A robot traffic detection method, system and medium based on orthogonal prototype decoupling and mixed experts

Abstract

This invention relates to a robot traffic detection method, system, and storage medium based on orthogonal prototype decoupling and hybrid expert networks. The method includes: Step S101: Extracting multi-dimensional features; Step S102: Extracting hybrid text semantic features and reducing dimensionality to construct a global heterogeneous feature matrix; Step S103: Using a gated residual network to achieve adaptive noise reduction and filtering of heterogeneous features; Step S104: Using a sparse hybrid expert network to dynamically route diverse abnormal traffic; Step S105: Segmenting the feature subspace and using multi-cross attention to achieve deep interaction; Step S106: Introducing an orthogonal prototype network to decouple and separate human and robot features; Step S107: Using bilinearization to capture high-order collaborative features and outputting multi-path decisions; Step S108: Optimizing model weights based on joint contrastive loss and deploying to a real-time detection environment. Beneficial effects: Improves the model's adaptability to diverse attack behaviors and alleviates the catastrophic averaging problem.

Description

Technical Field

[0001] This invention relates to the fields of network security and artificial intelligence, and in particular to a robot traffic detection method, system and medium based on orthogonal prototype decoupling and hybrid experts. Background Technology

[0002] In the fields of cybersecurity and social media governance, social bot detection serves as a crucial defense mechanism, aiming to identify malicious accounts controlled by automated programs within network traffic or social platforms. With the development of Large Language Models (LLM) and automated generation technologies, the behavioral patterns and content generation capabilities of social bots are continuously improving, exhibiting stronger anthropomorphic characteristics and greater dynamism and diversity. Against this backdrop, accurately extracting and distinguishing the essential characteristics of humans and robots from multi-source heterogeneous data (such as time-series requests, text content, and behavioral statistics), and effectively addressing the significant distributional differences among different types of bots, has become one of the core issues in current bot detection research.

[0003] Social bot detection methods based on graph structures and network topology primarily identify abnormal group behavior by mining the relationships between accounts (such as following, forwarding, and commenting). The basic assumption of these methods is that bots often rely on specific network structures for collaborative operations or information dissemination. For example, Liu F et al. proposed the community-walking-based detection model Accou2vec, which enhances the homogeneity within the community by cutting off some attack edges; Wang Keke et al. proposed the multi-stage self-training method MSSBot based on graph neural networks, using unlabeled data combined with deep clustering for consistency constraints; furthermore, addressing the problem that traditional graph neural networks ignore the interaction relationships between neighboring nodes, some studies have proposed the Adaptive Multi-Scale Group Behavior Aware Network (AMGP) to characterize group behavior patterns; Guyan Q et al. proposed the Peripheral Enhancement Graph Neural Network (PEGNN), which mines peripheral structural information by introducing a domain-adaptive loss. Although graph structure methods have certain advantages in modeling topological relationships, they still face many limitations in practical applications. First, these methods rely on relatively complete social relationship graphs. However, in low-level traffic detection scenarios (such as HTTP request logs or gateway traffic), the relationships between accounts are often unobservable or extremely sparse, thus limiting the construction and application of graph models. Second, the graph construction process and multi-hop message passing mechanisms typically incur high computational overhead, making it difficult to meet the real-time requirements of high-concurrency environments. Finally, for "latent" robots that deliberately reduce interaction and maintain low connectivity, topology-based methods often struggle to capture their features, leading to decreased detection performance.

[0004] Methods based on behavioral temporal analysis and multi-source feature fusion focus on identifying abnormal patterns from the evolution of user behavior and cross-domain information. For example, Qiao B et al. proposed a window-based detection model that models interest changes between different posting time windows through a multi-head attention mechanism to characterize the differences between robots and humans in interest stability. In the information propagation cascade prediction task, the CasCIFF framework constructs a weighted adjacency matrix by standardizing participation time to achieve joint modeling of global and local temporal dynamic information. Although these methods have made some progress in capturing temporal dynamic features, several key problems still exist. First, when processing mixed tabular data containing discrete text fields (such as User-Agent, URI, Referrer) and continuous statistical features, existing methods usually use simple fully connected layers for mapping and concatenation, lacking an effective suppression mechanism for high-dimensional noise features, which can easily lead to key information being interfered with by redundant features. Second, existing feature interaction methods mostly remain at shallow concatenation or single-dimensional self-attention calculation, failing to achieve deep collaborative modeling between different feature subspaces (such as text semantic space and behavioral statistical space). Furthermore, due to the diverse types of malicious bots (such as scanners, crawlers, and automated request scripts), their data distribution exhibits significant differences. Since most methods use a uniform model structure for modeling, they are prone to the "catastrophic averaging" problem, which weakens the model's ability to identify minority classes or complex behavioral patterns.

[0005] With the development of generative artificial intelligence, text semantics and anthropomorphic behavior detection based on large language models (LLMs) have gradually become new research directions. Current social robots can generate highly deceptive text content using LLMs and, to some extent, simulate human expression and interaction rhythms. For example, Qiao B et al. constructed the LLM-driven BotSim simulation framework, pointing out that highly anthropomorphic robots have strong avoidance capabilities under existing datasets and detection methods; Kireev K et al., targeting the Telegram platform, analyzed the semantic connections between user replies through text embedding to distinguish normal users from promotional accounts. Although text semantics-based detection methods have some effect in identifying machine-generated content, they still have shortcomings at the representation learning level. First, high anthropomorphism leads to significant feature overlap and coupling between robots and real users in the latent feature space. Traditional classification models rely on a single decision boundary, making it difficult to effectively separate such complex distributions. Second, existing methods typically lack prototype modeling of "typical human behavior" and "typical robot behavior," relying more on relative differences between samples for discrimination rather than constructing a relatively independent representation space at the statistical or semantic level. This deficiency makes it easier for robots with slight behavioral perturbations or text camouflage to cross decision boundaries, thus adversely affecting the model's generalization ability and robustness.

[0006] Disadvantages of existing technology: Existing social bots and malicious traffic detection technologies still have significant limitations in practical applications. The main problems lie in the effective representation of multi-source heterogeneous data and insufficient generalization ability under complex behavioral distributions. When processing mixed tabular data containing both discrete textual semantic information (such as User-Agent, URI, etc.) and continuous behavioral statistical attributes, most existing methods rely on fully connected layers or shallow feature concatenation for fusion. This linear mapping-based approach lacks an effective mechanism for filtering redundant information in the high-dimensional input space, making it easy for discriminative but small-amplitude anomalous behavioral signals to be masked by a large number of irrelevant features. Furthermore, in the process of multi-source feature interaction, the overall features are often treated as a single sequence for unified modeling, lacking structured modeling and targeted characterization of different feature subspaces (such as textual semantic space and temporal behavioral space). This makes it difficult to capture the more complex nonlinear relationships between subspaces, which to some extent limits the model's ability to express combined attack behaviors.

[0007] From a distribution modeling perspective, malicious bots exhibit significant diversity and heterogeneity. For example, low-frequency stealthy crawlers, periodic API request scripts, and high-frequency vulnerability scanners show significant differences in their behavioral patterns. However, most existing deep learning methods still employ a single global network structure to uniformly model all anomalous distributions. Under this setting, the model tends to fit the overall distribution characteristics during optimization, while lacking the ability to characterize local complex patterns or minority behaviors. This can easily lead to the "catastrophic averaging" phenomenon, thus affecting the recognition performance of specific types or new types of bots.

[0008] With the development of large language models and automated camouflage techniques, robots are increasingly exhibiting stronger anthropomorphic characteristics in text generation, interaction rhythms, and request behaviors. This leads to a significant overlap in the distribution of human and robot representations in the hidden layer, a problem known as "feature entanglement." In this context, traditional classification methods typically rely on learning a unified decision boundary in the coupled feature space, lacking explicit prototype modeling of "typical human behavior" and "typical robot behavior," as well as constraints on mutually independent representations. This discrimination method based on relative differences is prone to breaching the discrimination boundary when faced with samples that have undergone slight behavioral perturbations or semantic camouflage, thus affecting the model's stability and generalization ability.

[0009] Overall, existing methods have certain structural limitations in terms of noise sensitivity during multi-source feature fusion, ability to model complex distributions, and feature separability in highly anthropomorphic scenarios. Therefore, it is necessary to further investigate detection methods with adaptive noise reduction capabilities, the ability to characterize differences among multiple distributions, and explicit feature decoupling to improve the robustness of models in complex environments and their performance in practical applications. Summary of the Invention

[0010] This invention provides a robot traffic detection method, system, and medium based on orthogonal prototype decoupling and hybrid experts, aiming to solve the technical problems of existing technologies in multi-source heterogeneous mixed data feature extraction, insufficient adaptability to the distribution of extremely diverse attack behaviors, and severe entanglement of highly anthropomorphic features.

[0011] This invention provides a robot traffic detection method based on orthogonal prototype decoupling and hybrid experts, comprising: Step S101: Extract multidimensional features, including manual basic features, temporal dynamic features, and IP behavior statistical features, and construct a local feature matrix from the extracted multidimensional features; Step S102: Extract multi-path hybrid semantic features from the text data and perform dimensionality reduction to obtain a low-dimensional text semantic vector. Concatenate the low-dimensional text semantic vector with the local feature matrix obtained in step S101 to construct a global heterogeneous feature matrix and output a comprehensive high-dimensional feature vector. X ; Step S103: The comprehensive high-dimensional feature vector output from step S102... X The input is fed into a gated residual network, which is used to achieve adaptive noise reduction and filtering of heterogeneous features, and outputs noise-reduced features. X GRN ; Step S104: Receive the noise reduction features output in step S103 X GRN A sparse hybrid expert network is used to dynamically route diverse abnormal traffic, resulting in distributed feature X. MoE ; Step S105: Receive the feature X after processing in step S104. MoE The feature space is divided into multiple feature subspaces, and deep interaction is performed on these multiple feature subspaces using multi-head cross attention to obtain deep interaction features X. interact ; Step S106: Transfer deep interaction features X interact A prototype decoupling layer is introduced, and human and robot features are decoupled and separated through an orthogonal prototype network mechanism to obtain the human decoupling feature F. human Decoupling feature F of the robot bot ; Step S107: Decouple human features F human Decoupling feature F of the robot bot The data are input into a first multilayer perceptron and a second multilayer perceptron, respectively. The first multilayer perceptron outputs a human-view prediction, and the second multilayer perceptron outputs a robot-view prediction. A bilinear pooling layer is used to decouple the human-view feature F. human Decoupling feature F of the robot bot The system integrates and outputs the predicted values ​​from the fused perspectives. It then performs an arithmetic average of the predictions from the human, robot, and fused perspectives to obtain the final decision result L. final ; Step S108: Calculate the final decision result L output in step S107. final By comparing with the real labels, end-to-end backpropagation is initiated, and the model weights are optimized using joint contrastive loss before being deployed to a real-time detection environment.

[0012] As a further improvement of the present invention, step S101 includes: Manual basic feature extraction steps: Calculate the length of User-Agent and URI and Shannon information entropy to measure the randomness of the request; use pattern matching to detect suspicious keywords and perform logarithmic smoothing on the number of transmitted bytes; The steps for extracting time-series dynamic features are as follows: sine and cosine functions are introduced to periodically map time, so that the time features remain continuous in the representation space. At the same time, session state is constructed at the IP granularity and request time intervals are calculated to characterize the behavioral rhythm. IP behavior statistical feature extraction steps: During the training phase, aggregate and statistically analyze the total number of requests, HTTP method distribution, status code distribution, and the duration of first and last requests for each IP; during the verification and testing phase, assign historical statistical features to the corresponding IP through a mapping table.

[0013] As a further improvement of the present invention, the time-series dynamic feature extraction step further includes: Extract the hour, minute, and day of the week from the timestamp, and map them to periodic continuous variables using sine and cosine functions to eliminate boundary jump errors across days / weeks; maintain a timestamp mapping table at the IP dimension, calculate the time difference between adjacent requests, and if the difference is less than a set threshold, it is determined to be the same session, and the relevant binary identifier is output.

[0014] As a further improvement of the present invention, step S102 further includes: Step a1: Call the hybrid text processor to perform deep semantic extraction on the discrete text fields in the request; for each type of text, after cleaning special characters, perform the following operations simultaneously: extract high-dimensional vectors using character-level statistical methods, and reduce dimensionality to eliminate sparsity by truncating singular value decomposition; extract the word frequency matrix using word-level word frequency; extract text statistical features; Step a2: Horizontally concatenate the local feature matrix from step S101 with the mixed text features extracted in step a1, dynamically remove invalid dead features with single values, and perform global zero-mean normalization to obtain a standardized comprehensive high-dimensional feature vector.

[0015] As a further improvement of the present invention, step S103 further includes: Step b1: Obtain the hidden layer representation by performing a nonlinear mapping between the fully connected layer and the ELU activation function. H :

[0016] Linear1 and Linear2 represent the first and second fully connected layers, respectively. Step b2: The gated layer activated by the parallel Sigmoid function calculates the weight retention rate of each feature channel, and combines layer normalization and residual skip connections to output the filtered features:

[0017] Linear gate This indicates linear gating, Skip indicates residual skip connections, and LayerNorm indicates layer normalization. This represents the gating weight coefficient calculated using the Sigmoid function.

[0018] As a further improvement of the present invention, step S104 further includes: Step c1: Calculate the noise reduction features of the current input through the linear routing layer. X GRN Calculate the confidence distribution across N experts and extract the probability index of the Top-K experts:

[0019] Where Softmax is the activation function, Router is the linear routing layer, and Top-K refers to selecting the K largest values ​​from the N expert confidence probabilities output by the routing network; A mask matrix is ​​constructed based on the extracted Top-K probability indexes, and the probabilities of non-Top-K experts are set to zero and renormalized. Step c2: Denoising features X GRN The results are fed into all expert subnetworks for calculation, weighted and summed using soft routing, and supplemented with residual connections to output the distributed feature X. MoE .

[0020] As a further improvement of the present invention, step S105 further includes: The high-dimensional vector is divided into m independent feature subspaces to construct a sequence feature X with time step attributes. seq This is then fed into a multi-head self-attention layer, prompting a deep cross-collision between the text semantic subspace and the temporal rhythm subspace:

[0021] After flattening the output and performing layer normalization, we obtain the deep interaction feature X. interact .

[0022] As a further improvement of the present invention, step S106 further includes: Step d1: Transfer deep interaction features X interact Projected separately into independent potential spaces Z human and Zbot In the middle, Z human Z represents the latent space of human characteristics. bot Represents the latent space of robot features; Step d2: Calculate the dot product similarity between latent features and corresponding prototype anchor matrix using the attention mechanism, and obtain the weights through Softmax; Step d3: Reconstruct the prototype matrix using the weights from step d2 through weighted summation, and combine this with residual connections to output the finally cleaned independent features:

[0023]

[0024] Among them, P human P represents the human archetype anchor point. bot Sim represents the robot prototype anchor point. human Sim represents the dot product similarity of the human prototype anchor matrix. bot represents the dot product similarity of the robot prototype anchor point matrix, and Softmax represents the normalized exponential function.

[0025] As a further improvement of the present invention, step S108 further includes: Step s1: Joint contrastive loss optimization; binary cross-entropy loss is used for the robot traffic binary classification task; cosine contrastive loss is introduced for the orthogonal prototype feature decoupling task, and the target is set to -1, so as to force the human decoupling feature F to be pushed away during gradient backpropagation. human Decoupling feature F of the robot bot Achieving ultimate decoupling through the cosine angle in multidimensional space: in Y true Indicates the true label, target This represents the target value. target=-1 indicates that the input samples are dissimilar, which means that the two feature vectors are forcibly pushed apart. Step s2: Combine an adaptive learning rate scheduler driven by the validation set AUC metric with a weighted random sampler to address the sample imbalance problem. Within each epoch, the model sequentially executes the full-link iteration from steps S103 to S108 until the loss function converges. After training, the optimal weights of the model are fixed and deployed in a real network environment for efficient traffic detection.

[0026] The present invention also discloses a robot traffic detection system based on orthogonal prototype decoupling and hybrid experts, characterized in that it includes: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the method described in the present invention when called by the processor.

[0027] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0028] Based on existing methods for detecting network traffic and social robots, this invention proposes a unified deep learning modeling framework addressing the feature representation of multi-source heterogeneous mixed data, the modeling ability of complex anomaly distributions, and the feature entanglement problem in highly anthropomorphic scenarios. By combining a gated residual network with a feature subspace interaction mechanism, and introducing a dynamic modeling strategy that decouples sparse hybrid experts from orthogonal prototypes, this method systematically improves feature representation, distribution modeling, and discriminative capabilities at multiple levels, thereby enhancing detection performance, stability, and generalization ability in complex network environments. Its beneficial effects are mainly reflected in the following aspects: 1. In multi-source heterogeneous feature modeling, existing methods typically rely on fully connected layers or shallow concatenation for feature fusion when processing mixed data containing discrete textual semantics (such as User-Agent, URI) and continuous behavioral statistical features. These methods lack effective noise suppression mechanisms in high-dimensional input spaces, easily leading to key anomalous signals being masked by redundant information, and also failing to fully characterize the complex relationships between different feature dimensions. To address this issue, this invention introduces a gated residual network (GRN), which adaptively filters input features through nonlinear gating and residual structures, suppressing redundant information while retaining fine-grained features with discriminative significance. Furthermore, the hidden layer representation is divided into multiple subspaces, and a multi-head cross-attention mechanism is introduced at the subspace level, enabling more comprehensive nonlinear interactions between different feature dimensions such as textual semantics and temporal behavior, thereby enhancing the model's ability to express combined feature patterns. This representation method, consisting of feature filtering and subspace interaction, alleviates the expressive limitations of traditional linear fusion methods to some extent. 2. Regarding complex distribution modeling, existing methods typically employ a single model to uniformly fit all anomaly patterns, given the diverse types and significant distribution differences of malicious robot behaviors. This tends to bias towards the overall distribution during optimization, weakening the ability to characterize local complex behaviors or minority samples. To address this, this invention introduces a Sparse Hybrid Expert (MoE) structure. A routing network is designed to estimate the patterns of input samples and assign them to corresponding expert submodules for processing. Different experts can model specific behavioral patterns, thus achieving differentiated characterization of various anomaly distributions within a unified framework. This mechanism improves the model's adaptability to diverse attack behaviors without significantly increasing inference complexity and alleviates the "catastrophic averaging" problem to some extent. 3. Regarding feature representation in highly anthropomorphic scenarios, with the development of automated generation technology, robots are gradually approaching real users in terms of behavior and content, resulting in significant overlap between the two in the hidden feature space. To address this issue, existing methods typically rely on a single decision boundary for classification, lacking structural constraints on features of different categories. This invention proposes an Orthogonal Prototype Feature Decoupling (OPD) mechanism, constructing prototype vectors for "typical humans" and "typical robots" in the representation space, and forming relatively independent reference bases through orthogonal constraints. Joint optimization combining attention reconstruction and contrastive loss functions allows input features to be reorganized in the new representation space, thereby enhancing the separability between categories. Based on this, a Bilinear Fusion structure is introduced to perform high-order interaction modeling on the decoupled features to capture potential multiplicative relationships and form a more stable discrimination boundary. This mechanism can improve the model's discriminative ability and overall robustness when facing highly anthropomorphic samples and those exhibiting camouflaged behavior. Attached Figure Description

[0029] Figure 1 This is a flowchart of the robot flow detection method of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments.

[0031] Parameter explanation: User-Agent: User agent, refers to the client software identifier string that initiates the HTTP request, used to declare the browser type, version, and operating system environment; URI: Uniform Resource Identifier, refers to the path address of the requested resource, including the specific page being accessed, the interface endpoint, and the query parameters; Referrer: The referrer address, indicating which upstream page the user was redirected from to the current requested page, used to track the source of the access.

[0032] The robot traffic detection method proposed in this invention, based on orthogonal prototype decoupling and hybrid experts, is a unified approach for social robots and malicious traffic detection. This method can alleviate the shortcomings of existing technologies in multi-source heterogeneous data modeling, highly complex distribution adaptation, and highly anthropomorphic feature expression.

[0033] Specifically, for mixed data containing both textual semantic information and behavioral statistical features, and considering the significant differences in behavioral patterns among different types of robots, this invention aims to improve the stability and discriminative ability of the model in complex scenarios. Based on this, a multi-source feature representation and fusion mechanism combining gated residual networks (GRNs) and feature subspace self-attention is constructed. By introducing gated nonlinear units and residual connection structures, GRNs can adaptively suppress redundant information in high-dimensional tabular data and text embeddings, thereby highlighting fine-grained behavioral features with discriminative value. Simultaneously, the hidden layer representation is divided into multiple relatively independent subspaces, and multi-head self-attention interactions are performed at the subspace level, enabling more comprehensive nonlinear correlation modeling between different feature dimensions (such as textual semantics and temporal behavior), thereby improving the model's ability to characterize complex combined attack patterns.

[0034] To address the challenges of diverse malicious bot types and significantly varying data distributions, this invention further introduces a sparse hybrid expert network as the core modeling framework. By designing a lightweight routing network, pattern probabilities are estimated for input samples, and these samples are dynamically assigned to the most relevant expert modules for processing. This allows for differentiated modeling of multiple behavioral patterns within a unified framework. This mechanism can, to some extent, avoid the "catastrophic averaging" problem that occurs when a single model uniformly fits multi-distributed data, enabling the model to maintain relatively stable recognition performance when facing different attack patterns such as web crawlers, vulnerability scanners, and rule-based API requests.

[0035] To address the issue of highly coupled human-robot features in the hidden space caused by highly anthropomorphic robots, this invention further proposes an orthogonal prototype feature decoupling and bilinear collaborative fusion mechanism. In the representation learning stage, multiple sets of learnable "typical human" and "typical robot" prototype vectors are introduced and orthogonal constraints are applied, allowing them to form relatively independent reference bases in the feature space. An attention mechanism is used to calculate the similarity between the input sample and each prototype, re-representing the features in the reconstruction space. Joint optimization is then performed using a contrastive loss function, thereby statistically enhancing the separability of features across different categories. Based on this, a bilinear pooling structure is used to perform high-order interaction modeling on the decoupled features to capture potential multiplicative relationships, thus improving the model's discriminative ability in complex camouflaged scenarios.

[0036] Based on the above design, this invention constructs a framework that integrates GRN feature selection, subspace attention interaction, sparse expert dynamic routing, and prototype decoupling mechanism.

[0037] The method of this invention forms a relatively complete technical path in terms of feature denoising, multi-distribution adaptation, and highly anthropomorphic behavior modeling, providing a more robust and expressive solution for social robot detection in complex network environments.

[0038] This invention specifically addresses the task of detecting robot traffic and malicious behavior in complex network environments. Traditional robot traffic detection methods struggle to accurately suppress high-dimensional noise and achieve deep interaction in feature subspaces within mixed tabular data containing discrete textual semantics and continuous behavioral statistics. Furthermore, when faced with various robots exhibiting vastly different behavioral patterns (such as low-frequency stealth crawlers, high-frequency vulnerability scanners, and regular API scripts), a single network architecture is prone to "catastrophic averaging," ignoring complex local anomaly distributions and leading to a significant decline in detection performance. Moreover, with the evolution of generative AI and automated camouflage technologies, advanced robots exhibit strong anthropomorphic characteristics, causing a high degree of confusion between normal and malicious traffic in the hidden representation space. Existing simple classification models lack the ability to explicitly separate and decouple the essential characteristics of humans and robots, making it easy for decision boundaries to be crossed. This invention innovatively introduces an adaptive noise reduction and multi-source fusion mechanism based on gated residual networks (GRN) and cross-attention of feature subspaces, combines it with a dynamic routing architecture based on sparse hybrid experts (SMoE) to handle differentiated behavior distributions, and further proposes an orthogonal prototype feature decoupling (OPD) and bilinear collaborative fusion mechanism. This provides an efficient, intelligent, and fine-grained robot traffic detection solution, effectively improving the feature representation accuracy, multi-mode attack adaptability, and overall robustness against anthropomorphic camouflage of the detection system.

[0039] This invention proposes a robot traffic detection architecture (HG-MoE-OPD) based on orthogonal prototype decoupling and hybrid expert routing. Combining multi-source feature engineering and multi-dimensional deep representation mechanisms, it significantly improves the model's perception accuracy in multi-source heterogeneous data spaces. The specific implementation process covers the entire process from multi-dimensional feature construction and dynamic routing noise reduction to multi-task joint optimization. Figure 1 As shown, the following are the specific implementation steps: Constructing a multi-source heterogeneous feature space: Step S101: Multidimensional Feature Engineering Extraction (Manual Features, Temporal Features, and Behavioral Statistical Features). Numerical features of three dimensions are extracted using the feature engineering module: Manual basic features: Calculate the length of User-Agent and URI and Shannon entropy to measure the randomness of the request; at the same time, use pattern matching to detect whether suspicious keywords (such as bot, crawler, admin, etc.) are included, and perform logarithmic smoothing (ln(1+x)) on the number of bytes transmitted.

[0040] Time-series dynamic features: Hours, minutes, and days of the week are extracted from timestamps and mapped to periodic continuous variables using sine and cosine functions (sin and cosine), eliminating boundary jump errors across days / weeks. Furthermore, a timestamp mapping table is maintained at the IP dimension to calculate the time difference between adjacent requests. If the difference is less than a set threshold of 1800 seconds, it is determined to be the same session, and a binary identifier indicating whether it is a peak period, late night, or weekend is output.

[0041] IP behavior statistics: During the training phase, the total number of requests, HTTP method distribution (GET / POST ratio), status code distribution (2xx / 4xx / 5xx ratio), and the duration of the first and last requests for each IP are aggregated and statistically analyzed. For the verification and testing phases, historical statistical characteristics are assigned to the corresponding IPs through a mapping table.

[0042] The three types of numerical features generated in this step form a local feature matrix, which awaits concatenation with the text semantic features.

[0043] Step S102: Dimensionality reduction extraction of hybrid text features and construction of the global feature matrix. Specifically, this includes: Step a1: For the three core discrete text categories—User-Agent, URI, and Referrer—use the HybridTextProcessor for deep semantic extraction. For each text category, special characters are first cleaned, followed by three simultaneous operations: The first operation uses character-level TF-IDF (n-gram=2~5) to extract high-dimensional vectors, and immediately reduces the dimensionality to 80-100 dimensions using Truncated Singular Value Decomposition (TruncatedSVD) to eliminate sparsity; the second operation uses word-level CountVectorizer to extract the term frequency matrix; and the third operation extracts statistical features of the text (such as the proportion of numbers, the proportion of non-letter characters, and the number of duplicate characters). Step a2: Feature Fusion and Denoising Integration: The three numerical features extracted in step S101 are horizontally concatenated with the mixed text features extracted in step a2 (np.hstack). Then, a variance threshold filter (VarianceThreshold=0.01) is used to dynamically remove invalid dead features with single values, and StandardScaler is used for global zero-mean normalization. This outputs a standardized, comprehensive high-dimensional feature vector X, which serves as the standard input for subsequent deep learning architectures.

[0044] Step S103: Adaptive Feature Filtering Based on Gated Residual Network (GRN). The comprehensive feature vector X output from step S102 is input into the gated residual network. Specifically, this includes: Step b1: Due to the presence of a large amount of discrete text mappings and continuous statistics in the mixed tabular data, there is severe noise interference between features. The model first obtains the hidden layer representation through a non-linear mapping between a fully connected layer and the ELU activation function. H :

[0045] Step b2: Subsequently, a sigmoid-activated gate layer is connected in parallel to calculate the weight retention rate of each feature channel, and the filtered features are output by combining layer normalization and residual skip connections.

[0046] Linear gate σ represents linear gating, Skip represents residual skip connections, LayerNorm represents layer normalization, and σ(sigma) represents the gating weight coefficient calculated by the Sigmoid function, with a value range of (0,1), used to adaptively control the information passing ratio of each feature channel. This step effectively suppresses redundant spoofing features in forged requests and outputs high-quality denoised features. X GRN This information is then passed to the next step, the expert distribution module.

[0047] Step S104: Dynamic pattern routing based on Sparse Hybrid Expert Network (Sparse MoE). Noise reduction features are received. X GRN Subsequently, to address the highly differentiated distribution of malicious traffic (such as low-frequency lurking crawlers and high-frequency brute-force scans), a MoE architecture is adopted for traffic splitting. The confidence distribution of the current input features across N experts (4 in this example) is calculated through a linear routing layer (Router), and the probability indices of the Top-K (2 in this example) are extracted.

[0048] A mask matrix is ​​constructed based on the extracted Top-K indices, and the probabilities of non-Top-K experts are set to zero and renormalized. In this invention, Top-K (top K maximum selection mechanism) refers to selecting the K largest elements from a set of values, where K is a preset positive integer, activating only these K experts to participate in the calculation, while the remaining NK experts are suppressed by the mask (probabilities set to zero), thereby achieving sparse activation.

[0049] Step c2: Then input (noise reduction features) X GRNThe results are fed into all expert subnetworks (two-layer MLPs containing GELU) for computation, weighted and summed via soft routing, and supplemented with residual connections to output the distributed feature X. MoE This step endows the network with the ability to dynamically adapt to diverse attack distributions.

[0050] Subspace interaction and orthogonal prototype decoupling: Step S105: Multi-head cross-attention interaction based on feature subspace. The X output from step S104... MoE Dimensional reshaping is performed. Since a conventional one-dimensional vector cannot perform meaningful self-attention computation, this step divides the high-dimensional vector (e.g., 256 dimensions) into m independent feature subspaces (e.g., eight 32-dimensional sequence blocks), constructing a sequence feature X with time-step attributes. seq This input is then fed into a multi-head attention layer, prompting a deep cross-interaction between the "textual semantic subspace" and the "temporal rhythm subspace":

[0051] After flattening the output and performing layer normalization, we obtain the deep interaction feature X. interact This feature has fully integrated cross-dimensional contextual information, providing an excellent high-order representation foundation for subsequent decoupling steps.

[0052] Step S106: Feature decoupling and separation based on orthogonal prototypes (OPD). This involves separating the deep interaction features X... interact A prototype decoupling layer is introduced to address feature entanglement arising from highly human-like robots. Specifically, this includes: Step d1: The system internally maintains two sets of orthogonally initialized learnable parameter matrices: human prototype anchor points (P human ) and robot prototype anchor point (P bot First, X interact Projected onto two independent potential spaces Z respectively human and Z bot In the middle, Z human Z represents the latent space of human characteristics, that is, the subspace of human behavior representation after projection. bot This represents the robot feature latent space, which is the subspace representing robot behavior after projection.

[0053] Step d2: Subsequently, the dot product similarity between latent features and corresponding prototype anchor matrix is ​​calculated using an attention mechanism (Sim...). human Sim bot The weights are obtained through Softmax.

[0054] Step d3: Finally, the prototype matrix is ​​reconstructed by weighted summation using this weight, and the residual connection outputs the two cleanly separated independent features:

[0055]

[0056] This step forcibly separates the areas of overlap between human and robot behaviors.

[0057] Decision fusion and joint optimization Step S107: Collaborative fusion and multi-path decision-making based on bilinear pooling. Obtain decoupling features F. human and F bot Then, the data is fed into the multi-path decision module. The first two paths output human-view predicted Logits and robot-view predicted Logits respectively from independent multilayer perceptrons (MLPs). To capture the high-order nonlinear multiplicative interactions between the decoupled features, the third path uses a bilinear pooling layer to fuse the two, which refer to the human decoupled feature Fh. uman Decoupling feature F from the robot bot This involves retrieving the original feature representation after decoupling and outputting predicted Logits from a fused perspective. The final decision result L... final The result is derived from the arithmetic average of these three Logits, thus combining the advantages of independent decision-making and cross-decision-making.

[0058] Step S108: Joint Loss Function Optimization and Dynamic Model Update. The predicted values ​​output from step S107 are compared with the true labels, initiating end-to-end backpropagation. Specifically, this includes: Step s1: This step employs a joint loss function mechanism: the main classification task uses binary cross-entropy loss (BCELoss), which refers to the binary classification of robot traffic (i.e., distinguishing whether the input traffic belongs to normal human access or malicious robot access); the auxiliary decoupling task introduces cosine contrast loss (Cosine Embedding Loss), which refers to the orthogonal prototype feature decoupling task (i.e., forcing human features and robot features to be orthogonal to each other and far apart in the latent space), and the objective is set to -1, thereby forcibly pushing F away during gradient backpropagation. human and F bot Achieving ultimate decoupling through the cosine angle in multidimensional space: , in Y true Indicates the true label, targetThis represents the target value. target=-1 indicates that the input samples are dissimilar (negative pair), which means that the two feature vectors are forced to be far apart. Step s2: Combining an adaptive learning rate scheduler (ReduceLROnPlateau) driven by the validation set AUC (Area Under the Curve) metric with a weighted random sampler (WeightedRandomSampler, which addresses sample imbalance), the model iterates through steps S103 to S108 across the entire chain within one epoch (training round) until the loss converges. After training, the optimal weights are fixed and deployed in a real network environment to perform efficient traffic detection.

[0059] The present invention also discloses a robot traffic detection system based on orthogonal prototype decoupling and hybrid experts, comprising: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the method described in the present invention when invoked by the processor.

[0060] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the method described in the present invention when invoked by a processor.

[0061] The innovative aspects of this invention: 1. A method for constructing a multi-source heterogeneous feature space based on multi-dimensional deep feature engineering, which improves the representation density of complex network traffic and the ability to characterize multimodal behavior.

[0062] Existing implementation methods: In existing social bot and malicious traffic detection technologies, feature construction typically relies on direct numerical conversion or single text vectorization strategies. For example, timestamps are often linearly encoded as integers or discrete hour or day-of-week categories. This approach disrupts the periodic continuity of time itself, causing 23:00 and 00:00 to be incorrectly separated in numerical space, thus weakening the model's ability to perceive cross-day or cross-week periodic behavior. Meanwhile, for discrete text features such as User-Agent and URI, common methods often employ the Bag-of-Words (BoW) model or TF-IDF for word frequency statistics. This not only introduces high-dimensional sparse representation, increasing computational overhead, but also ignores potential structural variations within the text, such as uneven character distribution and abnormal symbol patterns, resulting in limited overall feature representation capabilities.

[0063] The implementation scheme of this invention addresses the aforementioned problems by proposing a multi-dimensional deep feature engineering method that unifies the modeling of input data from three levels: temporal dynamics, statistical behavior, and textual semantics. Regarding temporal features, sine and cosine functions are introduced to periodically map hours and days of the week, ensuring continuity of temporal features in the representation space. Simultaneously, session states are constructed at the IP granularity, and request time intervals are calculated to characterize behavioral rhythms. For behavioral and statistical features, Shannon information entropy of URLs and User-Agents is extracted to measure the randomness of request structures. Furthermore, historical mapping relationships are combined to construct IP-level distribution features, such as the proportion of request methods and status codes. For textual features, a multi-path hybrid processing mechanism is designed: on the one hand, character-level TF-IDF combined with truncated singular value decomposition (SVD) is used to obtain a low-dimensional dense semantic representation; on the other hand, word-level frequency statistics and structural proportion features (such as the proportion of numeric and non-alphabetic characters) are introduced. Through this multi-level feature construction method, a high-density, distinguishable input representation is formed without relying on complex graph structures, thus providing a more stable feature foundation for subsequent models.

[0064] 2. A multi-source heterogeneous feature processing method based on gated residuals and cross-attention of feature subspaces effectively suppresses high-dimensional noise and achieves deep fusion of different feature dimensions.

[0065] Existing implementation methods: In existing methods, mixed data containing both discrete textual features and continuous behavioral statistics are typically processed using multilayer perceptrons or direct concatenation. These methods lack effective noise suppression mechanisms in high-dimensional feature spaces and are easily affected by redundant or fabricated information. Furthermore, in the feature interaction stage, all features are often treated as a unified vector for overall computation, lacking differentiation and targeted modeling of different semantic subspaces, making it difficult for the model to capture complex cross-dimensional association patterns.

[0066] The present invention proposes a feature processing mechanism combining a gated residual network (GRN) with multi-head cross-attention in feature subspaces. First, by introducing a sigmoid gate unit and residual connections, the input features are weighted and filtered channel-by-channel, thereby suppressing high-dimensional noise while preserving effective information. Then, the denoised feature vectors are divided into multiple low-dimensional subspaces, and a multi-head self-attention mechanism is introduced at the subspace level, enabling sufficient non-linear interaction between different types of features (such as textual semantics and temporal behavior). This explicit subspace partitioning and cross-modeling approach helps to enhance the model's ability to express complex combination patterns, thereby improving the overall feature fusion effect.

[0067] 3. A dynamic routing architecture based on Sparse Hybrid Expert Network (Sparse MoE) enhances the adaptive fitting capability when facing extremely diverse attack distributions.

[0068] Existing implementation methods: Current traffic detection models typically employ a single network structure to uniformly model all input data, such as convolutional neural networks or fully connected classifiers. When facing malicious traffic with significantly different behavioral patterns, this uniform modeling approach is prone to bias towards the overall distribution during optimization, thereby weakening its ability to characterize local complex patterns or minority class samples. Especially when the attack behavior spans a large range, the model is prone to underfitting or decreased discriminative ability.

[0069] The implementation scheme of this invention: This invention introduces a Sparse Hybrid Expert (MoE) architecture, which dynamically allocates input features by constructing a routing network and multiple expert sub-modules. During forward propagation, the routing network calculates the response weights of the input features under different modes and selects the experts with the highest scores for activation, while the remaining experts are suppressed through a masking mechanism. Finally, the outputs of the activated experts are weighted and fused together with residual connections to obtain the overall representation. This mechanism enables different experts to model specific behavioral patterns, thereby achieving differentiated fitting of diverse distributions within a unified framework, effectively alleviating the representational limitations caused by a single model.

[0070] 4. The Orthogonal Prototype Feature Decoupling (OPD) and Bilinear Collaborative Fusion Mechanism completely removes the entanglement of highly anthropomorphic features and optimizes the decision boundary.

[0071] Existing implementation methods: With the development of automated generation and camouflage technologies, malicious bots are gradually approaching real users in terms of behavior and semantics, resulting in significant overlap between the two types of samples in the feature space. Existing methods mostly rely on a single classification boundary for differentiation, lacking explicit constraints on the category structure. Once the features shift slightly, the model's discriminative ability easily declines.

[0072] The implementation scheme of this invention: This invention proposes an orthogonal prototype feature decoupling (OPD) mechanism, introducing two sets of orthogonally initialized learnable prototype parameters into the representation space, corresponding to "typical human" and "typical robot" respectively. After the input features are mapped to the latent space, their similarity to the prototype is calculated through an attention mechanism, and the decoupled feature representation is reconstructed accordingly. Simultaneously, a cosine contrastive loss is introduced for joint optimization, increasing the distance between the two types of features during training, thereby enhancing class separability. Based on this, a bilinear fusion mechanism is further employed to perform high-order interaction modeling on the decoupled features to capture potential nonlinear relationships, and a multi-branch classifier is used for judgment. Through this structured feature separation and fusion strategy, the feature overlap problem in highly anthropomorphic scenarios can be alleviated to some extent, improving the stability and discriminative ability of the model in complex adversarial environments.

[0073] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A robot flow detection method based on orthogonal prototype decoupling and hybrid experts, characterized in that, include: Step S101: Extract multidimensional features, including manual basic features, temporal dynamic features, and IP behavior statistical features, and construct a local feature matrix from the extracted multidimensional features; Step S102: Extract multi-path hybrid semantic features from the text data and perform dimensionality reduction to obtain a low-dimensional text semantic vector. Concatenate the low-dimensional text semantic vector with the local feature matrix obtained in step S101 to construct a global heterogeneous feature matrix and output a comprehensive high-dimensional feature vector. X ; Step S103: The comprehensive high-dimensional feature vector output from step S102... X The input is fed into a gated residual network, which is used to achieve adaptive noise reduction and filtering of heterogeneous features, and outputs noise-reduced features. X GRN ; Step S104: Receive the noise reduction features output in step S103 X GRN A sparse hybrid expert network is used to dynamically route diverse abnormal traffic, resulting in distributed feature X. MoE ; Step S105: Receive the feature X after processing in step S104. MoE The feature space is divided into multiple feature subspaces, and deep interaction is performed on these multiple feature subspaces using multi-head cross attention to obtain deep interaction features X. interact ; Step S106: Transfer deep interaction features X interact A prototype decoupling layer is introduced, and human features and robot features are decoupled and separated through an orthogonal prototype network mechanism to obtain the human decoupled feature F. human Decoupling feature F of the robot bot ; Step S107: Decouple human features F human Decoupling feature F of the robot bot The data are input into a first multilayer perceptron and a second multilayer perceptron, respectively. The first multilayer perceptron outputs a human-view prediction, and the second multilayer perceptron outputs a robot-view prediction. A bilinear pooling layer is used to decouple the human-view feature F. human Decoupling feature F of the robot bot The system integrates and outputs the predicted values ​​from the fused perspectives. It then performs an arithmetic average of the predictions from the human, robot, and fused perspectives to obtain the final decision result L. final ; Step S108: Calculate the final decision result L output in step S107. final By comparing with the real labels, end-to-end backpropagation is initiated, and the model weights are optimized using joint contrastive loss and deployed to the real-time detection environment. Step S101 includes: Manual basic feature extraction steps: Calculate the length of User-Agent and URI and Shannon information entropy to measure the randomness of the request; use pattern matching to detect suspicious keywords and perform logarithmic smoothing on the number of transmitted bytes; The steps for extracting time-series dynamic features are as follows: sine and cosine functions are introduced to periodically map time, so that the time features remain continuous in the representation space. At the same time, session state is constructed at the IP granularity and request time intervals are calculated to characterize the behavioral rhythm. IP behavior statistical feature extraction steps: During the training phase, aggregate and statistically analyze the total number of requests, HTTP method distribution, status code distribution, and the duration of first and last requests for each IP; during the verification and testing phase, assign historical statistical features to the corresponding IP through a mapping table.

2. The robot flow detection method according to claim 1, characterized in that, The time-series dynamic feature extraction step further includes: Extract the hour, minute, and weekday from the timestamp, and map them to periodic continuous variables using sine and cosine functions to eliminate boundary jump errors across days / weeks; maintain a timestamp mapping table at the IP granularity, calculate the time difference between adjacent requests, and if the difference is less than a set threshold, it is determined to be the same session, and the relevant binary identifier is output.

3. The robot flow detection method according to claim 1, characterized in that, Step S102 further includes: Step a1: Call the hybrid text processor to perform deep semantic extraction on the discrete text fields in the request; for each type of text, after cleaning special characters, perform the following operations simultaneously: extract high-dimensional vectors using character-level statistical methods, and reduce dimensionality to eliminate sparsity by truncating singular value decomposition; extract the word frequency matrix using word-level word frequency; extract text statistical features; Step a2: Horizontally concatenate the local feature matrix from step S101 with the mixed text features extracted in step a1, dynamically remove invalid dead features with single values, and perform global zero-mean normalization to obtain a standardized comprehensive high-dimensional feature vector.

4. The robot flow detection method according to claim 1, characterized in that, Step S103 further includes: Step b1: Obtain the hidden layer representation by performing a nonlinear mapping between the fully connected layer and the ELU activation function. H : Linear1 and Linear2 represent the first and second fully connected layers, respectively. Step b2: The gated layer activated by the parallel Sigmoid function calculates the weight retention rate of each feature channel, and combines layer normalization and residual skip connections to output the filtered features: Linear gate This indicates linear gating, Skip indicates residual skip connections, and LayerNorm indicates layer normalization. This represents the gating weight coefficient calculated using the Sigmoid function.

5. The robot flow detection method according to claim 4, characterized in that, Step S104 further includes: Step c1: Calculate the noise reduction features of the current input through the linear routing layer. X GRN Calculate the confidence distribution across N experts and extract the probability index of the Top-K experts: Where Softmax is the activation function, Router is the linear routing layer, and Top-K refers to selecting the K largest values ​​from the N expert confidence probabilities output by the routing network; A mask matrix is ​​constructed based on the extracted Top-K probability indexes, and the probabilities of non-Top-K experts are set to zero and renormalized. Step c2: Denoising features X GRN The results are fed into all expert subnetworks for calculation, weighted and summed using soft routing, and supplemented with residual connections to output the distributed feature X. MoE .

6. The robot flow detection method according to claim 1, characterized in that, Step S105 further includes: The high-dimensional vector is divided into m independent feature subspaces to construct a sequence feature X with time step attributes. seq This is then fed into a multi-head self-attention layer, prompting a deep cross-collision between the text semantic subspace and the temporal rhythm subspace: After flattening the output and performing layer normalization, we obtain the deep interaction feature X. interact .

7. The robot flow detection method according to claim 1, characterized in that, Step S106 further includes: Step d1: Transfer deep interaction features X interact Projected separately into independent potential spaces Z human and Z bot In the middle, Z human Z represents the latent space of human characteristics. bot Represents the latent space of robot features; Step d2: Calculate the dot product similarity between latent features and corresponding prototype anchor matrix using the attention mechanism, and obtain the weights through Softmax; Step d3: Reconstruct the prototype matrix using the weights from step d2 through weighted summation, and combine this with residual connections to output the finally cleaned independent features: Among them, P human P represents the human archetype anchor point. bot Sim represents the robot prototype anchor point. human Sim represents the dot product similarity of the human prototype anchor matrix. bot The dot product similarity of the robot prototype anchor point matrix is ​​represented by Softmax, which represents the normalized exponential function F. human F represents the decoupling characteristics of humans. bot This indicates the decoupling characteristics of the robot.

8. The robot flow detection method according to claim 1, characterized in that, Step S108 further includes: Step s1: Joint contrastive loss optimization; binary cross-entropy loss is used for the robot traffic binary classification task; cosine contrastive loss is introduced for the orthogonal prototype feature decoupling task, and the target is set to -1, so as to force the human decoupling feature F to be pushed away during gradient backpropagation. human Decoupling feature F of the robot bot Achieving ultimate decoupling through the cosine angle in multidimensional space: in Y true Indicates the true label, target This represents the target value; target=-1 indicates that the input samples are dissimilar. That is, forcibly pushing two feature vectors away. L final Indicates the final decision result. This represents the binary cross-entropy loss. Indicates cosine contrast loss; Step s2: Combine an adaptive learning rate scheduler driven by the validation set AUC metric with a weighted random sampler to address the sample imbalance problem. Within each epoch, the model sequentially executes the full-link iteration from steps S103 to S108 until the loss function converges. After training, the optimal weights of the model are fixed and deployed in a real network environment for efficient traffic detection.

9. A robot flow detection system based on orthogonal prototype decoupling and hybrid experts, characterized in that, include: A memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the method of any one of claims 1-8 when invoked by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to implement the steps of the method according to any one of claims 1-8 when invoked by a processor.

Images