Flow detection method

Abstract

The invention relates to the technical field of network flow monitoring, and discloses a flow detection method, comprising the following steps: collecting flow static data and flow dynamic data, the flow static data comprising basic flow parameters of a network device in an idle state, and the flow dynamic data comprising basic flow parameters of the network device in an idle state; the flow dynamic data comprises a real-time flow parameter of the network equipment in a data transmission state; performing multi-dimensional feature extraction processing on the flow static data and the flow dynamic data to generate a static feature vector and a dynamic feature vector; when network flow detection is carried out, flow static data and flow dynamic data are collected, multi-dimensional feature extraction standards are set according to different network states, the collaboration of static data collection and dynamic data collection is guaranteed, meanwhile, extracted features are subjected to intelligent fusion processing, the problems of data alignment deviation and time sequence inconsistency can be corrected in real time, and the accuracy of network flow detection is improved. The accuracy of flow pattern recognition is ensured, the abnormal detection error is reduced, and the reliability of the detection result is improved.

Description

Technical Field

[0001] This invention relates to the field of network traffic monitoring technology, specifically a method for traffic detection. Background Technology

[0002] As network applications become more widespread and their scale grows, the services carried by the network become more diverse. In order to ensure network security, in some application scenarios, data traffic transmitted on the network is detected to determine whether there are viruses, attack packets, or other data that could affect network security.

[0003] Currently, in existing network traffic detection methods, due to the lack of a collaborative control mechanism for the quality of multi-source heterogeneous data collection, there are differences in sampling frequency and feature dimension mismatch between the collected static traffic data and dynamic traffic data when performing network traffic anomaly detection. This leads to data alignment deviations during feature fusion. When the existing temporal inconsistencies are not identified and corrected in time, the accuracy of traffic pattern recognition will decrease, and the accuracy of anomaly traffic detection cannot be guaranteed.

[0004] Therefore, a flow detection method is proposed to solve the above problems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a traffic detection method that solves the problem mentioned in the background art of decreased accuracy in traffic pattern recognition and inability to guarantee the accuracy of abnormal traffic detection.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for flow detection, the method comprising the following steps: S1. Collect static traffic data and dynamic traffic data, wherein the static traffic data includes basic traffic parameters of the network device in an idle state, and the dynamic traffic data includes real-time traffic parameters of the network device in a data transmission state. S2. Perform multi-dimensional feature extraction processing on the static traffic data and dynamic traffic data to generate static feature vectors and dynamic feature vectors; S3. Perform feature fusion processing based on the static feature vector and the dynamic feature vector to generate a fused feature matrix; S4. Perform traffic pattern recognition processing based on the fused feature matrix to generate initial traffic pattern recognition results; S5. Perform a credibility assessment on the initial traffic pattern recognition results to generate a pattern credibility score; S6. Perform adaptive detection adjustment processing based on the pattern credibility score and the fusion feature matrix to generate optimized detection parameters; S7. Use the optimized detection parameters to detect and process real-time network traffic to generate the final traffic detection result.

[0007] Preferably, the step S1 of collecting static traffic data and dynamic traffic data includes the following steps: S11. Collect basic traffic parameters of network devices using network probes to generate raw static datasets; S12. Use traffic monitoring equipment to collect real-time traffic parameters of network devices and generate raw dynamic datasets; S13. Perform data preprocessing on the original static dataset and the original dynamic dataset, including data cleaning, outlier removal, and data standardization.

[0008] Preferably, the generation of static and dynamic feature vectors in S2 includes the following steps: S21. Extract time-domain features from the preprocessed static data to generate a static time-domain feature subset; S22. Extract frequency domain features from the preprocessed dynamic data to generate a dynamic frequency domain feature subset; S23. Extract statistical features from static and dynamic data to generate a subset of statistical features; S24. Combine the time-domain feature subset, frequency-domain feature subset, and statistical feature subset to generate a complete feature vector.

[0009] Preferably, generating the fusion feature matrix in S3 includes the following steps: S31. Construct the feature attention weight matrix and calculate the importance score of each feature; S32. The feature vector is weighted based on the importance score; S33. Concatenate the dimensions of the weighted feature vectors to generate a fused feature matrix; S34. Perform dimensionality reduction processing on the fused feature matrix to retain the main feature components.

[0010] Preferably, generating the initial traffic pattern recognition result in S4 includes the following steps: S41. Construct a deep neural network classification model, including an input layer, multiple hidden layers, and an output layer; S42. Input the fused feature matrix into the classification model to perform traffic pattern classification; S43. Calculate the probability distribution of each traffic pattern using the softmax function; S44. Generate initial traffic pattern recognition results based on probability distribution.

[0011] Preferably, the generation of the pattern credibility score in S5 includes the following steps: S51. Calculate the confidence index of the classification results, including the maximum probability and the probability distribution entropy. S52. Evaluate feature quality indicators, including feature discriminative power and feature stability; S53. Conduct a comprehensive evaluation based on the accuracy of historical test results; S54. Generate a credibility score for the generated pattern and establish a credibility level classification.

[0012] Preferably, generating optimized detection parameters in step S6 includes the following steps: S61. Dynamically adjust the detection threshold based on the confidence score, specifically including the following: When the confidence score is higher than the first threshold, the detection threshold is lowered and the detection sensitivity is increased; When the confidence score is below the second threshold, the detection threshold is increased to reduce false alarms; S62. Optimize detection algorithm parameters, including learning rate adjustment and weight decay coefficient optimization; S63. Adaptively update the detection model based on changes in the network environment.

[0013] Preferably, generating the final traffic detection result in step S7 includes the following steps: S71. Construct a real-time flow detection pipeline, including a data acquisition module, a feature extraction module, and a pattern recognition module; S72. Parallel processing of real-time traffic is performed using optimized detection parameters; S73. Generate a detailed detection report, including traffic classification results, abnormal traffic identifiers, and performance indicators; S74 provides visualization and early warning functions for test results.

[0014] Preferably, the method further includes step S8 of establishing a feedback optimization mechanism: S81. Establish a feedback optimization mechanism and update the detection model regularly; S82. Enables multi-granularity flow analysis, supporting detection at different time granularities such as second, minute, and hour. S83 provides an API interface to support integration with existing network management systems.

[0015] Preferably, the method further includes step S9, which optimizes query performance by using a columnar storage format: S91. The final traffic detection results are persistently stored and intelligently archived, specifically including writing the detection results into a distributed database system, using a columnar storage format to optimize query performance, setting a data retention strategy, and automatically cleaning up historical data that exceeds a preset period. S92. Real-time monitoring and performance tracking of the detection process are achieved by deploying a monitoring agent to collect system runtime metrics, including CPU utilization, memory usage and network latency, and triggering an automatic alarm mechanism based on thresholds. S93 provides multi-dimensional data analysis and visualization functions, supports data drill-down by time range, traffic type and device dimension, and generates interactive charts and statistical reports.

[0016] Compared with the prior art, the present invention provides a method for flow detection, which has the following beneficial effects: 1. In this invention, when performing network traffic detection, by collecting static and dynamic traffic data and setting multi-dimensional feature extraction standards for different network states, the synergy of static and dynamic data collection is ensured. At the same time, the extracted features are intelligently fused to correct data alignment deviations and timing inconsistencies in real time, ensuring the accuracy of traffic pattern recognition, reducing anomaly detection errors, and improving the reliability of detection results.

[0017] 2. In this invention, when detecting network traffic anomalies, traffic pattern recognition is performed based on a fusion feature matrix, and the reliability of the initial recognition results is evaluated. The reliability of the detection process is judged in real time, which can reduce false alarms and false negatives. Furthermore, when the reliability of the detection results is low, the detection parameters can be optimized in real time through an adaptive detection adjustment mechanism to ensure the adaptability and stability of the detection in the face of changes in the network environment.

[0018] 3. In this invention, when performing network traffic detection, adaptive optimization is achieved by using pattern credibility scores and fusion feature matrices, and multi-granularity analysis is performed using a feedback mechanism to evaluate traffic patterns at different time granularities in real time. This enables dynamic and refined detection of complex network traffic, reduces performance degradation caused by the single nature of detection algorithms, and improves detection accuracy and overall effectiveness. Attached Figure Description

[0019] Figure 1 This is a flowchart of a flow detection method according to the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] For specific implementation examples, please refer to: Figure 1 A method for flow detection, characterized in that the method includes the following steps: S1. Collect static traffic data and dynamic traffic data. Static traffic data includes basic traffic parameters of network devices in idle state, and dynamic traffic data includes real-time traffic parameters of network devices in data transmission state. S2. Perform multi-dimensional feature extraction processing on static and dynamic traffic data to generate static and dynamic feature vectors. S3. Perform feature fusion processing based on static and dynamic feature vectors to generate a fused feature matrix; S4. Perform traffic pattern recognition processing based on the fused feature matrix to generate initial traffic pattern recognition results; S5. Perform a credibility assessment on the initial traffic pattern recognition results and generate a pattern credibility score. S6. Perform adaptive detection adjustment processing based on the pattern credibility score and fused feature matrix to generate optimized detection parameters; S7. Utilize optimized detection parameters to detect and process real-time network traffic, generating the final traffic detection result.

[0022] The steps involved in collecting static and dynamic traffic data in S1 are as follows: S11. Collect basic traffic parameters of network devices using network probes to generate raw static datasets; S12. Use traffic monitoring equipment to collect real-time traffic parameters of network devices and generate raw dynamic datasets; S13. Perform data preprocessing on the original static dataset and the original dynamic dataset, including data cleaning, outlier removal, and data standardization.

[0023] The generation of static and dynamic feature vectors in S2 includes the following steps: S21. Extract time-domain features from the preprocessed static data to generate a subset of static time-domain features. This includes the following steps: S211. Calculate the statistical characteristics of the time series of the preprocessed static data, including the mean, variance, and peak value. The formula for the mean is: ; in, Represents the arithmetic mean. This represents the i-th observation in the dataset. This represents the total number of data points. Indicates the end of the index; The variance formula is as follows: ; in, This represents the total number of data points. Indicates the end of the index. Represents variance. Represents the first in the dataset One observation value, Represents the arithmetic mean; The formula for the peak index is: ; in, Indicates the range value. This indicates taking the minimum value. This indicates taking the maximum value. Represents the first in the dataset One observation value; S212. Extract the temporal variation trend of traffic and generate a subset of temporal features; The time series trend formula is as follows: ; in, Indicates the flow rate value. Indicates time, Indicates the intercept. Indicates the slope; S213. Normalize the time-domain features to ensure consistent feature scale; The normalization formula is as follows: ; in, Represents the normalized value. Represents the original value. This represents the minimum value. Indicates the maximum value; S22. Extract frequency domain features from the preprocessed dynamic data to generate a dynamic frequency domain feature subset, specifically including the following steps: S221. Perform a Fourier transform on the preprocessed dynamic data to convert it to the frequency domain; The Fourier transform formula is as follows: ; in, Represents frequency domain signals, Represents a time-domain signal. Indicates frequency, Indicates time, Represents the imaginary unit. This indicates integration. Indicates about time Accumulate points. Represents an exponential constant; S222. Calculate the energy distribution and spectral characteristics in the frequency domain, and generate a subset of frequency domain features; The energy distribution formula is as follows: ; in, Represents energy spectral density. Indicates frequency, Represents a frequency domain signal; The power spectral density formula is as follows: ; in, Represents power spectral density. Represents frequency domain signals, Indicates the total duration; S223. Filter the frequency domain features to remove noise components; The filtering formula is as follows: ; in, This indicates the filtered signal. Represents frequency domain signals, This represents the frequency response of the filter; S23. Extract statistical features from static and dynamic data to generate a subset of statistical features, which includes the following steps: S231. Calculate the statistics of the flow data, including the mean, standard deviation, and quantiles; The formula for the average value is: ; in, Represents the arithmetic mean. Represents the first in the dataset One observation value, This represents the total number of data points. Indicates the starting index; The standard deviation formula is: ; in, Represents variance. Indicates standard deviation; The quantile formula is as follows: ; in, Indicates quantiles, Indicates quantile proportion. Indicates the sorted order of the first... One data point; S232. Extract the distribution characteristics of the flow rate, including skewness and kurtosis; The skewness formula is as follows: ; in, Indicates skewness, Represents the standardization factor. This represents the total number of data points. Represents the arithmetic mean. Represents the first in the dataset One observation value, Indicates the end of the index; The kurtosis formula is as follows: in, Indicates kurtosis, Indicates the starting index. Represents the arithmetic mean. Represents the first in the dataset One observation value, This represents the total number of data points. This represents the overall standard deviation of the data; S233. Generate a subset of statistical features and verify the completeness of the features; The feature coverage formula is as follows: ; in, Indicates coverage rate. Represents the number of effective features. Represents the total number of characteristics; S24. Combine the time-domain feature subset, frequency-domain feature subset, and statistical feature subset to generate a complete feature vector.

[0024] Generating the fused feature matrix in S3 includes the following steps: S31. Construct the feature attention weight matrix and calculate the importance score of each feature, specifically including the following steps: S311. Initialize the attention weight parameters based on the initial values ​​of the feature importance; The initial weight formula is as follows: ; in, Indicates the first The initial weights of each feature, Indicates feature dimension; S312. Calculate the score of each feature through the attention mechanism to generate a weight matrix; The formula for attention score is as follows: ; in, Indicates the first The output probability of the category, Indicates the first The original score of the category, Indicates the first Index scores for each category Indicates the total number of categories. Indicates the starting index; S313. Normalize the weight matrix to ensure that the sum of the weights is 1. The weight normalization formula is as follows: ; in, Indicates the normalized weights. Indicates the starting index. Indicates the total number of elements. This represents the original score of the j-th element in the sequence. This represents the original score of the i-th element; S32. Weight the feature vectors based on importance scores, specifically including the following steps: S321. Perform element-wise multiplication on the eigenvectors based on the weight matrix; The weighting formula is as follows: ; in, This represents the weighted eigenvector. Represents the original feature vector. Represents the weight vector matrix; S322. Adjust the weighted feature scale to prevent numerical overflow; The scaling formula is as follows: ; in, This represents the scaled vector. This represents the original vector after weighting; S323. Verify the consistency of weighted processing and optimize the accuracy of feature fusion; The consistency formula is as follows: ; in, Indicators of consistency Represents the original vector; S33. Concatenate the dimensions of the weighted feature vectors to generate a fused feature matrix; S34. Perform dimensionality reduction on the fused feature matrix while retaining the main feature components. This includes the following steps: S341. Use principal component analysis (PCA) to reduce the dimensionality of the fusion feature matrix; The PCA projection formula is as follows: ; in, Indicates the output matrix. Represents the original feature matrix, Represents the weight vector matrix; S342. Retain the main feature components and select feature dimensions based on the variance contribution rate; The formula for the variance contribution rate is as follows: ; in, Indicates the variance contribution rate. Indicates the first 1 eigenvalue, Indicates that dimensions are to be preserved. Indicates the starting index; S343. Standardize the dimension-reduced matrix to improve computational efficiency; The standardized formula is as follows: ; in, Represents the normalized matrix. This represents the mean. Indicates standard deviation, This represents the output matrix.

[0025] The steps involved in generating initial traffic pattern recognition results in S4 are as follows: S41. Construct a deep neural network classification model, including an input layer, multiple hidden layers, and an output layer, specifically including the following steps: S411. Initialize the neural network weights using a random initialization method; The weight initialization formula is as follows: ; in, Represents the weight vector matrix, Indicates a normal distribution. The mean, Standard deviation; S412. Configure the activation functions of the hidden layer, including ReLU and Sigmoid functions; The ReLU activation function formula is as follows: ; in, Indicates the output result. Indicates the maximum value. Representation function The parameter list; The Sigmoid activation function formula is as follows: ; in, Indicates the output result. Represents an exponential constant; S413. Set the number of nodes in the output layer and the number of categories of the corresponding traffic patterns; The formula for the number of nodes is: ; in, Indicates the number of nodes. Indicates the number of categories; S42. Input the fused feature matrix into the classification model to perform traffic pattern classification; S43. Calculate the probability distribution of each traffic pattern using the softmax function, specifically including the following steps: S431. Perform an exponential operation on the output value of the neural network to calculate the unnormalized probability. The formula for exponentiation is as follows: ; in, Indicates the first The original output values ​​for each category, Indicates the first Count of elements; S432. Sum the exponential results to obtain the normalized denominator; The formula for the denominator is: ; in To represent the sum, This indicates the starting index, and d represents the total number of elements. This represents the original score of the j-th element in the sequence; S433. Calculate the final probability value for each category and generate the probability distribution; The softmax probability formula is as follows: ; in, Indicates the first The probability of an event occurring. Indicates the first Count of elements, Indicates the sum; S44. Generate initial traffic pattern recognition results based on probability distribution.

[0026] The credibility scoring of generated patterns in S5 includes the following steps: S51. Calculate the confidence index of the classification result, including the maximum probability and the probability distribution entropy value, specifically including the following steps: S511. Extract the maximum probability value from the classification results as the confidence benchmark; The confidence level formula is as follows: ; in, Indicates the degree of certainty. Indicates the first The probability of an event occurring. This indicates taking the maximum value; S512. Calculate the entropy value of the probability distribution and assess the uncertainty; The entropy formula is: ; in, Represents information entropy. Indicates the total number of categories. Indicates the first The probability of an event occurring. Indicates the starting index; S513. Combine historical data to calibrate the confidence index and improve reliability; The calibration formula is as follows: ; in, Indicates the confidence level after calibration. Indicates weight, Indicates historical accuracy; S52. Evaluate feature quality indicators, including feature discriminative power and feature stability; S53. Conduct a comprehensive evaluation based on the accuracy of historical test results; S54. Generate a credibility score for the generated pattern and establish a credibility level classification.

[0027] The steps involved in generating optimized detection parameters in S6 are as follows: S61. Dynamically adjust the detection threshold based on the confidence score, specifically including the following: When the confidence score is higher than the first threshold, the detection threshold is lowered and the detection sensitivity is increased; When the confidence score is below the second threshold, the detection threshold is increased to reduce false alarms; S62. Optimize the detection algorithm parameters, including learning rate adjustment and weight decay coefficient optimization, specifically including the following steps: S621. Adjust the learning rate parameter and update it dynamically based on gradient descent; The learning rate update formula is as follows: ; in, This represents the updated learning rate. This represents the current learning rate. Indicates the attenuation factor; S622. Optimize the weight decay coefficient to prevent overfitting; The weight decay formula is as follows: ; in, Indicates the updated weight. Indicates the current weight. Represents the gradient. Indicates the attenuation coefficient. Indicates the learning rate; S623. Verify the performance of the model after parameter optimization to improve detection results; The performance evaluation formula is as follows: ; in, Indicates performance metrics, Indicates the number of correct detections. Indicates the total number of tests; S63. Adaptively update the detection model based on changes in the network environment.

[0028] The steps involved in generating the final traffic detection result in S7 are as follows: S71. Construct a real-time flow detection pipeline, including a data acquisition module, a feature extraction module, and a pattern recognition module; S72. Parallel processing of real-time traffic is performed using optimized detection parameters; S73. Generate a detailed detection report, including traffic classification results, abnormal traffic identifiers, and performance indicators; S74 provides visualization and early warning functions for test results.

[0029] The method also includes step S8, which establishes a feedback optimization mechanism: S81. Establish a feedback optimization mechanism and update the detection model regularly; S82. Enables multi-granularity flow analysis, supporting detection at different time granularities such as second, minute, and hour. S83 provides an API interface to support integration with existing network management systems.

[0030] The method also includes step S9, which optimizes query performance by using a columnar storage format: S91. Persistently store and intelligently archive the final traffic detection results. Specifically, write the detection results to a distributed database system, use columnar storage format to optimize query performance, set a data retention strategy, and automatically clean up historical data that exceeds the preset period. S92. Real-time monitoring and performance tracking of the detection process are achieved by deploying a monitoring agent to collect system runtime metrics, including CPU utilization, memory usage and network latency, and triggering an automatic alarm mechanism based on thresholds. S93 provides multi-dimensional data analysis and visualization functions, supports data drill-down by time range, traffic type and device dimension, and generates interactive charts and statistical reports.

[0031] The operation steps of this flow detection method are as follows: Step 1: Data Acquisition This method first collects traffic data, including static traffic data and dynamic traffic data. Static traffic data refers to the basic traffic parameters of network devices in idle state, such as bandwidth utilization and protocol distribution. Dynamic traffic data refers to the real-time traffic parameters of network devices in data transmission state, including transmission rate and latency indicators. The collection process is implemented through network probes and traffic monitoring equipment to generate raw static datasets and raw dynamic datasets. Subsequently, the raw data is preprocessed, including data cleaning, outlier removal, and data standardization, to ensure data quality and consistency. This step provides reliable input for subsequent feature extraction and solves the problem of collaborative control of multi-source data collection.

[0032] Step 2: Multidimensional Feature Extraction Based on the collected data, the method performs multi-dimensional feature extraction processing to generate static and dynamic feature vectors. Specifically, it includes time-domain feature extraction, frequency-domain feature extraction, and statistical feature extraction. Time-domain feature extraction is for static data, calculating the statistical characteristics of the time series and extracting the time-series change trend of the flow. Frequency-domain feature extraction is for dynamic data, transforming it to the frequency domain through Fourier transform, calculating the energy distribution and spectral characteristics, and combining them into a complete feature vector. This step reduces data alignment bias by unifying the feature dimensions.

[0033] Step 3: Feature Fusion Step The method performs feature fusion processing based on static and dynamic feature vectors to generate a fused feature matrix. The fusion process includes constructing a feature attention weight matrix, calculating the importance score of each feature, and weighting the feature vectors based on the score. The weighted vectors are then concatenated by dimension to form the fused feature matrix, and dimensionality reduction is performed to retain the main components. The feature fusion adopts an attention mechanism to ensure that key features are enhanced, thereby improving the accuracy of subsequent pattern recognition. This step optimizes the ability to correct temporal inconsistency problems.

[0034] Step 4: Traffic Pattern Recognition Based on the fused feature matrix, the method performs traffic pattern recognition processing to generate initial traffic pattern recognition results. The recognition process is implemented by constructing a deep neural network classification model, including an input layer, multiple hidden layers, and an output layer. After the fused feature matrix is ​​input into the model, the softmax function is used to calculate the probability distribution of each traffic pattern, and the recognition results are generated based on the distribution. This step can classify normal traffic and abnormal traffic, improving the detection coverage and efficiency.

[0035] Step 5: Credibility Assessment Steps The method performs a credibility assessment on the initial traffic pattern recognition results, generates a pattern credibility score, and the assessment includes calculating the confidence index of the classification results, evaluating the feature quality index, and combining the accuracy of historical detection results for a comprehensive evaluation. Finally, a score is generated and a credibility level classification is established to provide a basis for adaptive adjustment. This step reduces the risk of false positives and false negatives by quantifying reliability.

[0036] Step Six: Adaptive Detection and Adjustment Steps Based on the pattern credibility score and the fused feature matrix, the method performs adaptive detection adjustment processing to generate optimized detection parameters. The adjustment includes dynamically adjusting the detection threshold, increasing or decreasing sensitivity according to the score, and optimizing detection algorithm parameters, including the learning rate and weight decay coefficient. At the same time, the method adaptively updates the detection model according to changes in the network environment and maintains stability. This step enhances the method's adaptability to complex network environments.

[0037] Step 7: Detection, Execution, and Output Steps The method utilizes optimized detection parameters to detect and process real-time network traffic, generating the final traffic detection results. The execution process is achieved by constructing a real-time traffic detection pipeline, including a data acquisition module, a feature extraction module, and a pattern recognition module. The detection results are output in the form of a detailed report, including traffic classification results, abnormal traffic identifiers, and performance indicators, and provide visualization and early warning functions. This step realizes the automation and standardization of the detection process.

[0038] Step 8: Feedback Optimization and Integration The method also includes establishing a feedback optimization mechanism, regularly updating the detection model, and supporting multi-granularity traffic analysis, including second-level, minute-level, and hour-level analysis. At the same time, it integrates with existing network management systems through API interfaces to achieve persistent storage and intelligent archiving of detection results. These additional steps enhance the scalability and reliability of the method.

[0039] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0040] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for flow detection, characterized in that: The method includes the following steps: S1. Collect static traffic data and dynamic traffic data, wherein the static traffic data includes basic traffic parameters of the network device in an idle state, and the dynamic traffic data includes real-time traffic parameters of the network device in a data transmission state. S2. Perform multi-dimensional feature extraction processing on the static traffic data and dynamic traffic data to generate static feature vectors and dynamic feature vectors; S3. Perform feature fusion processing based on the static feature vector and the dynamic feature vector to generate a fused feature matrix; S4. Perform traffic pattern recognition processing based on the fused feature matrix to generate initial traffic pattern recognition results; S5. Perform a credibility assessment on the initial traffic pattern recognition results to generate a pattern credibility score; S6. Perform adaptive detection adjustment processing based on the pattern credibility score and the fusion feature matrix to generate optimized detection parameters; S7. Use the optimized detection parameters to detect and process real-time network traffic to generate the final traffic detection result.

2. The method for flow detection according to claim 1, characterized in that: The collection of static and dynamic traffic data in S1 includes the following steps: S11. Collect basic traffic parameters of network devices using network probes to generate raw static datasets; S12. Use traffic monitoring equipment to collect real-time traffic parameters of network devices and generate raw dynamic datasets; S13. Perform data preprocessing on the original static dataset and the original dynamic dataset, including data cleaning, outlier removal, and data standardization.

3. The method for flow detection according to claim 1, characterized in that: The generation of static and dynamic feature vectors in S2 includes the following steps: S21. Extract time-domain features from the preprocessed static data to generate a static time-domain feature subset; S22. Extract frequency domain features from the preprocessed dynamic data to generate a dynamic frequency domain feature subset; S23. Extract statistical features from static and dynamic data to generate a subset of statistical features; S24. Combine the time-domain feature subset, frequency-domain feature subset, and statistical feature subset to generate a complete feature vector.

4. The method for flow detection according to claim 1, characterized in that: The generation of the fusion feature matrix in S3 includes the following steps: S31. Construct the feature attention weight matrix and calculate the importance score of each feature; S32. The feature vector is weighted based on the importance score; S33. Concatenate the dimensions of the weighted feature vectors to generate a fused feature matrix; S34. Perform dimensionality reduction processing on the fused feature matrix to retain the main feature components.

5. The method for flow detection according to claim 1, characterized in that: The process of generating the initial traffic pattern recognition result in S4 includes the following steps: S41. Construct a deep neural network classification model, including an input layer, multiple hidden layers, and an output layer; S42. Input the fused feature matrix into the classification model to perform traffic pattern classification; S43. Calculate the probability distribution of each traffic pattern using the softmax function; S44. Generate initial traffic pattern recognition results based on probability distribution.

6. The method for flow detection according to claim 1, characterized in that: The credibility scoring of the generated pattern in S5 includes the following steps: S51. Calculate the confidence index of the classification results, including the maximum probability and the probability distribution entropy. S52. Evaluate feature quality indicators, including feature discriminative power and feature stability; S53. Conduct a comprehensive evaluation based on the accuracy of historical test results; S54. Generate a credibility score for the generated pattern and establish a credibility level classification.

7. The method for flow detection according to claim 1, characterized in that: The process of generating optimized detection parameters in step S6 includes the following steps: S61. Dynamically adjust the detection threshold based on the confidence score, specifically including the following: When the confidence score is higher than the first threshold, the detection threshold is lowered and the detection sensitivity is increased; When the confidence score is below the second threshold, the detection threshold is increased to reduce false alarms; S62. Optimize detection algorithm parameters, including learning rate adjustment and weight decay coefficient optimization; S63. Adaptively update the detection model based on changes in the network environment.

8. The method for flow detection according to claim 1, characterized in that: The steps involved in generating the final traffic detection result in S7 are as follows: S71. Construct a real-time flow detection pipeline, including a data acquisition module, a feature extraction module, and a pattern recognition module; S72. Parallel processing of real-time traffic is performed using optimized detection parameters; S73. Generate a detailed detection report, including traffic classification results, abnormal traffic identifiers, and performance indicators; S74 provides visualization and early warning functions for test results.

9. The method for flow detection according to claim 1, characterized in that: The method further includes step S8 of establishing a feedback optimization mechanism: S81. Establish a feedback optimization mechanism and update the detection model regularly; S82. Enables multi-granularity flow analysis, supporting detection at different time granularities such as second, minute, and hour. S83 provides an API interface to support integration with existing network management systems.

10. A method for flow detection according to claim 1, characterized in that: The method further includes step S9, which optimizes query performance using a columnar storage format: S91. The final traffic detection results are persistently stored and intelligently archived, specifically including writing the detection results into a distributed database system, using a columnar storage format to optimize query performance, setting a data retention strategy, and automatically cleaning up historical data that exceeds a preset period. S92. Real-time monitoring and performance tracking of the detection process are achieved by deploying a monitoring agent to collect system runtime metrics, including CPU utilization, memory usage and network latency, and triggering an automatic alarm mechanism based on thresholds. S93 provides multi-dimensional data analysis and visualization functions, supports data drill-down by time range, traffic type and device dimension, and generates interactive charts and statistical reports.

Images