A large-scale network-oriented traffic real-time monitoring analysis method and system

CN122293501BActive Publication Date: 2026-07-24SHANGHAI FUHUA NETWORK TECH CO LTD
View PDF 2 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
SHANGHAI FUHUA NETWORK TECH CO LTD
Filing Date
2026-05-28
Publication Date
2026-07-24

AI Technical Summary

Technical Problem

Existing traffic monitoring and analysis methods struggle to accurately identify abnormal traffic events in large-scale networks without relying on prior knowledge of attacks. In particular, they are easily overwhelmed by normal background traffic during periods of low traffic density and short-term sudden abnormal behavior. Furthermore, traditional methods ignore the dependency relationship between the packet length and arrival interval of adjacent data packets within the traffic flow, leading to the failure of abnormal traffic event localization.

Method used

By dynamically segmenting time based on the five-tuple information and timestamps of traffic data packets, a state transition code is constructed. The direction of packet length change and the direction of arrival interval change are used to characterize the traffic behavior pattern. Node state deviation analysis is performed by combining the global observation matrix and the historical baseline feature matrix to achieve the location constraint of abnormal traffic events.

Benefits of technology

Without relying on prior attack knowledge, it can accurately segment traffic behavior fragments, capture hidden abnormal features, enhance the sensitivity of anomaly identification, realize global observation of large-scale networks, reduce the false judgment rate, quickly locate the anomaly initiating node and restore the propagation path, and meet the needs of traffic operation and maintenance.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN122293501B_ABST
    Figure CN122293501B_ABST
Patent Text Reader

Abstract

The application provides a large-scale network-oriented traffic real-time monitoring analysis method and system, belonging to the technical field of traffic monitoring analysis, which comprises the following steps: determining a plurality of traffic behavior segments based on traffic data packets of each network node; calculating packet length change direction and arrival interval change direction based on packet length sequence and arrival interval sequence corresponding to the traffic behavior segments, so as to construct a state transition code representing the micro behavior mode within the traffic behavior segment; constructing a global observation matrix from the state transition codes generated by each network node within the same time window; performing node state deviation analysis on each network node according to the global observation matrix and the baseline feature matrix of the current time window, so as to obtain a state deviation degree vector corresponding to each network node; and positioning and constraining abnormal traffic events according to the state deviation degree vector corresponding to each network node. The technical scheme provided by the application can realize positioning and constraint of abnormal traffic events without relying on prior attack knowledge.
Need to check novelty before this filing date? Find Prior Art