Network traffic anomaly detection method based on SSM and transformer fusion

By using a hybrid encoder network that integrates SSM and Transformer, the problem of insufficient feature extraction of network traffic data in existing technologies is solved, achieving high-precision anomaly detection and adapting to complex and dynamically changing network environments.

CN122293438APending Publication Date: 2026-06-26SOUTHWEST PETROLEUM UNIV +1
View PDF 0 Cites 0 Cited by

Patent Information

Application Number
CN202610740799.0
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2026-05-27
Publication Date
2026-06-26

AI Technical Summary

Technical Problem

Existing time series anomaly detection methods struggle to effectively extract traffic statistics, protocol behavior, and connection state features from network traffic data, resulting in insufficient detection accuracy in complex and dynamically changing network environments. In particular, their performance degrades significantly when dealing with ultra-long time series or multivariate coupled systems.

Method used

A hybrid encoder network based on the fusion of SSM and Transformer is adopted. Through multi-scale variable behavior fragment decomposition, multi-source heterogeneous features of network traffic are extracted. Combined with reconstruction constraints, denoising constraints and cross-view consistency constraints, high-precision anomaly detection is achieved.

Benefits of technology

It improves the accuracy and stability of network traffic anomaly detection, effectively distinguishes between normal and abnormal traffic, and adapts to complex and dynamically changing network environments.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122293438A_ABST
    Figure CN122293438A_ABST
Patent Text Reader

Abstract

This invention discloses a network traffic anomaly detection method based on the fusion of SSM and Transformer, belonging to the field of network traffic monitoring technology. The method includes the following steps: S1, construction of raw traffic observations; S2, construction of joint feature representations; S3, dual-view sample generation: constructing raw view samples and generating corresponding perturbation view samples; S4, multi-scale variable behavior fragment decomposition: performing fragment decomposition on the raw view samples and perturbation view samples at different time scales; S5, hybrid coding feature extraction: extracting intra-session dynamic features using the SSM modeling branch and extracting inter-session correlation features using the Transformer modeling branch; S6, normal behavior representation learning; S7, traffic anomaly determination. This invention captures features at different time granularities through a multi-scale patch hierarchical structure, achieving high-precision and high-stability time-series anomaly detection.
Need to check novelty before this filing date? Find Prior Art