Network traffic anomaly detection method based on SSM and transformer fusion

By using a hybrid encoder network that integrates SSM and Transformer, the problem of insufficient feature extraction of network traffic data in existing technologies is solved, achieving high-precision and stable anomaly detection and adapting to complex and dynamically changing network environments.

CN122293438BActive Publication Date: 2026-07-21SOUTHWEST PETROLEUM UNIV +1
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
SOUTHWEST PETROLEUM UNIV
Filing Date
2026-05-27
Publication Date
2026-07-21

AI Technical Summary

Technical Problem

Existing time series anomaly detection methods struggle to effectively extract traffic statistics, protocol behavior, and connection state features from network traffic data, resulting in insufficient detection accuracy in complex and dynamically changing network environments. In particular, their performance degrades significantly when dealing with ultra-long time series or multivariate coupled systems.

Method used

A hybrid encoder network based on the fusion of SSM and Transformer is adopted. Through multi-scale variable behavior fragment decomposition, multi-source heterogeneous features of network traffic are extracted. Combined with reconstruction constraints, denoising constraints and cross-view consistency constraints, high-precision anomaly detection is achieved.

Benefits of technology

It improves the accuracy and stability of network traffic anomaly detection, effectively distinguishes between normal and abnormal traffic, and adapts to complex and dynamically changing network environments.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122293438B_ABST
    Figure CN122293438B_ABST
Patent Text Reader

Abstract

The application discloses a network traffic anomaly detection method based on SSM and Transformer fusion, and belongs to the technical field of network traffic monitoring, and comprises the following steps: S1, original traffic observation construction; S2, joint feature representation construction; S3, double-view sample generation: original view samples are constructed, and corresponding disturbance view samples are generated; S4, multi-scale variable behavior segment decomposition: under different time scales, the original view samples and the disturbance view samples are subjected to segment decomposition respectively; S5, mixed coding feature extraction: the SSM modeling branch is used to extract intra-session dynamic features, and the Transformer modeling branch is used to extract inter-session correlation features; S6, normal behavior representation learning; and S7, traffic anomaly determination.The application can capture features under different time granularities through a multi-scale Patch hierarchical structure, and can realize high-precision and high-stability time series anomaly detection.
Need to check novelty before this filing date? Find Prior Art