Network traffic probe anomaly detection method based on deep learning
By employing a deep learning method based on liquid time constants for network traffic anomaly detection, the problem of time scale incompatibility in existing technologies is solved, enabling adaptive detection of network traffic and improving detection accuracy and robustness.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HANGZHOU TIANFANG XINAN TECH CO LTD
- Filing Date
- 2026-01-22
- Publication Date
- 2026-04-17
AI Technical Summary
Existing methods for detecting network traffic anomalies fail to fully consider the continuous evolution of network traffic at different time scales, making it difficult to adaptively adjust and resulting in insufficient accuracy and robustness of detection results in complex network environments.
By employing a liquid time constant deep learning method, a traffic state sequence is constructed through unified time index processing and continuous time modeling. The state is then updated using the time constant parameter sequence to generate an anomaly indication sequence, thereby achieving time-adaptive detection of network traffic.
It improves the accuracy and robustness of network traffic probe anomaly detection, enabling stable identification of sudden and slowly evolving anomalies in complex network environments, and providing clear time-based localization capabilities and structured representation.
Smart Images
Figure CN121887684A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network traffic monitoring technology, and in particular to a method for detecting network traffic probe anomalies based on deep learning. Background Technology
[0002] With the continuous expansion of network scale and the ongoing evolution of network service models, network traffic probes are widely deployed at critical network nodes to continuously monitor and analyze network traffic, supporting applications such as network operational status assessment, security situation awareness, and anomaly detection. Existing network traffic anomaly detection methods typically rely on statistical modeling of traffic characteristics within a fixed time window, or employ deep learning models such as recurrent neural networks and convolutional neural networks to model and analyze discrete time series, identifying abnormal traffic through prediction errors, reconstruction errors, or statistical thresholds. While these methods can detect some bursty traffic anomalies in practical applications, they still primarily rely on discrete-time modeling and fixed-time-scale analysis.
[0003] However, existing technologies generally fail to fully consider the continuous evolution characteristics of network traffic at different time scales, making it difficult to adaptively adjust the model's time response behavior based on the rate of traffic change and fluctuation characteristics. When the rhythm of network traffic changes is unstable or when both sudden changes and slow evolutionary anomalies exist simultaneously, detection methods with fixed time steps or fixed model parameters are prone to problems such as delayed responses to short-term anomalies or unstable identification of long-term evolutionary anomalies. This affects the accuracy and robustness of anomaly detection results, making it difficult to meet the actual needs of network traffic probe anomaly detection in complex network environments.
[0004] Therefore, how to provide a deep learning-based network traffic probe anomaly detection method is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] One objective of this invention is to propose a network traffic probe anomaly detection method based on deep learning. This invention uses liquid time constant deep learning to achieve network traffic anomaly detection, which has the advantages of strong time adaptability and stable detection.
[0006] A network traffic probe anomaly detection method based on deep learning according to an embodiment of the present invention includes the following steps:
[0007] Acquire network traffic data collected by the network traffic probe within a preset monitoring time period, and record the corresponding collection timestamp for the network traffic data;
[0008] Based on the collection timestamp, time alignment processing is performed on the network traffic data to generate a unified time index, and the network traffic data is correlated to obtain a traffic feature sequence.
[0009] Numerical normalization is performed on the flow characteristic sequence, and a continuous-time flow sequence is constructed based on the normalized flow characteristic sequence;
[0010] The continuous-time flow rate sequence is input into the improved liquid time constant network, and a flow state sequence is generated based on the continuous-time flow rate sequence under the constraint of the time continuity constraint term.
[0011] Calculate the characteristic sequence of flow change based on continuous time flow series;
[0012] Based on a preset time constant mapping function, the flow change feature sequence is mapped to generate a time constant parameter sequence, and the time constant parameter sequence is introduced as an endogenous modulation parameter in the improved liquid time constant network into the network state update process to obtain the updated flow state sequence.
[0013] Based on the updated flow state sequence and combined with the time constant parameter sequence, a state evolution baseline trajectory of the flow state is constructed, and the state evolution deviation sequence of the flow state sequence relative to the state evolution baseline trajectory is calculated.
[0014] An anomaly indication sequence is generated based on the state evolution deviation sequence, and the anomaly detection results of the network traffic probe are output based on the anomaly indication sequence.
[0015] Optionally, the generation of the traffic feature sequence includes:
[0016] Read the collection timestamps corresponding to the network traffic data, and determine the start and end collection timestamps within the preset monitoring time period based on the collection timestamps;
[0017] Based on the start and end timestamps of data collection, a unified time index covering the preset monitoring time period is generated according to the preset time granularity.
[0018] For each piece of network traffic data, the network traffic data is mapped to the corresponding time index in a unified time index based on its collection timestamp;
[0019] The network traffic data mapped to the unified time index is merged to form a time-aligned data set that corresponds one-to-one with the unified time index.
[0020] Using a unified time index as the basis for association, association processing is performed on message direction data, message length data, arrival time interval data, session identifier data, and protocol field statistics in the time-aligned data set to generate a traffic feature sequence that corresponds one-to-one with the unified time index.
[0021] Optionally, constructing the continuous-time flow sequence includes:
[0022] Read the traffic feature sequence and obtain the feature component set corresponding to each unified time index in chronological order;
[0023] Using the entire unified time index covered by the traffic feature sequence as the statistical range, statistical parameters are calculated for each feature component in the feature component set.
[0024] Based on statistical parameters, numerical normalization is performed on each feature component corresponding to each unified time index in the flow feature sequence to obtain the numerically normalized flow feature sequence.
[0025] According to the time order of the unified time index, each unified time index is extracted from the traffic feature sequence after numerical normalization and arranged in sequence to form a time index sequence. The feature components after numerical normalization corresponding to each unified time index are spliced in a preset order to form a feature vector sequence that corresponds one-to-one with the time index sequence.
[0026] The time index sequence and the feature vector sequence are combined in a one-to-one correspondence to form a continuous time flow sequence.
[0027] Optionally, the generation of the traffic state sequence includes:
[0028] Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to each time index in turn according to the time order of the time index sequence.
[0029] Initialize the initial network state of the improved liquid time constant network and establish a correspondence between the initial network state and the starting time index in the time index sequence;
[0030] For adjacent time indices in a time index sequence, calculate the time interval between adjacent time indices and generate time continuity constraint terms based on the time interval;
[0031] The feature vector corresponding to the current time index is input into the improved liquid time constant network, and combined with the network state corresponding to the previous time index, to form the state update input corresponding to the current time index;
[0032] Under the constraint of time continuity, state update processing is performed on the state update input to obtain the network state that corresponds one-to-one with the current time index;
[0033] The network states corresponding to each time index are arranged in chronological order according to the time index sequence, forming a traffic state sequence that corresponds one-to-one with the time index sequence.
[0034] Optionally, the formation of the flow rate change characteristic sequence includes:
[0035] Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to adjacent time indices one by one according to the time order of the time index sequence.
[0036] For adjacent time indices in the time index sequence, calculate the difference between the corresponding feature vectors, and construct a change magnitude sequence based on the difference;
[0037] For adjacent time indices in a time index sequence, calculate the time interval between adjacent time indices, and construct a change rate sequence based on the change magnitude sequence and the time interval;
[0038] Using the amplitude change sequence as input, within a preset sliding window aligned with the time index sequence, fluctuation statistics are performed on the continuous values of the amplitude change sequence to construct a fluctuation intensity sequence.
[0039] According to the time order of the time index sequence, the change amplitude sequence, change rate sequence, and fluctuation intensity sequence are arranged and a one-to-one correspondence is established with the time index sequence to form the flow change characteristic sequence.
[0040] Optionally, the generation of the updated traffic state sequence includes:
[0041] Read the flow change characteristic sequence and time index sequence, and determine the change amplitude sequence value, change rate sequence value and fluctuation intensity sequence value corresponding to each time index according to the time order of the time index sequence;
[0042] For each time index, the corresponding change amplitude sequence value, change rate sequence value, and fluctuation intensity sequence value are taken as input, and the mapping process is performed through a preset time constant mapping function to generate time constant parameter values that correspond one-to-one with the time index.
[0043] Arrange the values of the time constant parameters corresponding to each time index according to the time order of the time index sequence to form a time constant parameter sequence that corresponds one-to-one with the time index sequence;
[0044] The time constant parameter sequence is introduced as an endogenous modulation parameter in the improved liquid time constant network and incorporated into the network state update process;
[0045] The network state of the improved liquid time constant network is updated under the modulation of the time constant parameter sequence, resulting in an updated flow state sequence.
[0046] Optionally, the formation of the state evolution deviation sequence includes:
[0047] Read the updated traffic status sequence and time index sequence, and determine the traffic status corresponding to each time index in turn according to the time order of the time index sequence;
[0048] Read the time constant parameter sequence that corresponds one-to-one with the time index sequence, and use the time constant parameter sequence as state evolution condition information;
[0049] Using the updated flow state sequence as input, and combined with the time constant parameter sequence within a preset reference window aligned with the time index sequence, for each time index, select multiple flow states that simultaneously satisfy the time index proximity relationship and time constant parameter constraints to form the flow state set corresponding to that time index.
[0050] A baseline aggregation process is performed on the conditional flow state set to obtain a baseline flow state that corresponds one-to-one with the time index. The baseline flow states are arranged in chronological order according to the time index sequence to construct the baseline trajectory of conditional state evolution. For each time index in the time index sequence, the flow state corresponding to the time index and the baseline flow state corresponding to the time index are obtained, and the two are subtracted component by component to obtain the state difference vector.
[0051] The values of the state evolution deviation sequence are calculated based on the state difference vector;
[0052] According to the time order of the time index sequence, the values of the state evolution deviation sequence corresponding to each time index are arranged and a one-to-one correspondence is established with the time index sequence to form the state evolution deviation sequence.
[0053] Optionally, the generation of the anomaly detection result includes:
[0054] Read the state evolution deviation sequence and the time index sequence, and determine the state evolution deviation sequence value corresponding to each time index according to the time order of the time index sequence;
[0055] The anomaly determination threshold is calculated based on the state evolution deviation sequence. The mean and standard deviation of the state evolution deviation sequence are weighted and summed to obtain the anomaly determination threshold.
[0056] For each time index in the time index sequence, the value of the state evolution deviation sequence corresponding to the time index is compared with the anomaly judgment threshold, and the anomaly indicator corresponding to each time index is arranged according to the time order of the time index sequence to form an anomaly indicator sequence.
[0057] In the anomaly indication sequence, identify the continuous time index segment with the anomaly indication identifier as the first identifier, and determine the anomaly occurrence time segment based on the start time index and end time index corresponding to the continuous time index segment;
[0058] The network traffic probe summarizes the time segments in which anomalies occur and the corresponding anomaly indicators, and outputs the anomaly detection results.
[0059] The beneficial effects of this invention are:
[0060] This invention introduces continuous-time modeling and adaptive time-scale modulation mechanisms into the anomaly detection process of network traffic probes, enabling network traffic analysis to move beyond fixed time windows or discrete time steps and comprehensively improving the ability to characterize complex network traffic evolution. By performing unified time alignment and feature normalization on network traffic data and constructing continuous-time traffic sequences, this invention maintains temporal semantic consistency under irregular sampling and traffic abrupt change scenarios, providing a stable and comparable temporal basis for subsequent traffic state modeling. Furthermore, an improved liquid time constant network is used to model the continuous-time evolution of network traffic states, allowing the model to naturally reflect the dynamic process of network traffic changes over time, avoiding the sensitivity issues of traditional discrete models in terms of time granularity selection.
[0061] Furthermore, this invention explicitly extracts flow change features such as amplitude, rate of change, and fluctuation intensity from continuous-time flow sequences, and generates a time constant parameter sequence based on a preset time constant mapping function. This sequence is used to constrain the state update process of the improved liquid time constant network, enabling the model's time response behavior to adaptively adjust to the network flow change characteristics. When network flow changes drastically, the model can respond quickly to state changes; when network flow evolves slowly, the model maintains a smooth and stable state update. This allows for unified modeling and identification of sudden anomalies and slowly evolving anomalies within the same detection framework, effectively improving the time adaptability and stability of the anomaly detection process.
[0062] Furthermore, this invention constructs a baseline trajectory for the state evolution of traffic states and calculates a sequence of deviations in traffic state evolution relative to this baseline trajectory. This transforms anomaly detection from simple instantaneous feature judgment into an analysis of the degree of deviation from the traffic state evolution pattern, enabling a more accurate characterization of the extent to which abnormal behavior disrupts the normal evolution trend. The anomaly indication sequence and anomaly occurrence time segments generated based on this provide the anomaly detection results with clear temporal localization capabilities and a structured expression, facilitating subsequent handling by network operations and security analysts. In summary, this invention improves the accuracy, robustness, and engineering practicality of network traffic probe anomaly detection in complex network environments. Attached Figure Description
[0063] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0064] Figure 1 This is an overall flowchart of a deep learning-based network traffic probe anomaly detection method proposed in this invention;
[0065] Figure 2 This is a schematic diagram illustrating the relationship between continuous-time flow sequences and an improved liquid time constant network in a deep learning-based network flow probe anomaly detection method proposed in this invention.
[0066] Figure 3 This is a schematic diagram illustrating the generation of anomaly indication sequences and the determination of anomaly occurrence time segments in a deep learning-based network traffic probe anomaly detection method proposed in this invention. Detailed Implementation
[0067] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.
[0068] refer to Figures 1-3 A deep learning-based network traffic probe anomaly detection method includes the following steps:
[0069] The network traffic probe collects network traffic data within a preset monitoring time period and records the corresponding collection timestamp for the network traffic data. The network traffic data includes packet direction data, packet length data, arrival time interval data, session identifier data, and protocol field statistics.
[0070] Based on the collection timestamp, time alignment processing is performed on the network traffic data to generate a unified time index. The network traffic data is then correlated according to the unified time index to obtain a traffic feature sequence arranged according to the unified time index.
[0071] Numerical normalization is performed on the flow feature sequence, and a continuous-time flow sequence is constructed based on the normalized flow feature sequence. The continuous-time flow sequence includes a time index sequence and a feature vector sequence that corresponds one-to-one with the time index sequence.
[0072] By inputting the continuous-time flow sequence into the improved liquid time constant network, and under the constraint of the time continuity constraint term, a flow state sequence corresponding one-to-one with the time index sequence is generated based on the continuous-time flow sequence.
[0073] The flow change feature sequence is calculated based on the continuous time flow series. The flow change feature sequence includes the change amplitude sequence, the change rate sequence, and the fluctuation intensity sequence, and the flow change feature sequence corresponds one-to-one with the time index sequence.
[0074] Based on a preset time constant mapping function, the flow change feature sequence is mapped to generate a time constant parameter sequence. The time constant parameter sequence corresponds one-to-one with the time index sequence. The time constant parameter sequence is introduced as an endogenous modulation parameter in the improved liquid time constant network into the network state update process. It is used to modulate the state evolution rate of the improved liquid time constant network at different time indices, thereby constraining the state update process in the improved liquid time constant network and obtaining the updated flow state sequence.
[0075] Based on the updated flow state sequence and combined with the time constant parameter sequence, a state evolution baseline trajectory of the flow state is constructed, and the state evolution deviation sequence of the flow state sequence relative to the state evolution baseline trajectory is calculated. The state evolution deviation sequence corresponds one-to-one with the time index sequence.
[0076] An anomaly indication sequence is generated based on the state evolution deviation sequence, and the anomaly detection result of the network traffic probe is output based on the anomaly indication sequence. The anomaly detection result includes the time segment of the anomaly occurrence and the anomaly indication identifier corresponding to the time segment of the anomaly occurrence.
[0077] In this embodiment, the generation of the traffic feature sequence includes:
[0078] Read the collection timestamp corresponding to the network traffic data, and determine the start and end collection timestamps within the preset monitoring time period based on the collection timestamps. The preset monitoring time period is used to limit the time range of the network traffic data and serve as the time boundary for time alignment, unified time index generation, and continuous time modeling of the network traffic data.
[0079] Based on the start and end timestamps of data collection, a unified time index covering a preset monitoring period is generated according to a preset time granularity. The preset time granularity is used to divide the time scale within the preset monitoring period, limit the generation interval of the unified time index, and provide a time resolution basis for the construction of continuous time flow sequences.
[0080] For each piece of network traffic data, the network traffic data is mapped to the corresponding time index in a unified time index based on its collection timestamp;
[0081] The network traffic data mapped to the unified time index is merged to form a time-aligned data set that corresponds one-to-one with the unified time index.
[0082] Using a unified time index as the association basis, association processing is performed on message direction data, message length data, arrival time interval data, session identifier data, and protocol field statistics in the time-aligned data set. The association processing includes using the unified time index as the association basis, performing time consistency alignment on various types of data corresponding to the same unified time index, and combining them according to a preset feature order to generate a traffic feature sequence that corresponds one-to-one with the unified time index.
[0083] In this embodiment, constructing the continuous time flow sequence includes:
[0084] Read the traffic feature sequence and obtain the feature component set corresponding to each unified time index according to the time order of the unified time index. The feature component set includes message direction data, message length data, arrival time interval data, session identifier data, and protocol field statistics.
[0085] Using the entire unified time index covered by the traffic feature sequence as the statistical range, statistical parameters are calculated for each feature component in the feature component set. The statistical parameters include the mean and the standard deviation. The mean is obtained by summing all the values of the feature component within the statistical range and dividing by the number of unified time indices. The standard deviation is obtained by summing the squares of the differences between each value of the feature component within the statistical range and the corresponding mean, dividing by the number of unified time indices, and then taking the square root.
[0086] Based on statistical parameters, numerical normalization is performed on each feature component corresponding to each unified time index in the flow feature sequence. The numerical normalization process is to subtract the corresponding mean from the current value of each feature component and then divide it by the corresponding standard deviation to obtain the flow feature sequence after numerical normalization.
[0087] According to the time order of the unified time index, each unified time index is extracted from the traffic feature sequence after numerical normalization and arranged in sequence to form a time index sequence. The feature components corresponding to each unified time index after numerical normalization are concatenated in a preset order. The preset order is the feature arrangement order determined in advance for message direction data, message length data, arrival time interval data, session identifier data and protocol field statistics data. This is used to ensure the consistency of the feature vectors formed under different unified time indices in the feature dimension position, forming a feature vector sequence that corresponds one-to-one with the time index sequence.
[0088] The time index sequence and the feature vector sequence are combined in a one-to-one correspondence. The combination is to pair each time index in the time index sequence with the feature vector at the same position in the feature vector sequence to form a continuous time flow sequence composed of time indexes and corresponding feature vectors.
[0089] In this embodiment, the generation of the traffic state sequence includes:
[0090] Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to each time index in turn according to the time order of the time index sequence.
[0091] Initialize the initial network state of the improved liquid time constant network and establish a correspondence between the initial network state and the starting time index in the time index sequence, so that the improved liquid time constant network performs state updates according to the time order of the time index sequence;
[0092] For adjacent time indices in the time index sequence, the time interval between adjacent time indices is calculated, and a time continuity constraint term is generated based on the time interval. The time continuity constraint term is used to limit the update amplitude of the improved liquid time constant network between the network states corresponding to adjacent time indices.
[0093] The feature vector corresponding to the current time index is input into the improved liquid time constant network, and combined with the network state corresponding to the previous time index, to form the state update input corresponding to the current time index;
[0094] Under the constraint of the time continuity constraint, the state update input is processed by performing state update processing. The state update processing is performed by calculating and updating the network state of the improved liquid time constant network based on the state update input corresponding to the current time index under the constraint of the time continuity constraint, so as to obtain the network state corresponding to the current time index.
[0095] The network states corresponding to each time index are arranged in chronological order according to the time index sequence, forming a traffic state sequence that corresponds one-to-one with the time index sequence.
[0096] In this embodiment, the formation of the flow rate change characteristic sequence includes:
[0097] Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to adjacent time indices one by one according to the time order of the time index sequence.
[0098] For adjacent time indices in the time index sequence, the difference between the corresponding feature vectors is calculated. The calculation of the difference between the corresponding feature vectors is to perform a component-by-component subtraction operation on the values of the two feature vectors corresponding to adjacent time indices, to obtain the difference representing the change of each feature component, and to construct a change magnitude sequence based on the difference.
[0099] The construction of the change amplitude sequence is based on the difference of feature vectors corresponding to adjacent time indices. The numerical values reflecting the change amplitude of network traffic characteristics over time are extracted and organized in the order of the time index sequence to form the change amplitude sequence. Each value in the change amplitude sequence is the sum of the absolute values of each component of the difference between two adjacent feature vectors, and the change amplitude sequence corresponds one-to-one with the time index sequence.
[0100] For adjacent time indices in the time index sequence, the time interval between adjacent time indices is calculated. The time interval is the difference between the corresponding time values of adjacent time indices. A change rate sequence is constructed based on the change amplitude sequence and the time interval. Each value in the change rate sequence is the result obtained by dividing the corresponding change amplitude sequence value by the corresponding time interval.
[0101] Using the change amplitude sequence as input, within a preset sliding window aligned with the time index sequence, fluctuation statistical processing is performed on the continuous values of the change amplitude sequence to construct a fluctuation intensity sequence. The value of each value in the fluctuation intensity sequence is the square root of the sum of the squares of the differences between the change amplitude sequence values within the sliding window and the mean of the change amplitude sequence within the sliding window, divided by the number of values within the sliding window.
[0102] According to the time order of the time index sequence, the change amplitude sequence, change rate sequence, and fluctuation intensity sequence are arranged and a one-to-one correspondence is established with the time index sequence to form the flow change characteristic sequence.
[0103] In this embodiment, the generation of the updated traffic state sequence includes:
[0104] Read the flow change characteristic sequence and time index sequence, and determine the change amplitude sequence value, change rate sequence value and fluctuation intensity sequence value corresponding to each time index according to the time order of the time index sequence;
[0105] For each time index, the corresponding change amplitude sequence value, change rate sequence value, and fluctuation intensity sequence value are taken as input, and the mapping process is performed through a preset time constant mapping function to generate time constant parameter values that correspond one-to-one with the time index.
[0106] When the preset time constant mapping function is implemented, for the change amplitude sequence, change rate sequence, and fluctuation intensity sequence at the same time index, the influence ratio of each flow change feature in the time scale adjustment is preset, and the three types of flow change features are combined and calculated according to the influence ratio to reflect the overall strength of the network flow change at that time index. During the mapping process, a monotonic correspondence is set to ensure that the combined calculation result and the time constant parameter value maintain a consistent trend, thereby ensuring that when the flow change rhythm accelerates or intensifies, the corresponding time constant parameter value changes synchronously. To avoid the time constant parameter value from exceeding the range that the improved liquid time constant network can operate stably, a value range restriction is imposed on the time constant parameter value in the mapping output stage, so that the time constant parameter values generated at different time indices change within a uniform scale.
[0107] The execution mapping process includes taking the change amplitude sequence value, change rate sequence value and fluctuation intensity sequence value corresponding to the same time index as mapping input, and performing combined calculations according to a preset time constant mapping function to generate time constant parameter values used to characterize the network traffic evolution time scale at that time index;
[0108] Arrange the values of the time constant parameters corresponding to each time index according to the time order of the time index sequence to form a time constant parameter sequence that corresponds one-to-one with the time index sequence;
[0109] The time constant parameter sequence is used as an endogenous modulation parameter in the improved liquid time constant network. It is introduced into the network state update process to modulate the state evolution rate of the improved liquid time constant network at different time indices, so that the update speed of the network state matches the flow change characteristics at the corresponding time index.
[0110] The network state of the improved liquid time constant network is updated under the modulation of the time constant parameter sequence, resulting in an updated flow state sequence.
[0111] In this embodiment, the formation of the state evolution deviation sequence includes:
[0112] Read the updated traffic status sequence and time index sequence, and determine the traffic status corresponding to each time index in turn according to the time order of the time index sequence;
[0113] Read the time constant parameter sequence that corresponds one-to-one with the time index sequence, and use the time constant parameter sequence as state evolution condition information;
[0114] Using the updated flow state sequence as input, and combined with the time constant parameter sequence within a preset reference window aligned with the time index sequence, for each time index, select multiple flow states that simultaneously satisfy the time index proximity relationship and time constant parameter constraints to form the flow state set corresponding to that time index.
[0115] A baseline aggregation process is performed on the conditional flow state set. The baseline aggregation process includes summing each flow state in the flow state set component by component and dividing by the number of flow states in the flow state set to obtain a baseline flow state that corresponds one-to-one with the time index. The baseline flow states are then arranged in chronological order according to the time index sequence to construct the baseline trajectory of the conditional state evolution.
[0116] For each time index in the time index sequence, obtain the traffic status corresponding to that time index and the baseline traffic status corresponding to that time index, and subtract the two components one by one to obtain the state difference vector.
[0117] The values of the state evolution deviation sequence are calculated based on the state difference vector;
[0118] According to the time order of the time index sequence, the values of the state evolution deviation sequence corresponding to each time index are arranged and a one-to-one correspondence is established with the time index sequence to form the state evolution deviation sequence.
[0119] In this embodiment, the generation of the anomaly detection result includes:
[0120] Read the state evolution deviation sequence and the time index sequence, and determine the state evolution deviation sequence value corresponding to each time index according to the time order of the time index sequence;
[0121] The anomaly determination threshold is calculated based on the state evolution deviation sequence. The mean and standard deviation of the state evolution deviation sequence are weighted and summed to obtain the anomaly determination threshold.
[0122] For each time index in the time index sequence, the value of the state evolution deviation sequence corresponding to that time index is compared with the anomaly judgment threshold. When the value of the state evolution deviation sequence is greater than the anomaly judgment threshold, an anomaly indicator for the corresponding time index is generated as the first indicator. When the value of the state evolution deviation sequence is not greater than the anomaly judgment threshold, an anomaly indicator for the corresponding time index is generated as the second indicator. The anomaly indicator indicators corresponding to each time index are arranged in the time order of the time index sequence to form an anomaly indicator sequence.
[0123] In the anomaly indication sequence, identify the continuous time index segment with the anomaly indication identifier as the first identifier, and determine the anomaly occurrence time segment based on the start time index and end time index corresponding to the continuous time index segment;
[0124] The network traffic probe summarizes the time segments in which anomalies occur and the corresponding anomaly indicators, and outputs the anomaly detection results.
[0125] Example 1:
[0126] To verify the feasibility of this invention in practice, it was applied to a network traffic probe anomaly detection scenario in a large enterprise campus network. This campus network simultaneously supports various service types, including office system access, production control data interaction, video conferencing communication, and external internet access. Network traffic exhibits significant differences across different time periods, including both sudden large-scale access events and slow traffic evolution processes that gradually change with the workload. Due to the complex network structure and diverse service patterns, traditional anomaly detection methods based on fixed time windows or discrete time modeling struggle to identify abnormal traffic changes at different time scales in a timely and stable manner. This often leads to delayed responses to sudden anomalies or discontinuous identification of slowly evolving anomalies, posing challenges to network operation monitoring and security management.
[0127] In this scenario, the network operations and maintenance department deploys network traffic probes at core switching nodes and critical link locations within the campus to continuously collect data on passing network traffic. The collected data includes packet direction information, packet length information, packet arrival time intervals, session identifiers, and statistical results of protocol fields. A corresponding collection timestamp is recorded for each piece of network traffic data. By limiting the preset monitoring time period, the system can perform unified analysis of network traffic within a specified time range, avoiding interference from irrelevant historical data with current analysis results. After traffic collection is complete, the system performs time alignment processing on the network traffic data based on the collection timestamps, generating a unified time index covering the monitoring time period. Network traffic data within the same time index are merged and correlated to form a traffic feature sequence arranged in chronological order, thereby ensuring the consistency of traffic data from different sources and at different arrival times in the time dimension.
[0128] After generating the flow characteristic sequence, the system performs numerical normalization on the flow characteristics corresponding to each time index, eliminating the influence of differences in feature dimensions and numerical ranges. Based on the normalized flow characteristic sequence, a continuous-time flow sequence is constructed. This continuous-time flow sequence includes both the time index sequence and its corresponding feature vector sequence, allowing network flow to be expressed continuously in the time dimension, providing a foundation for subsequent continuous-time modeling. On this basis, the system inputs the continuous-time flow sequence into an improved liquid time constant network, modeling the network flow state under the constraint of a time continuity constraint term. This ensures that the network state evolves continuously over time, rather than only changing at fixed discrete time points, thus more realistically reflecting the actual change process of network flow.
[0129] Meanwhile, the system calculates a flow change feature sequence based on a continuous-time flow series. By calculating the difference between the feature vectors corresponding to adjacent time indices, a sequence reflecting the magnitude of flow change is obtained. This sequence is then combined with time interval information to construct a change rate sequence. Simultaneously, the system statistically analyzes the fluctuations in the change magnitude within the sliding time range, forming a fluctuation intensity sequence. These flow change features can characterize the network flow changes over time from multiple perspectives. Subsequently, the system uses a preset time constant mapping function to map the change magnitude, change rate, and fluctuation intensity together into a time constant parameter sequence. This time constant parameter sequence is then used to constrain the state update process of the improved liquid time constant network, enabling the network model to have a faster response capability when flow changes drastically and to maintain a smooth state evolution when flow changes are stable, thereby achieving adaptive adjustment of time response behavior.
[0130] After completing traffic state modeling, the system constructs a baseline trajectory for traffic state evolution based on the updated traffic state sequence. By aggregating traffic states corresponding to adjacent time indices within a preset baseline time range, a baseline trajectory reflecting the normal state evolution trend is formed. Furthermore, the deviation of the traffic state at each time index from this baseline trajectory is calculated, resulting in a state evolution deviation sequence. This deviation sequence can intuitively reflect whether the current network traffic state deviates from the normal evolution pattern, thus providing a basis for anomaly detection.
[0131] During the anomaly detection phase, the system calculates anomaly judgment thresholds based on the state evolution deviation sequence and compares the deviation corresponding to each time index with this threshold to generate anomaly indication sequences. By identifying the time indices of consecutive anomaly identifiers in the anomaly indication sequence, the system can determine the time segment in which the anomaly occurred, and summarize the anomaly occurrence time segment with the corresponding anomaly indicator to output the anomaly detection results of the network traffic probe. Through continuous application in a real network operating environment, it can be observed that this method can maintain stable detection outputs when facing sudden access behavior, abnormal communication patterns, and slowly changing abnormal traffic. The anomaly localization has clear time boundaries, effectively supporting the implementation of network operation and maintenance and security management.
[0132] As can be seen from the above implementation process, the present invention can solve the problem that existing anomaly detection methods are difficult to adapt to the unstable rhythm of traffic changes and the variety of time scales in actual network environments, making the network traffic probe anomaly detection process closer to the real traffic evolution characteristics, and improving the continuity, stability and engineering applicability of anomaly detection.
[0133] Table 1 Performance Comparison of Network Traffic Probe Anomaly Detection Methods
[0134] Method Name Anomaly detection accuracy Recall rate False alarm rate Detection response delay Time-scale adaptability score Traditional statistical thresholding method 89.2% 85.6% 6.8% 420ms 2.1 LSTM-based time series detection method 92.7% 90.3% 5.1% 310ms 3.4 Traffic anomaly detection method based on TCN 93.5% 91.6% 4.7% 280ms 3.9 Method of the present invention 94.8% 92.4% 2.3% 160ms 4.8
[0135] As shown in Table 1, in the performance verification, the method of the present invention is compared and analyzed with traditional statistical thresholding methods, methods based on long short-term memory networks, and methods based on temporal convolutional networks. The comparison indicators include anomaly detection accuracy, recall, false alarm rate, detection response latency, and temporal scale adaptability score.
[0136] In terms of anomaly detection accuracy, the traditional statistical threshold method is 89.2%, the method based on long short-term memory network is 92.7%, the method based on temporal convolutional network is 93.5%, while the method of this invention reaches 94.8%, which is a significant improvement over existing methods. This indicates that continuous time modeling and adaptive modulation of time constant can more stably distinguish between abnormal and normal traffic states.
[0137] In terms of recall, the traditional method is 85.6%, the method based on long short-term memory network is 90.3%, the method based on temporal convolutional network is 91.6%, and the method of this invention is improved to 92.4%, which shows that the present invention can cover more abnormal states in complex traffic change scenarios and effectively reduce the number of anomaly missed detections.
[0138] Regarding the false alarm rate, the traditional statistical threshold method has a false alarm rate of 6.8%, the method based on long short-term memory networks has a false alarm rate of 5.1%, the method based on temporal convolutional networks has a false alarm rate of 4.7%, while the method of this invention reduces it to 2.3%, indicating that judging by the state evolution baseline trajectory and the state evolution deviation can effectively reduce the misjudgment of normal traffic fluctuations.
[0139] Regarding the detection response latency, traditional methods take 420 milliseconds, methods based on long short-term memory networks take 310 milliseconds, and methods based on temporal convolutional networks take 280 milliseconds, while the method of this invention shortens it to 160 milliseconds, demonstrating the response advantage of continuous-time modeling in rapidly changing traffic scenarios.
[0140] In terms of time-scale adaptability scoring, the traditional method scored 2.1, the method based on long short-term memory network scored 3.4, the method based on temporal convolutional network scored 3.9, and the method of this invention scored 4.8, indicating that the present invention can simultaneously adapt to traffic anomalies at different time scales under a unified detection framework.
[0141] The above data demonstrate that the method of the present invention is superior to existing methods in terms of accuracy, stability, and response speed, verifying its effectiveness and practicality in network traffic probe anomaly detection.
[0142] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. A deep learning-based network traffic probe anomaly detection method, characterized in that, Includes the following steps: Acquire network traffic data collected by the network traffic probe within a preset monitoring time period, and record the corresponding collection timestamp for the network traffic data; Based on the collection timestamp, time alignment processing is performed on the network traffic data to generate a unified time index, and the network traffic data is correlated to obtain a traffic feature sequence. Numerical normalization is performed on the flow characteristic sequence, and a continuous-time flow sequence is constructed based on the normalized flow characteristic sequence; The continuous-time flow rate sequence is input into the improved liquid time constant network, and a flow state sequence is generated based on the continuous-time flow rate sequence under the constraint of the time continuity constraint term. Calculate the characteristic sequence of flow change based on continuous time flow series; Based on a preset time constant mapping function, the flow change feature sequence is mapped to generate a time constant parameter sequence, and the time constant parameter sequence is introduced as an endogenous modulation parameter in the improved liquid time constant network into the network state update process to constrain the state update process in the improved liquid time constant network, thereby obtaining the updated flow state sequence. Based on the updated flow state sequence and combined with the time constant parameter sequence, a state evolution baseline trajectory of the flow state is constructed, and the state evolution deviation sequence of the flow state sequence relative to the state evolution baseline trajectory is calculated. An anomaly indication sequence is generated based on the state evolution deviation sequence, and the anomaly detection results of the network traffic probe are output based on the anomaly indication sequence.
2. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The generation of the flow feature sequence includes: Read the collection timestamps corresponding to the network traffic data, and determine the start and end collection timestamps within the preset monitoring time period based on the collection timestamps; Based on the start and end timestamps of data collection, a unified time index covering the preset monitoring time period is generated according to the preset time granularity. For each piece of network traffic data, the network traffic data is mapped to the corresponding time index in a unified time index based on its collection timestamp; The network traffic data mapped to the unified time index is merged to form a time-aligned data set that corresponds one-to-one with the unified time index. Using a unified time index as the basis for association, association processing is performed on message direction data, message length data, arrival time interval data, session identifier data, and protocol field statistics in the time-aligned data set to generate a traffic feature sequence that corresponds one-to-one with the unified time index.
3. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The construction of the continuous-time flow sequence includes: Read the traffic feature sequence and obtain the feature component set corresponding to each unified time index in chronological order; Using the entire unified time index covered by the traffic feature sequence as the statistical range, statistical parameters are calculated for each feature component in the feature component set. Based on statistical parameters, numerical normalization is performed on each feature component corresponding to each unified time index in the flow feature sequence to obtain the numerically normalized flow feature sequence. According to the time order of the unified time index, each unified time index is extracted from the traffic feature sequence after numerical normalization and arranged in sequence to form a time index sequence. The feature components after numerical normalization corresponding to each unified time index are spliced in a preset order to form a feature vector sequence that corresponds one-to-one with the time index sequence. The time index sequence and the feature vector sequence are combined in a one-to-one correspondence to form a continuous time flow sequence.
4. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The generation of the flow state sequence includes: Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to each time index in turn according to the time order of the time index sequence. Initialize the initial network state of the improved liquid time constant network and establish a correspondence between the initial network state and the starting time index in the time index sequence; For adjacent time indices in a time index sequence, calculate the time interval between adjacent time indices and generate time continuity constraint terms based on the time interval; The feature vector corresponding to the current time index is input into the improved liquid time constant network, and combined with the network state corresponding to the previous time index, to form the state update input corresponding to the current time index; Under the constraint of time continuity, state update processing is performed on the state update input to obtain the network state that corresponds one-to-one with the current time index; The network states corresponding to each time index are arranged in chronological order according to the time index sequence, forming a traffic state sequence that corresponds one-to-one with the time index sequence.
5. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The formation of the flow rate change characteristic sequence includes: Read the continuous time flow sequence, extract the time index sequence and feature vector sequence from the continuous time flow sequence, and determine the feature vector corresponding to adjacent time indices one by one according to the time order of the time index sequence. For adjacent time indices in the time index sequence, calculate the difference between the corresponding feature vectors, and construct a change magnitude sequence based on the difference; For adjacent time indices in a time index sequence, calculate the time interval between adjacent time indices, and construct a change rate sequence based on the change magnitude sequence and the time interval; Using the amplitude change sequence as input, within a preset sliding window aligned with the time index sequence, fluctuation statistics are performed on the continuous values of the amplitude change sequence to construct a fluctuation intensity sequence. According to the time order of the time index sequence, the change amplitude sequence, change rate sequence, and fluctuation intensity sequence are arranged and a one-to-one correspondence is established with the time index sequence to form the flow change characteristic sequence.
6. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The generation of the updated traffic state sequence includes: Read the flow change characteristic sequence and time index sequence, and determine the change amplitude sequence value, change rate sequence value and fluctuation intensity sequence value corresponding to each time index according to the time order of the time index sequence; For each time index, the corresponding change amplitude sequence value, change rate sequence value, and fluctuation intensity sequence value are taken as input, and the mapping process is performed through a preset time constant mapping function to generate time constant parameter values that correspond one-to-one with the time index. Arrange the values of the time constant parameters corresponding to each time index according to the time order of the time index sequence to form a time constant parameter sequence that corresponds one-to-one with the time index sequence; The time constant parameter sequence is introduced as an endogenous modulation parameter in the improved liquid time constant network and incorporated into the network state update process; The network state of the improved liquid time constant network is updated under the modulation of the time constant parameter sequence, resulting in an updated flow state sequence.
7. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The formation of the state evolution deviation sequence includes: Read the updated traffic status sequence and time index sequence, and determine the traffic status corresponding to each time index in turn according to the time order of the time index sequence; Read the time constant parameter sequence that corresponds one-to-one with the time index sequence, and use the time constant parameter sequence as state evolution condition information; Using the updated flow state sequence as input, and combined with the time constant parameter sequence within a preset reference window aligned with the time index sequence, for each time index, select multiple flow states that simultaneously satisfy the time index proximity relationship and time constant parameter constraints to form the flow state set corresponding to that time index. A baseline aggregation process is performed on the set of conditional flow states to obtain baseline flow states that correspond one-to-one with time indices. The baseline flow states are then arranged in chronological order according to the time index sequence to construct the baseline trajectory of conditional state evolution. For each time index in the time index sequence, obtain the flow state corresponding to that time index and the baseline flow state corresponding to that time index, and subtract the two components one by one to obtain the state difference vector. Calculate the value of the state evolution deviation sequence based on the state difference vector. According to the time order of the time index sequence, the values of the state evolution deviation sequence corresponding to each time index are arranged and a one-to-one correspondence is established with the time index sequence to form the state evolution deviation sequence.
8. The network traffic probe anomaly detection method based on deep learning according to claim 1, characterized in that, The generation of the anomaly detection results includes: Read the state evolution deviation sequence and the time index sequence, and determine the state evolution deviation sequence value corresponding to each time index according to the time order of the time index sequence; The anomaly determination threshold is calculated based on the state evolution deviation sequence. The mean and standard deviation of the state evolution deviation sequence are weighted and summed to obtain the anomaly determination threshold. For each time index in the time index sequence, the value of the state evolution deviation sequence corresponding to the time index is compared with the anomaly judgment threshold, and the anomaly indicator corresponding to each time index is arranged according to the time order of the time index sequence to form an anomaly indicator sequence. In the anomaly indication sequence, identify the continuous time index segment with the anomaly indication identifier as the first identifier, and determine the anomaly occurrence time segment based on the start time index and end time index corresponding to the continuous time index segment; The network traffic probe summarizes the time segments in which anomalies occur and the corresponding anomaly indicators, and outputs the anomaly detection results.