Network anomaly detection method, device, equipment, medium and product

By performing hierarchical feature extraction and cross-domain comparison on network traffic data, and using pre-built models and fingerprint databases to identify cross-domain anomalies, the accuracy problem of cross-domain traffic detection in existing technologies has been solved, achieving high-precision and full-link awareness network anomaly detection.

CN121841689APending Publication Date: 2026-04-10CHINA UNITED NETWORK COMM GRP CO LTD +2
0 Cites 1 Cited by

Patent Information

Application Number
CN202511903814.0
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-12-16
Publication Date
2026-04-10

AI Technical Summary

Technical Problem

Existing network anomaly detection methods are ineffective at detecting cross-domain traffic anomalies, have low monitoring accuracy, and are prone to missed detections and false detections.

Method used

By performing hierarchical feature extraction on the network traffic data to be detected, and using a pre-built multi-domain network feature invariant identification model and a multi-level traffic feature fingerprint database, key invariant feature vectors that remain stable during cross-domain propagation are identified. These vectors are then compared with known attack patterns stored in the pre-built multi-level traffic feature fingerprint database to determine cross-domain abnormal behavior.

Benefits of technology

It achieves high-precision, low-latency, and end-to-end awareness and identification of cross-domain attacks, significantly improving the accuracy and coverage of network anomaly detection, and is able to identify complex, covert, and multi-stage network attacks that are difficult to detect using traditional single-layer detection methods.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention provides a network anomaly detection method, device and equipment, a medium and a product, and relates to the technical field of computer network security. Comprising the following steps: acquiring a pre-established multi-domain network feature invariant recognition model, a pre-established multi-level traffic feature fingerprint database and to-be-detected network traffic data; determining a target feature extraction strategy according to the to-be-detected network traffic data; performing hierarchical feature extraction on the to-be-detected network traffic data according to the target feature extraction strategy; inputting the target features into a pre-training anomaly detection model to obtain a traffic anomaly detection result; and when it is detected that the traffic anomaly detection result is abnormal, inputting the target feature into a pre-established multi-domain network feature invariant recognition model and a pre-established multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain a cross-domain anomaly detection result. According to the method provided by the invention, the cross-domain traffic anomaly can be effectively detected, the monitoring accuracy is improved, and the problems of missing detection and false detection are reduced.
Need to check novelty before this filing date? Find Prior Art