A computer science network traffic prediction method and system based on big data

Abstract

The application discloses a computer science network flow prediction method and system based on big data, relates to the technical field of network flow data processing, and comprises the following steps: preprocessing original network flow data packets and external event data to obtain normalized multivariate time series and external event coding; performing time series convolution feature extraction processing on the normalized multivariate time series and fusing the external event coding to obtain fused features; fusing the fused features with pre-training node embedding vectors to obtain enhanced features; performing linear projection transformation and preliminary detrending processing on the enhanced features to obtain a detrended sequence; performing frequency spectrum analysis and cycle extraction on the detrended sequence; performing cycle decomposition and aggregation on the detrended sequence to obtain an aggregated trend item and an aggregated seasonal item; inputting the aggregated trend item and the aggregated seasonal item into an improved Graph WaveNet backbone network for processing to obtain fused spatio-temporal features and performing uncertainty estimation on the fused spatio-temporal features to generate a first prediction result; and performing reverse normalization processing on the first prediction result to obtain a second prediction result.

Description

Technical Field

[0001] This invention relates to the field of network traffic data processing technology, and in particular to a computer science network traffic prediction method and system based on big data. Background Technology

[0002] In recent years, with the continuous expansion of network scale and the acceleration of digital transformation, network traffic prediction has become a key technology for ensuring network service quality, optimizing resource allocation, and conducting security situation awareness. In particular, network traffic analysis based on big data can extract potential spatiotemporal correlations and patterns from massive, high-dimensional, and dynamic traffic data, providing an important basis for network planning and anomaly detection.

[0003] However, traditional forecasting methods often rely on fixed statistical models or single time-series analysis techniques, making it difficult to effectively capture the complex nonlinear spatiotemporal dependencies, multi-period superposition characteristics, and disturbances caused by sudden external events in network traffic. This results in insufficient prediction accuracy and robustness in dynamic and heterogeneous network environments. Existing technologies also have shortcomings, specifically including: most methods do not fully consider the heterogeneity of network nodes and their inherent behavioral differences, usually using a uniform model and ignoring the individualized characteristics at the node level; in terms of period extraction, they are often based on fixed or pre-set period assumptions, failing to adaptively identify and decompose the real multi-scale dominant periods from the data, making it difficult to cope with complex seasonal and trend combinations in traffic; the lack of explicit modeling and fusion mechanisms for external events, such as network attacks and important events, results in weak explanatory and predictive capabilities for sudden traffic changes; and the prediction results are usually only single point estimates, failing to provide confidence intervals that reflect prediction uncertainty, thus limiting their application in risk-sensitive decision-making. Summary of the Invention

[0004] The technical problem addressed by this invention is that traditional prediction methods often rely on fixed statistical models or single time-series analysis techniques, making it difficult to effectively capture the complex nonlinear spatiotemporal dependencies, multi-period superposition characteristics, and disturbances caused by sudden external events in network traffic. This results in insufficient prediction accuracy and robustness in dynamic and heterogeneous network environments. Existing technologies also have shortcomings, specifically including: most methods do not fully consider the heterogeneity of network nodes and their inherent behavioral differences, typically using a uniform model and ignoring the individualized characteristics at the node level; in terms of period extraction, they are often based on fixed or preset period assumptions, failing to adaptively identify and decompose the truly existing multi-scale dominant periods from the data, making it difficult to cope with complex seasonal and trend-based combinations of changes in traffic; the lack of explicit modeling and fusion mechanisms for external events, such as network attacks and important activities, results in weak explanatory and predictive capabilities for sudden traffic changes; and the prediction results are usually only single point estimates, failing to provide confidence intervals reflecting prediction uncertainty, thus limiting their application in risk-sensitive decision-making.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a computer science network traffic prediction method based on big data, comprising the following steps:

[0006] Step S1: Preprocess the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes;

[0007] Step S2: Perform temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. Fuse the external event encoding with the temporal convolution features to obtain fused features. Fuse the fused features with the pre-trained node embedding vectors representing network nodes to obtain enhanced features. Perform linear projection transformation on the enhanced features to obtain encoded features.

[0008] Step S3: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence. Perform spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Perform period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms.

[0009] Step S4: Input the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing to obtain the fused spatiotemporal features;

[0010] Step S5: Perform uncertainty estimation on the fused spatiotemporal features to generate the first prediction result corresponding to the next P time steps;

[0011] The first prediction result is inversely normalized to obtain the second prediction result.

[0012] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S1 specifically includes:

[0013] Step S101: Obtain raw network traffic data packets and external event data;

[0014] The original network traffic data packets are in pcap format, and the external event data is in CSV format, including timestamp and event type fields.

[0015] Step S102: Divide the network into N nodes according to the preset network topology information;

[0016] For each of the N nodes, based on the network topology information, the network traffic data packets corresponding to each node are filtered out from the original network traffic data packets, and the network traffic data packets are aggregated according to a preset fixed time window to obtain the node aggregated traffic data corresponding to each node.

[0017] Traffic feature indicators are extracted from the node aggregated traffic data corresponding to each node to form a multivariate time series of the node within a preset observation period;

[0018] The traffic characteristic indicators include total bytes, total data packets, number of TCP protocol distributions, number of UDP protocol distributions, number of ICMP protocol distributions, number of unique source IP addresses, and number of unique destination port numbers.

[0019] Combine the multivariate time series corresponding to all nodes to construct a multivariate time series tensor;

[0020] Step S103: Normalize the multivariate time series tensor, calculate the normalized statistical parameters corresponding to each traffic characteristic index of each network node, and obtain the normalized multivariate time series.

[0021] Step S104: Based on the timestamps in the external event data, assign each event in the external event data to a corresponding fixed time window;

[0022] The event types occurring within each time window are statistically analyzed and their features are encoded to generate a D-dimensional external event feature vector.

[0023] Arrange the feature vectors of all external events in time order to obtain a time series of length [length missing]. The external event encoding sequence.

[0024] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S2 specifically includes:

[0025] Step S201: For the normalized multivariate time series, use a step size of 1 for 3... 1. Perform temporal convolution feature extraction processing using convolution kernels to obtain temporal convolution features;

[0026] Step S202: The external event encoding is fused with the temporal convolutional features to obtain the fused features;

[0027] The fusion process includes copying the external event encoding along the node dimension to obtain an aligned external event encoding that is aligned with the temporal convolutional features in both the node dimension and the time dimension, and then performing a first concatenation.

[0028] The first concatenated expression is:

[0029] ;

[0030] in, Indicates fusion features, Representing temporal convolutional features, This indicates alignment with external event encoding. Indicates the number of network nodes. Indicates the length of the time series. The dimension representing the temporal convolutional feature. The dimension of the feature vector of external events. It represents the set of real numbers.

[0031] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S203 involves fusing the fused features with the pre-trained node embedding vectors representing network nodes to obtain enhanced features.

[0032] Wherein, the node embedding vector is an independently learned parameter vector, and the fusion includes copying the node embedding vector along the time dimension to obtain a time-extended node embedding vector aligned with the fusion feature in the time dimension, and then performing a second concatenation.

[0033] The second concatenated expression is:

[0034] ;

[0035] in, F represents the enhanced feature, and F represents the fused feature. This represents the temporally extended node embedding vector. This represents the dimension of the pre-trained node embedding vector;

[0036] Step S204: Perform a linear projection transformation on the enhanced features to obtain the encoded features;

[0037] In this process, the linear projection transformation unifies the dimension of the enhanced features to the target dimension D through a fully connected layer;

[0038] The expression for linear projection transformation is:

[0039] ;

[0040] Where H represents the coding feature, Let W represent the enhanced feature, W represent the weight matrix of the fully connected layer, and b represent the bias vector of the fully connected layer. This represents the dimension of the target feature after projection.

[0041] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S3 specifically includes:

[0042] Step S301: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence;

[0043] The initial detrending process includes filling the starting positions of the encoded feature sequence in the time dimension, and using a preset fixed-length window to perform causal one-way average sliding calculation on the filled encoded features to obtain the moving average.

[0044] Subtracting the moving average from the encoded features yields the detrended sequence;

[0045] Step S302, the spectrum analysis process includes: performing frequency domain transformation on the detrended sequence to obtain the amplitude spectrum; calculating the corresponding amplitude spectrum for each network node and each feature dimension in the coding features to obtain the calculated amplitude spectrum; and averaging all the calculated amplitude spectra to obtain the average amplitude spectrum.

[0046] The average amplitude spectrum is obtained by averaging the amplitude spectrum corresponding to each node and each feature dimension in the encoded feature.

[0047] The process of period extraction includes selecting the M frequencies with the largest amplitudes from the average amplitude spectrum as the dominant frequencies, denoted as MM. The expression for selecting the dominant frequency is:

[0048] ;

[0049] in, Represents the average amplitude spectrum. Indicates M dominant frequencies;

[0050] Based on the time series length and dominant frequency, the lengths of the M dominant periods are calculated and denoted as... The expression for calculating the period length is:

[0051] ;

[0052] = ;

[0053] in, Indicates the length of the M dominant cycles. This represents the length of the m-th cycle out of the M dominant cycle lengths. This represents the m-th dominant frequency among M dominant frequencies.

[0054] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S303, the periodic decomposition process includes, for the m-th period length among the M dominant period lengths... The encoded features are decomposed separately to obtain a trend term and a seasonal term. Based on all trend terms and seasonal terms, M trend terms and M seasonal terms are obtained.

[0055] The expression for the trend term is:

[0056] ;

[0057] in, This represents the length corresponding to the m-th period. The trend term, where H represents the encoded feature, Indicates the length of the m-th period The moving average pooling operation is for the window size, and Padding represents the padding operation;

[0058] The expression for the seasonal term is:

[0059] ;

[0060] in, This represents the length corresponding to the m-th period. Seasonal items;

[0061] Step S304, the aggregation process includes: inputting M trend items into the channel attention mechanism, generating a corresponding attention weight for each trend item through the channel attention mechanism, and performing a weighted summation of the M trend items based on the attention weights to obtain the aggregated trend item;

[0062] M seasonal items are input into a channel attention mechanism, and a corresponding attention weight is generated for each seasonal item through the channel attention mechanism. The M seasonal items are then weighted and summed based on the attention weights to obtain an aggregated seasonal item.

[0063] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S4 specifically includes:

[0064] Step S401: Construct an adaptive adjacency matrix based on the pre-trained node embedding vectors;

[0065] Step S402: Construct an original adjacency matrix based on preset network topology information; combine the original adjacency matrix and the adaptive adjacency matrix; perform graph convolution operation on the aggregated seasonal terms to obtain graph convolution features.

[0066] Step S403: Perform dilated causal temporal convolution on the graph convolutional features to obtain temporal features;

[0067] Step S404: The temporal features are fused with the aggregated trend term, and the spatiotemporal features are obtained through residual connection.

[0068] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S5 specifically includes:

[0069] Step S501, the first prediction result includes the first point prediction result and the first confidence interval;

[0070] The uncertainty estimation process includes generating corresponding prediction results based on spatiotemporal characteristics using a first preset quantile, a second preset quantile, and a third preset quantile;

[0071] The first preset quantile, the second preset quantile, and the third preset quantile are arranged in ascending order of numerical value.

[0072] Step S502: Use the second preset quantile in the prediction result as the first point prediction result;

[0073] The first preset quantile and the third preset quantile are used as the lower limit and upper limit of the first confidence interval, respectively. The first confidence interval is then constructed based on the lower limit and the upper limit of the first confidence interval.

[0074] As a preferred embodiment of the computer science network traffic prediction method based on big data described in this invention, step S503, the process of inverse normalization includes performing inverse normalization on the first prediction result to obtain the second prediction result.

[0075] The inverse normalization process includes performing linear inverse transformations on the first point prediction result, the lower limit of the first confidence interval, and the upper limit of the first confidence interval according to the normalization statistical parameters, to obtain the second point prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval.

[0076] The second prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval are reorganized according to the dimensions of network nodes, P prediction time steps, and traffic characteristic indicators to form the network traffic point prediction result and the corresponding confidence interval result.

[0077] The network traffic point prediction results and the corresponding confidence intervals constitute the second prediction result.

[0078] A computer science network traffic prediction system based on big data includes a preprocessing module, an encoding module, a decomposition module, a fusion module, and a prediction module.

[0079] The preprocessing module preprocesses the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes;

[0080] The encoding module performs temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. It then fuses the external event encoding with the temporal convolution features to obtain fused features. Finally, it fuses the fused features with the pre-trained node embedding vectors that represent network nodes to obtain enhanced features. Finally, it performs linear projection transformation on the enhanced features to obtain encoded features.

[0081] The decomposition module performs preliminary detrending processing on the encoded features to obtain a detrended sequence. It then performs spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Finally, it performs period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms.

[0082] The fusion module inputs the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing, and obtains the fused spatiotemporal features;

[0083] The prediction module performs uncertainty estimation on the fused spatiotemporal features and generates the first prediction result corresponding to the next P time steps.

[0084] The first prediction result is inversely normalized to obtain the second prediction result.

[0085] The beneficial effects of this invention are as follows: Addressing the issue of existing algorithms neglecting node heterogeneity, pre-trained node embedding vectors are introduced during the encoding stage, enhancing adaptability to network topology. Overcoming the limitations of traditional periodic extraction relying on fixed assumptions, data-driven spectral analysis is employed during the decomposition stage to adaptively identify and decompose multi-scale dominant periods, accurately capturing complex trends and seasonality in traffic. Furthermore, by fusing external event encoding, the impact of sudden factors is effectively integrated, improving the robustness of abnormal traffic prediction. In the prediction stage, based on the improved Graph WaveNet backbone network, spatiotemporal features are fused, and confidence intervals are generated by combining uncertainty estimation, which not only improves the accuracy of point prediction but also provides reliable risk assessment, ultimately achieving more comprehensive and reliable multi-step prediction of network traffic. Attached Figure Description

[0086] Figure 1 This is a flowchart illustrating the steps of a computer science network traffic prediction method based on big data, provided as an embodiment of the present invention.

[0087] Figure 2 This is a basic flowchart of a computer science network traffic prediction system based on big data, provided as an embodiment of the present invention. Detailed Implementation

[0088] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0089] Example 1, referring to Figure 1 As an embodiment of the present invention, a computer science network traffic prediction method based on big data is provided, comprising the following steps:

[0090] Step S1: Preprocess the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes;

[0091] Step S2: Perform temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. Fuse the external event encoding with the temporal convolution features to obtain fused features. Fuse the fused features with the pre-trained node embedding vectors representing network nodes to obtain enhanced features. Perform linear projection transformation on the enhanced features to obtain encoded features.

[0092] Step S3: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence. Perform spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Perform period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms.

[0093] Step S4: Input the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing to obtain the fused spatiotemporal features;

[0094] Step S5: Perform uncertainty estimation on the fused spatiotemporal features to generate the first prediction result corresponding to the next P time steps;

[0095] The first prediction result is inversely normalized to obtain the second prediction result.

[0096] In one embodiment, an end-to-end intelligent prediction framework is constructed that integrates multi-source information, adaptively parses complex time-series patterns, and quantifies prediction uncertainty. This method preprocesses raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes. The raw network traffic data packets represent the operational status and load of the network infrastructure itself, while the external event data represents external environmental factors and business activities that may cause traffic fluctuations. Basic features are extracted through temporal convolution and then fused and projected at multiple levels with the external event codes and pre-trained node embedding vectors characterizing the inherent attributes of nodes to form unified coding features. The core innovation of this method lies in the data-driven frequency... Spectral analysis and periodic extraction adaptively decompose aggregated trend and seasonal terms, accurately capturing the inherent multi-scale patterns of traffic. These decomposed terms are then input into an improved GraphWaveNet backbone network, deeply fusing spatiotemporal dependencies to generate spatiotemporal features including contextual information. Uncertainty estimation of these features generates point predictions and confidence intervals for multiple future time steps, which are then inversely normalized to obtain a final second prediction result directly applicable to network management. This structured process automates the transformation from raw network traffic data packets and external event data to reliable quantitative prediction results, significantly improving the accuracy, robustness, and decision support value of long-term predictions in complex and dynamic network environments.

[0097] Step S1 specifically includes:

[0098] Step S101: Obtain raw network traffic data packets and external event data;

[0099] The original network traffic data packets are in pcap format, and the external event data is in CSV format, including timestamp and event type fields.

[0100] Step S102: Divide the network into N nodes according to the preset network topology information;

[0101] For each of the N nodes, based on the network topology information, the network traffic data packets corresponding to each node are filtered out from the original network traffic data packets, and the network traffic data packets are aggregated according to a preset fixed time window to obtain the node aggregated traffic data corresponding to each node.

[0102] Traffic feature indicators are extracted from the aggregated traffic data of each node to form a multivariate time series of the node within a preset observation period.

[0103] The traffic characteristic indicators include total bytes, total data packets, number of TCP protocol distributions, number of UDP protocol distributions, number of ICMP protocol distributions, number of unique source IP addresses, and number of unique destination port numbers.

[0104] Combine the multivariate time series corresponding to all nodes to construct a multivariate time series tensor;

[0105] Step S103: Normalize the multivariate time series tensor, calculate the normalized statistical parameters corresponding to each traffic characteristic index of each network node, and obtain the normalized multivariate time series.

[0106] Step S104: Based on the timestamps in the external event data, assign each event in the external event data to a corresponding fixed time window;

[0107] The event types occurring within each time window are statistically analyzed and their features are encoded to generate a D-dimensional external event feature vector.

[0108] Arrange the feature vectors of all external events in time order to obtain a time series of length [length missing]. The external event encoding sequence.

[0109] In one embodiment, step S1 lays the foundation for high-quality model input. Its core objective is to transform raw network traffic data packets and external event data into a model-processable sequence with a unified structure, standardized scale, and complementary information. Specifically, this includes step S101, acquiring raw network traffic data packets (pcap format) and external event data (CSV format). The pcap format is the de facto standard for link-layer network packet capture, fully preserving packet header information for subsequent feature extraction; the CSV format is structured and easily aligned with time series. Step S102, dividing the network into N logical or physical nodes, such as routers, gateways, or subnets, based on preset network topology information. The number of nodes N is determined according to the physical or logical scale of the network to be managed, typically ranging from tens to hundreds. This division provides the model with a cognitive foundation regarding the network spatial structure. For each node, based on the topology rules of its IP address range... Traffic packets belonging to a given node are filtered from the global pcap data and aggregated within a pre-defined fixed time window, such as 5 minutes. This time window is set based on a balance between the business's need for predictive granularity and computational overhead. Within each time window, traffic characteristic indicators are extracted from the aggregated data, such as total bytes, total packets, TCP / UDP / ICMP protocol distribution, number of unique source IP addresses, and number of unique destination port numbers. These traffic characteristic indicators collectively constitute a feature profile describing node behavior from multiple dimensions: total bytes reflect load, total packets reflect activity, TCP / UDP / ICMP protocol distribution reflects application type, number of unique source IP addresses relates to the number of users or scanning behavior, and number of unique destination port numbers reflects service diversity. The feature sequences of all nodes within the observation period are combined into a multivariate time series tensor, with the shape [number of nodes N, number of time steps]. [Feature dimension n]; Step S103, normalize the multivariate time series tensor, for example, perform Z-score standardization on each node-feature dimension combination separately, and calculate the corresponding mean and standard deviation as parameters for subsequent inverse normalization; this step aims to eliminate the differences in different feature dimensions and numerical ranges; Step S104, at the same time, process the external event data, specifically, according to the timestamp of the event, assign it to the same fixed time window as the traffic data, and then statistically analyze and encode the event types that occur in each time window, for example, using embedding encoding to generate a D-dimensional vector, where D is set according to the total number of event types and the desired encoding richness; the vectors of all time windows are arranged in order, that is, the time series tensor is obtained with respect to the traffic tensor. The model employs strictly aligned external event encoding across multiple dimensions. There are deep, interconnected steps: node partitioning and feature engineering provide a spatially structured representation of the model's internal state; external event encoding injects external causal information that may trigger traffic mutations; and normalization is a crucial step in ensuring numerical scale compatibility between multivariate time series and external event encoding, guaranteeing fair weighting in subsequent processing. Overall, through this series of standardization, structuring, and alignment operations, the original network traffic data packets and external event data are transformed into a paired input of multivariate time series including spatiotemporal nodes and time-aligned external event encoding. This lays a solid and well-organized data foundation for accurate spatiotemporal dependency modeling and causal impact analysis in subsequent models.

[0110] Step S2 specifically includes:

[0111] Step S201: For the normalized multivariate time series, use a step size of 1 for 3... 1. Perform temporal convolution feature extraction processing using convolution kernels to obtain temporal convolution features;

[0112] Step S202: The external event encoding is fused with the temporal convolutional features to obtain the fused features;

[0113] The fusion process includes copying the external event encoding along the node dimension to obtain an aligned external event encoding that is aligned with the temporal convolutional features in both the node dimension and the time dimension, and then performing a first concatenation.

[0114] The first concatenated expression is:

[0115] ;

[0116] in, Indicates fusion features, Representing temporal convolutional features, This indicates alignment with external event encoding. Indicates the number of network nodes. Indicates the length of the time series. The dimension representing the temporal convolutional feature. The dimension of the feature vector of external events. It represents the set of real numbers.

[0117] Step S203: The fused features are fused with the pre-trained node embedding vectors representing the network nodes to obtain the enhanced features;

[0118] Here, the node embedding vector is an independently learned parameter vector. The fusion includes copying the node embedding vector along the time dimension to obtain a time-extended node embedding vector that is aligned with the fused feature in the time dimension, and then performing a second concatenation.

[0119] The second concatenated expression is:

[0120] ;

[0121] in, F represents the enhanced feature, and F represents the fused feature. This represents the temporally extended node embedding vector. This represents the dimension of the pre-trained node embedding vector;

[0122] Step S204: Perform a linear projection transformation on the enhanced features to obtain the encoded features;

[0123] In this process, the linear projection transformation unifies the dimension of the enhanced features to the target dimension D through a fully connected layer;

[0124] The expression for linear projection transformation is:

[0125] ;

[0126] Where H represents the coding feature, Let W represent the enhanced feature, W represent the weight matrix of the fully connected layer, and b represent the bias vector of the fully connected layer. This represents the dimension of the target feature after projection.

[0127] In one embodiment, step S2 specifically includes step S201, for the shape [N, The normalized multivariate time series of [N, n] is used, where n is the dimension of the traffic feature indicator. Temporal convolutional feature extraction is performed using a 3×1 convolutional kernel with a stride of 1. This step is equivalent to a one-dimensional causal convolution that uses a local receptive field of size 3 to slide along the time dimension to capture the local dependencies and short-term change patterns of traffic features of each node in adjacent time steps, such as the previous, current, and next time steps. For example, it can identify sudden jumps in the number of data packets or instantaneous fluctuations in the traffic of a certain protocol. After this operation, the dimension of the input traffic feature indicator is transformed into a C-dimensional temporal convolutional feature f, with the shape [N, n]. [,C], where C is the number of channels in the convolution output, and its value, such as 32 or 64, is set according to the requirements of model complexity and feature richness; step S202, the [ The external event encoding sequence of [D] is denoted as e; to fuse it with the temporal features of each node, this sequence e is copied and extended along the node dimension (N), resulting in a sequence of shape [N, For simplicity, the aligned tensor of [N, D] will still be denoted as e in the following text and formulas; subsequently, through the first concatenation operation, f and the aligned e are directly concatenated on the feature dimension (the last dimension) to form the fused feature F, whose shape is [N, D]. [,(C+D)], the core design is used to explicitly correlate external factors that may cause traffic anomalies, such as network attack alerts and business promotion activities, with the temporal evolution of the traffic itself, providing clues for causal inference for the model; step S203, a second and deeper information fusion is performed, injecting each network node with its unique identity and behavioral preference information, and introducing a pre-trained node embedding vector, which is an independently assigned vector for each node (N in total) in the network with a dimension of The pre-trained node embedding vectors are typically initialized randomly during model training, such as following a Gaussian distribution. During training, these vectors, along with other model parameters, are optimized using a backpropagation algorithm (such as Adam). By minimizing the prediction loss function, such as quantile regression, each node's embedding vector is forced to automatically learn and encode the node's inherent attributes and distributed representation of its role in the network topology (such as a core router or edge access point) and historical behavioral patterns (such as service type preference and general traffic baseline). In the application prediction phase, the pre-learned and fixed node embedding vector parameter table is used. Specifically, during fusion, each node's embedding vector parameter is... 3D embedding vector along the time dimension Copying yields a shape of [N, , Temporal Extended Node Embedding Vector Subsequently, through a second splicing operation, the... The fused feature F from the previous step is connected along the feature dimension to form the enhanced feature. Its shape is [N, ,(C+D+ This step addresses the problem of traditional models ignoring node heterogeneity by assigning a learnable identity code to each node, enabling the model to distinguish and adaptively handle different nodes, such as the traffic patterns of web servers and database servers, even if their external events and short-term time-series characteristics are similar; Step S204, due to multiple splicing steps, The feature dimension is high and may contain redundancy, so it is mapped to a uniform and compact target dimension through a linear projection transformation (a fully connected layer). For example, 128; the expression for this transformation is: Where W and b are the learnable weight matrix and bias vector, respectively, and the output encoded feature H has a shape of [N, , This step is used for dimensionality reduction and feature integration. The core design is to provide a highly condensed tensor representation that integrates three core types of information: time series, event, and node identity, and is scale-uniform for the subsequent temporal decomposition module. There are deep connections between the steps, which are progressive and complementary. Specifically, step S201 extracts common, local temporal patterns; step S202 introduces global, time-aligned external events to provide context for explaining pattern mutations; step S203 injects personalized, spatially distributed node identity information, which provides key priors for the model to understand that the same event may have different effects on different nodes; and step S204 projection is a necessary step to integrate and compress all information into the same vector space. Through this hierarchical and explicit fusion mechanism, the model not only sees what the traffic is (temporal features) and why it happens (external events), but also understands who it happens to (node ​​attributes), thus laying a solid and comprehensive feature foundation for subsequent accurate and personalized spatiotemporal prediction.

[0128] Step S3 specifically includes:

[0129] Step S301: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence;

[0130] The initial detrending process includes filling the starting positions of the encoded feature sequence in the time dimension, and using a preset fixed-length window to perform causal one-way average sliding calculation on the filled encoded features to obtain the moving average.

[0131] Subtracting the moving average from the encoded features yields the detrended sequence;

[0132] Step S302, the spectrum analysis process includes: performing frequency domain transformation on the detrended sequence to obtain the amplitude spectrum; calculating the corresponding amplitude spectrum for each network node and each feature dimension in the coding features to obtain the calculated amplitude spectrum; and averaging all the calculated amplitude spectra to obtain the average amplitude spectrum.

[0133] The average amplitude spectrum is obtained by averaging the amplitude spectrum corresponding to each node and each feature dimension in the encoded features;

[0134] The process of period extraction includes selecting the M frequencies with the largest amplitudes from the average amplitude spectrum as the dominant frequencies, denoted as MM. The expression for selecting the dominant frequency is:

[0135] ;

[0136] in, Represents the average amplitude spectrum. Indicates M dominant frequencies;

[0137] Based on the time series length and dominant frequency, the lengths of the M dominant periods are calculated and denoted as... The expression for calculating the period length is:

[0138] ;

[0139] = ;

[0140] in, Indicates the length of the M dominant cycles. This represents the length of the m-th cycle out of the M dominant cycle lengths. This represents the m-th dominant frequency among M dominant frequencies.

[0141] The characteristic feature is that step S303, the periodic decomposition process includes, for the m-th period length among the M dominant period lengths The encoded features are decomposed separately to obtain a trend term and a seasonal term. Based on all trend terms and seasonal terms, M trend terms and M seasonal terms are obtained.

[0142] The expression for the trend term is:

[0143] ;

[0144] in, This represents the length corresponding to the m-th period. The trend term, where H represents the encoded feature, Indicates the length of the m-th period The moving average pooling operation is for the window size, and Padding represents the padding operation;

[0145] The expression for the seasonal term is:

[0146] ;

[0147] in, This represents the length corresponding to the m-th period. Seasonal items;

[0148] Step S304, the aggregation process includes: inputting M trend items into the channel attention mechanism, generating corresponding attention weights for each trend item through the channel attention mechanism, and performing a weighted summation of the M trend items based on the attention weights to obtain the aggregated trend item;

[0149] M seasonal items are input into the channel attention mechanism, and a corresponding attention weight is generated for each seasonal item through the channel attention mechanism. The M seasonal items are then weighted and summed based on the attention weights to obtain the aggregated seasonal item.

[0150] In one embodiment, the core design of step S3 lies in adaptively and data-drivenly decomposing the potential multi-scale periodic and trend components in network traffic from the encoded features, thereby structuring the complex time series and providing a more easily modelable and separable regularity representation for subsequent models. Specifically, this includes step S301, for the shape [N, , The encoded feature H is initially detrended; padding is performed at the beginning of the time dimension, usually by filling with (preset fixed length window minus 1) zero values ​​to ensure that the output length remains unchanged. The preset fixed length window is set to 24, based on the preliminary assumption or experience of the daily cycle, indicating the focus on the hourly granular pattern within a day. Then, a causal one-way average sliding calculation is performed using a preset fixed length window. The sliding average of each time step is calculated only by itself and the previous preset fixed length window minus 1 time step to strictly maintain the causality of the time series and prevent future information leakage. This sliding average is subtracted from H to obtain the detrended sequence. This step is used to remove short-term, high-frequency fluctuations or noise, initially highlighting the potential periodic components in the sequence, providing a cleaner input for subsequent spectral analysis. Step S302, spectral analysis and period extraction are performed on the detrended sequence. The spectral analysis process includes processing each node (N) and each feature dimension ( The detrended sequences of dimension (N*) are subjected to frequency domain transformations, such as Fast Fourier Transform (FFT), to obtain the corresponding amplitude spectra; then, for all N*... The amplitude spectrum is averaged at frequency points to obtain an average amplitude spectrum A that comprehensively reflects the periodicity strength of the entire network and all feature dimensions. The period extraction process involves selecting the M frequencies with the largest amplitudes from the first half of A (due to spectral symmetry) as the dominant frequencies. The value of M, such as 3 or 5, is determined based on the number of significant periodic components extracted, usually based on business priors, such as the assumption that traffic has multiple periods of daily, weekly, or monthly occurrences, or by observing the significance of spectral peaks; it is also determined based on the total length of the time series. Calculate the corresponding dominant cycle length The core principle of this step is to use FFT to convert the time-domain signal to the frequency domain, thereby objectively and quantitatively identifying the strongest oscillation frequency (period) hidden in the data, replacing the traditional method that relies on manually preset fixed periods; Step S303, based on the extracted M dominant period lengths Perform periodic decomposition on the original encoded feature H, for each period length The decomposition is performed separately, specifically including the decomposition of H by... Causal moving average pooling (with padding) is applied to the window size to obtain the trend term corresponding to long-term changes at that scale. Then, subtract from the original H This yields a seasonal term that primarily includes seasonal fluctuations within that periodic scale. This process generates a trend term and a seasonal term for each periodic scale, resulting in a total of M trend terms. and M seasonal items From a core design perspective, this step achieves multi-scale time series decomposition, separating the original complex mixed signal into trend (slowly changing) and seasonal (periodic fluctuation) components at different time scales. Step S304 aggregates the M decomposed components. Since different periodic scales contribute differently to the final prediction, this scheme introduces a channel attention mechanism. The process applied to the trend and seasonal components is the same and independent. Taking the aggregation of the trend component as an example, the specific steps include: for each trend component Tm, in the time dimension... Global average pooling is performed on it to compress it into a single pool. A vector of dimension M, representing the global statistical characteristics of the trend at this scale; [the vector contains M vectors]. The vectors are stacked on the channel dimension, i.e., on M scales, to form an M× The feature map; it is then fed into a lightweight attention network: first through a dimensionality-reduced fully connected layer (such as...). Dimension mapping to / r dimension, where r is the compression ratio, usually set to 8 or 16), a non-linear activation function (such as ReLU), and then through a fully connected layer that restores the dimension (mapped back). Finally, after passing through the Sigmoid activation function, a set of normalized M scalar attention weights is generated for the M scales; these attention weights are then used to adjust the original M trend terms. Weighted summation is performed to obtain the aggregated trend term; the same operation is performed on the M seasonal terms to obtain the aggregated seasonal term. The purpose of this step is to automatically learn through an attention mechanism and assign different importance weights to different periodic scales, achieving adaptive multi-scale information fusion, so that the model can focus on the periodic patterns most critical to the prediction. There are close causal and synergistic relationships between the steps. The preliminary detrending in step S301 is a prerequisite for effective spectral analysis in step S302, removing short-term disturbances to make the periodic components more prominent in the spectrum; the periodicity extracted by data-driven step S302... This serves as the basis for targeted decomposition in step S303, ensuring that the decomposition scale matches the dominant period in the actual data. The multi-scale components produced in step S303 are the raw materials for adaptive aggregation in step S304. The aggregation result of step S304 provides clear and structured input for the subsequent spatiotemporal modeling module. The entire step S3 constitutes a complete process that automatically discovers periods, decomposes components, and intelligently fuses them from the data. This overcomes the limitations of traditional methods that rely on fixed period assumptions, cannot handle multi-period mixtures, and treat all periods equally. As a result, it can more accurately capture and represent the complex and multi-level temporal patterns in network traffic, providing key structured temporal features for the final high-precision prediction.

[0151] Step S4 specifically includes:

[0152] Step S401: Construct an adaptive adjacency matrix based on the pre-trained node embedding vectors;

[0153] Step S402: Construct an original adjacency matrix based on preset network topology information; combine the original adjacency matrix and the adaptive adjacency matrix; perform graph convolution operation on the aggregated seasonal terms to obtain graph convolution features.

[0154] Step S403: Perform dilated causal temporal convolution on the graph convolutional features to obtain temporal features;

[0155] Step S404: The temporal features are fused with the aggregated trend term, and the spatiotemporal features are obtained through residual connection.

[0156] In one embodiment, in step S4, the core design lies in using an improved Graph WaveNet backbone network to deeply fuse the aggregated trend term and aggregated seasonal term from step S3, synchronously and efficiently capturing the complex dependencies of network traffic at nodes, i.e., in the spatial and temporal dimensions, ultimately generating a unified spatiotemporal feature; specifically, step S401, constructing an adaptive adjacency matrix based on pre-trained node embedding vectors. The processing method for this step is to use the trained node embedding vector matrix as input, where the matrix has dimensions [N, ... The initial similarity matrix between nodes is obtained by multiplying the matrix by its transpose. Then, the ReLU activation function is used to threshold the initial similarity matrix, filtering out negative values ​​or weak connections, ultimately generating an N×N adaptive adjacency matrix. This step is a process of learning potential associations between nodes from data. From a design perspective, it breaks through the limitations of traditional graph convolution relying solely on preset static topologies, such as physical connections, enabling it to automatically discover and model dynamic or implicit spatial dependencies between nodes formed due to functional similarity or traffic pattern correlation, which are not reflected in the physical topology. Step S402 combines the original adjacency matrix and the adaptive adjacency matrix to perform graph convolution on the aggregated seasonal terms. Specifically, first, a binary or weighted original adjacency matrix is ​​constructed based on preset network topology information, such as router connection relationships. Then, the original adjacency matrix is ​​added to the adaptive adjacency matrix generated in step S401, and the summed matrix is ​​symmetrically normalized to form a comprehensive graph structure. This comprehensive graph structure quantitatively defines the connection strength between any two nodes in the network. This process clarifies the set of "neighboring nodes" for each node and their influence weights. Subsequently, a first-order approximate graph convolution operation is performed on the aggregated seasonal terms using this comprehensive graph structure to obtain graph convolution features. Essentially, this involves using the comprehensive graph structure to perform feature transformation and aggregation of connected node information on the aggregated seasonal terms at the node dimension. This step is particularly useful for seasonal fluctuations, such as traffic peaks, which often exhibit spatial propagation and correlation. For example, a traffic surge in one service may affect its upstream servers. Therefore, specifically performing graph convolution on the aggregated seasonal terms can effectively model periodic patterns. Diffusion and mutual influence in cyberspace; Step S403, performing dilated causal temporal convolution on graph convolution features; inputting the graph convolution features into a temporal convolution module composed of multiple stacked dilated causal convolution blocks, where the dilation factor of each block grows exponentially. For example, in a 4-layer structure, the dilation factor sequence can be set to [1,2,4,8], where each item in the sequence corresponds to the k-th convolution block, k is the block index, starting from 0, and the total number of layers L is a preset hyperparameter. The basis for setting this sequence is that, through the exponentially growing dilation factor, the receptive field size of the k-th layer is approximately This allows an L-layer structure to cover approximately In this embodiment, the L=4 design allows the network's receptive field to cover approximately 32 historical time steps, thus achieving a balance between effectively capturing long-term temporal dependencies and maintaining model simplicity, thereby efficiently capturing long-range dependencies with fewer network layers. The dilation factor determines the interval skipped by the convolutional kernel when processing sequences, allowing its receptive field to grow exponentially even with shallow layers, thereby capturing long-range temporal dependencies. Simultaneously, causality ensures that the output of each time step depends only on the current and past time steps, strictly meeting the requirements of the prediction task. This step, based on the features already fused with spatial information, further extracts their complex and long-term temporal evolution patterns in the temporal dimension; Step S40 4. The temporal features and aggregated trend terms are fused, and spatiotemporal features are obtained through residual connections. The temporal features output from step S403 are added element-wise to the aggregated trend terms input from step S3. This is a residual connection, which re-injects the initially separated long-term trend information into the features after complex spatiotemporal modeling. The core design is that trend terms usually change slowly, have strong globality, and are an important component of the traffic baseline. They do not require complex spatial diffusion modeling like seasonal fluctuations. Therefore, step S402 does not perform graph convolution on the aggregated trend terms. Through this residual fusion, the long-term trend accurately extracted by the module in step S3 is preserved, and the improved graph is integrated. The WaveNet backbone learns the spatiotemporal evolution features of seasonal fluctuations based on spatial correlation, thus forming a complete spatiotemporal feature. There are precise collaborations and divisions of labor among the steps. The adaptive adjacency matrix provided in step S401 endows the graph convolution in step S402 with the ability to learn implicit spatial relationships, which is not available in traditional methods. Step S402 specifically handles the seasonal component with spatial propagation characteristics, while step S403 performs deep temporal modeling of all spatial information in the time dimension. The residual fusion in step S404 cleverly reintegrates the relatively stable, global trend component with the complex spatiotemporal dynamic component, avoiding information loss. Through this improved architecture of adaptive graph construction → seasonal spatial convolution → long-range temporal convolution → trend residual fusion, efficient and unified modeling of the spatiotemporal heterogeneity (different behaviors of different nodes) and spatiotemporal dependence (mutual influence between nodes and temporal correlation) of network traffic is achieved, significantly improving the model's ability to extract deep predictive features from complex network data.

[0157] Step S5 specifically includes:

[0158] Step S501, the first prediction result includes the first point prediction result and the first confidence interval;

[0159] The uncertainty estimation process includes generating corresponding prediction results based on spatiotemporal characteristics using a first preset quantile, a second preset quantile, and a third preset quantile;

[0160] The first preset quantile, the second preset quantile, and the third preset quantile are arranged in ascending order of numerical value.

[0161] Step S502: Use the second preset quantile in the prediction result as the first point prediction result;

[0162] The first preset quantile and the third preset quantile are used as the lower limit and upper limit of the first confidence interval, respectively. The first confidence interval is then constructed based on the lower limit and the upper limit of the first confidence interval.

[0163] Step S503, the process of inverse normalization includes performing inverse normalization on the first prediction result to obtain the second prediction result;

[0164] The inverse normalization process includes performing linear inverse transformations on the first point prediction result, the lower limit of the first confidence interval, and the upper limit of the first confidence interval according to the normalization statistical parameters, to obtain the second point prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval.

[0165] The second prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval are reorganized according to the dimensions of network nodes, P prediction time steps, and traffic characteristic indicators to form the network traffic point prediction result and the corresponding confidence interval result.

[0166] The network traffic point prediction results and the corresponding confidence intervals constitute the second prediction result.

[0167] In one embodiment, step S5 is designed to generate a final prediction result that includes both specific future traffic values ​​(point prediction) and quantifies its possible fluctuation range (confidence interval). It also restores the normalized features within the model to network traffic values ​​with actual physical meaning, thereby providing a quantitative basis for network management decisions that is both accurate and reliable. Specifically, steps S501 and S502 involve performing uncertainty estimation on the spatiotemporal features output in step S4 to generate the first prediction result for the next P time steps. The prediction step size P is set according to specific business needs. For example, if the business needs to predict traffic for the next day and the aggregation time window is 1 hour, then P can be set to 24. The processing method in this step is to simultaneously predict three specific... The conditional quantiles are used to characterize different positions in the predicted distribution. Typically, a first, second, and third preset quantiles are selected. The first preset quantile is the lower quantile, set to 0.1; the second preset quantile is the median, set to 0.5; and the third preset quantile is the upper quantile, set to 0.9. The setting of these three preset quantiles is based on the fact that they collectively define a 90% confidence interval centered at the 0.1 and 0.9 quantiles. This interval achieves an effective balance between ensuring a high confidence level (covering most possible scenarios) and controlling the interval width (ensuring the practicality of the prediction results). This step uses a quantile regression... Implemented in the Regression layer, it outputs these three quantile values ​​for each future time step. Its core design lies in abandoning the traditional approach of only outputting a single deterministic value. By estimating the key quantiles of the distribution, it actively quantifies the uncertainty of the prediction, providing a direct input for risk assessment. The specific process of uncertainty estimation is as follows: the model generates three sets of prediction sequences corresponding to the next P time steps in parallel based on spatiotemporal characteristics. Then, the prediction sequence with the second preset quantile of 0.5 is used as the first point prediction result because it is the most likely center estimate of the future flow. At the same time, the first preset quantile of 0.1 and the third preset quantile of 0 are also used.The predicted sequences of 9 are used as the lower and upper limits of the first confidence interval, respectively, to jointly construct the first confidence interval. This interval implies that there is a 90% probability that the future actual traffic value will fall within this range. In step S503, the first prediction result is inversely normalized to obtain a second prediction result with practical significance. The first prediction result includes point predictions and upper and lower limits of the confidence interval. The processing method is to perform linear inverse transformation on the first point prediction result, the lower limit of the confidence interval, and the upper limit of the confidence interval according to the normalized statistical parameters corresponding to each node and each traffic feature indicator calculated and saved in step S103, such as the mean μ and the standard deviation σ. For example, for data standardized using Z-score, the inverse transformation is: original value = normalized value × σ + μ. This is to map the model prediction value from the standard normal distribution space back to the original data space. The core design is to make the output result of the model completely consistent with the original traffic indicators, such as the number of bytes and the number of data packets, as understood by the business monitoring system in terms of units and numerical range, so as to achieve seamless transformation from the internal representation of the model to the final business value. After transformation and denormalization, the second prediction result, the lower and upper limits of the second confidence interval need to be reorganized according to the dimensions of network nodes (N), prediction time steps (P), and traffic characteristic indicators. This results in a clearly structured network traffic point prediction result and its corresponding confidence interval, which together constitute the directly applicable final second prediction result. There is a strict sequential dependency and progressive value relationship between each step. Specifically, the uncertainty estimation in steps S501 and S502 is a prerequisite for denormalization in step S503, because the prediction distribution within the model space must be generated first before it can be restored. The denormalization in step S503 is the final step that gives the results of steps S501 and S502 practical application value. By introducing quantile regression to quantify uncertainty, the prediction result provided by this scheme is expanded from a single point to a probability range, greatly enhancing the practicality and decision support capability of the prediction. This allows network managers not only to predict traffic levels but also to assess the reliability of the prediction, thereby making more robust resource allocation or anomaly detection decisions.

[0168] Example 2, refer to Figure 2 In another embodiment of the present invention, which differs from the first embodiment, a computer science network traffic prediction system based on big data is provided, including a preprocessing module, an encoding module, a decomposition module, a fusion module, and a prediction module:

[0169] The preprocessing module preprocesses the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes;

[0170] The encoding module performs temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. It then fuses the external event encoding with the temporal convolution features to obtain fused features. Finally, it fuses the fused features with the pre-trained node embedding vectors that represent network nodes to obtain enhanced features. Finally, it performs linear projection transformation on the enhanced features to obtain encoded features.

[0171] The decomposition module performs preliminary detrending processing on the encoded features to obtain a detrended sequence. It then performs spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Finally, it performs period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms.

[0172] The fusion module inputs the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing, and obtains the fused spatiotemporal features;

[0173] The prediction module performs uncertainty estimation on the fused spatiotemporal features and generates the first prediction result corresponding to the next P time steps.

[0174] The first prediction result is inversely normalized to obtain the second prediction result.

[0175] In one embodiment, an end-to-end intelligent prediction framework is constructed that integrates multi-source information, adaptively analyzes complex time-series patterns, and quantifies prediction uncertainty. This method preprocesses raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes. The raw network traffic data packets represent the operational status and load of the network infrastructure itself, while the external event data represents external environmental factors and business activities that may cause traffic fluctuations. Basic features are extracted through temporal convolution and then fused and projected at multiple levels with the external event codes and pre-trained node embedding vectors characterizing the inherent attributes of nodes to form unified coding features. The core innovation of this method lies in data-driven spectral analysis and periodic extraction of the coding features, adaptively decomposing them into aggregated trend terms and aggregated seasonal terms to accurately capture the inherent multi-scale patterns of traffic. These decomposed terms are then input into an improved graph. The WaveNet backbone network deeply integrates spatiotemporal dependencies to generate spatiotemporal features that include contextual information. By estimating the uncertainty of these features, it generates point prediction results and confidence intervals for multiple future time steps. After inverse normalization, it obtains the final second prediction result that can be directly applied to network management. This structured process realizes the automated transformation from raw network traffic data packets and external event data to reliable quantitative prediction results, significantly improving the accuracy, robustness, and decision support value of long-term predictions in complex and dynamic network environments.

[0176] This invention addresses the problem of existing algorithms neglecting node heterogeneity by introducing pre-trained node embedding vectors during the encoding stage, enhancing adaptability to network topology. To overcome the limitations of traditional periodic extraction relying on fixed assumptions, the decomposition stage employs data-driven spectral analysis to adaptively identify and decompose multi-scale dominant periods, accurately capturing complex trends and seasonality in traffic. Furthermore, by fusing external event encoding, the impact of sudden factors is effectively integrated, improving the robustness of abnormal traffic prediction. In the prediction stage, based on an improved Graph WaveNet backbone network, spatiotemporal features are fused, and confidence intervals are generated using uncertainty estimation. This not only improves point prediction accuracy but also provides reliable risk assessment, ultimately achieving more comprehensive and reliable multi-step network traffic prediction.

[0177] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0178] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A computer science network traffic prediction method based on big data, characterized in that, Includes the following steps: Step S1: Preprocess the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes; Step S2: Perform temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. Fuse the external event encoding with the temporal convolution features to obtain fused features. Fuse the fused features with the pre-trained node embedding vectors representing network nodes to obtain enhanced features. Perform linear projection transformation on the enhanced features to obtain encoded features. Step S3: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence. Perform spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Perform period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms. Step S4: Input the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing to obtain the fused spatiotemporal features; Step S5: Perform uncertainty estimation on the fused spatiotemporal features to generate the first prediction result corresponding to the next P time steps; The first prediction result is inversely normalized to obtain the second prediction result.

2. The computer science network traffic prediction method based on big data as described in claim 1, characterized in that, Step S1 specifically includes: Step S101: Obtain raw network traffic data packets and external event data; The original network traffic data packets are in pcap format, and the external event data is in CSV format, including timestamp and event type fields. Step S102: Divide the network into N nodes according to the preset network topology information; For each of the N nodes, based on the network topology information, the network traffic data packets corresponding to each node are filtered out from the original network traffic data packets, and the network traffic data packets are aggregated according to a preset fixed time window to obtain the node aggregated traffic data corresponding to each node. Traffic feature indicators are extracted from the node aggregated traffic data corresponding to each node to form a multivariate time series of the node within a preset observation period; The traffic characteristic indicators include total bytes, total data packets, number of TCP protocol distributions, number of UDP protocol distributions, number of ICMP protocol distributions, number of unique source IP addresses, and number of unique destination port numbers. Combine the multivariate time series corresponding to all nodes to construct a multivariate time series tensor; Step S103: Normalize the multivariate time series tensor, calculate the normalized statistical parameters corresponding to each traffic characteristic index of each network node, and obtain the normalized multivariate time series. Step S104: Based on the timestamps in the external event data, assign each event in the external event data to a corresponding fixed time window; The event types occurring within each time window are statistically analyzed and their features are encoded to generate a D-dimensional external event feature vector. Arrange the feature vectors of all external events in time order to obtain a time series of length [length missing]. The external event encoding sequence.

3. The computer science network traffic prediction method based on big data as described in claim 2, characterized in that, Step S2 specifically includes: Step S201: For the normalized multivariate time series, use a step size of 1 for 3...

1. Perform temporal convolution feature extraction processing using convolution kernels to obtain temporal convolution features; Step S202: The external event encoding is fused with the temporal convolutional features to obtain the fused features; The fusion process includes copying the external event encoding along the node dimension to obtain an aligned external event encoding that is aligned with the temporal convolutional features in both the node dimension and the time dimension, and then performing a first concatenation. The first concatenated expression is: ； in, Indicates fusion features, Representing temporal convolutional features, This indicates alignment with external event encoding. Indicates the number of network nodes. Indicates the length of the time series. The dimension representing the temporal convolutional feature. The dimension of the feature vector of external events. It represents the set of real numbers.

4. The computer science network traffic prediction method based on big data as described in claim 3, characterized in that, Step S203: The fused features are fused with the pre-trained node embedding vectors representing network nodes to obtain enhanced features; Wherein, the node embedding vector is an independently learned parameter vector, and the fusion includes copying the node embedding vector along the time dimension to obtain a time-extended node embedding vector aligned with the fusion feature in the time dimension, and then performing a second concatenation. The second concatenated expression is: ； in, F represents the enhanced feature, and F represents the fused feature. This represents the temporally extended node embedding vector. This represents the dimension of the pre-trained node embedding vector; Step S204: Perform a linear projection transformation on the enhanced features to obtain the encoded features; In this process, the linear projection transformation unifies the dimension of the enhanced features to the target dimension D through a fully connected layer; The expression for linear projection transformation is: ； Where H represents the coding feature, Let W represent the enhanced feature, W represent the weight matrix of the fully connected layer, and b represent the bias vector of the fully connected layer. This represents the dimension of the target feature after projection.

5. The computer science network traffic prediction method based on big data as described in claim 4, characterized in that, Step S3 specifically includes: Step S301: Perform preliminary detrending processing on the encoded features to obtain a detrended sequence; The initial detrending process includes filling the starting positions of the encoded feature sequence in the time dimension, and using a preset fixed-length window to perform causal one-way average sliding calculation on the filled encoded features to obtain the moving average. Subtracting the moving average from the encoded features yields the detrended sequence; Step S302, the spectrum analysis process includes: performing frequency domain transformation on the detrended sequence to obtain the amplitude spectrum; calculating the corresponding amplitude spectrum for each network node and each feature dimension in the coding features to obtain the calculated amplitude spectrum; and averaging all the calculated amplitude spectra to obtain the average amplitude spectrum. The average amplitude spectrum is obtained by averaging the amplitude spectrum corresponding to each node and each feature dimension in the encoded feature. The process of period extraction includes selecting the M frequencies with the largest amplitudes from the average amplitude spectrum as the dominant frequencies, denoted as MM. The expression for selecting the dominant frequency is: ； in, Represents the average amplitude spectrum. Indicates M dominant frequencies; Based on the time series length and dominant frequency, the lengths of the M dominant periods are calculated and denoted as... The expression for calculating the period length is: ； = ； in, Indicates the length of the M dominant cycles. This represents the length of the m-th cycle out of the M dominant cycle lengths. This represents the m-th dominant frequency among M dominant frequencies.

6. The computer science network traffic prediction method based on big data as described in claim 5, characterized in that, Step S303, the process of periodic decomposition includes, for the m-th period length among the M dominant period lengths The encoded features are decomposed separately to obtain a trend term and a seasonal term. Based on all trend terms and seasonal terms, M trend terms and M seasonal terms are obtained. The expression for the trend term is: ； in, This represents the length corresponding to the m-th period. The trend term, where H represents the encoded feature, Indicates the length of the m-th period The moving average pooling operation is for the window size, and Padding represents the padding operation; The expression for the seasonal term is: ； in, This represents the length corresponding to the m-th period. Seasonal items; Step S304, the aggregation process includes: inputting M trend items into the channel attention mechanism, generating a corresponding attention weight for each trend item through the channel attention mechanism, and performing a weighted summation of the M trend items based on the attention weights to obtain the aggregated trend item; M seasonal items are input into a channel attention mechanism, and a corresponding attention weight is generated for each seasonal item through the channel attention mechanism. The M seasonal items are then weighted and summed based on the attention weights to obtain an aggregated seasonal item.

7. The computer science network traffic prediction method based on big data as described in claim 6, characterized in that, Step S4 specifically includes: Step S401: Construct an adaptive adjacency matrix based on the pre-trained node embedding vectors; Step S402: Construct an original adjacency matrix based on preset network topology information; combine the original adjacency matrix and the adaptive adjacency matrix; perform graph convolution operation on the aggregated seasonal terms to obtain graph convolution features. Step S403: Perform dilated causal temporal convolution on the graph convolutional features to obtain temporal features; Step S404: The temporal features are fused with the aggregated trend term, and the spatiotemporal features are obtained through residual connection.

8. The computer science network traffic prediction method based on big data as described in claim 7, characterized in that, Step S5 specifically includes: Step S501, the first prediction result includes the first point prediction result and the first confidence interval; The uncertainty estimation process includes generating corresponding prediction results based on spatiotemporal characteristics using a first preset quantile, a second preset quantile, and a third preset quantile; The first preset quantile, the second preset quantile, and the third preset quantile are arranged in ascending order of numerical value. Step S502: Use the second preset quantile in the prediction result as the first point prediction result; The first preset quantile and the third preset quantile are used as the lower limit and upper limit of the first confidence interval, respectively. The first confidence interval is then constructed based on the lower limit and the upper limit of the first confidence interval.

9. The computer science network traffic prediction method based on big data as described in claim 8, characterized in that, Step S503, the process of inverse normalization includes performing inverse normalization on the first prediction result to obtain the second prediction result; The inverse normalization process includes performing linear inverse transformations on the first point prediction result, the lower limit of the first confidence interval, and the upper limit of the first confidence interval according to the normalization statistical parameters, to obtain the second point prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval. The second prediction result, the lower limit of the second confidence interval, and the upper limit of the second confidence interval are reorganized according to the dimensions of network nodes, P prediction time steps, and traffic characteristic indicators to form the network traffic point prediction result and the corresponding confidence interval result. The network traffic point prediction results and the corresponding confidence intervals constitute the second prediction result.

10. A computer science network traffic prediction system based on big data, applied to a computer science network traffic prediction method based on big data as described in any one of claims 1-9, characterized in that, It includes a preprocessing module, an encoding module, a decomposition module, a fusion module, and a prediction module: The preprocessing module preprocesses the raw network traffic data packets and external event data to obtain normalized multivariate time series and external event codes; The encoding module performs temporal convolution feature extraction on the normalized multivariate time series to obtain temporal convolution features. It then fuses the external event encoding with the temporal convolution features to obtain fused features. Finally, it fuses the fused features with the pre-trained node embedding vectors that represent network nodes to obtain enhanced features. Finally, it performs linear projection transformation on the enhanced features to obtain encoded features. The decomposition module performs preliminary detrending processing on the encoded features to obtain a detrended sequence. It then performs spectral analysis and period extraction on the detrended sequence to obtain M dominant period lengths. Finally, it performs period decomposition and aggregation on the M dominant period lengths to obtain aggregated trend terms and aggregated seasonal terms. The fusion module inputs the aggregated trend term and aggregated seasonal term into the improved Graph WaveNet backbone network for processing, and obtains the fused spatiotemporal features; The prediction module performs uncertainty estimation on the fused spatiotemporal features and generates the first prediction result corresponding to the next P time steps. The first prediction result is inversely normalized to obtain the second prediction result.

Images