Network data stream anomaly detection method, system, device and medium

Abstract

This application provides a method, system, device, and medium for anomaly detection of network data streams. After receiving traffic characteristics of a potential abnormal data stream, the method determines an anomaly score based on the traffic characteristics using a first autoencoder, fuses the anomaly score with the traffic characteristics to obtain enhanced traffic characteristics, and uses a deep reinforcement learning classification network to make classification decisions on the enhanced traffic characteristics, thereby obtaining the network behavior classification result of the potential abnormal data stream. In this application's embodiment, traffic detection based on the collaborative operation of a first autoencoder and a deep reinforcement learning classification network can detect traffic with unknown behavior types, thereby improving the security of network data transmission.

Description

Technical Field

[0001] This application relates to the field of network anomaly detection technology, and more specifically, to a method, system, device, and storage medium for anomaly detection of network data streams. Background Technology

[0002] Software-Defined Wide Area Networking (SD-WAN) originates from the core technology concept of Software-Defined Networking (SDN). By decoupling the network's control plane (responsible for decision-making) from its data plane (responsible for forwarding), it achieves a new network management model. Its typical architecture consists of a centralized controller and numerous edge devices deployed in various branches and data centers. The central controller, as the network's master control device, has a network-wide perspective and can intelligently select the optimal transmission path (e.g., Multiprotocol Label Switching (MPLS), broadband internet, 4G / 5G wireless networks) for each application traffic based on real-time link status (such as latency, jitter, and packet loss rate) and preset service policies. The edge devices, acting as execution devices, efficiently execute the controller's forwarding instructions. This architecture endows the network with high performance, programmability, and cost-effectiveness, enabling enterprises to flexibly allocate network resources on demand, improving operational efficiency and user experience.

[0003] However, while SD-WAN brings tremendous convenience, its distributed and open architecture also significantly expands the network attack surface, introducing entirely new security challenges. As traditional perimeter defense models gradually become ineffective, the SD-WAN environment makes every branch and every edge device a potential springboard for attackers. Therefore, addressing these issues is currently one of the important research directions in the field of network technology. Summary of the Invention

[0004] In view of this, this application provides a method, system, device and storage medium for detecting anomalies in network data streams, so as to at least solve the problems existing in the related technologies.

[0005] Specifically, this application is implemented through the following technical solution: This application provides a method for detecting anomalies in network data streams, applied to a central controller in a software-defined wide area network (SDW). The SWD further includes multiple edge devices, and the central controller is communicatively connected to each of the edge devices. The method includes: Receive traffic characteristics of a pending abnormal data stream sent by any of the edge devices; the pending abnormal data stream refers to a data stream that has been preliminarily detected as abnormal by the edge device after anomaly detection. Based on the traffic characteristics, an anomaly score is determined for the pending abnormal data stream using a first autoencoder; the anomaly score is used to reflect the difference between the network behavior type of the pending abnormal data stream and the known network behavior type; the known network behavior type includes benign behavior and attack behavior. The abnormal score and the traffic features are fused to obtain enhanced traffic features, and a deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, aggressive behavior or unknown type of behavior.

[0006] This application provides another method for anomaly detection in network data streams, applicable to any edge device in a software-defined wide area network (SDW), wherein the SWD further includes a central controller, which is communicatively connected to the edge device; the method includes: Receive data streams and extract features from the data streams to obtain traffic features; The traffic features are reconstructed based on the second autoencoder to obtain the reconstructed traffic features. If the difference between the reconstructed traffic features and the traffic features is not less than a preset difference threshold, the preliminary detection result of the data stream is determined to be abnormal, and the data stream is determined to be a pending abnormal data stream. The traffic characteristics of the data stream are sent to the central controller; the central controller generates enhanced traffic characteristics based on the traffic characteristics and the anomaly score determined by the traffic characteristics, and uses a deep reinforcement learning classification network to make classification decisions on the enhanced traffic characteristics to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, attack behavior or unknown type of behavior.

[0007] This application also provides an anomaly detection system for network data streams, including a central controller and multiple edge devices communicatively connected to the central controller; The edge device is used to receive data streams, and performs feature reconstruction processing on the traffic characteristics of the data streams based on the second autoencoder to obtain reconstructed traffic characteristics. If the difference between the reconstructed traffic characteristics and the traffic characteristics is not less than a preset difference threshold, the preliminary detection result of the data stream is determined to be abnormal, the data stream is determined to be a pending abnormal data stream, and the traffic characteristics of the data stream are sent to the central controller. The central controller receives traffic characteristics of the pending abnormal data stream sent by the edge device. Based on the traffic characteristics, it determines the abnormality score of the pending abnormal data stream through a first autoencoder, and fuses the abnormality score and the traffic characteristics to obtain enhanced traffic characteristics. Then, it uses a deep reinforcement learning classification network to make classification decisions on the enhanced traffic characteristics to obtain the network behavior classification result of the pending abnormal data stream. The network behavior classification result includes benign behavior, attack behavior, or unknown type of behavior.

[0008] This application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the network data stream anomaly detection method described in any of the foregoing embodiments.

[0009] This application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network data stream anomaly detection method described in any of the foregoing embodiments.

[0010] This application also provides a computer program product, including a computer program that, when run by a processor, performs the steps of any of the possible network data stream anomaly detection methods described above.

[0011] The technical solutions provided by the embodiments of this application may include the following beneficial effects: In this embodiment, the central controller determines the anomaly score of the pending abnormal data stream through the first autoencoder, and then fuses the anomaly score with the traffic features to obtain enhanced traffic features. In this way, the enhanced traffic features not only include the original attributes of the pending abnormal traffic, but also embed the degree of abnormality score of the pending abnormal data stream relative to the known network behavior, providing a more comprehensive information basis for intelligent decision-making.

[0012] Furthermore, the enhanced traffic features are input into a deep reinforcement learning classification network, and the deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification results of the pending abnormal data stream. In this way, the ability of the deep reinforcement learning classification network to perceive and detect constantly evolving zero-day attacks not included in the training data can be improved.

[0013] Furthermore, since the pending abnormal data stream is a data stream that has been received by the edge device and has been initially detected as abnormal, the detection accuracy can be improved by performing two abnormal detections through the edge device and the central controller. In addition, the edge device only sends the traffic characteristics of the pending abnormal data stream to the central controller instead of sending the complete data stream, thus reducing the overhead of data transmission.

[0014] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the architecture of an anomaly detection system for network data streams, as illustrated in an exemplary embodiment of this application. Figure 2 This is a flowchart illustrating an anomaly detection method for network data streams applied to edge devices, as shown in an exemplary embodiment of this application; Figure 3 This is a flowchart illustrating an anomaly detection method for network data streams applied to a central controller, as shown in an exemplary embodiment of this application; Figure 4 This is a flowchart illustrating the parameter update of a deep reinforcement learning classification network according to an exemplary embodiment of this application; Figure 5 This is a data transmission architecture diagram of an anomaly detection system for network data streams, as illustrated in an exemplary embodiment of this application. Figure 6 This is a hardware structure diagram of a computer device illustrated in an exemplary embodiment of this application. Detailed Implementation

[0016] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of systems and methods consistent with some aspects of this application as detailed in the appended claims.

[0017] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0018] It should be understood that although the terms first, second, third, etc., may be used in this application to describe various information, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0019] As enterprises deepen their digital transformation, business applications are rapidly migrating to the cloud, exhibiting a trend towards distributed and mobile office environments. Against this backdrop, traditional Wide Area Network (WAN) architectures, primarily relying on static and rigid leased line connections such as Multiprotocol Label Switching (MPLS), are increasingly revealing their limitations. Specifically, while MPLS lines can provide reliable Quality of Service (QoS), their long deployment cycles, high bandwidth costs, and severely insufficient flexibility and scalability make them ill-suited to meet the stringent demands of modern applications such as video conferencing, Software as a Service (SaaS), and Infrastructure as a Service (IaaS) for high bandwidth, low latency, and dynamic path selection. The issue of traffic backhaul (i.e., "traffic detours") between enterprise branches and cloud data centers / internet egress points not only exacerbates network latency but also leads to inefficient use of leased line bandwidth resources.

[0020] To address these pain points, Software-Defined Wide Area Network (SD-WAN) emerged and quickly became the mainstream choice for enterprise network upgrades.

[0021] Software-Defined Wide Area Networking (SD-WAN) originates from the core technology concept of Software-Defined Networking (SDN). By decoupling the network's control plane (responsible for decision-making) from its data plane (responsible for forwarding), it achieves a new network management model. Its typical architecture consists of a centralized controller and numerous edge devices deployed in various branches and data centers. The central controller, as the network's master control device, has a network-wide perspective and can intelligently select the optimal transmission path (such as MPLS, broadband internet, 4G / 5G wireless networks) for each application traffic based on real-time link status (such as latency, jitter, and packet loss rate) and preset service policies. The edge devices, as the specific execution devices, efficiently execute the controller's forwarding instructions. This architecture endows the network with high performance, programmability, and cost-effectiveness, enabling enterprises to flexibly allocate network resources on demand, improving operational efficiency and user experience.

[0022] However, while SD-WAN brings great convenience, its distributed and open architecture also significantly expands the network attack surface and introduces new security challenges. As traditional perimeter defense models gradually fail, the SD-WAN environment makes every branch and every edge device a springboard for attackers to intrude. Network traffic, especially encrypted traffic, faces severe security threats in the complex public network environment, including but not limited to: (1) Distributed Denial of Service (DDoS) attacks: Attackers can use a large number of edge access points to launch DDoS attacks against the network core or critical services, consuming network bandwidth and system resources, resulting in service interruption; (2) Advanced Persistent Threats and Zero-Day Attacks: Attack methods are becoming increasingly covert and complex, especially zero-day attacks that exploit unknown vulnerabilities. Because they do not have pre-set signatures, traditional signature-based detection methods are almost ineffective; (3) Data Leakage and Penetration: Malware may transmit sensitive data through encrypted channels, such as Hypertext Transfer Protocol Secure (HTTPS), to evade plaintext-based detection. (4) Malicious scanning and intrusion: Attackers may perform port scanning and vulnerability probing on exposed SD-WAN management interfaces or edge devices in an attempt to gain unauthorized access.

[0023] In an SD-WAN environment, to achieve efficient and accurate malicious traffic detection, detection systems typically face the following core challenges: (1) Detection of unknown attacks (zero-day attacks): Traditional network security defenses rely on signature-based detection (such as traditional Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS)) and supervised learning-based classification models. The former requires extracting accurate signature codes for known attacks through prior knowledge, while the latter relies on a large amount of labeled training data containing known attack types to learn classification boundaries. The essence of both methods is a "closed-world" assumption, that is, the attacks they can effectively identify must already exist in their rule base or training set. However, for zero-day attacks or advanced persistent threats (APTs) that appear after training and whose behavior patterns have never been recorded and analyzed, the above methods are difficult to detect. Attackers can easily evade detection through encrypted communication, polymorphism, slow and low-frequency means. This results in the traditional detection system having limited detection capabilities for these new threats, a still high false negative rate, and a large security blind spot.

[0024] (2) Limited Edge Device Resources: The architectural advantage of SD-WAN lies in pushing intelligence and computing power to the network edge, but this also brings inherent resource constraints. Edge devices typically use commercial-grade hardware, and their processor computing power, memory capacity, and power consumption are strictly limited in order to control costs and ensure deployment flexibility. However, modern high-precision detection models (especially complex deep learning) require a large number of matrix operations and memory accesses during inference, exceeding the carrying capacity of edge devices. If complex models are forcibly deployed at the edge, it will severely crowd out resources that are intended for high-speed data forwarding, affecting core network performance. Conversely, if all raw traffic or massive amounts of data are sent back to the central controller for processing to avoid local overhead, it will introduce huge network communication overhead, significant end-to-end latency, and single-point processing bottlenecks. This not only violates the original intention of SD-WAN local traffic offloading and experience optimization, but may also make security detection itself unable to meet the real-time requirements of critical services.

[0025] (3) Conceptual drift of network traffic: The network environment is a highly dynamic system. Network traffic patterns are not static but undergo continuous and unpredictable changes over time. This phenomenon is known as conceptual drift in the field of machine learning. Specifically, the statistical distribution and behavioral characteristics of traffic may change due to various factors, such as: employees using new applications or cloud services (e.g., the sudden popularity of video conferencing), adjustments to network strategies, fluctuations in business cycles (e.g., promotional activities), and attackers actively changing their attack strategies to evade detection. A static detection model that is trained and achieves high performance on a specific dataset at a specific time point will experience a gradual mismatch between its learned decision boundaries and the current real traffic distribution, leading to a continuous decline in detection performance over time. The model may misjudge new normal behavior as an attack (increased false positive rate) or fail to identify known attacks that have been disguised (increased false negative rate). Therefore, in a dynamic environment like SD-WAN, relying on a fixed model trained once is unsustainable. The detection system must have continuous learning, adaptive capabilities, and the ability to dynamically update model parameters to maintain long-term effectiveness.

[0026] Among related technologies, there are also anomaly detection schemes based on machine learning methods, including some emerging deep reinforcement learning (DRL) methods. However, these still have shortcomings when dealing with the unique challenges of the SD-WAN environment, mainly in the following aspects: First, there is a conflict between model deployment and resource consumption. Many advanced DRL solutions aim to improve detection accuracy, but their models are typically complex and have a large number of parameters, resulting in high computational complexity and memory consumption during forward inference (i.e., model application). This directly conflicts with the inherent resource constraints of SD-WAN edge devices (such as limited computing power, memory, and power consumption), making it difficult to deploy such models directly at the edge for real-time traffic analysis. As a second-best option, sending all raw traffic or large amounts of feature data back to the central controller for processing, while leveraging the controller's greater computing power, incurs significant communication bandwidth overhead and substantial detection latency, contradicting the original intention of SD-WAN to ensure a smooth experience for critical applications and reduce transmission costs.

[0027] Secondly, it has inherent limitations in detecting unknown threats. The standard DRL model primarily learns by finding the optimal strategy within the "state-action" space encountered during training. This means it excels at distinguishing between "benign" and "known malicious" traffic categories that are well-represented in the training data. However, for unknown threats (especially zero-day attacks) that have never appeared during training and whose behavior patterns differ from any known category, the standard DRL model lacks a built-in, effective perception and identification mechanism. It tends to forcibly categorize unknown traffic into a learned category, resulting in a high false negative rate and failing to meet the current network security requirements for early detection and warning of new attacks.

[0028] Finally, traditional network inspection architectures are incompatible with the dynamic nature of SD-WAN. Traditional out-of-band inspection relies on dedicated, high-performance hardware probes or traffic mirroring devices, which are expensive to purchase and have a fixed system, lacking flexibility and programmability, making it difficult to update inspection strategies agilely in response to the rapid evolution of network traffic characteristics (conceptual drift). On the other hand, while a purely centralized processing model simplifies management, in SD-WAN scenarios where traffic originates from a large number of distributed nodes, it encounters the aforementioned communication and computing bottlenecks, failing to meet the low-latency requirements for real-time detection of large-scale traffic.

[0029] Therefore, solving the above problems is one of the important research directions in the field of network technology.

[0030] Based on the above research, this disclosure provides an anomaly detection method for network data streams. This method is applied to a central controller in a software-defined wide area network (SDW), which also includes multiple edge devices. The central controller is communicatively connected to each of the edge devices. First, the method receives traffic characteristics of a pending abnormal data stream sent by any of the edge devices. The pending abnormal data stream refers to a data stream whose preliminary detection result is abnormal after anomaly detection by the edge device. Then, based on the traffic characteristics, an anomaly score is determined for the pending abnormal data stream using a first autoencoder. The anomaly score reflects the difference between the network behavior type of the pending abnormal data stream and known network behavior types. The known network behavior types include benign behavior and attack behavior. Finally, the anomaly score and the traffic characteristics are fused to obtain enhanced traffic characteristics. A deep reinforcement learning classification network is then used to classify the enhanced traffic characteristics to obtain a network behavior classification result for the pending abnormal data stream. The network behavior classification result includes benign behavior, attack behavior, or unknown type behavior.

[0031] In this embodiment, the central controller determines the anomaly score of the pending abnormal data stream through the first autoencoder, and then fuses the anomaly score with the traffic features to obtain enhanced traffic features. In this way, the enhanced traffic features not only include the original attributes of the pending abnormal traffic, but also embed the degree of abnormality score of the pending abnormal data stream relative to the known network behavior, providing a more comprehensive information basis for intelligent decision-making.

[0032] Furthermore, the enhanced traffic features are input into a deep reinforcement learning classification network, and the deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification results of the pending abnormal data stream. In this way, the ability of the deep reinforcement learning classification network to perceive and detect constantly evolving zero-day attacks not included in the training data can be improved.

[0033] Furthermore, since the pending abnormal data stream is a data stream that has been received by the edge device and has been initially detected as abnormal, the detection accuracy can be improved by performing two abnormal detections through the edge device and the central controller. In addition, the edge device only sends the traffic characteristics of the pending abnormal data stream to the central controller instead of sending the complete data stream, thus reducing the overhead of data transmission.

[0034] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0035] Please see the appendix Figure 1 This is a schematic diagram illustrating the architecture of an anomaly detection system for network data streams, as shown in an exemplary embodiment of this application. Figure 1 As shown, the network data stream anomaly detection system 100 includes a central controller 10 and an edge device set 20. The edge device set 20 includes edge device 201, edge device 202, ..., edge device 20n, where n is a positive integer. The central controller 10 is communicatively connected to the multiple edge devices respectively.

[0036] Optionally, the central controller 10 can be a hardware central controller or a software central controller. If it is a software central controller, the central controller can be a server. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud storage, big data and artificial intelligence platforms.

[0037] Edge devices can be network devices, such as switches and routers. In other implementations, edge devices can also be terminal devices, such as mobile phones, tablets, and computers. This is not a limitation.

[0038] The edge device is equipped with a lightweight first self-encoder. When the data stream flows through the edge device, the edge device will extract features from the data stream and input the extracted traffic features into the second self-encoder for traffic anomaly detection. If the preliminary detection result of the data stream is abnormal, the data stream will be identified as a pending abnormal data stream and the traffic features of the data stream will be sent to the central controller 10.

[0039] After receiving the traffic characteristics of the pending abnormal data stream sent by the edge device, the central controller 10 determines an anomaly score based on the traffic characteristics through a first autoencoder. The anomaly score is used to reflect the difference between the network behavior type of the pending abnormal data stream and the known network behavior type, which includes benign behavior and attack behavior. Then, the anomaly score and traffic characteristics are fused to obtain enhanced traffic characteristics. A deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic characteristics to obtain the network behavior classification result of the pending abnormal data stream. The network behavior classification result includes benign behavior, attack behavior, or unknown type behavior.

[0040] The following section provides a detailed description of the testing procedures performed on the central controller and edge devices.

[0041] Please see the appendix Figure 2 The above is a flowchart illustrating an anomaly detection method for network data streams applied to an edge device, as shown in an exemplary embodiment of this application. Figure 2 As shown, the network data stream anomaly detection method in this embodiment may include the following steps S201~S204: S201: Receive the data stream and extract features from the data stream to obtain traffic features.

[0042] First, it should be noted that since the real-time data stream received by the edge device is transmitted continuously, the edge device must first perform stream segmentation processing on the real-time data stream. Specifically, since a 5-tuple can uniquely identify a data stream, stream segmentation processing can be performed based on the 5-tuple (source IP, destination IP, source port, destination port, transport layer protocol).

[0043] The data stream includes multiple data packets, and the traffic characteristics include both flow-level and packet-level characteristics.

[0044] Specifically, when extracting features from the data stream to obtain traffic features, the following steps (1) to (3) may be included: (1) Based on the header information of multiple data packets, determine the flow level summary information and extract features from the flow level summary information to obtain flow level features; the flow level features include basic statistical features, packet length distribution features, and timing and flag features.

[0045] It is understandable that, since the flow-level features are applied to the entire data flow, the flow-level summary information can be determined based on the header information of multiple data packets.

[0046] Specifically, when determining flow-level summary information based on the header information of multiple data packets, the header information of multiple data packets can be parsed separately to obtain parsing results, and the multiple parsing results can be summarized to obtain the flow-level summary information.

[0047] The header information includes protocol header information (taking TCP / UDP as an example, it may include source port, destination port, sequence number, etc.) and IP layer header information (such as source IP address, destination IP address, protocol type, TTL, total packet length, arrival time, and the time interval between the arrival of the previous packet). By parsing and summarizing the header information of multiple packets, the flow-level summary information can be obtained.

[0048] The flow-level summary information can include basic statistics, packet length distribution information, and timing and flag information. Basic statistics include the total number of packets in the flow, the total number of bytes in the flow, the duration of the flow, and the number of packets per second. Packet length distribution information includes the average, standard deviation, maximum, minimum, and length sequence of uplink or downlink packets. Timing and flag information includes statistics on the arrival time interval of packets, the frequency of occurrence of specific flags in the protocol (taking the TCP protocol as an example, the characteristic flags include the SYN flag, ACK flag, and FIN flag) and the proportion of flag combinations (such as the proportion of the number of times SYN+ACK occurs to the total number of packets).

[0049] In this way, after obtaining the stream-level summary information, feature extraction can be performed on the stream-level summary information to obtain stream-level features.

[0050] (2) For each data packet, feature extraction is performed on the header information of the data packet to obtain packet-level features.

[0051] Similarly, features can be extracted from the header information of data packets (such as the protocol header information and IP layer header information mentioned above) to obtain packet-level features.

[0052] (3) Generate the flow characteristics based on the flow-level characteristics and the packet-level characteristics.

[0053] In this way, after obtaining flow-level features and packet-level features through feature extraction, traffic features can be generated based on the flow-level features and packet-level features.

[0054] S202: Based on the second autoencoder, the traffic features are reconstructed to obtain reconstructed traffic features.

[0055] The second autoencoder is obtained through unsupervised training based on benign data stream samples. The second autoencoder to be trained includes a second encoder and a second decoder. During the training process, the second encoder can learn the features of benign network behavior in the low-dimensional space, while the decoder can reconstruct the original input (i.e., benign data stream samples) with high fidelity from these features in the low-dimensional space.

[0056] In this way, during the actual detection process, the flow characteristics can be input into the second autoencoder, which will then perform feature reconstruction processing to obtain the reconstructed flow characteristics.

[0057] S203: If the difference between the reconstructed traffic feature and the traffic feature is not less than a preset difference threshold, determine that the preliminary detection result of the data stream is abnormal, and determine the data stream as a pending abnormal data stream.

[0058] Among them, the difference between the reconstructed traffic characteristics and the traffic characteristics can be the mean square error, which can reflect the degree of deviation between the network behavior of the data stream and the benign network behavior of the "benign data stream sample".

[0059] Furthermore, after obtaining the reconstructed traffic characteristics, the difference between the reconstructed traffic characteristics and the traffic characteristics can be determined. If the difference between the reconstructed traffic characteristics and the traffic characteristics is not less than the preset difference threshold, it indicates that the preliminary detection result of this data stream is abnormal and is judged as a pending abnormal data stream with potential security threats.

[0060] Conversely, if the difference between the reconstructed traffic characteristics and the actual traffic characteristics is less than a preset difference threshold, it indicates that the network behavior of this data flow highly matches the normal network behavior of a benign data flow, and the preliminary detection result of the data flow can be determined as a benign data flow. Subsequent data packets of this flow will be directly allowed at the edge device, and their traffic characteristics will also be cleaned, thus completing the filtering at the edge device without needing to be reported.

[0061] S204: The traffic characteristics of the data stream are sent to the central controller; the central controller is used to generate enhanced traffic characteristics based on the traffic characteristics and the anomaly score determined by the traffic characteristics, and to make classification decisions on the enhanced traffic characteristics using a deep reinforcement learning classification network to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, attack behavior or unknown type of behavior.

[0062] Here, as mentioned above, since the second encoder of the edge device only used benign data stream samples during the training process, it can be assumed that if the edge device determines that the initial detection result of the data stream is abnormal, it may be a false detection due to insufficient sample coverage. Therefore, the flow characteristics of the data stream can be sent to the central controller so that the central controller can perform secondary anomaly detection on the data stream.

[0063] Here, the edge device sends the traffic characteristics of this data stream, rather than the raw data packets, to the central controller for further in-depth analysis, thus reducing transmission overhead.

[0064] For information on the central controller's secondary detection of the data stream, please refer to [link / reference]. Figure 3 As shown, Figure 3 A flowchart illustrating an anomaly detection method for network data streams applied to a central controller, provided in an embodiment of this application.

[0065] like Figure 3 As shown, the anomaly detection method for network data streams applied to the central controller includes steps S301~S303: S301: Receive the traffic characteristics of a pending abnormal data stream sent by any of the edge devices; the pending abnormal data stream refers to a data stream that has been preliminarily detected as abnormal by the edge device after performing anomaly detection.

[0066] As mentioned above, each edge device performs anomaly detection on the data streams it passes through. If the preliminary detection result of any data stream is abnormal, the edge device will treat the data stream as a pending abnormal data stream and send the traffic characteristics of the data stream to the central controller. The central controller will then receive the traffic characteristics of the pending abnormal data stream sent by any edge device.

[0067] S302: Based on the traffic characteristics, an anomaly score of the pending abnormal data stream is determined by a first autoencoder; the anomaly score is used to reflect the difference between the network behavior type of the pending abnormal data stream and the known network behavior type; the known network behavior type includes benign behavior and attack behavior.

[0068] Here, the central controller is equipped with a first self-encoder, which is larger and more complex than the second self-encoder deployed on the edge devices.

[0069] Specifically, the training data for the second autoencoder is different from that for the first autoencoder. The training process for the first autoencoder is shown in steps (A) to (B): (A) Obtain a mixed data stream sample set; the mixed data stream sample set includes a first data stream sample with benign behavior and a second data stream sample with aggressive behavior.

[0070] (B) Based on the first data stream sample and the second data stream sample, perform unsupervised training on the first autoencoder to be trained until the preset requirements are met, and obtain the first autoencoder.

[0071] It can be understood that the mixed data stream sample set includes a first data stream sample with benign behavior and a second data stream sample with aggressive behavior. This mixed data stream sample set covers a generalized feature space that encompasses the "complete set of known network behaviors".

[0072] In this way, by performing unsupervised training on the first autoencoder to be trained based on the first data stream samples and the second data stream samples, the first autoencoder can learn benign and aggressive behaviors.

[0073] Specifically, regarding step S302, since the anomaly score is used to reflect the difference between the network behavior type of the pending abnormal data flow and the known network behavior types, and the known network behavior types include benign behavior and attack behavior, that is, the higher the anomaly score, the greater the difference between the network behavior type of the pending abnormal data flow and all known network behavior types (benign behavior and attack behavior), and the more difficult it is for its data flow structure to be accurately reconstructed by existing "knowledge". Therefore, it can be considered that the pending abnormal data flow belongs to a type of zero-day attack or new threat that is not found in the mixed data flow sample set. Conversely, the lower the anomaly score, the more similar the pending abnormal data flow is to a certain known type (whether good or bad). This anomaly scoring mechanism provides the ability to quantitatively assess the "unfamiliarity" of network traffic.

[0074] As mentioned above, traffic characteristics include flow-level characteristics and packet-level characteristics. Therefore, for step S302, based on the flow-level characteristics, the anomaly score of the pending abnormal data flow can be determined by the first autoencoder, and the anomaly score and flow-level characteristics can be fused to obtain enhanced traffic characteristics.

[0075] Specifically, when determining the anomaly score of a pending abnormal data stream based on stream-level features using a first autoencoder, the stream-level features can be reconstructed based on the first autoencoder to obtain reconstructed stream-level features. Then, based on the difference between the stream-level features and the reconstructed stream-level features, the anomaly score of the pending abnormal data stream can be determined.

[0076] In this step, after determining the difference between the level features and the reconstructed flow level features, the anomaly score is obtained by normalizing the difference.

[0077] S303: The abnormal score and the traffic features are fused to obtain enhanced traffic features, and a deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, attack behavior or unknown type behavior.

[0078] As mentioned above, traffic features include flow-level features. Therefore, after obtaining the anomaly score, when fusing the anomaly score with the traffic features, the anomaly score can be fused with the flow-level features to obtain enhanced traffic features. In this way, the enhanced traffic features not only include the original attributes of the anomaly traffic to be determined, but also embed its degree of anomaly relative to known network behavior, providing a more comprehensive information basis for intelligent decision-making.

[0079] Furthermore, the enhanced traffic features are input into a deep reinforcement learning classification network, and the deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification results of the pending abnormal data stream.

[0080] Among them, deep reinforcement learning classification network refers to reinforcement learning classifier based on deep Q-network (DQN). The core of the DQN model is a deep neural network, which learns the following two capabilities during training: First, it classifies traffic samples into classic "benign" and "known malicious types" based on historical experience. Second, it learns to interpret and rely on the information conveyed by "anomaly scoring" to identify and label "unknown types" of traffic that exhibit high anomalies and cannot be classified as "known network behavior types". Its output layer corresponds to three actions, which represent the final classification decision: benign behavior, attack behavior, or unknown type behavior.

[0081] This can improve the deep reinforcement learning classification network's ability to perceive and detect evolving zero-day attacks that are not included in the training data.

[0082] Furthermore, in order to enable the deep reinforcement learning classification network to continuously adapt to dynamic environments, this application embodiment also designs a refined reward mechanism to update the parameters of the deep reinforcement learning classification network.

[0083] Please see Figure 4 This is a flowchart illustrating parameter updates in a deep reinforcement learning classification network, provided as an exemplary embodiment of this application. Figure 4 As shown, the parameter update process includes steps S401 to S404: S401: Obtain the protocol type of the pending abnormal data stream, and configure reward weights for multiple packet-level features based on the protocol type.

[0084] Here, the data stream typically uses different protocol types during transmission. These protocol types can include transport layer protocols and transport layer security protocols. Transport layer protocols can include Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), while transport layer security protocols are typically TLS encryption protocols.

[0085] The information density varies for data streams with different protocols. Therefore, it is first necessary to determine the protocol type of the pending abnormal data stream and, based on the protocol type, configure reward weights for each of the packet-level features.

[0086] Specifically, for transport layer protocols, reward weights are configured for each of the multiple packet-level features in a linearly increasing manner according to the temporal order of the features.

[0087] Here, for data streams of transport layer protocols, the initial data packets have limited information, and early judgments are prone to errors. However, as the stream continues, subsequent data packets can provide more complete and definite behavioral information.

[0088] It can be understood that each packet-level feature corresponds to a timing sequence, which is the arrival time sequence of the data packet corresponding to the packet-level feature in the pending abnormal data stream. In this way, reward weights can be configured for multiple packet-level features in a linearly increasing manner according to the timing sequence of multiple packet-level features, thereby highlighting the importance of packet-level features that arrive later.

[0089] On the other hand, for the Transport Layer Security (TLS) protocol, it is divided into a handshake phase and a transmission phase. The first data packet to arrive carries complete protocol features, such as TLS version, cipher suite, certificate information, key negotiation algorithm and other key features, and needs to be assigned higher weight. The data packets that arrive later (encrypted transmission phase) have lower feature value, such as only including basic information such as packet length and transmission rate. Therefore, the weight can be gradually reduced to highlight the importance of the features of the packets that arrive earlier.

[0090] S402: For each of the package-level features, the package-level feature is taken as a state, and the corresponding classification action is performed according to the state to obtain the classification result.

[0091] Here, the agent takes the packet-level features as the state and outputs the predicted Q values ​​for three types of actions through the policy network. The three types of actions correspond to three classification results: benign behavior, aggressive behavior, and unknown behavior. The action with the largest predicted Q value is taken as the classification decision for the current packet-level features. That is, the model believes that "the action that can obtain the greatest long-term cumulative reward in the current state".

[0092] S403: Determine the environmental reward based on the classification result, and perform weighted processing on the environmental reward using the reward weight corresponding to the package-level feature to obtain the target environmental reward.

[0093] In the current environment, environmental rewards are determined based on the classification results, and the environmental rewards are weighted using the reward weights set above to obtain the target environmental reward.

[0094] S404: Update the network parameters of the deep reinforcement learning classification network based on the target environment reward.

[0095] Finally, based on the reward of the target environment, the network parameters of the deep reinforcement learning classification network are updated. In this way, based on the above reward-based continuous interactive learning mechanism, the deep reinforcement learning classification network can continuously adjust its internal strategy and dynamically adapt to changes in traffic characteristics caused by changes in user behavior, the emergence of new applications, or the evolution of attack methods. This can effectively deal with the problem of concept drift and meet the accuracy and robustness requirements of the long-term operation of the SD-WAN dynamic network environment.

[0096] Furthermore, the central controller can periodically or as needed synchronize the relevant characteristics of detected unknown types of data streams to various edge devices, thereby enabling the edge devices to directly intercept such data streams and achieve collaborative evolution of the entire system.

[0097] The following is combined with Figure 5 The complete execution flow of the above-mentioned network data stream anomaly detection method is introduced. Figure 5 This is a data transmission architecture diagram of an anomaly detection system for network data streams provided as an exemplary embodiment of this application.

[0098] like Figure 5 As shown, the edge device receives the data stream. The traffic collector in the edge device is used to capture the data stream in real time and perform stream segmentation. The packet parsing module is used to parse the header and payload information of each packet in the data stream, and then extract features from the data stream to obtain traffic features, which are stored in the feature database (the feature database includes a quintuple and traffic features). The second autoencoder reconstructs the traffic features and performs anomaly detection, and sends the traffic features of the pending abnormal data streams to the central controller.

[0099] The central controller receives pending abnormal data streams. The first autoencoder in the central controller calculates anomaly scores based on traffic characteristics. Then, the central controller fuses the anomaly scores with the traffic characteristics to generate enhanced traffic characteristics. A deep reinforcement learning classification network is then used to achieve "perception-decision-feedback-optimization" through a deep Q-network (DQN). This allows the network to adjust its parameters based on the enhanced traffic characteristics, enabling the deep learning classification network to cope with dynamic changes in traffic characteristics (such as new applications or new attacks).

[0100] Corresponding to the above-described method for detecting anomalies in network data streams, this disclosure also provides a computer device, such as... Figure 6 The diagram shown is a structural schematic of a computer device provided in an embodiment of this disclosure. Figure 6As shown, the computer device 600 includes a processor 610, an internal bus 620, memory 630, a network interface 640, and non-volatile memory 650, and may also include other hardware required for its functions. One or more embodiments of this specification can be implemented in software, for example, the processor 610 reads the corresponding computer program from the non-volatile memory 650 into the memory 630 and then runs it. Of course, besides software implementation, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0101] The memory 630, also known as internal memory, is used to temporarily store the computational data in the processor 610, as well as the data exchanged with non-volatile memory 650 such as hard disk. The processor 610 exchanges data with non-volatile memory 650 through the memory 630.

[0102] In this embodiment, memory 630 is specifically used to store application code that executes the solution of this application, and its execution is controlled by processor 610. That is, when the computer device is running, processor 610 communicates with network interface 640, memory 630 and non-volatile memory 650 through internal bus 620, so that processor 610 executes the application code stored in memory 630 and non-volatile memory 650, thereby executing the network data stream anomaly detection method described in the above method embodiment.

[0103] Processor 610 may be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware microservices. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor.

[0104] It is understood that the structures illustrated in the embodiments of this application do not constitute a specific limitation on the computer device 600. In other embodiments of this application, the computer device 600 may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0105] This disclosure also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the network data stream anomaly detection method described in the above method embodiments. The storage medium can be a volatile or non-volatile computer-readable storage medium.

[0106] This disclosure also provides a computer program product carrying program code. The program code includes instructions that can be used to execute the steps of the network data stream anomaly detection method in the above method embodiments. For details, please refer to the above method embodiments, which will not be repeated here.

[0107] The aforementioned computer program product can be implemented through hardware, software, or a combination thereof. In one optional embodiment, the computer program product is specifically embodied in a computer storage medium; in another optional embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0108] The embodiments of the subject matter and functional operation described in this specification can be implemented in: digital electronic circuits, tangibly embodied computer software or firmware, computer hardware including the structures disclosed in this specification and their structural equivalents, or combinations thereof. Embodiments of the subject matter described in this specification can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transitory program carrier for execution by or control of the operation of a data processing system. Alternatively or additionally, program instructions may be encoded on artificially generated propagation signals, such as machine-generated electrical, optical, or electromagnetic signals, generated to encode information and transmit it to a suitable receiving system for execution by the data processing system. The computer storage medium may be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or combinations thereof.

[0109] The processing and logic flow described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform corresponding functions by operating on input data and generating output. The processing and logic flow can also be executed by dedicated logic circuitry—such as FPGAs (Field-Programmable Gate Arrays) or ASICs (Application-Specific Integrated Circuits), and the system can also be implemented as dedicated logic circuitry.

[0110] Computers suitable for executing computer programs include, for example, general-purpose and / or special-purpose microprocessors, or any other type of central processing unit. Typically, the central processing unit receives instructions and data from read-only memory and / or random access memory. Basic computer microservices include a central processing unit for implementing or executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include one or more mass storage devices for storing data, such as disks, magneto-optical disks, or optical disks, or the computer will be operatively coupled to such mass storage devices to receive data from or transfer data to them, or both. However, a computer is not required to have such devices. Furthermore, a computer can be embedded in another device, such as a mobile phone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable storage device such as a universal serial bus (USB) flash drive, to name a few.

[0111] Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, such as semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices), magnetic disks (e.g., internal hard disks or removable disks), magneto-optical disks, and CD-ROM and DVD-ROM disks. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0112] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather are primarily intended to describe features of specific embodiments of a particular invention. Certain features described in the various embodiments herein may also be implemented in combination in a single embodiment. Conversely, various features described in a single embodiment may also be implemented separately in various embodiments or in any suitable sub-combination. Furthermore, while features may function in certain combinations as described above and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and a claimed combination may refer to a sub-combination or a variation thereof.

[0113] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring these operations to be performed in the specific order shown or sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and microservices in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program microservices and systems can generally be integrated together in a single software product or packaged into multiple software products.

[0114] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims may be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings are not necessarily shown in a specific order or sequence to achieve the desired result. In some implementations, multitasking and parallel processing may be advantageous.

[0115] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting anomalies in network data streams, characterized in that, A central controller applied in a software-defined wide area network (SDWN), wherein the SWDN further includes multiple edge devices, and the central controller is communicatively connected to each of the multiple edge devices; the method includes: Receive traffic characteristics of a pending abnormal data stream sent by any of the edge devices; the pending abnormal data stream refers to a data stream that has been preliminarily detected as abnormal by the edge device after anomaly detection. Based on the traffic characteristics, an anomaly score is determined for the pending abnormal data stream using a first autoencoder; the anomaly score is used to reflect the difference between the network behavior type of the pending abnormal data stream and the known network behavior type; the known network behavior type includes benign behavior and attack behavior. The abnormal score and the traffic features are fused to obtain enhanced traffic features, and a deep reinforcement learning classification network is used to make classification decisions on the enhanced traffic features to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, aggressive behavior or unknown type of behavior.

2. The method according to claim 1, characterized in that, The flow characteristics include flow-level characteristics; The step of determining the anomaly score of the pending abnormal data stream based on the traffic characteristics using a first autoencoder includes: Based on the stream-level features, the anomaly score of the pending abnormal data stream is determined by a first autoencoder; the stream-level features include basic statistical features, packet length distribution features, and temporal and flag features. The process of fusing the anomaly score and the traffic characteristics to obtain enhanced traffic characteristics includes: The enhanced flow characteristics are obtained by fusing the anomaly score and the flow level features.

3. The method according to claim 2, characterized in that, The step of determining the anomaly score of the pending abnormal data stream based on the stream-level features using a first autoencoder includes: Based on the first autoencoder, the stream-level features are reconstructed to obtain reconstructed stream-level features; An anomaly score for the pending abnormal data stream is determined based on the difference between the stream-level features and the reconstructed stream-level features.

4. The method according to claim 3, characterized in that, The first autoencoder is trained through the following steps: Obtain a mixed data stream sample set; the mixed data stream sample set includes a first data stream sample with benign behavior and a second data stream sample with aggressive behavior; Based on the first data stream samples and the second data stream samples, the first autoencoder to be trained is subjected to unsupervised training until the preset requirements are met, and the first autoencoder is obtained.

5. The method according to any one of claims 1-4, characterized in that, The pending abnormal data stream includes multiple data packets, and the traffic characteristics also include multiple packet-level characteristics of the data packets; The method further includes: Obtain the protocol type of the pending abnormal data stream, and configure reward weights for multiple packet-level features based on the protocol type; For each of the package-level features, the package-level feature is taken as a state, and the corresponding classification action is performed according to the state to obtain the classification result; The environmental reward is determined based on the classification results, and the environmental reward is weighted using the reward weights corresponding to the package-level features to obtain the target environmental reward. The network parameters of the deep reinforcement learning classification network are updated based on the target environment reward.

6. The method according to claim 5, characterized in that, Each packet-level feature corresponds to a timing sequence, which is the arrival time sequence of the data packet corresponding to the packet-level feature in the pending abnormal data stream; the protocol type includes a transport layer protocol or a transport layer security protocol. The step of configuring reward weights for multiple packet-level features based on the protocol type includes: If the protocol type is a transport layer protocol, reward weights are configured for each of the multiple packet-level features in a linearly increasing manner according to the temporal order of the multiple packet-level features; or, If the protocol type is a transport layer security protocol, reward weights are configured for each of the multiple packet-level features in a linearly decreasing manner according to the temporal order of the multiple packet-level features.

7. A method for anomaly detection in network data streams, characterized in that, The method is applied to any edge device in a software-defined wide area network (SDWN), wherein the SWDN further includes a central controller, the central controller being communicatively connected to the edge device; the method includes: Receive data streams and extract features from the data streams to obtain traffic features; The traffic features are reconstructed based on the second autoencoder to obtain the reconstructed traffic features. If the difference between the reconstructed traffic features and the traffic features is not less than a preset difference threshold, the preliminary detection result of the data stream is determined to be abnormal, and the data stream is determined to be a pending abnormal data stream. The traffic characteristics of the data stream are sent to the central controller; the central controller generates enhanced traffic characteristics based on the traffic characteristics and the anomaly score determined by the traffic characteristics, and uses a deep reinforcement learning classification network to make classification decisions on the enhanced traffic characteristics to obtain the network behavior classification result of the undetermined abnormal data stream; the network behavior classification result includes benign behavior, attack behavior or unknown type of behavior.

8. The method according to claim 7, characterized in that, The data stream includes multiple data packets; the step of extracting features from the data stream to obtain traffic features includes: Based on the header information of multiple data packets, flow-level summary information is determined, and feature extraction is performed on the flow-level summary information to obtain flow-level features; the flow-level features include basic statistical features, packet length distribution features, and timing and flag bit features; For each data packet, feature extraction is performed on the header information of the data packet to obtain packet-level features; The traffic features are generated based on the flow-level features and the packet-level features.

9. The method according to claim 7, characterized in that, The second autoencoder is obtained through unsupervised training based on benign data stream samples.

10. The method according to claim 7, characterized in that, The method further includes: If the difference between the reconstructed traffic features and the traffic features is less than the preset difference threshold, the preliminary detection result of the data stream is determined to be a benign data stream.

11. An anomaly detection system for network data streams, characterized in that, It includes a central controller and multiple edge devices that are communicatively connected to the central controller; The edge device is used to receive data streams, and performs feature reconstruction processing on the traffic characteristics of the data streams based on the second autoencoder to obtain reconstructed traffic characteristics. If the difference between the reconstructed traffic characteristics and the traffic characteristics is not less than a preset difference threshold, the preliminary detection result of the data stream is determined to be abnormal, the data stream is determined to be a pending abnormal data stream, and the traffic characteristics of the data stream are sent to the central controller. The central controller is used to receive the traffic characteristics of the pending abnormal data stream sent by the edge device, and based on the traffic characteristics, to determine the abnormal score of the pending abnormal data stream through a first autoencoder, and to fuse the abnormal score and the traffic characteristics to obtain enhanced traffic characteristics, and to use a deep reinforcement learning classification network to make classification decisions on the enhanced traffic characteristics to obtain the network behavior classification result of the pending abnormal data stream. The network behavior classification results include benign behavior, aggressive behavior, or unknown types of behavior.

12. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the network data stream anomaly detection method according to any one of claims 1-10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the anomaly detection method for network data streams as described in any one of claims 1-10.

Images