Network anomaly detection method, device, equipment, medium and product

Abstract

The invention provides a network anomaly detection method, device and equipment, a medium and a product, and relates to the technical field of computer network security. Comprising the following steps: acquiring a pre-established multi-domain network feature invariant recognition model, a pre-established multi-level traffic feature fingerprint database and to-be-detected network traffic data; determining a target feature extraction strategy according to the to-be-detected network traffic data; performing hierarchical feature extraction on the to-be-detected network traffic data according to the target feature extraction strategy; inputting the target features into a pre-training anomaly detection model to obtain a traffic anomaly detection result; and when it is detected that the traffic anomaly detection result is abnormal, inputting the target feature into a pre-established multi-domain network feature invariant recognition model and a pre-established multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain a cross-domain anomaly detection result. According to the method provided by the invention, the cross-domain traffic anomaly can be effectively detected, the monitoring accuracy is improved, and the problems of missing detection and false detection are reduced.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to a method, apparatus, device, medium and product for detecting network anomalies. Background Technology

[0002] In modern network environments, cyberspace exhibits a distinct layered structure, typically divided into three levels: access networks, intra-domain networks, and inter-domain networks. With the rapid development of network technology, network attacks have become increasingly complex and diverse, making effective detection of such attacks a crucial aspect of ensuring network security.

[0003] Existing technologies primarily analyze traffic characteristics based on a single network layer (such as an access network or intra-domain network). Detection methods often involve identifying abnormal traffic through rule matching or simple statistical methods, or defining traffic characteristic rules based on expert experience. For example, detection models are built based on static indicators such as protocol type and traffic rate, and fixed features are extracted from them to detect network attack behavior.

[0004] However, existing network anomaly detection methods are difficult to effectively detect cross-domain traffic anomalies, and suffer from low monitoring accuracy, and are prone to missed detections and false detections. Summary of the Invention

[0005] This application provides a network anomaly detection method, apparatus, device, medium, and product. It involves performing hierarchical feature extraction on network traffic data to be detected, inputting the extracted target features into a pre-built multi-domain network feature invariant identification model to identify invariant feature vectors, and then comparing these vectors with features in a pre-built multi-level traffic feature fingerprint database to determine the cross-domain anomaly detection result for cross-domain attacks. This effectively solves the problems of existing network anomaly detection methods, such as difficulty in effectively detecting cross-domain traffic anomalies, low monitoring accuracy, and susceptibility to missed detections and false detections.

[0006] Firstly, this application provides a method for detecting network anomalies, the method comprising:

[0007] Acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected;

[0008] Based on the network traffic data to be detected, determine the target feature extraction strategy;

[0009] Based on the target feature extraction strategy, hierarchical feature extraction is performed on the network traffic data to be detected, and any one of the inter-domain features, intra-domain features, and access network features to be detected is used as the target feature.

[0010] Input the target features into the pre-trained anomaly detection model to obtain the traffic anomaly detection results;

[0011] When an anomaly is detected, the target features are input into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain the cross-domain anomaly detection result.

[0012] In one possible implementation, obtaining a pre-built multi-domain network feature invariant identification model includes:

[0013] Obtain traffic data from different network domains and an initial feature invariant identification model, and perform data preprocessing on the traffic data from different network domains to obtain the network traffic data to be labeled;

[0014] Label the network traffic data to be labeled to obtain normal network traffic data and abnormal network traffic data;

[0015] Hierarchical feature extraction is performed on normal network traffic data and abnormal network traffic data to obtain inter-domain features, intra-domain features, and access network features to be detected as training feature sets.

[0016] The initial feature invariant recognition model is trained based on the training feature set to obtain the pre-built multi-domain network feature invariant recognition model.

[0017] In one possible implementation, obtaining a pre-built multi-level traffic feature fingerprint database includes:

[0018] Acquire initial multi-layer network traffic data and perform data preprocessing on the multi-layer network traffic data to obtain the traffic data to be extracted;

[0019] Perform hierarchical feature extraction on the traffic data to be extracted to obtain multi-level network domain spatial traffic features;

[0020] A multi-level traffic feature fingerprint database is constructed based on the multi-level network domain space traffic characteristics, resulting in a pre-built multi-level traffic feature fingerprint database.

[0021] In one possible implementation, the network traffic data to be detected includes inter-domain traffic data to be detected, intra-domain traffic data to be detected, and access network traffic data to be detected.

[0022] Hierarchical feature extraction is performed on the network traffic data to be detected, and any one of the following is used as the target feature: inter-domain features, intra-domain features, and access network features:

[0023] An autoencoder is used to perform the first-level feature extraction operation on the inter-domain traffic data to be detected, and the inter-domain features to be detected are used as target features.

[0024] Alternatively, a second-level feature extraction operation can be performed on the traffic data within the detection domain to obtain the features within the detection domain as target features;

[0025] Alternatively, a third-level feature extraction operation can be performed on the access network traffic data to be detected to obtain the access network features to be detected as target features.

[0026] In one possible implementation, an autoencoder is used to perform a first-level feature extraction operation on the inter-domain traffic data to be detected, obtaining the inter-domain features to be detected as target features, including:

[0027] The traffic data between the domains to be detected is partitioned to obtain time feature groups, size feature groups, address feature groups, and protocol feature groups;

[0028] Multiple autoencoders are used to extract features from the time feature group, size feature group, address feature group, and protocol feature group respectively, resulting in time feature output, size feature output, address feature output, and protocol feature output.

[0029] The time feature output, size feature output, address feature output, and protocol feature output are concatenated or fused to obtain the inter-domain features to be detected.

[0030] In one possible implementation, a second-level feature extraction operation is performed on the traffic data within the detection domain to obtain features within the detection domain as target features, including:

[0031] Clustering algorithms are used to perform cluster analysis on the traffic data within the detection domain to obtain clustering results;

[0032] The clustering results are used to extract feature fingerprints by the Local Interpretability Model (LIME) to obtain the features within the domain to be detected as target features.

[0033] In one possible implementation, a third-level feature extraction operation is performed on the access network traffic data to be detected to obtain the access network features to be detected as target features, including:

[0034] Perform feature calculations on the access network traffic data to be detected to obtain the first statistical feature and the second statistical feature.

[0035] Time series features are obtained by extracting time series features from the access network traffic data to be tested using a pre-built time series model;

[0036] Graph structure features are obtained by extracting graph structure from the traffic data of the access network to be detected using a pre-trained graph neural network.

[0037] Feature fusion is performed based on the first statistical feature, the second statistical feature, the time series feature, and the graph structure feature to obtain the access network features to be detected as target features.

[0038] Secondly, this application provides a network anomaly detection device, the device comprising:

[0039] The acquisition module is used to acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected;

[0040] The feature extraction module is used to determine the target feature extraction strategy based on the network traffic data to be detected.

[0041] The feature extraction module is also used to perform hierarchical feature extraction on the network traffic data to be detected according to the target feature extraction strategy, and obtain any one of the inter-domain features, intra-domain features, and access network features to be detected as the target feature;

[0042] The anomaly detection module is used to input target features into a pre-trained anomaly detection model to obtain traffic anomaly detection results;

[0043] The anomaly detection module is also used to input the target features into the pre-built multi-domain network feature invariant recognition model and the pre-built multi-level traffic feature fingerprint database when the traffic anomaly detection result is abnormal, so as to perform cross-domain anomaly detection processing and obtain the cross-domain anomaly detection result.

[0044] In one possible implementation, the acquisition module is further configured to acquire traffic data from different network domains and an initial feature invariant identification model, and to perform data preprocessing on the traffic data from different network domains to obtain the network traffic data to be labeled.

[0045] The acquisition module is also used to perform annotation operations on the network traffic data to be labeled, so as to obtain normal network traffic data and abnormal network traffic data;

[0046] The acquisition module is also used to perform hierarchical feature extraction on normal network traffic data and abnormal network traffic data to obtain inter-domain features, intra-domain features, and access network features to be detected as training feature sets.

[0047] The acquisition module is also used to train the initial feature invariant recognition model based on the training feature set to obtain the pre-built multi-domain network feature invariant recognition model.

[0048] In one possible implementation, the acquisition module is further configured to acquire initial multi-layer network traffic data and perform data preprocessing on the multi-layer network traffic data to obtain traffic data to be extracted.

[0049] The acquisition module is also used to perform hierarchical feature extraction operations on the traffic data to be extracted, so as to obtain multi-level network domain spatial traffic features;

[0050] The acquisition module is also used to construct a multi-level traffic feature fingerprint database based on the multi-level network domain space traffic characteristics, thereby obtaining a pre-built multi-level traffic feature fingerprint database.

[0051] In one possible implementation, the network traffic data to be detected includes inter-domain traffic data to be detected, intra-domain traffic data to be detected, and access network traffic data to be detected.

[0052] The feature extraction module is also used to perform the first-level feature extraction operation on the inter-domain traffic data to be detected using an autoencoder, so as to obtain the inter-domain features to be detected as target features.

[0053] Alternatively, it can be used to perform a second-level feature extraction operation on the traffic data within the detection domain, obtaining the features within the detection domain as target features;

[0054] Alternatively, it can be used to perform third-level feature extraction on the traffic data of the access network to be detected, and obtain the features of the access network to be detected as target features.

[0055] In one possible implementation, the feature extraction module is also used to perform data partitioning operations on the inter-domain traffic data to be detected, to obtain time feature groups, size feature groups, address feature groups and protocol feature groups.

[0056] The feature extraction module is also used to perform feature representation extraction processing on the time feature group, size feature group, address feature group and protocol feature group respectively using multiple autoencoders to obtain time feature output, size feature output, address feature output and protocol feature output;

[0057] The feature extraction module is also used to concatenate or fuse the time feature output, size feature output, address feature output, and protocol feature output to obtain the inter-domain features to be detected.

[0058] In one possible implementation, the feature extraction module is also used to perform cluster analysis on the traffic data within the domain to be detected using a clustering algorithm to obtain clustering results;

[0059] The feature extraction module is also used to extract feature fingerprints from the clustering results using the Local Interpretability Model (LIME) to obtain features within the domain to be detected as target features.

[0060] In one possible implementation, the feature extraction module is further used to perform feature calculation operations on the access network traffic data to be detected, to obtain a first statistical feature and a second statistical feature.

[0061] The feature extraction module is also used to extract time series features from the access network traffic data to be detected using a pre-built time series model, thereby obtaining time series features;

[0062] The feature extraction module is also used to extract graph structure features from the access network traffic data to be detected by using a pre-trained graph neural network.

[0063] The feature extraction module is also used to perform feature fusion based on the first statistical feature, the second statistical feature, the time series feature, and the graph structure feature to obtain the access network features to be detected as target features.

[0064] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor.

[0065] The memory stores the instructions that the computer executes.

[0066] The processor executes computer execution instructions stored in memory to implement a network anomaly detection method according to the first aspect of the invention.

[0067] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement a network anomaly detection method according to the first aspect of the invention.

[0068] Fifthly, this application provides a computer program product, including a computer program, which, when executed by a processor, is used to implement a network anomaly detection method according to the first aspect of the invention.

[0069] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods.

[0070] This application provides a network anomaly detection method, apparatus, device, medium, and product, comprising: first, acquiring a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected; next, determining a target feature extraction strategy based on the network traffic data to be detected; subsequently, performing hierarchical feature extraction on the network traffic data to be detected according to the target feature extraction strategy, obtaining any one of the following as target features: inter-domain features, intra-domain features, and access network features; then, inputting the target features into a pre-trained anomaly detection model to obtain a traffic anomaly detection result; finally, when an anomaly is detected, the target features are input into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain a cross-domain anomaly detection result. This achieves the following technical effects: by performing hierarchical feature extraction on the network traffic data to be detected according to its network level, fine-grained target features adapted to the characteristics of each layer are obtained. Then, the extracted target features are input into the pre-built multi-domain network feature invariant identification model to identify key invariant feature vectors that remain stable during cross-domain propagation. Subsequently, the invariant feature vector is compared with known attack patterns stored in a pre-built multi-level traffic feature fingerprint database. If a match is found, cross-domain abnormal behavior is determined, and cross-domain anomaly detection results containing attack type, involved levels, and propagation path are output. This not only enables rapid initial screening of single-point anomalies but also automatically triggers cross-domain correlation analysis after anomaly confirmation, effectively identifying complex, covert, and multi-stage network attacks that are difficult to detect using traditional single-layer detection methods. This achieves high-precision, low-latency, end-to-end awareness and identification of cross-domain attacks, significantly improving the accuracy and coverage of network anomaly detection. Attached Figure Description

[0071] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0072] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0073] Figure 1 This is a schematic diagram illustrating an application scenario of a network anomaly detection method provided in an embodiment of this application.

[0074] Figure 2 A flowchart illustrating a network anomaly detection method provided in an embodiment of this application;

[0075] Figure 3 This is a schematic diagram of the structure of a network anomaly detection device provided in an embodiment of this application;

[0076] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0077] Figure label:

[0078] 101 - Terminal; 102 - Server;

[0079] 310 - Acquisition module; 320 - Feature extraction module; 330 - Anomaly detection module;

[0080] 410 - Processor; 420 - Memory; 430 - Communication components; 440 - Bus. Detailed Implementation

[0081] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0082] In the embodiments of this application, the terms "first" and "second" are used to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and that "first" and "second" do not necessarily imply difference. It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate that something is being used as an example, illustration, or description. Any embodiment or design scheme described as "exemplary" or "for example" in this application should not be construed as being better or more advantageous than other embodiments or design schemes. Specifically, the use of "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more.

[0083] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0084] It should be noted that the phrase "at...time" in the embodiments of this application can refer to the instant at which a certain situation occurs, or to a period of time after the occurrence of a certain situation; the embodiments of this application do not specifically limit this. Furthermore, the network anomaly detection method provided in the embodiments of this application is merely an example; a network anomaly detection method may include more or fewer elements.

[0085] In modern network environments, network space structures exhibit distinct layered characteristics, typically divided into access networks (edge ​​networks, such as enterprise networks and cloud nodes), intra-domain networks (backbone networks or metropolitan area networks within the same management domain), and inter-domain networks (interconnection boundaries between different autonomous systems). Network traffic flows from inter-domain networks through intra-domain networks to access networks, forming high, medium, and low-level multi-tiered transmission paths. The traffic volume at each layer ranges from megabytes (TB) to terabytes (MB), and their characteristic dimensions also differ significantly.

[0086] Existing network anomaly detection methods primarily rely on traffic analysis at a single network layer (e.g., only within the access network or domain), employing static rules based on expert experience (such as protocol type, connection rate, and packet length thresholds) for matching, or identifying deviations from the baseline through simple statistical models. Some solutions introduce machine learning algorithms to classify fixed feature sets, but their feature extraction process does not consider the structural characteristics and semantic differences in traffic across different network layers. When facing cross-domain coordinated attacks (such as segment scanning attacks and anthropomorphic slow attacks), these methods lack a multi-layered traffic correlation perspective, making it difficult to accurately capture the propagation path and behavioral consistency of attacks across high, medium, and low-level networks. This results in high false negative rates, frequent false alarms, and insufficient real-time performance, failing to meet the security protection needs of complex network environments.

[0087] Based on this, this application proposes a network anomaly detection method, apparatus, device, medium, and product, which can be used in the field of computer network security technology and aims to solve the above-mentioned technical problems of the prior art. By extracting layered features from the network traffic data to be detected according to its network level (access network, intra-domain network, inter-domain network), fine-grained target features adapted to the characteristics of each layer are obtained. Then, the extracted target features are input into a pre-built multi-domain network feature invariant recognition model to identify key invariant feature vectors that remain stable during cross-domain propagation. Subsequently, the invariant feature vector is compared with known attack patterns stored in a pre-built multi-level traffic feature fingerprint database. If a match is successful, cross-domain abnormal behavior is determined, and a cross-domain anomaly detection result containing the attack type, involved level, and propagation path is output. This achieves high-precision, low-latency, and full-link perception and identification of cross-domain attacks, significantly improving the accuracy and coverage of network anomaly detection.

[0088] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0089] Figure 1 This is a schematic diagram illustrating an application scenario of a network anomaly detection method provided in an embodiment of this application, such as... Figure 1 As shown, it includes: terminal 101 and server 102.

[0090] Terminal 101 is used to display cross-domain anomaly detection results for user viewing. Server 102 is communicatively connected to terminal 101 and is used to acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected, and to perform network anomaly detection operations to generate cross-domain anomaly detection results.

[0091] Figure 2 This is a flowchart illustrating a network anomaly detection method provided in an embodiment of this application. The execution entity of this embodiment can be... Figure 1 The server 102 in the illustrated embodiment can also be other computer-related devices, and this embodiment does not impose any particular limitation on it. For ease of description, the implementing entity of a network anomaly detection method is uniformly described as a server in this application embodiment.

[0092] like Figure 2 As shown, the method includes:

[0093] S201. Obtain the pre-built multi-domain network feature invariant identification model, the pre-built multi-level traffic feature fingerprint database, and the network traffic data to be detected.

[0094] Specifically, the server can first load a pre-built and trained multi-domain network feature invariant identification model. This pre-built multi-domain network feature invariant identification model is trained through deep reinforcement learning and concept drift adaptive mechanism, and can identify invariant features that remain stable during the cross-domain propagation of network attacks.

[0095] Simultaneously, a pre-built multi-level traffic feature fingerprint database is loaded. This pre-built multi-level traffic feature fingerprint database stores structured feature templates of historically known attack patterns at three levels: access network, intra-domain network, and inter-domain network. These include, but are not limited to, multi-level feature combinations of cross-domain attacks such as Distributed Denial-of-Service (DDoS) coordinated attacks, Advanced Persistent Threat (APT) lateral movement, and Subnet Scanning.

[0096] In addition, network traffic data to be detected is obtained in real time from data sources such as network probes, traffic mirroring ports, or software-defined networking (SDN) controllers. This network traffic data includes raw data packets or flow records, such as network flow records (NetFlow) and sampled flow (sFlow), covering high, medium, and low-level network nodes.

[0097] S202. Determine the target feature extraction strategy based on the network traffic data to be detected.

[0098] Specifically, the server can determine the network layer to which the network traffic data to be detected belongs, which can be determined by the autonomous system to which the source / destination Internet Protocol (IP) belongs, geographical location tags, network topology metadata, or traffic collection point identifiers. The server can then automatically match the corresponding target feature extraction strategy.

[0099] Specifically, if the traffic originates from inter-domain networks, such as operator backbone interconnection points, a high-level feature extraction strategy is adopted, focusing on large-scale parallel feature grouping processing.

[0100] If the traffic originates from an intra-domain network, such as a core router within the same metropolitan area network, a median feature extraction strategy is adopted to focus on automated clustering and interpretable feature generation.

[0101] If the traffic originates from the access network, such as the enterprise boundary or the virtual private cloud (VPC) of a cloud tenant, a low-level feature extraction strategy is adopted, emphasizing fine-grained statistics, time-series dynamics, and graph structure relationship mining.

[0102] S203. Perform hierarchical feature extraction on the network traffic data to be detected according to the target feature extraction strategy, and obtain any one of the inter-domain features, intra-domain features, and access network features to be detected as the target feature.

[0103] Specifically, based on the target feature extraction strategy described above, the server can perform targeted processing on the network traffic data to be detected.

[0104] Specifically, under the high-bit feature extraction strategy, an integrated autoencoder is used to encode feature groups such as time, address, protocol, and size in parallel, and output the inter-domain features to be detected.

[0105] Under the median feature extraction strategy, key discriminative features are extracted through Local Interpretable Model-agnostic Explanations (LIME) to form features within the detection domain.

[0106] Under the low-level feature extraction strategy, statistical indicators, prediction residuals from Long Short-Term Memory (LSTM) networks, and graph neural network embeddings are integrated to generate the features of the access network to be detected.

[0107] Finally, the extracted hierarchical features can be used as target features for subsequent network anomaly detection.

[0108] S204. Input the target features into the pre-trained anomaly detection model to obtain the traffic anomaly detection results.

[0109] Specifically, the target features can be input into a lightweight, low-latency pre-trained anomaly detection model, such as a general anomaly scorer based on Isolation Forest, One-Class Support Vector Machine (One-Class SVM), or a small Transformer. This pre-trained anomaly detection model can quickly determine whether the current traffic deviates from the normal behavior baseline and output the traffic anomaly detection result, such as normal or abnormal, and can also include an anomaly confidence score.

[0110] S205. When the traffic anomaly detection result is abnormal, the target features are input into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain the cross-domain anomaly detection result.

[0111] Specifically, when the traffic anomaly detection result indicates an anomaly (i.e., the confidence level exceeds the preset threshold), the server can initiate the cross-domain anomaly detection and processing procedure.

[0112] First, the target features can be input into a pre-built multi-domain network feature invariant identification model, which extracts invariant feature vectors that should remain consistent during cross-domain propagation. Then, this invariant feature vector is compared for similarity with various cross-domain attack templates stored in a pre-built multi-level traffic feature fingerprint database, using methods such as cosine similarity, Dynamic Time Warping (DTW), or graph edit distance. If the matching degree exceeds a preset threshold, cross-domain coordinated attack behavior is identified, and a structured cross-domain anomaly detection result is generated. Specifically, the cross-domain anomaly detection result can include: attack type (e.g., distributed scanning combined with intranet penetration), network layers involved (inter-domain networks, intra-domain networks, and access networks), propagation path, risk level, and suggested response measures.

[0113] Through the above steps, this embodiment not only achieves rapid initial screening of single-point anomalies, but also automatically triggers cross-domain correlation analysis after confirming the anomaly, effectively identifying complex, covert, and multi-stage network attacks that are difficult to detect by traditional single-layer detection methods, and can significantly improve the accuracy and coverage of network anomaly detection.

[0114] This embodiment provides a network anomaly detection method. First, a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected are acquired. Next, a target feature extraction strategy is determined based on the network traffic data to be detected. Subsequently, hierarchical feature extraction is performed on the network traffic data to be detected according to the target feature extraction strategy, obtaining any one of the following as the target feature: inter-domain feature, intra-domain feature, and access network feature. Then, the target feature is input into a pre-trained anomaly detection model to obtain a traffic anomaly detection result. Finally, when an anomaly is detected, the target feature is input into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain a cross-domain anomaly detection result.

[0115] The following technical effects were achieved: By extracting layered features from the network traffic data to be detected according to its network layer, fine-grained target features adapted to the characteristics of each layer were obtained. Then, the extracted target features were input into a pre-built multi-domain network feature invariant recognition model to identify key invariant feature vectors that remain stable during cross-domain propagation. Subsequently, this invariant feature vector was compared with known attack patterns stored in a pre-built multi-level traffic feature fingerprint database. If a match was found, cross-domain abnormal behavior was determined, and a cross-domain anomaly detection result containing the attack type, involved layer, and propagation path was output. This not only achieved rapid initial screening of single-point anomalies but also automatically triggered cross-domain correlation analysis after anomaly confirmation, effectively identifying complex, covert, and multi-stage network attacks that are difficult to detect using traditional single-layer detection methods. This resulted in high-precision, low-latency, and end-to-end perception and identification of cross-domain attacks, significantly improving the accuracy and coverage of network anomaly detection.

[0116] In one possible implementation, obtaining a pre-built multi-domain network feature invariant identification model includes: acquiring traffic data from different network domains and an initial feature invariant identification model; preprocessing the traffic data from different network domains to obtain network traffic data to be labeled; labeling the network traffic data to be labeled to obtain normal network traffic data and abnormal network traffic data; performing hierarchical feature extraction on the normal network traffic data and abnormal network traffic data to obtain inter-domain features, intra-domain features, and access network features to be detected as a training feature set; and training the initial feature invariant identification model based on the training feature set to obtain the pre-built multi-domain network feature invariant identification model.

[0117] Specifically, the server can simultaneously collect raw network traffic data from multiple monitoring points covering access networks (such as enterprise perimeter firewalls and cloud tenant VPC egress points), intra-domain networks (such as metropolitan area network core routers and data center internal switching nodes), and inter-domain networks (such as carrier backbone interconnection points and Internet exchange centers). This data includes packet-level capture (PCAP) or flow-level recordings (such as NetFlow and sFlow). Simultaneously, a configurable initial feature invariant recognition model is loaded. This model can be based on a deep neural network architecture, such as a Graph Attention Network (GAT), a Spatio-Temporal Convolutional Network (ST-Conv), or a Transformer variant, possessing cross-domain feature alignment and invariant learning capabilities. This model can also be an agent, a machine learning model, or another model capable of learning and recognizing invariant features of network traffic using deep reinforcement learning and concept drift techniques.

[0118] Then, the server can perform standardized preprocessing on the collected network domain traffic data, including data cleaning operations to remove duplicate streams, empty payload packets, or timestamp errors caused by collection anomalies; extract basic fields such as network five-tuple, protocol type, packet length sequence, arrival time interval between packets, and byte rate, and perform min-max or Z-score normalization on numerical features; and segment the traffic according to a fixed time window (such as 5 minutes) or session granularity to ensure that cross-domain data is comparable in time series.

[0119] After the above processing, we can obtain network traffic data with uniform structure and controllable quality that is ready for annotation.

[0120] Then, security experts can manually or semi-automatically label the network traffic data to be labeled, combining threat intelligence, sandbox analysis results, and historical alert logs, to clearly distinguish between normal and abnormal network traffic data. Normal network traffic data refers to traffic originating from legitimate business activities (such as regular internet access, database synchronization, and video conferencing) and not associated with any security incidents. Abnormal network traffic data refers to traffic samples containing confirmed attack behaviors (such as port scanning, brute-force attacks, and data breaches). Threat intelligence can include the MITRE ATT&CK framework (Adversarial Tactics, Techniques, and Common Knowledge) and a list of Indicators of Compromise (IoC).

[0121] The annotation results can be attached to each traffic record as labels to form a training corpus with supervised signals.

[0122] For labeled normal traffic data and abnormal traffic data, corresponding feature extraction strategies can be used to process them according to their respective network layers.

[0123] Specifically, for inter-domain traffic, an integrated autoencoder can be used to extract high-level comprehensive features as the inter-domain features to be detected.

[0124] For intra-domain traffic, median discriminant features can be generated through unsupervised clustering and interpretability analysis as intra-domain features to be detected.

[0125] For access network traffic, low-level fine-grained features can be obtained by fusing statistical indicators, time series residuals, and graph embedding vectors as the features of the access network to be detected.

[0126] Next, the three types of extraction results (inter-domain features, intra-domain features, and access network features) can be uniformly organized into a structured training feature set, where each sample can contain its original label (normal / abnormal) and the corresponding hierarchical feature vector.

[0127] Finally, the server can input the training feature set into the initial feature invariant recognition model, and by employing a contrastive learning or domain-adversarial training objective function, the initial feature invariant recognition model can learn invariant feature representations that are discriminative against attack behavior but insensitive to domain-specific noise in different network domains.

[0128] Furthermore, the generalization ability of the initial feature invariant recognition model can be improved by introducing a concept drift detection module, such as monitoring the distribution of Kullback–Leibler Divergence (KL) divergence, and dynamically weighting new and old samples during training.

[0129] Once the initial feature invariant identification model achieves the cross-domain attack identification accuracy, F1 score, and invariant consistency index on the validation set, training is stopped, and the final model parameters are solidified into a pre-built multi-domain network feature invariant identification model for cross-domain anomaly verification in the subsequent real-time detection stage.

[0130] In one possible implementation, obtaining a pre-built multi-level traffic feature fingerprint database includes: acquiring initial multi-level network traffic data and performing data preprocessing on the multi-level network traffic data to obtain traffic data to be extracted; performing hierarchical feature extraction operations on the traffic data to be extracted to obtain multi-level network domain spatial traffic features; and constructing a multi-level traffic feature fingerprint database based on the multi-level network domain spatial traffic features to obtain a pre-built multi-level traffic feature fingerprint database.

[0131] Specifically, the server can simultaneously collect historical network traffic data from multiple monitoring points covering access networks (such as enterprise intranet egress, cloud tenant virtual switches), intra-domain networks (such as metropolitan area network aggregation nodes, data center internal backbone links), and inter-domain networks (such as carrier interconnection boundaries, Internet exchange centers), forming initial multi-layer network traffic data. This initial multi-layer network traffic data includes flow-level records or packet-level packet captures, and the time span covers various network operating states, including normal business peaks, periods of security incidents, and system maintenance windows.

[0132] Subsequently, the server can perform unified data preprocessing operations on the initial multi-layer network traffic data, including: data cleaning operations to remove invalid records caused by collection equipment failure or transmission packet loss; parsing key fields such as quintuples, protocol identifiers, timestamps, and packet / byte counts, and standardizing fields by unifying units and encoding formats; filling numerical features with interpolation or mean, and performing Min-Max normalization or Z-score normalization; and slicing the traffic at fixed time granularities (such as 1 minute or 5 minutes) to ensure that cross-layer data is comparable in time series.

[0133] After data preprocessing, we can obtain structurally consistent and reliable traffic data to be extracted.

[0134] Then, the server can call the corresponding feature extraction strategy according to the network layer to which the traffic data to be extracted belongs, so as to realize fine-grained feature mining adapted to the characteristics of each layer.

[0135] Specifically, for inter-domain traffic, an integrated autoencoder can be used to encode feature groups such as address, protocol, timing, and size in parallel to extract high-level abstract features.

[0136] For intra-domain traffic, unsupervised clustering and interpretability analysis can be combined to automatically identify discriminative median behavior patterns.

[0137] For access network traffic, statistical features (entropy, kurtosis), time series residuals (such as LSTM prediction errors), and graph neural network embeddings (host communication graph node representation) can be integrated to extract low-level fine-grained nonlinear relationship features.

[0138] Finally, the three types of extraction results are organized into structured, multi-level network domain spatial traffic features. Each feature record is associated with its original traffic source, timestamp, network level label, and attack type label (if it is a known attack sample).

[0139] Finally, the server can construct a multi-level traffic feature fingerprint database based on the aforementioned multi-level network domain space traffic characteristics.

[0140] Specifically, for each type of known attack behavior (such as distributed denial of service, lateral movement of advanced persistent threats, port scanning, data leakage, etc.), the corresponding feature vectors in the three layers of access network, intra-domain, and inter-domain are aggregated to form a cross-domain attack feature template.

[0141] Each cross-domain attack feature template can include: attack name, involved level, feature vector set, similarity matching threshold, confidence weight, and response suggestions.

[0142] All cross-domain attack signature templates can be stored in an indexed structure (such as a hash table or vector database) to support efficient retrieval and real-time comparison.

[0143] After the construction of the multi-level traffic feature fingerprint database is completed, the server can solidify the fingerprint database as a pre-built multi-level traffic feature fingerprint database, which can be used as a comparison benchmark in the subsequent cross-domain anomaly detection stage to identify whether new traffic is highly similar to known cross-domain attack patterns in the multi-level feature space.

[0144] In one possible implementation, the network traffic data to be detected includes inter-domain traffic data, intra-domain traffic data, and access network traffic data. Hierarchical feature extraction is performed on the network traffic data to be detected to obtain any one of the inter-domain features, intra-domain features, and access network features as target features. This includes: performing a first-level feature extraction operation on the inter-domain traffic data using an autoencoder to obtain inter-domain features as target features; or performing a second-level feature extraction operation on the intra-domain traffic data to obtain intra-domain features as target features; or performing a third-level feature extraction operation on the access network traffic data to obtain access network features as target features.

[0145] Specifically, the network traffic data to be detected includes three types of data from different network layers: inter-domain traffic data to be detected (collected from the interconnection boundary between different autonomous systems or operators), intra-domain traffic data to be detected (collected from backbone or aggregation nodes within the same management domain), and access network traffic data to be detected (collected from enterprise edge, cloud tenant, or end-user side networks).

[0146] Accordingly, hierarchical feature extraction is performed on the network traffic data to be detected, and any one of the following can be used as the target feature: inter-domain feature, intra-domain feature, and access network feature: This includes the following mutually exclusive but structurally unified operation paths:

[0147] If the network traffic data to be detected is inter-domain traffic data, then the first-level feature extraction operation is used. Specifically, the traffic data can be input into a pre-configured integrated autoencoder model (composed of multiple parallel sparse autoencoders, processing time feature groups, address feature groups, protocol feature groups, and traffic scale feature groups respectively). Its high-dimensional invariant representation is learned through nonlinear compression and reconstruction, and the inter-domain features to be detected are output as target features. This feature focuses on macroscopic patterns and cross-domain propagation consistency in large-scale traffic, and is suitable for identifying high-level attack behaviors such as Border Gateway Protocol (BGP) anomaly notifications, large-scale scanning, or DDoS reflection sources.

[0148] If the network traffic data to be detected is within the detection domain, then a second-level feature extraction operation is performed. Specifically, firstly, unsupervised clustering can be performed on the traffic, such as using K-means or Density-Based Spatial Clustering of Applications with Noise (DBSCAN) algorithms, to identify potential behavioral clusters. Subsequently, interpretable artificial intelligence methods, such as LIME or Shapley Additive exPlanations (SHAP), can be combined to analyze the key discriminative dimensions of each cluster, and based on character sequence similarity, such as edit distance or n-gram matching, pattern induction is performed on protocol interaction sequences, ultimately generating semantically readable features within the detection domain as target features. This feature emphasizes mid-level business behavior anomalies and is suitable for detecting mid-level attacks such as internal lateral movement, covert command and control (C2) communication, or policy bypass.

[0149] In this embodiment, the second-layer feature extraction operation can be performed using methods such as unsupervised learning, Explainable Artificial Intelligence (XAI), and character sequence similarity analysis. An efficient automated feature extraction framework is constructed, and the algorithms and computing power of this framework can compensate for the limitations of human expert experience, improving the accuracy of intra-domain feature extraction.

[0150] If the network traffic data to be detected is access network traffic data to be detected, then the third-level feature extraction operation is performed. Specifically, statistical features (such as information entropy, kurtosis, skewness, and autocorrelation coefficient) can be calculated to characterize the traffic distribution pattern. A time series model is constructed, such as an Autoregressive Integrated Moving Average (ARIMA) model or LSTM, to extract prediction residuals and confidence intervals as dynamic anomaly indicators. The communication relationships between hosts are modeled as a graph structure, and node embeddings and community anomaly scoring are learned through graph neural networks, such as Graph Sample and AggregatE (GraphSAGE) or GAT.

[0151] Finally, the aforementioned multi-source features can be weighted and fused through an attention mechanism to generate high-dimensional, fine-grained features of the access network to be detected as target features. These target features are adept at capturing subtle anomalies at the low-level terminal side and are suitable for identifying sophisticated attacks such as zero-day vulnerability exploitation attempts, credential theft, and data leakage.

[0152] The above three feature extraction paths are automatically selected based on the traffic source, ensuring that the extracted target features are highly compatible with the structural characteristics, traffic scale, and security semantics of its network layer, providing an accurate and efficient input foundation for subsequent network anomaly detection and cross-domain correlation analysis.

[0153] In one possible implementation, an autoencoder is used to perform a first-level feature extraction operation on the inter-domain traffic data to be detected, obtaining the inter-domain features to be detected as target features. This includes: performing a data partitioning operation on the inter-domain traffic data to be detected to obtain time feature groups, size feature groups, address feature groups, and protocol feature groups; using multiple autoencoders to perform feature representation extraction processing on the time feature groups, size feature groups, address feature groups, and protocol feature groups respectively, to obtain time feature output, size feature output, address feature output, and protocol feature output; and concatenating or fusing the time feature output, size feature output, address feature output, and protocol feature output to obtain the inter-domain features to be detected.

[0154] Specifically, the server first performs field parsing and semantic grouping on the inter-domain traffic data to be detected, collected from inter-domain networks (such as carrier backbone interconnection points, Internet exchange centers, or cross-autonomous system boundary routers). Based on the multidimensional attributes of network traffic, it divides it into four mutually exclusive and complementary feature groups.

[0155] Specifically, the time feature group includes the flow start / end timestamp, flow duration, mean and variance of packet intervals, and flow burst cycle.

[0156] Size feature groups include total number of data packets, total number of bytes, average packet length, uplink / downlink byte ratio, peak rate, etc.

[0157] Address feature groups include source IP address, destination IP address, source / destination port, Autonomous System Number (ASN), and geographic region label (such as region / city code).

[0158] The protocol signature group includes the transport layer protocol type, such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP). It also includes application layer protocol identifiers, such as Hypertext Transfer Protocol (HTTP), Domain Name System (DNS), Transport Layer Security (TLS) fingerprints, TCP flag combinations, and protocol interaction sequence patterns.

[0159] This partitioning process ensures semantic consistency and similar dimensions within each feature group, facilitating subsequent parallel modeling.

[0160] Then, the server can configure an independent sparse autoencoder for each feature group, forming an integrated high-dimensional feature extraction architecture. Each encoder can receive the corresponding feature group as input and learn its low-dimensional nonlinear compressed representation through the encoder-decoder structure.

[0161] Specifically, the time-feature autoencoder outputs time-feature outputs, capturing the dynamic patterns of traffic timing. The size-feature autoencoder outputs size-feature outputs, representing traffic scale and load characteristics. The address-feature autoencoder outputs address-feature outputs, implicitly encoding network topology and routing path information. The protocol-feature autoencoder outputs protocol-feature outputs, extracting protocol behavior and interaction semantics.

[0162] Each sub-model has been pre-trained with a large number of normal and abnormal traffic samples between domains during the training phase, and is sensitive to abnormal deviations in its respective feature space.

[0163] Finally, the server can concatenate or weightedly fuse the low-dimensional latent vectors (i.e., time feature output, size feature output, address feature output, and protocol feature output) from the four autoencoders to form a unified high-dimensional composite vector. This high-dimensional composite vector retains the key discriminative information of each feature group and enhances its representation of complex attack patterns (such as distributed scanning, reflection amplification attacks, and precursory traffic to BGP hijacking) through ensemble learning. Ultimately, it serves as the inter-domain feature to be detected and can be used as the target feature for subsequent network anomaly detection and cross-domain correlation analysis.

[0164] Through the three-level processing mechanism of grouping, parallel processing and fusion described above, this implementation method effectively solves the problems of high-dimensional heterogeneity of inter-domain traffic, strong real-time requirements and large noise interference. While ensuring computational efficiency, it significantly improves the expressive power and stability of high-dimensional features.

[0165] In one possible implementation, a second-level feature extraction operation is performed on the traffic data within the detection domain to obtain the features within the detection domain as target features. This includes: performing cluster analysis on the traffic data within the detection domain using a clustering algorithm to obtain clustering results; and extracting feature fingerprints from the clustering results using the Local Interpretability Model (LIME) to obtain the features within the detection domain as target features.

[0166] Specifically, the server can first obtain traffic data within the domain to be detected from network nodes within the same management domain (such as core routers in metropolitan area networks, internal switches in data centers, or aggregation points in enterprise wide area networks). This data includes flow-level records (such as NetFlow or sFlow) and covers multi-dimensional fields such as source / destination IP, port, protocol type, number of packets, number of bytes, and flow duration.

[0167] After preprocessing the traffic data (including missing value imputation, normalization, and key feature selection), unsupervised clustering algorithms (such as K-means, DBSCAN, or Gaussian mixture models) can be used for cluster analysis. The clustering process can be based on the similarity of traffic behavior, dividing the overall traffic into several clusters, each representing a typical network communication pattern (such as normal business access, batch data synchronization, internal probing behavior, etc.). The clustering results are associated with each traffic record in the form of cluster labels, forming a structured clustering result.

[0168] Based on the clustering results, LIME can be further invoked to interpret and analyze the boundary samples or representative samples of each cluster. Specifically, for each cluster, LIME can generate perturbation samples within the sample neighborhood and fit a locally linearly interpretable model (such as ridge regression). Based on the feature weights of this locally linearly interpretable model, several original features that contribute the most to the current cluster classification can be identified, such as high TCP retransmission rate, a large number of Secure Shell (SSH) connections during off-peak hours, and high-frequency interactions on specific ports. By abstracting these high-contribution features and their value ranges or statistical distributions into a structured description, the server can form a semantically readable feature fingerprint.

[0169] Finally, the feature fingerprint is vectorized (e.g., through one-hot encoding, binning discretization, or embedding representation) as a feature within the domain to be detected, and it is labeled as a discriminative representation of the corresponding cluster to be used as a target feature for subsequent network anomaly detection.

[0170] By employing the two-stage approach of clustering discovery patterns and LIME interpretation of key factors, this implementation effectively overcomes the limitations of traditional intra-domain detection that relies excessively on expert rules. Without requiring prior knowledge, it automatically mines median traffic features with discriminative power and interpretability, significantly improving the ability to identify and respond to meso-level attacks such as internal lateral movement, covert C2 communication, and policy bypass.

[0171] In one possible implementation, a third-level feature extraction operation is performed on the access network traffic data to be detected to obtain the access network features to be detected as target features. This includes: performing feature calculation operations on the access network traffic data to be detected to obtain first statistical features and second statistical features; extracting time series features from the access network traffic data to be detected using a pre-built time series model to obtain time series features; extracting graph structure from the access network traffic data to be detected using a pre-trained graph neural network to obtain graph structure features; and fusing features based on the first statistical features, second statistical features, time series features, and graph structure features to obtain the access network features to be detected as target features.

[0172] Specifically, the server can perform feature engineering on the access network traffic data to be detected (collected from enterprise edge networks, cloud tenant virtual networks, or end-user side monitoring points) to calculate two complementary statistical features: the first statistical feature and the second statistical feature. The first statistical feature includes basic descriptive statistics such as mean, variance, standard deviation, maximum value, minimum value, skewness, and kurtosis, which are used to characterize the distribution of traffic in dimensions such as packet length, rate, and connection frequency.

[0173] The second statistical feature includes higher-order information metrics and correlation indicators, such as information entropy (reflecting the dispersion of source / destination IPs or ports), autocorrelation coefficient (measuring the periodicity of traffic over time), mutual information (analyzing the dependency between protocol type and data volume), and coefficient of variation within a sliding window, used to identify anomalous sparsity, burstiness, or atypical interaction patterns.

[0174] The first and second statistical features mentioned above together constitute the static and dynamic distribution representation of low-level flow behavior.

[0175] Next, the server can aggregate the access network traffic data to be detected into a time series (e.g., number of connections, total number of bytes, or proportion of abnormal packets per window) according to time windows (e.g., per second, per minute), and input it into a pre-built time series model for feature extraction. The pre-built time series model can specifically be an ARIMA model, used to capture linear trends and seasonal components, and output the standard deviation of the residual series and the Ljung-Box test p-value as anomaly indicators.

[0176] Pre-built time series models can also be LSTM, which extract nonlinear time-dependent features, such as long-term behavior drift and slow attack cumulative effects, through their hidden states or prediction errors (the difference between actual and predicted values).

[0177] The final output time series features can include model parameters, prediction confidence intervals, residual energy, and trend change point identifiers, which can reflect the evolution pattern and deviation of flow over time.

[0178] Then, the server can model the communication relationships between hosts within the access network as a dynamic Host Communication Graph. Hosts (IP addresses or device IDs) are used as nodes, and communication flows (such as TCP sessions and DNS queries) are used as edges. The edge weights can represent traffic volume, connection frequency, or protocol diversity.

[0179] The graph structure is input into a pre-trained graph neural network (such as GraphSAGE or GAT), which learns the embedding representation of each node through a multi-layer message passing mechanism. Subsequently, graph structure features are extracted. These include node embedding vectors (reflecting the host's role in the network, such as server, client, or anomalous stepping stone); graph-level global features (such as graph density, community modularity, and percentage of anomalous subgraphs); and node centrality metrics (such as node betweenness centrality) and their rate of change, used to identify potential C2 control nodes or data leakage exits.

[0180] Finally, the server can fuse the first statistical feature, second statistical feature, time series feature, and graph structure feature obtained above. Specifically, the fusion method can be concatenation fusion or attention-weighted fusion. Concatenation fusion refers to directly concatenating the feature vectors into a high-dimensional joint feature. Attention-weighted fusion refers to dynamically analyzing the importance of each feature modality to the current detection task through a lightweight attention network and generating a weighted combined vector.

[0181] The resulting fusion vector is the feature of the access network to be detected, which is input as the target feature to the subsequent anomaly detection unit. This feature comprehensively integrates statistical distribution, temporal dynamics, and topological relationships, and can effectively capture fine-grained, low-rate, and highly covert attack behaviors in low-level networks (such as credential stuffing, zero-day exploitation attempts, and internal data transmission), significantly improving the detection accuracy and stability of network anomaly detection.

[0182] Figure 3 This is a schematic diagram of a network anomaly detection device provided in an embodiment of this application. Figure 3 As shown, the device includes: an acquisition module 310, a feature extraction module 320, and an anomaly detection module 330.

[0183] The acquisition module 310 is used to acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected.

[0184] The feature extraction module 320 is used to determine the target feature extraction strategy based on the network traffic data to be detected;

[0185] The feature extraction module 320 is also used to perform hierarchical feature extraction on the network traffic data to be detected according to the target feature extraction strategy, and obtain any one of the inter-domain features, intra-domain features and access network features to be detected as the target feature;

[0186] Anomaly detection module 330 is used to input target features into a pre-trained anomaly detection model to obtain traffic anomaly detection results;

[0187] The anomaly detection module 330 is also used to input the target features into the pre-built multi-domain network feature invariant recognition model and the pre-built multi-level traffic feature fingerprint database to perform cross-domain anomaly detection processing when the traffic anomaly detection result is anomaly, so as to obtain the cross-domain anomaly detection result.

[0188] In one possible implementation, the acquisition module 310 is further configured to acquire traffic data from different network domains and an initial feature invariant identification model, and to perform data preprocessing on the traffic data from different network domains to obtain the network traffic data to be labeled.

[0189] The acquisition module 310 is also used to perform annotation operations on the network traffic data to be annotated, so as to obtain normal network traffic data and abnormal network traffic data;

[0190] The acquisition module 310 is also used to perform hierarchical feature extraction on normal network traffic data and abnormal network traffic data to obtain inter-domain features, intra-domain features and access network features to be detected as training feature sets.

[0191] The acquisition module 310 is also used to train the initial feature invariant recognition model based on the training feature set to obtain the pre-built multi-domain network feature invariant recognition model.

[0192] In one possible implementation, the acquisition module 310 is further configured to acquire initial multi-layer network traffic data and perform data preprocessing on the multi-layer network traffic data to obtain traffic data to be extracted.

[0193] The acquisition module 310 is also used to perform hierarchical feature extraction operations on the traffic data to be extracted, so as to obtain multi-level network domain space traffic features;

[0194] The acquisition module 310 is also used to construct a multi-level traffic feature fingerprint database based on the multi-level network domain space traffic characteristics, thereby obtaining a pre-built multi-level traffic feature fingerprint database.

[0195] In one possible implementation, the network traffic data to be detected includes inter-domain traffic data to be detected, intra-domain traffic data to be detected, and access network traffic data to be detected.

[0196] The feature extraction module 320 is also used to perform the first-level feature extraction operation on the inter-domain traffic data to be detected using an autoencoder to obtain the inter-domain features to be detected as target features.

[0197] Alternatively, it can be used to perform a second-level feature extraction operation on the traffic data within the detection domain, obtaining the features within the detection domain as target features;

[0198] Alternatively, it can be used to perform third-level feature extraction on the traffic data of the access network to be detected, and obtain the features of the access network to be detected as target features.

[0199] In one possible implementation, the feature extraction module 320 is also used to perform data partitioning operations on the inter-domain traffic data to be detected, to obtain time feature groups, size feature groups, address feature groups and protocol feature groups.

[0200] The feature extraction module 320 is also used to perform feature representation extraction processing on the time feature group, size feature group, address feature group and protocol feature group respectively using multiple autoencoders to obtain time feature output, size feature output, address feature output and protocol feature output;

[0201] The feature extraction module 320 is also used to concatenate or fuse the time feature output, size feature output, address feature output and protocol feature output to obtain the inter-domain features to be detected.

[0202] In one possible implementation, the feature extraction module 320 is further used to perform cluster analysis on the traffic data within the domain to be detected using a clustering algorithm to obtain clustering results;

[0203] The feature extraction module 320 is also used to extract feature fingerprints from the clustering results using the Local Interpretability Model (LIME) to obtain features within the domain to be detected as target features.

[0204] In one possible implementation, the feature extraction module 320 is further used to perform feature calculation operations on the access network traffic data to be detected, to obtain a first statistical feature and a second statistical feature.

[0205] The feature extraction module 320 is also used to extract time series features from the access network traffic data to be detected using a pre-built time series model, so as to obtain time series features;

[0206] The feature extraction module 320 is also used to extract graph structure features from the traffic data of the access network to be detected by a pre-trained graph neural network.

[0207] The feature extraction module 320 is also used to perform feature fusion based on the first statistical feature, the second statistical feature, the time series feature, and the graph structure feature to obtain the access network feature to be detected as the target feature.

[0208] The network anomaly detection device provided in this embodiment can execute a network anomaly detection method of the above embodiment. Its implementation principle and technical effect are similar, and will not be described again here.

[0209] In a specific implementation of the aforementioned network anomaly detection device, each module can be implemented as a processor. The processor can execute computer execution instructions stored in the memory, thereby enabling the processor to execute the aforementioned network anomaly detection method.

[0210] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device includes at least one processor 410 and a memory 420. The electronic device also includes a communication component 430. The processor 410, memory 420, and communication component 430 are connected via a bus 440.

[0211] In the specific implementation process, at least one processor 410 executes computer execution instructions stored in memory 420, causing at least one processor 410 to execute a network anomaly detection method as executed on the electronic device side as described above.

[0212] The specific implementation process of processor 410 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0213] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0214] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage.

[0215] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0216] The above description of the functions implemented by electronic devices and main control devices has introduced the solutions provided by the embodiments of the present invention. It is understood that, in order to implement the above functions, the electronic device or main control device includes hardware structures and / or software modules corresponding to the execution of each function. By combining the units and algorithm steps of the various examples described in the embodiments of the present invention, the embodiments of the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed by hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the technical solutions of the embodiments of the present invention.

[0217] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the network anomaly detection method described above.

[0218] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0219] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in an electronic device or a host device.

[0220] This application also provides a computer program product, which includes a computer program stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the solution provided in the above embodiments.

[0221] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.

[0222] The technical solutions of this application have been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it is readily understood by those skilled in the art that the scope of protection of this application is obviously not limited to these specific embodiments. The above embodiments are only used to illustrate the technical solutions of this application and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. These modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for detecting network anomalies, characterized in that, include: Acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected; Based on the network traffic data to be detected, a target feature extraction strategy is determined; According to the target feature extraction strategy, hierarchical feature extraction is performed on the network traffic data to be detected to obtain any one of the inter-domain features, intra-domain features, and access network features to be detected as the target feature. The target features are input into a pre-trained anomaly detection model to obtain traffic anomaly detection results; When the traffic anomaly detection result is detected as abnormal, the target feature is input into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain the cross-domain anomaly detection result.

2. The method according to claim 1, characterized in that, The acquisition of the pre-built multi-domain network feature invariant identification model includes: Obtain traffic data from different network domains and an initial feature invariant identification model, and perform data preprocessing on the traffic data from different network domains to obtain the network traffic data to be labeled; The network traffic data to be labeled is labeled to obtain normal network traffic data and abnormal network traffic data; Hierarchical feature extraction is performed on the normal network traffic data and abnormal network traffic data to obtain inter-domain features, intra-domain features, and access network features to be detected as training feature sets. The initial feature invariant recognition model is trained based on the training feature set to obtain a pre-built multi-domain network feature invariant recognition model.

3. The method according to claim 1, characterized in that, Obtaining the pre-built multi-level traffic feature fingerprint database includes: Acquire initial multi-layer network traffic data and perform data preprocessing on the multi-layer network traffic data to obtain traffic data to be extracted; Perform a hierarchical feature extraction operation on the traffic data to be extracted to obtain multi-level network domain spatial traffic features; Based on the multi-level network domain space traffic characteristics, a multi-level traffic feature fingerprint database is constructed to obtain the pre-built multi-level traffic feature fingerprint database.

4. The method according to claim 1, characterized in that, The network traffic data to be detected includes inter-domain traffic data, intra-domain traffic data, and access network traffic data. The step of performing hierarchical feature extraction on the network traffic data to be detected, obtaining any one of the following as the target feature: inter-domain features, intra-domain features, and access network features to be detected: The inter-domain flow data to be detected is subjected to a first-level feature extraction operation using an autoencoder to obtain the inter-domain features to be detected as target features. Alternatively, a second-level feature extraction operation can be performed on the traffic data within the domain to be detected to obtain the features within the domain to be detected as target features; Alternatively, a third-level feature extraction operation can be performed on the access network traffic data to be detected to obtain the access network features to be detected as target features.

5. The method according to claim 4, characterized in that, The step of performing a first-level feature extraction operation on the inter-domain traffic data to be detected using an autoencoder to obtain the inter-domain features to be detected as target features includes: The inter-domain traffic data to be detected is divided into time feature groups, size feature groups, address feature groups, and protocol feature groups. Multiple autoencoders are used to perform feature representation extraction processing on the time feature group, size feature group, address feature group and protocol feature group respectively, to obtain time feature output, size feature output, address feature output and protocol feature output; The time feature output, the size feature output, the address feature output, and the protocol feature output are concatenated or fused to obtain the inter-domain features to be detected.

6. The method according to claim 4, characterized in that, The second-level feature extraction operation on the traffic data within the detection domain to obtain features within the detection domain as target features includes: Clustering analysis was performed on the traffic data within the domain to be detected using a clustering algorithm to obtain clustering results; The clustering results are used to extract feature fingerprints using the Local Interpretability Model (LIME) to obtain features within the detection domain as target features.

7. The method according to claim 4, characterized in that, The third-level feature extraction operation on the access network traffic data to be detected, to obtain the access network features to be detected as target features, includes: The access network traffic data to be detected is subjected to feature calculation operations to obtain the first statistical feature and the second statistical feature; Time series features are obtained by extracting time series features from the access network traffic data to be tested using a pre-built time series model; The graph structure features are obtained by extracting the graph structure from the traffic data of the access network to be detected using a pre-trained graph neural network. Based on the first statistical feature, the second statistical feature, the time series feature, and the graph structure feature, feature fusion is performed to obtain the access network feature to be detected as the target feature.

8. A network anomaly detection device, characterized in that, include: The acquisition module is used to acquire a pre-built multi-domain network feature invariant identification model, a pre-built multi-level traffic feature fingerprint database, and network traffic data to be detected; The feature extraction module is used to determine the target feature extraction strategy based on the network traffic data to be detected. The feature extraction module is further configured to perform hierarchical feature extraction on the network traffic data to be detected according to the target feature extraction strategy, and obtain any one of the inter-domain features, intra-domain features, and access network features to be detected as the target feature; Anomaly detection module is used to input the target features into a pre-trained anomaly detection model to obtain traffic anomaly detection results; The anomaly detection module is further configured to, when the traffic anomaly detection result is detected as abnormal, input the target feature into the pre-built multi-domain network feature invariant identification model and the pre-built multi-level traffic feature fingerprint database for cross-domain anomaly detection processing to obtain the cross-domain anomaly detection result.

9. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images