Internet protocol (IP) cross-region detection method and system based on network flow

Abstract

The invention discloses an IP cross-region detection method and system based on network traffic. The method comprises the following steps: constructing a geographically associated fusion network traffic feature set; the fusion network traffic feature set comprises a plurality of sample pairs containing'traffic feature pair-geographic distance-classification label '; the traffic feature pairs in the sample pairs have the same IP but different time windows; training a traffic encoder by using the sample pair to realize that a traffic embedding space output by the traffic encoder is consistent with a physical geographic space; extracting the traffic characteristics of the current data stream of the target client, and inputting the traffic characteristics into the traffic encoder to obtain the current traffic embedding space of the target client; and according to the current traffic embedding space of the target client and the historical latest traffic embedding space of the target client, judging whether the target client is subjected to cross-regional migration or not. According to the method, the accuracy, the efficiency and the robustness of an IP cross-region detection technology are improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of network management, and particularly relates to an IP cross-region detection method and system based on network traffic. BACKGROUND

[0002] With the continuous rise of the demand of digital economy for network performance optimization and efficient use of resources, dynamic IP technology has become the core means for telecom operators and cloud service providers to improve resource allocation efficiency. Operators realize periodic allocation and recovery of resources by centralized management of IP address pools, while cloud service providers rely on elastic IP (EIP) drift technology to realize local access and automatic switching of traffic in case of failure. However, dynamic IP technology breaks the static binding relationship between IP address and geographical location in traditional networks, directly challenging network services that rely on IP geographical information. In this context, IP cross-region detection technology that can track the cross-region geographical migration of IP addresses and provide support for dynamic adjustment of related network service policies has emerged. For example, Amazon Web Application Firewall (AWS WAF) limits authorized regional access to prevent cross-region data leakage through geographical rules. This technology can identify the geographical migration of access IP to ensure effective rule execution. Alibaba Cloud Global Accelerator relies on the correspondence between acceleration regions and IP sets to achieve precise routing. It can ensure the accuracy of the correspondence by detecting IP geographical migration, thereby ensuring CDN scheduling accuracy and service response efficiency. IP2Location integrates IP geographical positioning into the multi-factor authentication (MFA) login process. By identifying IP geographical location changes, it can avoid remote login risk misjudgment. This technology effectively avoids compliance risks, resource waste, and security risks caused by IP and geographical location matching deviations, and has become a key technology to support efficient operation, security protection, and compliance management of modern networks.

[0003] But the traditional IP cross-region detection relies heavily on third-party IP geolocation database, when the client accesses the service, the server will query the third-party database to obtain the IP geographical location, and then judge whether the IP deviates from the historical region according to the result to realize the detection, limited by the detection delay and operation cost, the traditional third-party database generally adopts large-scale batch updating mechanism, and the geographical mapping relationship needs to be synchronized after the whole IP data is updated, and the update period is usually several days to several weeks, such geographical positioning lag leads to detection relying on outdated results, causing detection distortion, while in the actual scene, CDN resource scheduling needs the system to select the optimal edge node according to the user IP, and requires millisecond to second level response to control the content distribution delay, and the client IP geographical information verification needs to be completed within several seconds to several minutes in the user login verification, the lagging detection cannot meet the timeliness demand of IP cross-region movement judgment of the service, and further damages the service stability and reliability. SUMMARY

[0004] In view of the problems in the prior art, the purpose of the present application is to provide an IP cross-region detection method and system based on network traffic, which enhances its accuracy, efficiency and robustness.

[0005] The technical scheme of the present application is as follows: An IP cross-region detection method based on network traffic, comprising the following steps: Constructing a geographically associated fusion network traffic feature set; the fusion network traffic feature set comprises a plurality of sample pairs comprising "traffic feature pair-geographical distance-classification label"; the traffic feature pair in the sample pair has the same IP but different time windows; Training a traffic encoder using the sample pair, so that the traffic embedding space output by the traffic encoder is consistent with the physical geographical space; Extracting the traffic features of the current data stream of the target client into the traffic encoder to obtain the current traffic embedding space of the target client; and judging whether the target client has migrated across regions according to the current traffic embedding space of the target client and the latest historical traffic embedding space of the target client.

[0006] According to the method of claim 1, the method for constructing the fusion network traffic feature set is as follows: Collecting network traffic of a plurality of clients and dividing them according to a set time window; and dividing the network traffic in each time window into a plurality of data streams according to the four-tuple (source IP, destination IP, source port, destination port); Extracting the features of each data stream, and arranging the features of the same data stream in different time windows according to time to form a feature sequence, thereby obtaining the feature sequence of each data stream; According to the characteristic sequence of each data stream, statistical characteristics of the corresponding data stream are obtained; and the sequence characteristics and the statistical characteristics of each data stream are spliced to form a feature vector of each data stream; The feature vectors of each data stream in each time window are averaged to obtain a fusion feature vector of the time window; The geographical identifiers corresponding to the fusion feature vectors of each time window are obtained, and the fusion feature vectors of the same IP but different time windows are selected as a traffic feature pair in a sample pair; the geographical distance of the traffic feature pair is calculated according to the geographical identifiers corresponding to the traffic feature pair, and the classification label corresponding to the traffic feature pair is determined.

[0007] The method of claim 2, wherein the characteristics of each data stream include time characteristics, load characteristics, burst characteristics, window characteristics and direction characteristics.

[0008] Preferably, the TCP payload length sequence, the packet interval sequence, the window size sequence, the direction sequence and the burst duration sequence in the characteristic sequence are constituted by the load characteristics, the time characteristics, the window characteristics, the direction characteristics and the burst characteristics; the TCP payload length sequence, the packet interval sequence and the window size sequence in the characteristic sequence are fused with the direction sequence by Hadamard product to obtain a burst length sequence; and the burst length sequence is spliced with the burst duration sequence in the characteristic sequence to obtain the feature vector of each data stream.

[0009] Preferably, the fusion network traffic feature set is divided into groups; for each group of the to-be-supplemented sample, a traffic feature offset amplitude parameter is introduced, a random offset is added to each dimension of the fusion feature vector in the group of the to-be-supplemented sample to generate positive and negative supplementary samples; and a geographical coordinate offset proportion parameter is introduced, a random offset is added to the geographical identifier in the group of the to-be-supplemented sample to generate positive and negative supplementary samples; then, a new sample pair is generated according to the generated positive and negative supplementary samples, and the group of the to-be-supplemented sample is supplemented.

[0010] Preferably, the traffic encoder adopts a shared weight Transformer Encoder as a core encoder; the traffic feature pair in the sample pair is input into the traffic encoder to output a traffic embedding space; an alignment between the traffic embedding space and the physical geographical space is realized by a contrastive learning mechanism, so that the embedding distance accurately reflects the geographical distance and enhances the geographical semantic expression ability of the traffic feature; wherein, in the contrastive learning mechanism, a mean square error (MSE) loss is used to minimize the difference between the traffic embedding space and the physical geographical space, and the traffic encoder is optimized.

[0011] Preferably, the flow embedding-based IP cross-region classifier designs a lightweight binary classifier for determining whether the IP migrates across regions in adjacent time windows; the lightweight binary classifier is trained and optimized using the sample pairs, and cross-entropy loss is used as the classification loss during the training and optimization; then, the current flow embedding space of the target client and the latest historical flow embedding space of the target client are input into the optimized lightweight binary classifier to output a binary classification probability distribution, and it is determined whether the target client migrates across regions.

[0012] An IP cross-region detection system based on network flow, characterized by comprising a fusion network flow feature set generation module, a training module and a detection module. The fusion network flow feature set generation module is configured to construct a geographical correlation fusion network flow feature set; the fusion network flow feature set comprises a plurality of sample pairs comprising a "flow feature pair-geographical distance-classification label"; the flow feature pair in the sample pair has the same IP but different time windows; The training module is configured to train a flow encoder using the sample pairs, so that the flow embedding space output by the flow encoder is consistent with the physical geographical space; The detection module is configured to extract the flow features of the current data flow of the target client and input them into the flow encoder to obtain the current flow embedding space of the target client; and determine whether the target client migrates across regions according to the current flow embedding space of the target client and the latest historical flow embedding space of the target client.

[0013] A server, characterized by comprising a memory and a processor, wherein the memory stores a computer program configured to be executed by the processor, and the computer program comprises instructions for executing the above method.

[0014] A computer readable storage medium having a computer program stored thereon, characterized in that the computer program is executed by a processor to implement the above method.

[0015] The advantages of the present application are as follows: This invention constructs a multidimensional geographic network traffic feature set that integrates sequence features and statistical features. This effectively quantifies the heterogeneity of network features between different regions, overcoming the shortcomings of traditional single-feature methods which are susceptible to network fluctuations, routing congestion interference leading to feature jitter and data loss, and are difficult to adapt to encrypted network environments. Secondly, it introduces a contrastive learning mechanism to align traffic embedding distance with physical distance, strengthening the semantic association between traffic features and geographic location, and significantly improving the accuracy of geographic attribute representation. Thirdly, it designs a lightweight binary classification task that only determines whether an IP has migrated across regions within adjacent time windows, maximizing the efficiency requirements of network services, thereby improving the accuracy, efficiency, and robustness of IP cross-region detection technology. Attached Figure Description

[0016] Figure 1 This is a flowchart of the method of the present invention.

[0017] Figure 2 This is a flowchart of a method for detecting cross-regional IP traffic based on network traffic.

[0018] Figure 3 This is a basic framework diagram of a cross-regional IP detection method based on network traffic. Detailed Implementation

[0019] The present invention will now be described in further detail with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0020] The method flow of this invention is as follows: Figure 1 As shown, the steps include: Construct a geographically associated converged network traffic feature set; the converged network traffic feature set includes multiple sample pairs containing "traffic feature pair - geographic distance - classification label"; the traffic feature pairs in the sample pairs have the same IP but different time windows; The traffic encoder is trained using the sample pairs to ensure that the traffic embedding space output by the traffic encoder is consistent with the physical geographic space. The traffic characteristics of the current data stream of the target client are extracted and input into the traffic encoder to obtain the current traffic embedding space of the target client; based on the current traffic embedding space of the target client and the latest historical traffic embedding space of the target client, it is determined whether the target client has migrated across regions.

[0021] like Figure 2 As shown, an optional embodiment of the present invention provides a method for IP cross-region detection based on network traffic, including the following steps: S1: Construct a geographically associated fusion network traffic feature set; S2: Comparative learning based on traffic geospatial data; S3: IP cross-region detection based on traffic.

[0022] The following will be described in detail for each step: S1-1: Traffic data preprocessing. Split the original traffic according to the client IP, divide the traffic according to a 1-hour time window, and split the flow according to the four-tuple (source IP, destination IP, source port, and destination port). Extract the sequence features of each data flow (TCP payload length, packet interval, ACK RTT, window size, etc. combined with uplink and downlink direction information), remove outliers (IQR method), unify sequence length (short sequence padding, long sequence truncation), and obtain statistical features (RTT mean, throughput, window size mean, etc.) according to the sequence features of each data flow.

[0023] S1-2: Traffic feature set fusion. Concatenate and fuse the single-flow sequence features and statistical features, take the average of multi-flow features according to the time window, and form a unified traffic feature vector.

[0024] S1-3: Traffic geographical correlation. Match the traffic feature vector with the corresponding IP geographical coordinates according to time, then pair the same IP at different times, calculate the geographical distance of the sample pair through the Haversine formula, label the sample pair "same region (0) / cross-region (1)" label, and generate training sample pairs containing traffic feature pairs, geographical distance, and classification labels.

[0025] S1-4: Traffic geographical data enhancement. To solve the problem of unbalanced geographical grouping samples, add random offset to the traffic features and apply slight directional offset to the geographical coordinates, supplement positive and negative samples, balance the distribution of the data set, and improve the model's anti-interference ability.

[0026] S2-1: Traffic encoder. Use TransformerEncoder with self-attention and multi-head mechanism (shared weights) to encode the fused traffic feature vector into a deep semantic embedding vector, capturing key associations between traffic features.

[0027] S2-2: Traffic embedding distance-geographical distance contrastive learning. L2 normalize the deep semantic embedding vector, introduce a learnable parameter to adjust the distance range, and calculate the embedding distance; minimize the difference between embedding distance and geographical distance through MSE loss, and realize the alignment of traffic embedding space and physical geographical space.

[0028] S3-1: IP cross-region classifier based on traffic embedding. Concatenate the current IP traffic embedding and the latest historical traffic embedding, input the lightweight binary classifier (fully connected network), and train through cross-entropy loss to quickly determine whether the IP has migrated across regions within the adjacent time window.

[0029] According to step S1, a geographical correlation fusion network traffic feature set is constructed, and the core basis is that network traffic has significant regional differences, which are caused by the comprehensive influence of network environment, operator strategy and user behavior: the regional heterogeneity of network environment is reflected in geographical distance and infrastructure density. Developed areas have more intensive base stations, routers and other facilities to ensure stronger transmission stability, while remote areas have sparse facilities, resulting in weaker transmission stability. At the same time, geographical distance and local service deployment also directly affect transmission delay; there are regional differences in operator strategy, and different regions have different dominant operators, which leads to differences in congestion control, load balancing algorithms and parameter configurations, resulting in different transmission regulation features between regions; the regional differences in user behavior at the application layer are also obvious, and there are differences in user source and request mode in different regions. Some show high concurrency request characteristics, which may be related to enterprise online operation, and some are mainly low-concurrency personal daily queries, reflecting different user portraits. Due to the multi-level geographical heterogeneity of network environment, we designed five types of core features including time features, load features, burst features, window features and direction features as shown in Table 1. Time features reflect the geographical distribution pattern of infrastructure transmission quality through packet arrival interval and round-trip time, load features are derived from packet length and throughput to reflect the regional regularity of user request size, burst features quantify the regional characteristics of user activity intensity through traffic concentration, window features reveal regional exclusive transmission regulation features driven by operator strategy, and direction features describe the spatial distribution of traffic structure between geographical regions based on uplink and downlink traffic proportion. Through these five types of feature systems, regional characteristics are decoded to establish a close correlation between network traffic and geographical space.

[0030] Table 1 Traffic Feature Category Description According to step S1-1, the traffic data is preprocessed, and the original traffic is stored in pcap format. Whether it is a client IP is judged according to whether it belongs to an external IP. The original traffic is divided according to the client IP, and then the traffic is further divided according to a 1-hour time window. According to the four-tuple (source IP, destination IP, source port, destination port), it is divided into multiple flows. Using the Tshark command, according to the timestamp, the packet-level features such as TCP payload length, direction, packet interval, ACK RTT, window size, etc. are extracted. The features of different times constitute a feature sequence, and the IQR method is used to process the feature sequence data of a single traffic flow. Outliers are removed, and the feature sequence is normalized to [0, 1]. outliers in the range, avoiding extreme data interference. Unify the length of feature sequences of each flow (short sequence padding, long sequence truncation), for each dimension of the flow's feature sequence such as packet interval, payload length sequence, calculate the average length L of all feature sequences in this dimension of the data set, pad 0 to the feature sequence shorter than L, truncate the feature sequence longer than L to the first L elements, and ensure the consistency of the length of the feature sequence. Calculate the mean value of the corresponding dimension feature according to the sequence to obtain the statistical feature (RTT mean value, throughput, window size mean value, etc.), as shown in Table 2.

[0031] Table 2 Statistical feature calculation method According to step S1-2, the flow feature set is fused, and the TCP payload length sequence , the packet interval sequence , and the window size sequence are fused with the direction sequence (client to server is positive, and vice versa) using Hadamard product to construct the burst length sequence , where a single element represents the total number of packets with the same direction in the time, and the direction is identified. The burst duration sequence is , where a single duration .The final sequence feature is obtained by vector splicing , and the formula 1 is as follows: Formula (1) The single-flow feature fusion is to splice the sequence feature of each flow with the statistical feature to form the complete feature vector of a single flow, as formula 2 Formula (2) Formula (3) where is the feature vector of the nth flow in the time window calculated by formula (2), and N is the total number of data flows in the time window .

[0032] According to step S1-3, the flow geographical correlation is performed for the fusion feature vector , query IP database corresponding time window of IP's geographic identification , including standardized area labels such as "Beijing-Chaoyang District" and central longitude and latitude coordinates . From the processed traffic feature set, select the feature vector of the same IP but different time window to form a sample pair , while calculating its and physical distance such as formula (4).

[0033] Formula (4) This formula is used to calculate the shortest distance between two points on the sphere, which is suitable for the conversion of physical distance of longitude and latitude coordinates. Classification label: if (IP does not cross the region), label the label , if IP cross region), label the label . Finally, form a sample pair containing "traffic feature pair-geographic distance-classification label"

[0034] According to steps S1-4, the traffic geographic data is enhanced, the sample imbalance problem between geographic groups is solved, the model robustness is improved through reasonable data expansion, and the traffic fluctuation and geographic positioning error in the real scene are simulated. According to the geographic grouping identification such as operators, cities, the sample pair data set is divided into groups , assuming that the maximum sample size of each group is , and the target amount of positive and negative samples of each group is set to , ensuring a 1:1 sample balance ratio. For the group that needs to supplement the sample, introduce the traffic feature offset amplitude parameter default , ensure that the offset amplitude is within a reasonable range, simulate the natural variation of features caused by network fluctuations; add random offset to each dimension of the original feature vector , formula (5) is as follows: Formula (5) where controls the offset direction. And introduce the geographic coordinate offset ratio parameter default value 1, add random offset to the original longitude and latitude coordinates, formula (6) is as follows: ​Formula (6) wherein is the corresponding physical distance of the base offset unit, about 20.07m, simulating the small error of geographic positioning. The original samples and the generated positive and negative supplementary samples are merged to obtain a balanced data set as formula (7): Formula (7) According to step S2-1, the traffic encoder adopts a shared weight Transformer Encoder as the core encoder, and the specific parameters are: hidden layer dimension , 4 attention heads, 2-layer network structure, capturing long-time dependence and key association of traffic features through self-attention mechanism, and enhancing multi-dimensional expression ability of features through multi-head mechanism. The features in the sample pair of the balanced data set are input into the encoder, and the deep semantic representation is output, wherein represents the mapping function of the encoder. The deep semantic representation is dimensionally converted and feature mapped through the projection head , and the projection head structure is 256→128→64. Finally, the low-dimensional embedding vector is output, with an embedding dimension , which reduces the subsequent calculation complexity while retaining the core geographic semantic information.

[0035] According to step S2-2, the traffic embedding distance-geographic distance contrast learning is implemented through the contrast learning mechanism to align the traffic embedding space with the physical geographic space, so that the embedding distance can accurately reflect the geographic distance and enhance the geographic semantic expression ability of the traffic features. The embedding vector is normalized to eliminate the cross-dimension scale difference, as shown in formula (8), to stabilize the cosine similarity calculation.

[0036] Formula (8) The learnable parameter is introduced to dynamically adjust the distance range to adapt to the large range fluctuation of geographic distance, and the final embedding distance calculation formula (9) is: Formula (9) The mean square error (MSE) loss is used to minimize the difference between the embedding distance and the physical geographic distance , so as to constrain the small embedding distance of the traffic in adjacent areas and the large embedding distance of the traffic in remote areas, and optimize the traffic encoder; the loss formula (10) is as follows: ​Formula (10) According to step S3-1, the traffic embedding-based IP cross-region classifier designs a lightweight binary classifier (such as a softmax binary classifier) to quickly determine whether the IP migrates across regions in the adjacent time window, meeting the real-time and accuracy requirements of network services. The traffic feature vector of the current time window is extracted , and the current embedding is obtained through the traffic encoder The traffic embedding database is queried (by embedding all the historical traffic, recording the time stamp and traffic features, and storing them in the embedding database, so as to achieve the effect of fast identification), and the latest historical embedding of the IP is obtained The two are spliced into a fusion feature vector: The fusion feature dimension is . A lightweight fully connected network is used as a classifier, and the structure is“512→128→2”. The fusion feature vector is input , and a binary classification probability distribution is output. The classification loss adopts cross-entropy loss, and formula (11) is as follows: Formula (11) Wherein, represents the mapping function of the classifier. The binary classification result is obtained through classification reasoning , wherein represents that the IP does not migrate across regions, represents that the IP migrates across regions. The training process adopts a batch size of 1024, an Adam optimizer initial learning rate , a weight decay , a ReduceLROnPlateau learning rate scheduler decay factor 0.5, a patience value 30, a training of 200 rounds, and a gradient clipping to prevent overfitting.

[0037] As shown in Figure 3 , an optional embodiment of the present application provides an IP cross-region detection system based on network traffic, characterized in that it comprises a fusion network traffic feature set generation module, a training module and a detection module; The fusion network traffic feature set generation module is used to construct a geographical correlation fusion network traffic feature set; the fusion network traffic feature set comprises a plurality of sample pairs comprising“traffic feature pair-geographical distance-classification label”; the traffic feature pair in the sample pair has the same IP but different time windows; The training module is used to train the traffic encoder by using the sample pair, so that the traffic embedding space output by the traffic encoder is consistent with the physical geographical space; The detection module is configured to extract a traffic feature of a current data flow of the target client as an input of the traffic encoder to obtain a current traffic embedding space of the target client; and determine whether the target client has migrated across regions according to the current traffic embedding space of the target client and a latest historical traffic embedding space of the target client.

[0038] An optional embodiment of the present application provides a server, characterized by comprising a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the above method.

[0039] An optional embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above method.

[0040] Although the specific embodiments of the present application are disclosed for the purpose of illustrating the present application, the purpose is to help understand the content of the present application and to implement the same, those skilled in the art can understand that various replacements, changes and modifications are possible without departing from the spirit and scope of the present application and the appended claims. Therefore, the present application should not be limited to the disclosed content of the best mode, and the scope of the present application is defined by the scope of the claims.

Claims

1. A method for detecting cross-regional IP addresses based on network traffic, comprising the following steps: Construct a geographically associated fusion network traffic feature set; The converged network traffic feature set includes multiple sample pairs containing "traffic feature pair - geographical distance - classification label"; the traffic feature pairs in the sample pairs have the same IP but different time windows; The traffic encoder is trained using the sample pairs to ensure that the traffic embedding space output by the traffic encoder is consistent with the physical geographic space. The traffic characteristics of the current data stream of the target client are extracted and input into the traffic encoder to obtain the current traffic embedding space of the target client; Based on the target client's current traffic embedding space and the target client's latest historical traffic embedding space, determine whether the target client has undergone cross-region migration.

2. The method according to claim 1, characterized in that, The method for constructing the converged network traffic feature set is as follows: Collect network traffic from multiple clients and divide it according to a set time window; divide the network traffic within each time window into multiple data streams based on a four-tuple (source IP, destination IP, source port, destination port); Extract the features of each data stream, arrange the features of the same data stream in different time windows according to time to form a feature sequence, and obtain the feature sequence of each data stream; The statistical features of each data stream are obtained from its feature sequence; the sequence features and statistical features of each data stream are concatenated to form the feature vector of each data stream. The fused feature vector of each data stream within each time window is obtained by averaging the feature vectors of that time window. Obtain the geographic identifier corresponding to the fusion feature vector of each time window, and select the fusion feature vectors of the same IP but different time windows as traffic feature pairs in a sample pair; calculate the geographic distance of the traffic feature pair based on the geographic identifier corresponding to the traffic feature pair and determine the classification label corresponding to the traffic feature pair.

3. The method according to claim 2, characterized in that, The characteristics of each data stream include time characteristics, load characteristics, burst characteristics, window characteristics, and direction characteristics.

4. The method according to claim 3, characterized in that, The TCP payload length sequence, packet interval sequence, window size sequence, direction sequence, and burst duration sequence are constructed based on load characteristics, time characteristics, window characteristics, direction characteristics, and burst characteristics in the feature sequence. The TCP payload length sequence, packet interval sequence, and window size sequence in the feature sequence are fused with the direction sequence through Hadamard product to obtain the burst length sequence. The burst length sequence is concatenated with the burst duration sequence in the feature sequence to obtain the feature vector of each data stream.

5. The method according to claim 2, characterized in that, The fused network traffic feature set is divided into For each group of samples to be supplemented, a traffic feature offset magnitude parameter is introduced to add random offsets to each dimension of the fused feature vector in the group of samples to be supplemented, generating positive and negative supplementary samples; and a geographic coordinate offset ratio parameter is introduced to add random offsets to the geographic identifiers in the group of samples to be supplemented, generating positive and negative supplementary samples; then, new sample pairs are generated based on the generated positive and negative supplementary samples to supplement the group of samples to be supplemented.

6. The method according to claim 1, 2, or 3, characterized in that, The flow encoder uses a shared-weight Transformer Encoder as the core encoder; the flow feature pairs in the sample pairs are input into the flow encoder, and the flow embedding space is output. The traffic embedding space and the physical geographic space are aligned through a contrastive learning mechanism, so that the embedding distance accurately reflects the geographic distance and enhances the geographic semantic expression capability of traffic features. In the contrastive learning mechanism, the mean square error (MSE) loss is used to minimize the difference between the traffic embedding space and the physical geographic space to optimize the traffic encoder.

7. The method according to claim 1, 2, or 3, characterized in that, A lightweight binary classifier based on traffic embedding is designed to determine whether an IP has migrated across regions within adjacent time windows. The lightweight binary classifier is trained and optimized using the sample pairs, with cross-entropy loss used as the classification loss during training and optimization. Then, the current traffic embedding space of the target client and the latest historical traffic embedding space of the target client are input into the optimized lightweight binary classifier, which outputs a binary classification probability distribution to determine whether the target client has migrated across regions.

8. A network traffic-based IP cross-regional detection system, characterized in that, This includes a network traffic feature set generation module, a training module, and a detection module; The converged network traffic feature set generation module is used to construct a geographically associated converged network traffic feature set; the converged network traffic feature set includes multiple sample pairs containing "traffic feature pair - geographical distance - classification label"; the traffic feature pairs in the sample pairs have the same IP but different time windows; The training module is used to train the traffic encoder using the sample pairs, so that the traffic embedding space output by the traffic encoder is consistent with the physical geographic space. The detection module is used to extract the traffic characteristics of the current data stream of the target client and input them into the traffic encoder to obtain the current traffic embedding space of the target client; Based on the target client's current traffic embedding space and the target client's latest historical traffic embedding space, determine whether the target client has undergone cross-region migration.

9. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 8.

Images