Deep learning based network traffic anomaly behavior identification method

Abstract

This invention discloses a deep learning-based method for identifying abnormal network traffic behavior, belonging to the field of network security technology. The invention constructs a traffic state matrix based on traffic sample features, extracts high-frequency traffic slices to calculate the maximum Lyapunov exponent to generate an adaptive numerical integration step size, and dynamically generates channel mask vectors by combining power spectral entropy from frequency domain transformation. An anomaly perception model is constructed, incorporating traffic inertia and frequency domain analysis branches. The inertia branch uses the integration step size to perform Euler discretization operations to capture cross-scale time-domain dynamic features, while the frequency domain branch accurately filters out pseudo-noise through mask vector gating and activation energy sorting mechanisms. The model is jointly trained using a total loss function that integrates manifold regularization and elastic filtering, and the judgment result is output. This invention effectively overcomes numerical divergence under chaotic burst traffic and significantly improves the robustness of identification against attacks with unknown bandwidth and feature deception.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for identifying abnormal network traffic behavior based on deep learning. Background Technology

[0002] Network traffic anomaly behavior identification, as a core component of cyberspace security defense, aims to accurately detect threatening behaviors such as distributed denial-of-service attacks, malicious port scanning, and covert data transmission from massive, high-concurrency network interaction data. This is of great necessity and practical significance for ensuring the stable operation of critical information infrastructure and timely blocking of network attacks.

[0003] Currently, Chinese patent CN120880791A discloses a method and system for network traffic anomaly perception based on big data. This method extracts cross-protocol dependencies and traffic cycle patterns from historical network traffic data, generates a historical steady-state invariant baseline, and compares it with the real-time baseline generated by real-time traffic to identify sudden traffic surges and slow scanning behaviors. It also maps abnormal events as nodes and edges, constructs a dynamic network behavior graph, and extracts causal chain-like anomaly evidence chains to achieve cross-domain collaborative perception. However, most existing technologies rely on comparisons at a macroscopic fixed time scale, lacking understanding of the nonlinear dynamics hidden in traffic at the microscopic time slice level. When mining evolutionary features, fixed analysis step sizes and static models are prone to numerical divergence when networks encounter sudden attacks with highly chaotic conditions. This makes it difficult to accurately capture the rapidly changing attack waveforms and the cross-scale evolutionary inertia of transient traffic. Existing technologies lack adaptive analytical capabilities in the frequency domain dimension for feature extraction. The analysis structure of existing technologies is often fixed and cannot dynamically adjust the receptive field of feature extraction according to the frequency domain complexity of the current traffic or the attack bandwidth. It also cannot effectively remove high-frequency background white noise caused by random network jitter, making it highly susceptible to background noise interference and false alarms when facing broadband noise interference or complex attacks. Summary of the Invention

[0004] The technical problem solved by this invention is that most existing technologies rely on comparisons at a fixed macroscopic time scale, lacking the ability to explore the nonlinear dynamic evolution characteristics of traffic hidden at a microscopic time slice. Existing technologies lack adaptive analytical capabilities in the frequency domain dimension for feature extraction, and cannot dynamically adjust the receptive field of feature extraction according to the frequency domain complexity of the current traffic or the attack bandwidth. They also cannot effectively remove high-frequency background white noise caused by random network jitter.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a method for identifying abnormal network traffic behavior based on deep learning, comprising the following steps:

[0006] Step S1: Collect network traffic data samples and construct a training set and a perturbation set. Each sample in the training set and the perturbation set includes a traffic state matrix and a category label.

[0007] Step S2: Extract the flow throughput column vector from the flow state matrix of the sample, construct the phase trajectory using phase space reconstruction technology and calculate the maximum Lyapunov exponent, calculate the numerical integration step size based on the maximum Lyapunov exponent, perform frequency domain transformation on the flow state matrix of the sample to calculate the power spectral entropy, calculate the number of modal channels based on the power spectral entropy and generate a channel mask vector.

[0008] Step S3: Construct a traffic anomaly perception model that includes a traffic inertia branch, a frequency domain analysis branch, and a total loss function. The traffic inertia branch is used to perform equation operations based on Euler discretization on network traffic data samples using the numerical integration step size. The frequency domain analysis branch is used to perform convolution operations and soft thresholding on network traffic data samples using the channel mask vector.

[0009] Step S4: Train the traffic anomaly perception model using the training set, determine the parameters of the traffic anomaly perception model, input the traffic data sample to be detected into the traffic anomaly perception model, and obtain the traffic anomaly analysis results.

[0010] Preferably, the process of constructing the training set in step S1 specifically includes:

[0011] Collect several raw traffic data points, slice them according to a preset macroscopic time step, and obtain traffic segments on a discrete time series.

[0012] For each time slice, extract feature values ​​of several dimensions for the traffic segment to form a basic feature vector. The feature values ​​include traffic throughput, average packet length, packet length variance, control bit ratio, and average packet arrival interval.

[0013] Calculate the deviation of the feature value of the current traffic segment from the preset bandwidth upper limit threshold and the preset protocol specification threshold, and use the inverse proportional function to map and obtain the data confidence factor with a value range between 0 and 1;

[0014] The mathematical expression for the confidence factor is:

[0015] ;

[0016] in, As the confidence factor, The sensitivity coefficient, For bandwidth deviation, This is a deviation from the protocol specifications;

[0017] The mathematical expression for bandwidth deviation is:

[0018] ;

[0019] in, For bandwidth deviation, For throughput, This is the upper limit threshold for bandwidth.

[0020] The mathematical expression for protocol specification deviation is:

[0021] ;

[0022] in, Due to deviations from the protocol specifications, and The normalization coefficient is... To cover the variance, To control the proportion of flag bits, The packet length fluctuation threshold, To control the percentage threshold of the control bits;

[0023] The basic feature vector and the data confidence factor are concatenated along the feature dimension to form a traffic state matrix;

[0024] Each raw traffic data sample is assigned a category label, which is a scalar number representing the state attribute of the raw traffic data sample.

[0025] The traffic state matrix and category label of each original traffic data sample are stored in the training set in a one-to-one correspondence;

[0026] The process of constructing the perturbation set specifically includes:

[0027] Using the preset Bernoulli distribution parameters, a Bernoulli mask matrix with the same dimension as the sample's flow state matrix is ​​generated. The flow state matrix of the sample and the Bernoulli mask matrix are then subjected to a Hadamard product to obtain the perturbation sample corresponding to the sample.

[0028] All the perturbation samples constitute the perturbation sample set.

[0029] Preferably, the process of calculating the numerical integration step size in step S2 specifically includes:

[0030] Extract the original network traffic data corresponding to the current sample, perform high-frequency time slicing according to the preset micro time step, obtain the high-frequency traffic state sequence, construct the phase trajectory of the high-frequency traffic state sequence using phase space reconstruction technology, and calculate the maximum Lyapunov exponent of the phase trajectory.

[0031] Based on the maximum Lyapunov exponent, the numerical integration step size is calculated, and the mathematical expression for the numerical integration step size is:

[0032] ;

[0033] in, This is the numerical integration step size. The preset baseline integration step size, The chaos sensitivity coefficient, The maximum Lyapunov exponent of the phase trajectory;

[0034] Since the flow state matrix is ​​sliced ​​in 1-second increments, here... It is not 1 second in the physical sense, but an adaptive state evolution step size mapped from the microscopic (50ms) dynamic characteristics. It automatically decreases when the chaos of the microscopic flow increases. This is to ensure that numerical divergence is suppressed during the 1s macroscopic iteration.

[0035] Preferably, the process of generating the channel mask vector in step S2 specifically includes:

[0036] Perform a discrete Fourier transform on the column vectors of the flow state matrix of the sample to obtain a complex sequence in the frequency domain;

[0037] The power spectral density function is obtained by calculating the square of the modulus of the frequency domain complex sequence.

[0038] The power spectral density function is normalized to obtain the frequency domain probability distribution, and the power spectral entropy is calculated based on the frequency domain probability distribution.

[0039] The number of modal channels is calculated based on the power spectral entropy, and the mathematical expression for the number of modal channels is:

[0040] ;

[0041] in, For the number of modal channels, Number of basic channels This is the expansion factor; Power spectral entropy;

[0042] A channel mask vector is generated based on the calculated number of modal channels. The length of the channel mask vector is a preset length. The first few elements of the channel mask vector have a value of 1, and the rest have a value of 0. The number of elements with a value of 1 is the same as the number of modal channels.

[0043] Preferably, in step S3, the traffic anomaly perception model includes a traffic inertia branch, a frequency domain analysis branch, a feature splicing layer, a fully connected classification layer, and a Softmax output layer.

[0044] The flow inertia branch and the frequency domain analysis branch are parallel branches;

[0045] The output of the flow inertia branch is the final hidden state vector, and the output of the frequency domain analysis branch is the frequency domain feature vector;

[0046] The feature concatenation layer is used to concatenate the final hidden state vector with the frequency domain feature vector in the feature dimension to obtain a fused feature vector;

[0047] The fully connected classification layer is used to map the fused feature vector into a category logical value vector;

[0048] The Softmax output layer is used to convert the category logical value vector into a probability distribution vector representing the confidence level of each anomaly category.

[0049] Preferably, in step S3, the process of the flow inertial branch performing equation operations on the flow state matrix based on Euler discretization specifically includes:

[0050] The flow state matrix of the sample is split into multiple row vectors by row, and these vectors are used as the input row vectors of the flow inertia branch in chronological order. The input row vectors are then subjected to linear projection to obtain high-dimensional mapping feature vectors.

[0051] The linear projection operation is a matrix multiplication of the input row vector and the input mapping weight matrix, plus the bias vector.

[0052] Multiply the hidden state vector from the previous round with the state transition weight matrix, and add the high-dimensional mapping feature vector to obtain the pre-activated state increment vector.

[0053] The state transition weight matrix is ​​constrained by the spectral norm.

[0054] Perform the following for each element in the pre-activated state increment vector Function calculation to obtain the instantaneous rate of change vector;

[0055] Multiply the instantaneous rate of change vector by the numerical integration step size corresponding to the sample, and add the hidden state vector from the previous round to obtain the hidden state vector for the current round; the initial hidden state vector is an all-zero vector.

[0056] Input each row vector of the flow state matrix sequentially until the last row vector is reached to obtain the final hidden state vector corresponding to the sample.

[0057] Preferably, the frequency domain analysis branch includes a flow mode decomposition layer, a background noise spectrum filtering layer, and a feature reconstruction and output layer;

[0058] The input to the flow mode decomposition layer is the flow state matrix of the sample. Using a preset one-dimensional convolution kernel, a sliding dot product operation is performed in the row direction of the flow state matrix, and the operation result is mapped to the frequency domain feature space to obtain the mode feature matrix.

[0059] The modal feature matrix is ​​obtained by concatenating modal feature vectors as column vectors, and the modal feature vectors are obtained by gating the initial modal feature vectors sorted based on activation energy through channel mask vectors;

[0060] The mathematical expression for the initial modal feature vector is:

[0061] ;

[0062] in, Indicates the first Modal feature vectors; The first element of the flow state matrix represents the flow state matrix. List; This represents a one-dimensional convolution operation; For the first The convolutional kernel at the _th ... Weight vectors on each feature dimension; This is the modal channel bias vector; ;

[0063] Preferably, the background noise spectrum filtering layer is used to perform a shrinking transformation on the modal feature matrix using a soft thresholding function to obtain a purified frequency domain feature matrix;

[0064] The frequency domain feature matrix is ​​obtained by concatenating frequency domain feature vectors;

[0065] The mathematical expression for the frequency domain feature vector is:

[0066] ;

[0067] in, For the purified first The modal channel in the first... Frequency domain feature values ​​of each time slice; The shrinkage threshold of the corresponding channel is obtained from the shrinkage threshold vector. Indicates the first before purification The modal channel in the first... The original frequency domain feature values ​​of each time slice;

[0068] The process of obtaining the shrinkage threshold vector specifically includes:

[0069] Global average pooling is performed on the modal feature matrix to obtain the average energy of each modal channel, and an energy vector is constructed. A shrinkage threshold vector is then generated through a fully connected layer.

[0070] The purified frequency domain feature matrix is ​​subjected to global average pooling operation and output as the frequency domain feature vector for frequency domain analysis and detection.

[0071] Preferably, the mathematical expression for the total loss function is:

[0072] ;

[0073] in, For classification loss terms; This is the manifold regularization loss term; This is the elastic filtering loss term; and These are the corresponding weighting coefficients;

[0074] The mathematical expression for the manifold regularization loss term is:

[0075] ;

[0076] in, For manifold regularization loss term, and Samples from the training set and samples The final hidden state vector; The number of samples in the training set; For training set samples and samples Edge indicator weight;

[0077] The mathematical expression for the edge indicator weight is:

[0078] ;

[0079] in, For training set samples and samples Edge indicator weight, and For the sample and samples The flow state matrix, These are the parameters of the Gaussian kernel;

[0080] The elastic filtering loss term is calculated, and its mathematical expression is as follows:

[0081] ;

[0082] in, For elastic filtering loss term, Let be the probability distribution vector of the sample. This is the probability distribution vector of the disturbed sample corresponding to the sample;

[0083] The disturbed sample is obtained by performing a Hadamard product operation on the flow state matrix of the original sample and a random feature discard mask generated based on the Bernoulli distribution.

[0084] Preferably, the process of obtaining the traffic anomaly analysis results in step S4 specifically includes:

[0085] The traffic anomaly perception model is trained using the training set. The gradient of the total loss function with respect to the learnable parameters of the traffic anomaly perception model is calculated using the backpropagation algorithm. The model parameters on all activation paths are iteratively updated using the optimizer until the total loss function converges, and the trained traffic anomaly perception model is obtained.

[0086] Obtain the sample to be detected, calculate the numerical integration step size and channel mask vector corresponding to the sample, input the sample to be detected into the trained traffic anomaly perception model, and obtain the traffic anomaly analysis results.

[0087] The beneficial effects of this invention are as follows: By introducing a cross-scale numerical integration step-size adaptive adjustment mechanism based on the maximum Lyapunov exponent, this invention effectively solves the numerical divergence and gradient explosion problems that easily occur in traditional fixed-time-step models when facing sudden attacks in highly chaotic situations. By dynamically introducing a virtual evolution step-size constrained by the degree of micro-chaos into the macro-level flow state evolution equation, it can automatically adopt a conservative iterative strategy when network traffic exhibits drastic nonlinear fluctuations. By combining the spectral norm constraint of the state transition weight matrix and the memory freezing mechanism of the neuron saturation interval, this invention can sensitively respond to and filter out irregular background traffic jitter, forming a deep dynamic record of persistent attack behavior. This invention designs a dynamic channel masking mechanism driven by power spectral entropy and a gating screening strategy based on activation energy sorting. This overcomes the limitations of the physical structure and fixed receptive field of traditional deep learning models. By sorting the initial modal features in descending order of activation energy before masking, the potential for the model to discard key features due to weight randomness is avoided. This invention also constructs a multi-dimensional collaborative loss function constraint system that integrates manifold regularization and elastic filtering. The elastic filtering loss term enables the model to maintain high adversarial resilience and inference robustness when facing deceptive data with incomplete or contaminated features. The manifold regularization loss term enables the model to maintain feature smoothness when processing similar background traffic to enhance noise resistance. Attached Figure Description

[0088] Figure 1 A flowchart illustrating the steps of a deep learning-based network traffic anomaly behavior identification method provided in an embodiment of the present invention. Detailed Implementation

[0089] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0090] Example, refer to Figure 1 This paper provides a method for identifying abnormal network traffic behavior based on deep learning, including the following steps:

[0091] Step S1: Collect network traffic data samples and construct a training set and a perturbation set. Each sample in the training set and the perturbation set includes a traffic state matrix and a category label.

[0092] Step S2: Extract the flow throughput column vector from the flow state matrix of the sample, construct the phase trajectory using phase space reconstruction technology and calculate the maximum Lyapunov exponent, calculate the numerical integration step size based on the maximum Lyapunov exponent, perform frequency domain transformation on the flow state matrix of the sample to calculate the power spectral entropy, calculate the number of modal channels based on the power spectral entropy and generate the channel mask vector.

[0093] Step S3: Construct a traffic anomaly perception model that includes a traffic inertia branch, a frequency domain analysis branch, and a total loss function. The traffic inertia branch is used to perform equation operations based on Euler discretization on network traffic data samples using numerical integration step size. The frequency domain analysis branch is used to perform convolution operations and soft thresholding on network traffic data samples using channel mask vectors.

[0094] Step S4: Train the traffic anomaly perception model using the training set, determine the parameters of the traffic anomaly perception model, input the traffic data sample to be detected into the traffic anomaly perception model, and obtain the traffic anomaly analysis results.

[0095] This invention dynamically adjusts the numerical integration step size of macroscopic state evolution by extracting the maximum Lyapunov exponent of high-frequency slices and adaptively generating channel masks using power spectral entropy. This overcomes the limitations of fixed receptive fields and single time scales in traditional deep learning models, and can adaptively capture the dynamic characteristics of various complex network attacks, from low-speed covert scanning to highly chaotic bursts, thereby improving the comprehensive identification accuracy and generalization ability of unknown and variant network threats.

[0096] Step S1, the process of constructing the training set, specifically includes:

[0097] Collect several raw traffic data points and slice them according to a preset macroscopic time step (1s in this embodiment) to obtain traffic segments on a discrete time series.

[0098] For each time slice, extract feature values ​​of several dimensions for the traffic segment to form a basic feature vector. The feature values ​​include traffic throughput, average packet length, packet length variance, control bit ratio, and average packet arrival interval.

[0099] Calculate the deviation of the feature value of the current traffic segment from the preset bandwidth upper limit threshold and the preset protocol specification threshold, and use the inverse proportional function to map and obtain the data confidence factor with a value range between 0 and 1;

[0100] The mathematical expression for the confidence factor is:

[0101] ;

[0102] in, As the confidence factor, The sensitivity coefficient is set to 0.5 in this embodiment. For bandwidth deviation, This is a deviation from the protocol specifications;

[0103] The mathematical expression for bandwidth deviation is:

[0104] ;

[0105] in, For bandwidth deviation, For throughput, This is the upper limit threshold for bandwidth.

[0106] The mathematical expression for protocol specification deviation is:

[0107] ;

[0108] in, Due to deviations from the protocol specifications, and The normalization coefficient is used in this embodiment. Values The reciprocal, Values The reciprocal, To cover the variance, To control the proportion of flag bits, The packet length fluctuation threshold, To control the percentage threshold of the control bits;

[0109] The basic feature vector and the data confidence factor are concatenated along the feature dimension to form a traffic state matrix;

[0110] Each raw traffic data sample is assigned a category label, which is a scalar number representing the status attribute of the raw traffic data sample; 0 represents normal, 1 represents DDoS attack, and 2 represents scanning attack.

[0111] The traffic state matrix and category label of each original traffic data sample are stored in the training set in a one-to-one correspondence;

[0112] The process of constructing the perturbation set specifically includes:

[0113] Using a preset Bernoulli distribution parameter (0.9 in this embodiment), a Bernoulli mask matrix with the same dimension as the sample's flow state matrix is ​​generated. The flow state matrix of the sample and the Bernoulli mask matrix are then subjected to a Hadamard product operation to obtain the perturbation sample corresponding to the sample.

[0114] All the perturbation samples constitute the perturbation sample set.

[0115] In one specific embodiment of the present invention, each piece of traffic data collected is divided into seconds, and for each time slice, the traffic throughput, average packet length, packet length variance, control bit ratio and average packet arrival interval are extracted.

[0116] Throughput It represents the total number of bytes per unit time, used to characterize the current network load pressure and reflect the surge in traffic caused by DDoS attacks;

[0117] Average package length It is the arithmetic mean of the lengths of all data packets within the time slice, used to reflect the difference in payload size between attack traffic and normal business traffic;

[0118] Package variance The statistical variance of the data packet length within a time slice is used to reflect the drastic degree of load change. For example, the length of normal industrial control instructions is usually fixed and the variance is extremely small, while attacks or scanning behaviors may cause variance fluctuations.

[0119] Control flag percentage The percentage of packets with the SYN and FIN flags set in the Transmission Control Protocol header is used to identify port scanning or connection exhaustion attacks.

[0120] Average Packet Arrival Interval It is the average of the arrival time differences between two adjacent data packets, used to characterize the burstiness and density of traffic;

[0121] Set bandwidth upper limit thresholds and protocol specification thresholds. Protocol specification thresholds include packet length fluctuation thresholds and control bit percentage thresholds. Packet length fluctuation thresholds are used to verify packet length variance, and control bit percentage thresholds are used to verify the percentage of control flag bits.

[0122] The bandwidth limit threshold is derived from the physical attributes of network hardware devices and is set according to the physical link limits in the industrial site, such as setting a bandwidth limit for a 100 Mbps network port.

[0123] The packet length fluctuation threshold is obtained through statistical analysis of historical normal business traffic, specifically including:

[0124] In a clean network environment free from attacks, traffic data was collected continuously for 24 hours. The packet length variance within each time window was calculated to obtain a variance sequence. The maximum value of the variance sequence was taken as the packet length fluctuation threshold.

[0125] The control flag percentage threshold is set based on the normal interaction logic of the TCP protocol and the statistical baseline. In industrial networks dominated by long connections, handshake packets and teardown packets only appear at the beginning and end of a session, and their theoretical percentage in the total traffic is extremely low. In order to tolerate normal network fluctuations, this embodiment sets a lenient statistical upper limit, such as the maximum percentage of SYN / FIN packets in historical normal traffic, and adds a preset redundancy on this basis. In this embodiment, the redundancy is set to 20%, that is, when the number of SYN or FIN packets in a unit of time exceeds 20% of the total number of packets, it is determined that there is a scanning or denial-of-service attack.

[0126] The basic feature vector is concatenated with the confidence factor to obtain the feature vector. The feature vectors of continuous time slices are selected and concatenated as row vectors to construct the traffic state matrix. In this embodiment, one sample consists of 60 continuous time slices, i.e., traffic data within 1 minute. The traffic state matrix is ​​constructed with rows representing the number of time slices and columns representing the total feature dimension including the confidence factor. The elements in the traffic state matrix are the feature values ​​under each time slice. The first 5 columns are the normalized traffic throughput, average packet length, packet length variance, control bit percentage, and average packet arrival interval values ​​under each time slice. The 6th column is the normalized confidence factor value under each time slice.

[0127] This invention introduces a data confidence factor based on physical bandwidth limits and protocol specification constraints to calculate the deviation between traffic throughput and bandwidth limits, as well as the abnormal deviation between packet length and control bit ratio. This physically quantifies domain prior knowledge into feature confidence, effectively filtering artifact interference caused by network acquisition equipment failures or extreme packet loss. By using a Bernoulli mask matrix to construct a disturbed sample set, a solid data foundation is laid for subsequent model learning of the anti-destructive synergistic relationship between multi-dimensional features, thus improving the anti-interference capability at the data input level.

[0128] Step S2, the process of calculating the numerical integration step size, specifically includes:

[0129] Extract the original network traffic data corresponding to the current sample, perform high-frequency time slices according to the preset micro time step (50ms in this embodiment), obtain the high-frequency traffic state sequence, construct the phase trajectory of the high-frequency traffic state sequence using phase space reconstruction technology, calculate the maximum Lyapunov exponent of the phase trajectory, and use it as a dynamic fingerprint to measure the degree of chaos in traffic evolution.

[0130] The numerical integration step size is calculated based on the maximum Lyapunov exponent. The mathematical expression for the numerical integration step size is:

[0131] ;

[0132] in, This is the numerical integration step size. The preset baseline integration step size, The chaos sensitivity coefficient, The maximum Lyapunov exponent of the phase trajectory;

[0133] Since the flow state matrix is ​​sliced ​​in 1-second increments, here... It is not 1 second in the physical sense, but an adaptive state evolution step size mapped from the microscopic (50ms) dynamic characteristics. It automatically decreases when the chaos of the microscopic flow increases. This is to ensure that numerical divergence is suppressed during the 1s macroscopic iteration.

[0134] In one specific embodiment of the present invention, the chaos sensitivity coefficient is 1.0, and a baseline step size is set. ;

[0135] To capture the nonlinear dynamic characteristics implicit in the flow, the Takens embedding theorem is used to reconstruct the phase space of the flow throughput sequence;

[0136] With an embedding dimension of 3 and a time delay of 1, a phase vector is constructed based on the throughput sequence. The expression for each element in the phase vector is: The trajectory of these phase points in three-dimensional space constitutes the phase trajectory of flow evolution;

[0137] The maximum Lyapunov exponent of phase trajectory separation rate is calculated using the small data method (Rosenstein algorithm). The maximum Lyapunov exponent reflects the degree of chaos in the data. A maximum Lyapunov exponent greater than 0 indicates that the flow has chaotic characteristics. The larger the value, the faster the adjacent trajectories diverge, and the more difficult it is to predict the flow in the short term.

[0138] Using an inverse proportional function to calculate the numerical integration step size can ensure that the flow evolution branch does not diverge when dealing with highly chaotic flow.

[0139] When a network encounters a strong chaotic attack, such as a DDoS pulse, and the maximum Lyapunov exponent of the phase trajectory surges, the denominator of the formula for the numerical integration step size increases, resulting in a larger calculated value. Automatic reduction means performing differential iterations at a finer time granularity, thereby accurately capturing rapidly changing attack waveforms.

[0140] This invention proposes a cross-scale dynamic constraint mechanism based on phase space reconstruction. By extracting the maximum Lyapunov exponent, which measures the degree of chaos in traffic evolution, at the micro-time scale, and inversely mapping it to the adaptive integral step size of the macro-state evolution equation, this mechanism can keenly detect sudden strong chaotic attacks in network traffic. When the network encounters a pulse attack that causes a surge in the degree of chaos, the adaptively reduced integral step size forces the model to adopt a more conservative virtual evolution step, effectively avoiding numerical divergence and gradient explosion during macro-feature iteration, and ensuring the numerical stability and dynamic waveform capture accuracy of the model under extreme attack traffic.

[0141] Step S2, the process of generating the channel mask vector, specifically includes:

[0142] Perform a discrete Fourier transform on the column vectors of the flow state matrix of the sample to obtain a complex sequence in the frequency domain;

[0143] The power spectral density function is obtained by calculating the square of the modulus of the complex sequence in the frequency domain.

[0144] The power spectral density function is normalized to obtain the frequency domain probability distribution. The power spectral entropy is calculated based on the frequency domain probability distribution and used as an indicator to measure the frequency domain complexity of the flow.

[0145] The number of modal channels is calculated based on the power spectral entropy. The mathematical expression for the number of modal channels is:

[0146] ;

[0147] in, For the number of modal channels, Number of basic channels This is the expansion factor; Power spectral entropy;

[0148] A channel mask vector is generated based on the calculated number of modal channels. The length of the channel mask vector is a preset length. The first few elements of the channel mask vector have a value of 1, and the rest have a value of 0. The number of elements with a value of 1 is the same as the number of modal channels.

[0149] The channel mask vector is used to dynamically mask redundant convolution kernels while keeping the physical structure of the model unchanged, so that the receptive field of the model can be adapted to the current attack bandwidth.

[0150] In one specific embodiment of the present invention, this embodiment sets a basic number of channels. Expansion coefficient ;

[0151] in, For the number of modal channels, Number of basic channels This is the expansion factor; Power spectral entropy;

[0152] A channel mask vector is generated based on the calculated number of modal channels. The length of the channel mask vector is a preset length. The first few elements of the channel mask vector have a value of 1, and the rest have a value of 0. The number of elements with a value of 1 is the same as the number of modal channels.

[0153] The channel mask vector is used to dynamically mask redundant convolution kernels while keeping the physical structure of the model unchanged, so that the receptive field of the model can be adapted to the current attack bandwidth.

[0154] In one specific embodiment of the present invention, this embodiment sets a basic number of channels. Expansion coefficient ;

[0155] Perform a Fast Fourier Transform on each column of the flow state matrix of the sample to obtain the power spectral density function, and normalize the power spectrum into a probability distribution form. ), and calculate the power spectral entropy ( );

[0156] The lower the power spectral entropy, the more concentrated the energy is in a few frequencies; the higher the power spectral entropy, the more disordered the energy distribution in the frequency domain, such as broadband noise interference or complex frequency domain analysis.

[0157] To resolve the contradiction between fixed weights and varying channel counts in traditional models, this embodiment employs a channel masking mechanism, pre-setting a maximum convolutional kernel count of 64, meaning the physical dimension of the model weight matrix is ​​fixed at 64, and using a proportional mapping function to calculate the required number of modal channels.

[0158] Power spectrum The theoretical range of values ​​is The modal channel count approaches 0 under pure single-frequency signals and reaches its maximum value under completely random white noise. To ensure the deterministic nature of the model's physical structure, the number of modal channels... The value of is rigidly truncated and restricted to Within the closed interval, the maximum number of modal channels is preset in this embodiment. Basic channel count The above The complete mathematical expression is revised as follows:

[0159] ;

[0160] Based on the calculated number of modal channels Generate a channel mask vector, the length of which is fixed. (i.e., 64), before which One element has a value of 1, and the rest have a value of 0.

[0161] This invention combines power spectral entropy from signal processing with dynamic pruning of physical structures in deep learning. It quantifies the frequency domain complexity of current traffic by calculating the power spectral entropy of the frequency domain probability distribution, and dynamically calculates the required number of modal channels based on this. This allows the model to automatically expand or contract its sensing range according to the bandwidth of the attack features. When facing normal or simple attacks, the model only activates the basic channels to reduce computational overhead and improve real-time detection. When facing broadband noise interference or complex attacks, it automatically unlocks all channels to obtain the widest frequency domain receptive field, achieving a dynamic balance between model representation capability and computational efficiency.

[0162] In step S3, the traffic anomaly perception model includes a traffic inertia branch, a frequency domain analysis branch, a feature splicing layer, a fully connected classification layer, and a Softmax output layer.

[0163] Among them, the flow inertia branch and the frequency domain analysis branch are parallel branches;

[0164] The output of the flow inertia branch is the final hidden state vector, and the output of the frequency domain analysis branch is the frequency domain feature vector.

[0165] The feature concatenation layer is used to concatenate the final hidden state vector with the frequency domain feature vector along the feature dimension to obtain the fused feature vector;

[0166] Fully connected classification layers are used to map fused feature vectors into class logistic value vectors;

[0167] The Softmax output layer is used to convert the category logistic value vector into a probability distribution vector representing the confidence level of each anomaly category.

[0168] In a specific embodiment of the present invention, the modal channel number and numerical integration step size corresponding to each sample calculated above are substituted into the traffic anomaly perception model during the training process. When facing simple traffic samples, the traffic anomaly perception model only activates 16 basic channels, which has a small computational load and fast speed. When facing complex attacks, the traffic anomaly perception model automatically unlocks all 64 channels, covering a wide frequency band and with high accuracy.

[0169] This invention achieves complementary advantages of traffic features in terms of deep time-domain memory and fine-grained frequency-domain modes by deploying a traffic inertia branch and a frequency domain analysis branch in parallel. The traffic inertia branch is used to mine dynamic inertial trajectories under long-term dependence, while the frequency domain analysis branch is used to extract transient high-frequency attack waveforms. Subsequently, the two heterogeneous features are deeply fused through a feature splicing layer. This structure completely eliminates the feature blind spots that are prone to occur in complex attack scenarios by single time-domain or single frequency-domain analysis, and significantly improves the comprehensiveness and accuracy of the classification layer output results.

[0170] In step S3, the process of performing equation operations based on Euler discretization on the flow state matrix by the flow inertial branch specifically includes:

[0171] The flow state matrix of the sample is split into multiple row vectors by row, and these vectors are used as the input row vectors of the flow inertia branch in chronological order. The input row vectors are then subjected to linear projection to obtain high-dimensional mapping feature vectors.

[0172] The linear projection operation is a matrix multiplication of the input row vector and the input mapping weight matrix, plus the bias vector;

[0173] Multiply the hidden state vector from the previous round with the state transition weight matrix, and add the high-dimensional mapping feature vector to obtain the pre-activated state increment vector.

[0174] The state transition weight matrix is ​​constrained by the spectral norm;

[0175] Perform the following for each element in the pre-activated state increment vector Function calculation to obtain the instantaneous rate of change vector;

[0176] Multiply the instantaneous rate of change vector by the numerical integration step size corresponding to the sample, and add the hidden state vector from the previous round to obtain the hidden state vector for the current round; the initialized hidden state vector is an all-zero vector (in this embodiment, the dimension of the hidden state vector is preset to 64).

[0177] Input each row vector of the flow state matrix sequentially until the last row vector is reached to obtain the final hidden state vector corresponding to the sample.

[0178] In a specific embodiment of the present invention, the flow inertia branch adopts a cyclic iterative calculation mode. The overall operation logic is to decompose the flow state matrix into row vectors, each row vector representing a time slice, and to perform cyclic calculations of high-dimensional mapping feature vector, pre-activated state increment vector, instantaneous rate of change vector and hidden state vector in chronological order.

[0179] In the flow inertia branch, the input mapping weight matrix (dimension) ), State transition weight matrix (dimensions) ) and bias vector (dimension) All of these are learnable parameters that are gradually solidified during model training.

[0180] Following the order of macroscopic time slices (1 second in this embodiment), and combining the numerical integration step size extracted from the microscopic time slices, a cross-scale state evolution equation is constructed using the Euler discretization formula. The instantaneous rate of change for each macroscopic time slice is calculated, and the hidden state at the current moment is updated. For each macroscopic time slice... The mathematical expression for the update process of the hidden state vector is:

[0181] ;

[0182] in, For the current number The hidden state vector obtained by calculating a macroscopic time slice ( ); This is the hidden state vector stored in the previous time step; The input feature vector; The hyperbolic tangent nonlinear activation function is... For the input mapping weight matrix, The state transition weight matrix is... This is the numerical integration step size;

[0183] ( ) is a high-dimensional mapping feature vector, ( ) is the pre-activated state increment vector, ( () represents the instantaneous rate of change vector;

[0184] The update process of the hidden state vector indicates that the evolution of the flow state has cross-scale inertia: the evolution of macroscopic features over time depends not only on the state of the previous time step and the input of the current time step, but also on the adaptive constraint of the degree of microscopic chaos, which affects the state of the current time step. The state at the previous moment On the basis of, superimposed with The instantaneous scaling increments, when micro-level traffic exhibits a highly chaotic attack pattern. Automatic reduction allows the model to adopt a more conservative virtual evolution step size in the iteration of macroscopic features, thereby ensuring the numerical stability and feature coherence of state evolution when facing severe nonlinear flow.

[0185] Each dimension of the hidden state vector corresponds to a virtual neuron. When the output value of the neuron is in a certain range... When the linear interval is reached, the derivative of the function is large within this interval, and the neuron state fluctuates violently with the input, lacking the ability to retain memory. This mechanism is used to quickly respond and filter out irregular background traffic jitter (noise) to prevent it from interfering with the extraction of long-term features.

[0186] When the neuron's output value is in When the neuron enters the saturation region, the derivative of the function approaches 0, and the neuron state exhibits extremely high stability. This mechanism is used to lock in persistent attack characteristics. Once a certain attack pattern causes a neuron to enter the saturation region, its state will be frozen and passed to subsequent time steps, forming a memory of persistent attack behavior.

[0187] To ensure the numerical stability of the evolution process and prevent gradient explosion or vanishing during iterative calculations of up to 60 steps, this embodiment applies a spectral norm constraint to the state transition weight matrix. The spectral norm constraint specifically includes:

[0188] During the parameter update phase of model training, the maximum singular value of the state transition weight matrix is ​​calculated using the singular value decomposition algorithm. If the maximum singular value exceeds the preset singular threshold (1 in this embodiment), all elements of the state transition weight matrix are normalized and scaled.

[0189] By limiting the maximum singular value, it is ensured that even with small perturbations in the input data, the evolution trajectory of the flow state can converge to a stable manifold, thus ensuring the stability of long-term time-dependent information.

[0190] After 60 time steps of iterative calculation, the output is a hidden state matrix containing all time slice states. The hidden state matrix not only records the instantaneous state of the flow in each second, but also implies the dynamic trajectory of the flow changing over time through the aforementioned inertial evolution mechanism. As the temporal inertial feature of the flow, it is transmitted to the subsequent feature splicing layer.

[0191] This invention achieves adaptive state updates by leveraging the segmental characteristics of the hyperbolic tangent nonlinear activation function. It can quickly forget irregular jitters and lock persistent attack patterns for a long time. The spectral norm constraint applied to the state transition weight matrix fundamentally curbs the state drift phenomenon in multi-time-step sequence iterations, ensuring that the evolution trajectory can converge to a stable manifold and guaranteeing the secure transmission of long-term time-dependent information.

[0192] The frequency domain analysis branch includes a flow mode decomposition layer, a background noise spectrum filtering layer, and a feature reconstruction and output layer;

[0193] The input to the flow mode decomposition layer is the flow state matrix of the sample. Using a pre-defined one-dimensional convolution kernel, a sliding dot product operation is performed on the row direction (time axis) of the flow state matrix, and the operation result is mapped to the frequency domain feature space to obtain the mode feature matrix.

[0194] The modal feature matrix is ​​obtained by concatenating the modal feature vectors as column vectors. The modal feature vectors are obtained by gating the initial modal feature vectors sorted based on activation energy through channel mask vectors.

[0195] The mathematical expression for the initial modal eigenvectors (column vectors) is:

[0196] ;

[0197] in, Indicates the first Modal feature vectors; The first element of the flow state matrix represents the flow state matrix. List; This represents a one-dimensional convolution operation; For the first The convolutional kernel at the _th ... Weight vectors on each feature dimension; modal channel bias vectors; ;

[0198] After obtaining all initial modal feature vectors, to prevent important features from being lost due to channel mask truncation, the activation energy of each initial modal feature vector within the current time window is calculated. In this embodiment, the L2 norm is used as the energy metric, and the activation energy is used to evaluate all features. The initial modal feature vectors are sorted in descending order to obtain the sorted set of modal feature vectors;

[0199] The sorted set of modal feature vectors is arranged column-wise and then gating with the channel mask vectors; the specific process includes:

[0200] After sorting, the first The modal feature vector multiplied by the corresponding channel mask vector of the i-th modality feature vector If the product of the elements is 1, the modal feature vector is retained; if the channel mask is 0, the value of the modal feature vector is forced to zero. Finally, the filtered modal feature matrix is ​​obtained.

[0201] By introducing a dynamic sorting mechanism, it is ensured that the main mode with the strongest current frequency domain response and the most attack features is always preserved by the mask, while the channel containing high-frequency noise is naturally set to zero.

[0202] In one specific embodiment of the present invention, The value is set to 64, and the time window length of each convolutional kernel is set to 3. In the initial stage, the convolutional kernel weight vector is randomly initialized according to a normal distribution, and it is continuously updated through backpropagation algorithm in the subsequent model training stage. Finally, it is solidified into filter coefficients that can identify specific frequency domain analysis waveforms. A learnable modal channel bias vector is set for each modal channel to adjust the baseline of the activation threshold.

[0203] This invention introduces a dynamic gating strategy based on descending order of activation energy, which solves the serious defect of traditional masking techniques that may mistakenly discard key features due to the randomness of the initial weights of the convolution kernel. Before applying channel masking truncation, all initial modal feature vectors are forcibly reordered according to their energy response intensity within the current window, ensuring that the main modal with the strongest frequency response and the most attack clues is retained, while the channels containing high-frequency noise are naturally set to zero, which greatly enhances the model's feature focusing and filtering capabilities in the frequency domain.

[0204] The background noise spectrum filtering layer is used to perform a shrinking transformation on the modal feature matrix using a soft thresholding function, eliminating pseudo-noise with amplitudes below the threshold, and obtaining a purified frequency domain feature matrix.

[0205] The frequency domain feature matrix is ​​obtained by concatenating the frequency domain feature vectors;

[0206] The mathematical expression for the frequency domain eigenvector is:

[0207] ;

[0208] in, For the purified first The modal channel in the first... Frequency domain feature values ​​of each time slice; The shrinkage threshold of the corresponding channel is obtained from the shrinkage threshold vector. Indicates the first before purification The modal channel in the first... The original frequency domain feature values ​​of each time slice;

[0209] The process of obtaining the shrinkage threshold vector specifically includes:

[0210] Global average pooling is performed on the modal feature matrix to obtain the average energy of each modal channel, and an energy vector is constructed. A shrinkage threshold vector is then generated through a fully connected layer.

[0211] The purified frequency domain feature matrix is ​​subjected to global average pooling operation and output as the frequency domain feature vector for frequency domain analysis and detection.

[0212] In a specific embodiment of the present invention, the decomposed modal features contain both real attack features and a large amount of background white noise caused by network jitter. If these features are used directly for polarity classification, the noise will interfere with the judgment. Therefore, a soft thresholding mechanism needs to be introduced to automatically filter out those weak and messy noise components and retain only the abnormal spectrum with significant energy.

[0213] Calculate the average absolute value of each column of the modal feature tensor to obtain the energy descriptor, which has a dimension of [missing value]. Input the energy descriptor into the fully connected structure In this process, the output is mapped to the (0,1) interval by the Sigmoid function and multiplied by the scaling factor to obtain the shrinkage threshold vector;

[0214] The mathematical expression for the shrinkage threshold vector is:

[0215] ;

[0216] in, For the shrinkage threshold vector, The preset scaling factor is 0.5 in this embodiment. For energy descriptors, Generate the network weight matrix for the threshold; Generate network bias vectors for the threshold;

[0217] When the characteristic amplitude at a certain moment Less than the shrinkage threshold When, in the mathematical expression of the frequency domain eigenvector When the term is 0, the result is set to 0, which means that weak signals in this frequency band are regarded as background noise and are completely eliminated;

[0218] When the characteristic amplitude at a certain moment Greater than or equal to the contraction threshold When the result is the original value minus the shrinkage threshold, this preserves the significant part of the signal while eliminating the noise floor bias.

[0219] The purified frequency domain feature matrix Its dimensions remain unchanged. However, it contains a large number of zero elements (sparserization), retaining only high-confidence frequency domain features;

[0220] In the frequency domain analysis branch, the convolution kernel weights (dimensions) Modal channel bias vector (dimension) Threshold generation network weight matrix (dimensions) Threshold generation network bias vector (dimension) ); Convolution kernel weights are determined by constitute.

[0221] This invention senses the average energy of each channel and dynamically generates a unique shrinkage threshold. It can not only keenly identify and completely eliminate weak physical jitter and pseudo white noise with amplitude below the threshold, but also accurately retain the polarity and amplitude characteristics of high-energy anomalous spectrum. This results in the frequency domain features of the final output exhibiting a highly pure sparsity state, which greatly reduces the noise resistance pressure of the model's tail classification.

[0222] The mathematical expression for the total loss function is:

[0223] ;

[0224] in, This is the classification loss term, used to measure the accuracy of the prediction results; This is the manifold regularization loss term, used to constrain the topology of the feature space; This is the elastic filtering loss term, used to improve the model's robustness against deception attacks; and These are the corresponding weighting coefficients (in this embodiment) The value is 0.01. (Value is 0.02).

[0225] The mathematical expression for the manifold regularization loss term is:

[0226] ;

[0227] in, For manifold regularization loss term, and Samples from the training set and samples The final hidden state vector; The number of samples in the training set; For training set samples and samples Edge indicator weight;

[0228] The mathematical expression for the edge indicator weight is:

[0229] ;

[0230] in, For training set samples and samples Edge indicator weight, and For the sample and samples The flow state matrix, The Gaussian kernel parameter is set to 1.0 in this embodiment.

[0231] Real-world network traffic data typically exhibits a specific low-dimensional manifold structure in a high-dimensional feature space. The core idea of ​​the manifold regularization loss term is to maintain local topological consistency, and the edge indicator weights of the manifold regularization loss term are... It acts as a Gaussian kernel function to measure the samples in the input space. and Similarity is used when two traffic samples are highly similar in input features, such as both belonging to the same type of scanning attack. Approaching 1, at which point they are forced to evolve into their final hidden state vectors after model evolution. and European distance As small as possible, or conversely, when the differences between input samples are significant. Approaching 0, without imposing strong constraints on the hidden state, this mechanism forces the model to maintain feature smoothness when the inputs are similar, i.e., enhances noise resistance, while allowing the feature manifold to jump when the input undergoes a fundamental change, such as from normal traffic to a DDoS attack, thereby accurately preserving the dynamic features of the traffic change edge;

[0232] The elastic filtering loss term is calculated, and its mathematical expression is as follows:

[0233] ;

[0234] in, For elastic filtering loss term, Let be the probability distribution vector of the sample. This is the probability distribution vector of the disturbed sample corresponding to the sample;

[0235] The disturbed sample is obtained by performing a Hadamard product operation on the flow state matrix of the original sample and a random feature discard mask generated based on the Bernoulli distribution.

[0236] The elastic filtering loss term is essentially a self-supervised enhancement mechanism based on consistency constraints. In real-world network adversarial scenarios, attackers often use techniques such as fragmentation forgery and feature hiding to cause some traffic features, such as packet variance, to be missing or distorted. This invention simulates feature loss by applying a random feature mask to the original samples, generating perturbed samples. The elastic filtering loss term calculates the predicted probability distribution of the original samples. Predicted probability distribution of the perturbed sample The mean square error between them is minimized. This forces the model to output the same judgment result as the complete input when faced with incomplete input features. This prompts the model to abandon its reliance on single-dimensional features and instead learn the multi-dimensional collaborative relationship between various traffic features. For example, even if the traffic throughput feature is contaminated, the model can still infer the correct result through the collaborative relationship between the control bit ratio and the packet arrival interval, thereby greatly improving the model's resilience against deception attacks and incomplete data.

[0237] In one specific embodiment of the invention, the training set is organized as a batch input traffic anomaly perception model, with each batch containing... The sample size is 50 in this embodiment;

[0238] Before training begins, the learnable parameters in the model are randomly initialized following a normal distribution. The composite loss function includes a classification loss term, a manifold regularization loss term, and an elastic filtering loss term.

[0239] The calculation of the classification loss term specifically includes:

[0240] The samples within the batch are input into the traffic anomaly detection model, which outputs a predicted probability vector via a fully connected classification layer, with dimensions of [dimensional value missing]. ,in The total number of categories is calculated using the cross-entropy formula. The technical purpose of this step is to quantify the difference between the model's predictions and the true labels, thereby driving the model to learn the correct classification boundary.

[0241] The manifold regularization loss term forces the model to keep features smooth (noise-resistant) when inputs are similar, while allowing features to jump when inputs change drastically (preserving attack edges).

[0242] The calculation of the elastic filtering loss term specifically includes:

[0243] The flow feature matrix of the damaged sample corresponding to the sample is input into the model to perform complete forward inference, and the predicted probability vector of the damaged sample is obtained. The mean square error between the original predicted probability vector and the predicted probability vector of the damaged sample is calculated to obtain the elastic filtering loss term. By minimizing the elastic filtering loss term, the model is forced to learn the cooperative relationship between features, ensuring that even if some column features (such as flow throughput) are masked to zero, the model can still infer the correct result through other features (such as packet variance).

[0244] After calculating the total loss, the gradient of the loss function with respect to all learnable parameters is calculated using the chain rule. Then, the Adam optimizer is used to iteratively update all model parameters based on the effective gradients obtained from the above processing, until the total loss function converges, and the final trained model is output.

[0245] Step S4, the process of obtaining the traffic anomaly analysis results, specifically includes:

[0246] The traffic anomaly perception model is trained using the training set. The gradient of the total loss function with respect to the learnable parameters of the traffic anomaly perception model is calculated using the backpropagation algorithm. The model parameters on all activation paths are iteratively updated using the optimizer until the total loss function converges, and the trained traffic anomaly perception model is obtained.

[0247] Obtain the sample to be detected, calculate the numerical integration step size and channel mask vector corresponding to the sample, input the sample to be detected into the trained traffic anomaly perception model, and obtain the traffic anomaly analysis results.

[0248] In the flow inertial branch, this invention utilizes numerical integration step size and trained and solidified state transition weights to perform equation operations based on Euler discretization, causing the flow state to evolve along the attractor trajectory of the attack behavior, and outputting a time-domain inertial feature vector containing long-term time-series dependency information.

[0249] In the frequency domain analysis branch, the channel mask vector and the trained and fixed convolution kernel weights are used to perform frequency domain mode decomposition and soft thresholding on the input matrix, filter out the background noise spectrum, and output a frequency domain gated feature vector with high signal-to-noise ratio.

[0250] The time-domain inertial feature vector and the frequency-domain gated feature vector are concatenated at the feature level to obtain the fused feature vector;

[0251] The fused feature vector is input into the fully connected classification layer, and the output is mapped to a probability distribution vector using the Softmax function. The probability distribution vector represents the confidence probability that the current traffic belongs to a certain behavior category.

[0252] Find the maximum value in the probability distribution vector and its corresponding category index. If the maximum probability value exceeds the preset confidence threshold, the corresponding category is determined as the identification result of the current network traffic. If the identification result is an attack category, the corresponding security response mechanism is triggered, such as dropping the data packets of the IP, triggering firewall blocking, or generating a system alarm.

[0253] This invention, through an optimizer-based backpropagation algorithm, substantially internalizes and solidifies all the aforementioned cross-scale dynamic constraints, frequency domain gating, and collaborative loss strategies into the model's weight parameters. In the practical application inference stage, the sample to be detected only needs to be forward-propagated through the converged model to efficiently link time-domain inertia and frequency-domain fine features, and output anomaly classification confidence with strict probabilistic significance. This process directly transforms the complex physical and mathematical derivation mechanism into a lightweight, practical detection capability, ensuring that the system can identify threats in real time and trigger a reliable security response mechanism.

[0254] This invention effectively solves the problems of numerical divergence and gradient explosion that are prone to occur in traditional fixed-time-step models when facing sudden attacks in highly chaotic situations by introducing a cross-scale numerical integration step size adaptive adjustment mechanism based on the maximum Lyapunov exponent. By dynamically introducing a virtual evolution step size constrained by the degree of micro-chaos into the macro-flow state evolution equation, it can automatically adopt a conservative iterative strategy when network traffic exhibits violent nonlinear fluctuations. This not only accurately captures the rapidly changing micro-attack waveforms, but also ensures the numerical stability and cross-scale coherence of the long-term feature evolution process. By combining the spectral norm constraint of the state transition weight matrix and the memory freezing mechanism of the neuron saturation interval, this invention can sensitively respond to and filter out irregular background traffic jitter, forming a deep dynamic memory for persistent attack behavior.

[0255] To address the variable frequency bands of network attacks and random background noise interference, this invention designs a dynamic channel masking mechanism driven by power spectral entropy and a gating filtering strategy based on activation energy sorting. This overcomes the limitations of the physical structure and fixed receptive field of traditional deep learning models. It can adaptively unlock or block modal channels according to the frequency domain complexity of the current traffic, enabling the model's receptive field to accurately adapt to unknown attack bandwidth. In particular, by sorting the initial modal features in descending order of activation energy before masking, it avoids the hidden danger of the model erroneously discarding key features due to the randomness of weights, ensuring that the main attack modality with the strongest frequency domain response is always retained. Combined with soft thresholding processing using a shrinkage threshold dynamically generated by the energy descriptor, this invention can intercept and completely eliminate the pseudo-white noise caused by network physical jitter, significantly improving the signal-to-noise ratio and characterization purity of the extracted frequency domain features.

[0256] To address the sophisticated deception techniques commonly employed by attackers in real-world network adversarial scenarios, such as traffic fragmentation and feature hiding, this invention constructs a multi-dimensional collaborative loss function constraint system that integrates manifold regularization and elastic filtering. The elastic filtering loss term applies a random feature discard mask based on a Bernoulli distribution to the original samples and performs self-supervised learning for distribution consistency. This forces the model to move away from excessive reliance on single-dimensional traffic features and instead deeply mines and solidifies the physical collaborative relationships between multi-dimensional features. This allows the model to maintain extremely high adversarial resilience and inference robustness even when faced with deceptive data that is incomplete or contaminated with features. The manifold regularization loss term effectively maintains the local topological structure of the high-dimensional feature space using a Gaussian kernel function. This allows the model to maintain feature smoothness when dealing with similar background traffic to enhance noise resistance, while allowing manifold jumps to accurately delineate the boundaries of attack behavior when encountering fundamentally abrupt changes in traffic. This significantly improves the overall accuracy, reliability, and practical deployment value of identifying abnormal network traffic behavior.

[0257] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0258] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A method for identifying abnormal network traffic behavior based on deep learning, characterized in that, Includes the following steps: Step S1: Collect network traffic data samples and construct a training set and a perturbation set. Each sample in the training set and the perturbation set includes a traffic state matrix and a category label. Step S2: Extract the original network traffic data corresponding to the current sample, perform high-frequency time slicing according to the preset micro time step, obtain the high-frequency traffic state sequence, construct the phase trajectory of the high-frequency traffic state sequence using phase space reconstruction technology and calculate the maximum Lyapunov exponent, calculate the numerical integration step based on the maximum Lyapunov exponent, perform frequency domain transformation on the traffic state matrix of the sample to calculate the power spectral entropy, calculate the number of modal channels based on the power spectral entropy and generate a channel mask vector; Step S3: Construct a traffic anomaly perception model that includes a traffic inertia branch, a frequency domain analysis branch, and a total loss function. The traffic inertia branch is used to perform equation operations based on Euler discretization on network traffic data samples using the numerical integration step size. The frequency domain analysis branch is used to perform convolution operations and soft thresholding on network traffic data samples using the channel mask vector. Step S4: Train the traffic anomaly perception model using the training set, determine the parameters of the traffic anomaly perception model, input the traffic data sample to be detected into the traffic anomaly perception model, and obtain the traffic anomaly analysis results. The mathematical expression for the total loss function is: ； in, For classification loss terms; This is the manifold regularization loss term; This is the elastic filtering loss term; and These are the corresponding weighting coefficients; The mathematical expression for the manifold regularization loss term is: ； in, For manifold regularization loss term, and Samples from the training set and samples The final hidden state vector; The number of samples in the training set; For training set samples and samples Edge indicator weight; The mathematical expression for the edge indicator weight is: ； in, For training set samples and samples Edge indicator weight, and For the sample and samples The flow state matrix, These are the parameters of the Gaussian kernel; The elastic filtering loss term is calculated, and its mathematical expression is as follows: ； in, For elastic filtering loss term, Let be the probability distribution vector of the sample. This is the probability distribution vector of the disturbed sample corresponding to the sample; The disturbed sample is obtained by performing a Hadamard product operation on the flow state matrix of the original sample and a random feature discard mask generated based on the Bernoulli distribution.

2. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 1, characterized in that, The process of constructing the training set in step S1 specifically includes: Collect several raw traffic data points, slice them according to a preset macroscopic time step, and obtain traffic segments on a discrete time series. For each time slice, extract feature values ​​of several dimensions for the traffic segment to form a basic feature vector. The feature values ​​include traffic throughput, average packet length, packet length variance, control bit ratio, and average packet arrival interval. Calculate the deviation of the feature value of the current traffic segment from the preset bandwidth upper limit threshold and the preset protocol specification threshold, and use the inverse proportional function to map and obtain the data confidence factor with a value range between 0 and 1; The mathematical expression for the confidence factor is: ； in, As the confidence factor, The sensitivity coefficient, For bandwidth deviation, This is a deviation from the protocol specifications; The mathematical expression for bandwidth deviation is: ； in, For bandwidth deviation, For throughput, This is the upper limit threshold for bandwidth. The mathematical expression for protocol specification deviation is: ； in, Due to deviations from the protocol specifications, and The normalization coefficient is... To cover the variance, To control the proportion of flag bits, The packet length fluctuation threshold, To control the percentage threshold of the control bits; The basic feature vector and the data confidence factor are concatenated along the feature dimension to form a traffic state matrix; Each raw traffic data sample is assigned a category label, which is a scalar number representing the state attribute of the raw traffic data sample. The traffic state matrix and category label of each original traffic data sample are stored in the training set in a one-to-one correspondence; The process of constructing the perturbation set specifically includes: Using the preset Bernoulli distribution parameters, a Bernoulli mask matrix with the same dimension as the sample's flow state matrix is ​​generated. The flow state matrix of the sample and the Bernoulli mask matrix are then subjected to a Hadamard product to obtain the perturbation sample corresponding to the sample. All the perturbation samples constitute the perturbation sample set.

3. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 2, characterized in that, The process of calculating the numerical integration step size in step S2 specifically includes: Extract the original network traffic data corresponding to the current sample, perform high-frequency time slicing according to the preset micro time step, obtain the high-frequency traffic state sequence, construct the phase trajectory of the high-frequency traffic state sequence using phase space reconstruction technology, and calculate the maximum Lyapunov exponent of the phase trajectory. Based on the maximum Lyapunov exponent, the numerical integration step size is calculated, and the mathematical expression for the numerical integration step size is: ； in, This is the numerical integration step size. The preset baseline integration step size, The chaos sensitivity coefficient, The maximum Lyapunov exponent for the phase trajectory.

4. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 3, characterized in that, The process of generating the channel mask vector in step S2 specifically includes: Perform a discrete Fourier transform on the column vectors of the flow state matrix of the sample to obtain a complex sequence in the frequency domain; The power spectral density function is obtained by calculating the square of the modulus of the frequency domain complex sequence. The power spectral density function is normalized to obtain the frequency domain probability distribution, and the power spectral entropy is calculated based on the frequency domain probability distribution. The number of modal channels is calculated based on the power spectral entropy, and the mathematical expression for the number of modal channels is: ； in, For the number of modal channels, Number of basic channels This is the expansion factor; Power spectral entropy; A channel mask vector is generated based on the calculated number of modal channels. The length of the channel mask vector is a preset length. The first few elements of the channel mask vector have a value of 1, and the rest have a value of 0. The number of elements with a value of 1 is the same as the number of modal channels.

5. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 4, characterized in that, In step S3, the traffic anomaly perception model includes a traffic inertia branch, a frequency domain analysis branch, a feature splicing layer, a fully connected classification layer, and a Softmax output layer. The flow inertia branch and the frequency domain analysis branch are parallel branches; The output of the flow inertia branch is the final hidden state vector, and the output of the frequency domain analysis branch is the frequency domain feature vector; The feature concatenation layer is used to concatenate the final hidden state vector with the frequency domain feature vector in the feature dimension to obtain a fused feature vector; The fully connected classification layer is used to map the fused feature vector into a category logical value vector; The Softmax output layer is used to convert the category logical value vector into a probability distribution vector representing the confidence level of each anomaly category.

6. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 5, characterized in that, In step S3, the process of the flow inertial branch performing equation operations based on Euler discretization on the flow state matrix specifically includes: The flow state matrix of the sample is split into multiple row vectors by row, and these vectors are used as the input row vectors of the flow inertia branch in chronological order. The input row vectors are then subjected to linear projection to obtain high-dimensional mapping feature vectors. The linear projection operation is a matrix multiplication of the input row vector and the input mapping weight matrix, plus the bias vector. Multiply the hidden state vector from the previous round with the state transition weight matrix, and add the high-dimensional mapping feature vector to obtain the pre-activated state increment vector. The state transition weight matrix is ​​constrained by the spectral norm. Perform the following for each element in the pre-activated state increment vector Function calculation to obtain the instantaneous rate of change vector; Multiply the instantaneous rate of change vector by the numerical integration step size corresponding to the sample, and add the hidden state vector from the previous round to obtain the hidden state vector for the current round; the initialized hidden state vector is a vector of all zeros. Input each row vector of the flow state matrix sequentially until the last row vector is reached to obtain the final hidden state vector corresponding to the sample.

7. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 5, characterized in that, The frequency domain analysis branch includes a flow mode decomposition layer, a background noise spectrum filtering layer, and a feature reconstruction and output layer; The input to the flow mode decomposition layer is the flow state matrix of the sample. Using a preset one-dimensional convolution kernel, a sliding dot product operation is performed in the row direction of the flow state matrix, and the operation result is mapped to the frequency domain feature space to obtain the mode feature matrix. The modal feature matrix is ​​obtained by concatenating modal feature vectors as column vectors, and the modal feature vectors are obtained by gating the initial modal feature vectors sorted based on activation energy through channel mask vectors; The mathematical expression for the initial modal feature vector is: ； in, Indicates the first Modal feature vectors; The first element of the flow state matrix represents the flow state matrix. List; This represents a one-dimensional convolution operation; For the first The convolutional kernel at the _th ... Weight vectors on each feature dimension; This is the modal channel bias vector; .

8. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 7, characterized in that, The background noise spectrum filtering layer is used to perform a shrinking transformation on the modal feature matrix using a soft thresholding function to obtain a purified frequency domain feature matrix. The frequency domain feature matrix is ​​obtained by concatenating frequency domain feature vectors; The mathematical expression for the frequency domain feature vector is: ； in, For the purified first The modal channel in the first... Frequency domain feature values ​​of each time slice; This refers to the shrinkage threshold obtained from the shrinkage threshold vector for the corresponding channel. Indicates the first before purification The modal channel in the first... The original frequency domain feature values ​​of each time slice; The process of obtaining the shrinkage threshold vector specifically includes: Global average pooling is performed on the modal feature matrix to obtain the average energy of each modal channel, and an energy vector is constructed. A shrinkage threshold vector is then generated through a fully connected layer. The purified frequency domain feature matrix is ​​subjected to global average pooling operation and output as the frequency domain feature vector for frequency domain analysis and detection.

9. The method for identifying abnormal network traffic behavior based on deep learning as described in claim 8, characterized in that, The process of obtaining the traffic anomaly analysis results in step S4 specifically includes: The traffic anomaly perception model is trained using the training set. The gradient of the total loss function with respect to the learnable parameters of the traffic anomaly perception model is calculated using the backpropagation algorithm. The model parameters on all activation paths are iteratively updated using the optimizer until the total loss function converges, and the trained traffic anomaly perception model is obtained. Obtain the sample to be detected, calculate the numerical integration step size and channel mask vector corresponding to the sample, input the sample to be detected into the trained traffic anomaly perception model, and obtain the traffic anomaly analysis results.

Images