..., M k The similarity between the temporal evolution pattern feature F and each pattern is calculated separately, using methods such as cosine similarity. The pattern with the highest matching degree is selected as the link reference pattern M_ref.

[0113] To analyze the weight distribution of the impact of the deviation metric on the traffic states of preceding and subsequent nodes, a gradient backpropagation mechanism is employed. Specifically, a computational graph is constructed, taking the link traffic state tensor T as input and the deviation metric D as output, and then calculating... This yields the gradients of the deviation metric with respect to the traffic states of preceding and subsequent nodes. The distribution of these gradients reflects the degree to which different nodes contribute to the current anomaly. For example, if... Some components are significantly larger than others, indicating that the corresponding preceding node indicators contribute more to the deviation.

[0114] Under normal circumstances, the link reference mode also includes a normal influence weight distribution. The calculated influence weight distribution is compared with the normal influence weight distribution in the link reference mode, and distribution difference measurement methods such as KL divergence or JS divergence can be used. When the distribution difference exceeds the preset link consistency threshold (e.g., KL divergence is greater than 0.5), it is determined that the traffic to be detected has a link consistency anomaly, that is, the current traffic is abnormal and its traffic status with the nodes before and after it does not conform to the normal service call relationship.

[0115] This dual detection mechanism, which combines traffic baseline deviation and link consistency verification, can improve the accuracy of anomaly detection, reduce false alarm rates, and provide more information support for anomaly localization and root cause analysis.

[0116] In one optional implementation, for the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the initial abnormal node and the abnormal injection point on the abnormal propagation path, including:

[0117] Extract the complete service call node sequence from the service call chain information, construct a directed call topology graph based on the call order relationship of each node in the service call node sequence, and mark the position of the node corresponding to the abnormal traffic in the directed call topology graph;

[0118] Backtrack upstream along the reverse edge of the directed call topology graph, query the historical traffic status of each level of predecessor nodes corresponding to the abnormal traffic node in turn, calculate the deviation between the historical traffic status of each level of predecessor nodes and the baseline of normal traffic behavior, and mark the predecessor node whose deviation first exceeds the abnormal judgment threshold as the first abnormal node.

[0119] Starting from the first abnormal node, downstream tracing is performed along the positive edges of the directed call topology graph to obtain the complete propagation path from the first abnormal node to the node corresponding to the abnormal traffic. The traffic state transition records of each intermediate node on the propagation path are extracted, the gain contribution of each intermediate node to the traffic abnormality characteristics is analyzed, and the intermediate node whose gain contribution exceeds the contribution threshold is identified as the abnormal injection point.

[0120] In one specific embodiment, bidirectional tracing of abnormal traffic first extracts the complete sequence of service call nodes from the service call chain information. Service call chain information typically contains a complete call record for each service request, documenting all service nodes traversed during the entire process from request initiation to response. This information can be collected through a distributed tracing system, such as extracting key information like service identifiers, call timestamps, and request parameters from the tracing context passed between services.

[0121] The extracted call node sequence includes information such as source node, target node, call relationship, timestamp, and request status. For example, in a microservice architecture, a user request sequentially passes through the API gateway, authentication service, user service, and order service, forming a complete call node sequence. Based on these call relationships, a directed call topology graph is constructed, where each node represents a service instance, edges represent call relationships between services, and the direction of the edges indicates the direction of the call.

[0122] In the constructed directed call topology graph, the node locations corresponding to abnormal traffic are marked. Nodes corresponding to abnormal traffic refer to service nodes that have been detected by the monitoring system as having abnormal states, such as abnormal response times, increased error rates, or sudden changes in throughput. These nodes are marked with special colors or shapes in the topology graph to facilitate subsequent traceability and analysis.

[0123] Starting from the node corresponding to the abnormal traffic, and proceeding in the reverse direction of the call relationship, the historical traffic status of each preceding node is queried sequentially. Historical traffic status includes, but is not limited to, key performance indicators such as service request volume, response time, error rate, and resource utilization. This historical traffic data is typically obtained from the time-series database of the monitoring system and analyzed based on statistical values ​​within a time window (such as the past hour, day, or week).

[0124] For each preceding node, the deviation between its historical traffic status and the normal traffic behavior baseline is calculated. The traffic behavior baseline refers to the expected range of various performance indicators of the service node under normal operating conditions. The baseline can be obtained through statistical analysis of long-term monitoring data, typically constructed using moving averages, percentiles, or machine learning models. The deviation calculation uses statistical methods to calculate the standard deviation multiple of the current observation value from the baseline mean, quantifying the degree of deviation.

[0125] During upstream backtracking, the preceding node whose deviation first exceeds the predetermined anomaly threshold is marked as the first anomaly node. The anomaly threshold can be set based on business requirements, such as a multiple of the standard deviation (usually 2 or 3 times), or determined based on the quantile of historical data (such as 99.9%). The first anomaly node represents the earliest location where abnormal traffic appears and is the source of anomaly propagation.

[0126] After identifying the initial abnormal node, downstream tracing is performed from that node along the forward edges of the directed call topology graph. This process aims to obtain the complete propagation path of the anomaly from the initial point to the final detection point. During downstream tracing, all service nodes traversed by the abnormal traffic are recorded, forming an ordered anomaly propagation chain.

[0127] For each intermediate node in the propagation path, its traffic state transition record is extracted. The traffic state transition record describes the changes in the service's performance indicators before and after abnormal traffic passes through, including changes in traffic characteristics (such as request patterns and parameter distribution), performance characteristics (such as latency distribution and resource consumption), and error characteristics (such as error type and error rate).

[0128] By analyzing the gain contribution of intermediate nodes to traffic anomaly characteristics, key anomaly injection points can be identified. The gain contribution reflects the amplification or transformation effect of a node on anomaly characteristics and can be calculated by comparing the differences in anomaly characteristics between the node's input and output traffic. For example, if the error rate of a node's output traffic is significantly higher than that of its input traffic, or if the delay distribution of the output traffic is significantly shifted, then that node has a high gain contribution to the anomaly characteristics.

[0129] Gain contribution can be calculated using the information entropy change method. When the gain contribution of an intermediate node exceeds a preset contribution threshold, it is identified as an anomaly injection point. An anomaly injection point is a key node on the anomaly propagation path that significantly aggravates or changes the anomaly characteristics, usually representing a potential failure point or a vulnerable link that is being attacked.

[0130] The aforementioned bidirectional tracing method not only pinpoints the initial source of abnormal traffic but also identifies key anomaly injection points during propagation. This provides precise targets for subsequent fault location and security protection, significantly improving the efficiency and accuracy of anomaly handling. This method is particularly suitable for complex distributed system environments where anomalies propagate and evolve across multiple services, making it difficult for traditional single-point monitoring to effectively locate the root cause.

[0131] In one optional implementation, based on the initial abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of the abnormal impact is quantified to generate east-west traffic anomaly information for the data center, including:

[0132] Using the first abnormal node as the root node, the abnormal injection point as the intermediate propagation node, and the node corresponding to the abnormal traffic as the termination node, the abnormal propagation causal graph is constructed.

[0133] Starting from the root node, a breadth-first search is performed along the directed causal edge on the anomaly propagation causal graph to identify all service call nodes reachable from the root node as the directly affected node set. The business session connection relationship of each node in the directly affected node set is queried. Service call nodes that have business session connections with nodes in the directly affected node set are marked as the indirectly affected node set. The anomaly propagation distance of each node in the directly affected node set is calculated.

[0134] Based on the abnormal propagation distance, for each node in the set of directly affected nodes, the shortest abnormal propagation path from the root node to the target node is obtained. The propagation attenuation weights corresponding to all directed causal edges on the shortest abnormal propagation path are extracted and multiplied to obtain the abnormal impact attenuation coefficient. The impact level is divided based on the abnormal impact attenuation coefficient.

[0135] The abnormal propagation causal graph, the set of directly affected nodes, the set of indirectly affected nodes, and the impact level are integrated to generate the east-west traffic anomaly information of the data center.

[0136] An anomaly propagation causal graph is constructed, with the initial abnormal node as the root node, the anomaly injection point as the intermediate propagation node, and the node corresponding to the abnormal traffic as the termination node. In the graph, nodes represent service components or application instances, and directed edges represent anomaly propagation paths. Each directed edge is assigned a propagation attenuation weight, reflecting the degree to which the impact of the anomaly weakens during propagation.

[0137] During the construction process, service call chain data before and after the anomaly occurs is collected, the call relationships between services are extracted, and the direction of anomaly propagation is determined through time-series analysis. The call relationships are then converted into directed causal edges. For each edge, a propagation attenuation weight is calculated based on metrics such as service call error rate, response time changes, and call frequency. The weight value ranges from 0 to 1, with smaller values ​​indicating more severe anomaly propagation attenuation.

[0138] Starting from the root node, a breadth-first search algorithm is used to traverse the anomaly propagation causal graph, identify all reachable nodes as the set of directly affected nodes, and record the access depth of each node during the search process as the anomaly propagation distance of that node. For each node in the set of directly affected nodes, its business session connection records are queried to identify nodes with which there is a business session connection but which are not in the set of directly affected nodes, and these nodes are marked as the set of indirectly affected nodes.

[0139] For each node in the set of directly affected nodes, the Dijkstra algorithm is used to calculate the shortest anomaly propagation path from the root node to that node based on the anomaly propagation distance. The propagation attenuation weights corresponding to all directed causal edges on the shortest path are extracted and multiplied to obtain the anomaly impact attenuation coefficient. For example, if the shortest path from the root node to the target node contains three edges with weights of 0.9, 0.8, and 0.7, then the anomaly impact attenuation coefficient of that node is 0.9 × 0.8 × 0.7 = 0.504.

[0140] The impact level can be classified based on the attenuation coefficient of the abnormal impact. The interval classification method can be adopted: the coefficient in the range of [0.8, 1] is classified as the severe impact level, indicating that the abnormal impact has hardly attenuated; the range of [0.5, 0.8) is classified as the moderate impact level; the range of [0.2, 0.5) is classified as the slight impact level; and the range of [0, 0.2) is classified as the weak impact level, indicating that the abnormal impact has been significantly attenuated.

[0141] The anomaly propagation causal graph, the set of directly affected nodes, the set of indirectly affected nodes, and the impact level are integrated to generate anomaly information for east-west traffic in the data center. The anomaly information includes the following: the topology of the anomaly propagation causal graph, marking the root node, intermediate propagation nodes, and terminating nodes; a list of directly affected nodes, including node identifiers, anomaly propagation distance, impact level, and shortest anomaly propagation path; a list of indirectly affected nodes, including node identifiers and directly affected nodes with which they have business session connections; and node statistics for each impact level, used for macroscopic assessment of the anomaly scope.

[0142] In practical applications, assuming an anomaly occurs in a microservice architecture system, an anomaly propagation causal graph is constructed using the method described above. This identifies the API gateway service as the initial anomaly node (root node), the order processing service as the anomaly injection point (intermediate propagation node), and the user account service as the node corresponding to the abnormal traffic (termination node). Through breadth-first search, seven directly affected nodes are identified, including payment processing, inventory management, and logistics tracking. Further analysis of business session connections identifies four indirectly affected nodes, including data analysis and notification services.

[0143] Calculations show that the attenuation coefficient for the anomaly in the payment processing service is 0.82, classifying it as a severe impact; the attenuation coefficient for the inventory management service is 0.65, classifying it as a moderate impact; and the attenuation coefficient for the logistics tracking service is 0.31, classifying it as a minor impact. Comprehensive analysis indicates that this anomaly primarily affected the order processing and payment processes, necessitating priority in fixing the anomaly propagation path between the API gateway and the order processing service.

[0144] This method not only clearly depicts the propagation path of anomalies in the system, but also quantifies the impact of anomalies on each component, providing a scientific basis for anomaly root cause localization and repair priority ranking.

[0145] This invention relates to a deep learning-based east-west traffic anomaly detection system for data centers, the system comprising:

[0146] The first unit is used to collect east-west traffic data from the network switching nodes of the data center and extract traffic feature vectors;

[0147] The second unit is used to input the traffic feature vector into a deep neural network, and learn the temporal dependency relationship of the traffic feature vector through a multi-layer neural network structure to obtain temporal features containing multiple time granularities.

[0148] The third unit is used to encode the normal traffic pattern based on the time-series features, construct a traffic behavior baseline, extract the business session identifier and service call link information to which the traffic to be detected belongs and perform association mapping to obtain enhanced features containing business semantics.

[0149] The fourth unit is used to calculate the deviation metric between the enhanced feature and the traffic behavior baseline. At the same time, based on the traffic status of the preceding node and the traffic status of the subsequent node in the service call link information, the unit performs link consistency verification on the traffic to be detected. When the deviation metric exceeds the preset deviation threshold or the link consistency verification fails, the traffic to be detected is marked as abnormal traffic.

[0150] The fifth unit is used to perform bidirectional tracing along the service call link information for the abnormal traffic, identify the first abnormal node and the abnormal injection point on the abnormal propagation path; based on the first abnormal node and the abnormal injection point, construct an abnormal propagation causal graph and quantify the scope of abnormal impact, and generate east-west traffic abnormal information of the data center.

[0151] A third aspect of the present invention provides an electronic device, comprising:

[0152] processor;

[0153] Memory used to store processor-executable instructions;

[0154] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0155] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0156] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0157] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A deep learning-based method for detecting anomalies in east-west traffic in data centers, characterized in that, include: East-west traffic data is collected from network switching nodes in the data center, and traffic feature vectors are extracted. The traffic feature vector is input into a deep neural network, and the temporal dependency relationship of the traffic feature vector is learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities. Based on the aforementioned temporal characteristics, normal traffic patterns are encoded to construct a traffic behavior baseline. The service session identifier and service call link information to which the traffic to be detected belongs are extracted and associated with each other, resulting in enhanced features containing business semantics, including: The time-series features are projected onto a low-dimensional representation space, and the feature similarity between different time-series features is calculated in the low-dimensional representation space. Based on the feature similarity, the time-series features are divided into multiple traffic pattern clusters. Calculate the cluster center feature vector and intra-cluster feature dispersion of the traffic pattern cluster, use the cluster center feature vector as the encoding representation of the traffic pattern cluster, and use the intra-cluster feature dispersion as the boundary of the normal variation range of the traffic pattern cluster to construct the traffic behavior baseline; Extract the service session identifier to which the traffic to be detected belongs. The service session identifier contains a unique session identifier. Use the unique session identifier to trace the service call link information of the traffic to be detected in the data center. Record the service call chain information corresponding to each business session identifier, as well as the business role attributes of each node in the service call chain information, to form a mapping relationship table; Based on the mapping table, the business session identifier, the service call chain information, and the business role attribute are encoded into a business semantic feature vector. The business semantic feature vector is then concatenated with the temporal features of the traffic to be detected to obtain an enhanced feature containing business semantics. Calculate the deviation metric between the enhanced feature and the traffic behavior baseline, and simultaneously perform link consistency verification on the traffic to be detected based on the traffic status of the preceding and subsequent nodes in the service call link information, including: The feature space distance between the enhanced feature and the cluster center feature vector is calculated as the baseline deviation distance. At the same time, it is calculated whether the enhanced feature exceeds the normal variation range boundary of the flow pattern cluster. The deviation metric value is obtained based on the comparison result of the baseline deviation distance and the normal variation range boundary. Based on the service call link information, the traffic state vectors of the preceding nodes, the traffic state vectors of the following nodes, and the enhanced features in the business session corresponding to the traffic to be detected are concatenated into a link traffic state tensor according to the service call order. Temporal convolution transformation is performed on the link traffic state tensor to extract the temporal evolution pattern features of the traffic within the link. The matching degree between the temporal evolution pattern features and each preset normal link evolution pattern is calculated, and the normal link evolution pattern with the highest matching degree is taken as the link reference pattern. The influence weight distribution of the deviation metric on the traffic state vector of the preceding node and the traffic state vector of the subsequent node is analyzed by the gradient backpropagation mechanism. When the difference between the influence weight distribution and the normal influence weight distribution in the link reference mode exceeds the preset link consistency threshold, it is determined that the traffic to be detected has a link consistency anomaly and the link consistency verification result is obtained. When the deviation metric exceeds the preset deviation threshold or the link consistency verification fails, the traffic to be detected is marked as abnormal traffic. For the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the first abnormal node and the abnormal injection point on the abnormal propagation path; Based on the initial abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of abnormal impact is quantified to generate abnormal east-west traffic information of the data center.

2. The method according to claim 1, characterized in that, The traffic feature vector is input into a deep neural network, and the temporal dependency relationship of the traffic feature vector is learned through a multi-layer neural network structure to obtain temporal features containing multiple time granularities, including: In the deep neural network, the traffic feature vector is organized into a time series according to timestamp information, and a sliding time window is applied to the time series to obtain multiple time window segments; Perform a Fourier transform on the flow feature vector in each time window segment to decompose the time series into frequency spectral coefficients; Based on a preset frequency boundary value, the frequency spectrum coefficients with frequency values ​​greater than the frequency boundary value are classified as rapidly changing frequency bands, and the frequency spectrum coefficients with frequency values ​​less than the frequency boundary value are classified as slowly changing frequency bands. Transient flow change features are extracted from the rapidly changing frequency bands, and flow trend evolution features are extracted from the slowly changing frequency bands to obtain multi-band time-series features; Using the timestamps of the traffic feature vectors as nodes and time adjacency and feature similarity as edges, a traffic temporal dependency graph structure is constructed. A graph neural network is then used to perform message propagation and node feature aggregation on the traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships. Calculate the correlation strength between different frequency bands in the multi-band time series features and different nodes in the graph embedding features. Based on the correlation strength, perform cross-domain feature alignment and fusion on the multi-band time series features and the graph embedding features to obtain time series features containing multiple time granularities.

3. The method according to claim 2, characterized in that, Using the timestamps of the traffic feature vectors as nodes and temporal adjacency and feature similarity as edges, a traffic temporal dependency graph structure is constructed. A graph neural network is then used to perform message propagation and node feature aggregation on this traffic temporal dependency graph structure to obtain graph embedding features containing temporal topological relationships, including: For each timestamp of the traffic feature vector, the time interval between the timestamp and other timestamps is calculated, and time adjacency edges are established between timestamp pairs whose time interval is less than a preset time threshold. At the same time, the feature distance between different timestamps of the traffic feature vector is calculated, and feature similarity edges are established between timestamp pairs whose feature distance is less than a preset similarity threshold. The traffic time-series dependency graph structure containing time adjacency edges and feature similarity edges is constructed. In the aforementioned traffic temporal dependency graph structure, each node is initialized with a traffic feature vector corresponding to the timestamp. Through the multi-layer message propagation mechanism of the graph neural network, the feature information of temporally continuous neighboring nodes is aggregated along the temporal adjacency edge of each node, and the feature information of feature-similar neighboring nodes is aggregated along the feature similarity edge, so as to obtain the node update feature that integrates temporal continuity and feature similarity. The number of temporally adjacent edges and the number of feature-similar edges connected to each node in the traffic temporal dependency graph structure are counted. The topological centrality of the node is calculated based on the number of edges as the importance weight of the node in the temporal sequence. The node update features of all nodes in the traffic temporal dependency graph structure are weighted and aggregated according to the importance weight to obtain the graph embedding features containing the temporal topological relationship.

4. The method according to claim 1, characterized in that, For the abnormal traffic, bidirectional tracing is performed along the service call chain information to identify the initial abnormal node and the abnormal injection point on the abnormal propagation path, including: Extract the complete service call node sequence from the service call chain information, construct a directed call topology graph based on the call order relationship of each node in the service call node sequence, and mark the position of the node corresponding to the abnormal traffic in the directed call topology graph; Backtrack upstream along the reverse edge of the directed call topology graph, query the historical traffic status of each level of predecessor nodes corresponding to the abnormal traffic node in turn, calculate the deviation between the historical traffic status of each level of predecessor nodes and the baseline of normal traffic behavior, and mark the predecessor node whose deviation first exceeds the abnormal judgment threshold as the first abnormal node. Starting from the first abnormal node, downstream tracing is performed along the positive edges of the directed call topology graph to obtain the complete propagation path from the first abnormal node to the node corresponding to the abnormal traffic. The traffic state transition records of each intermediate node on the propagation path are extracted, the gain contribution of each intermediate node to the traffic abnormality characteristics is analyzed, and the intermediate node whose gain contribution exceeds the contribution threshold is identified as the abnormal injection point.

5. The method according to claim 1, characterized in that, Based on the initial abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of the abnormal impact is quantified. This generates abnormal east-west traffic information for the data center, including: Using the first abnormal node as the root node, the abnormal injection point as the intermediate propagation node, and the node corresponding to the abnormal traffic as the termination node, the abnormal propagation causal graph is constructed. Starting from the root node, perform a breadth-first search along the directed causal edge on the anomaly propagation causal graph, identify all service call nodes reachable from the root node as the set of directly affected nodes, query the business session connection relationship of each node in the set of directly affected nodes, mark the service call nodes that have business session connections with the nodes in the set of directly affected nodes as the set of indirectly affected nodes, and calculate the anomaly propagation distance of each node in the set of directly affected nodes. Based on the abnormal propagation distance, for each node in the set of directly affected nodes, the shortest abnormal propagation path from the root node to the target node is obtained, and the propagation attenuation weights corresponding to all directed causal edges on the shortest abnormal propagation path are extracted and multiplied to obtain the abnormal impact attenuation coefficient. The impact level is determined based on the attenuation coefficient of the aforementioned anomaly. The abnormal propagation causal graph, the set of directly affected nodes, the set of indirectly affected nodes, and the impact level are integrated to generate the east-west traffic anomaly information of the data center.

6. A deep learning-based east-west traffic anomaly detection system for data centers, used to implement the method as described in any one of claims 1-5, characterized in that, include: The first unit is used to collect east-west traffic data from the network switching nodes of the data center and extract traffic feature vectors; The second unit is used to input the traffic feature vector into a deep neural network, and learn the temporal dependency relationship of the traffic feature vector through a multi-layer neural network structure to obtain temporal features containing multiple time granularities. The third unit is used to encode the normal traffic pattern based on the time-series features, construct a traffic behavior baseline, extract the business session identifier and service call link information to which the traffic to be detected belongs and perform association mapping to obtain enhanced features containing business semantics. The fourth unit is used to calculate the deviation metric between the enhanced feature and the traffic behavior baseline. At the same time, based on the traffic status of the preceding node and the traffic status of the subsequent node in the service call link information, the unit performs link consistency verification on the traffic to be detected. When the deviation metric exceeds the preset deviation threshold or the link consistency verification fails, the traffic to be detected is marked as abnormal traffic. The fifth unit is used to perform bidirectional tracing along the service call chain information for the abnormal traffic, and to identify the first abnormal node and the abnormal injection point on the abnormal propagation path. Based on the initial abnormal node and the abnormal injection point, an abnormal propagation causal graph is constructed and the scope of abnormal impact is quantified to generate abnormal east-west traffic information of the data center.

7. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 5.

Images