A method and related equipment for detecting network traffic anomalies

Abstract

This invention relates to a method and related equipment for detecting network traffic anomalies. The method includes: acquiring network traffic data to be detected; extracting payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features; converting each feature, which is in one-dimensional vector form, into a grayscale image in two-dimensional matrix form using a pixel filling strategy; fusing the grayscale images to generate a traffic visualization image; inputting the traffic visualization image into an anomaly traffic detection model; extracting the spatial domain feature map of the image using a convolutional neural network; performing frequency domain enhancement processing on the spatial domain feature map using a frequency domain enhancement module; inversely transforming the frequency domain enhanced features back to the spatial domain and fusing them with the spatial domain feature map to obtain enhanced features; determining whether the network traffic data is abnormal based on the enhanced features and outputting the network traffic anomaly detection result. This method solves the problems of poor detection performance and security risks in related technologies.

Description

Technical Field

[0001] This invention relates to the field of traffic detection technology, and in particular to a method and related equipment for detecting network traffic anomalies. Background Technology

[0002] With the deep integration of Industrial Internet, Internet of Things (IoT), and cloud computing technologies, network traffic encryption has become an industry standard for ensuring data privacy and business security. Encryption protocols such as TLS and IPsec are widely used in Industrial Internet, IoT, and cloud computing environments. However, while encryption protocols defend against eavesdropping and tampering, they also provide a natural cover for Distributed Denial of Service (DDoS) attacks, rendering traditional Deep Packet Inspection (DPI) techniques, which rely on plaintext payload analysis, ineffective. As a component of critical infrastructure, industrial control systems, once subjected to encrypted DDoS attacks, will not only experience production service interruptions but may also trigger equipment failures and safety incidents, directly threatening infrastructure security and core corporate interests.

[0003] The network traffic anomaly detection methods provided by related technologies face the following bottlenecks when applied to encrypted traffic DDoS detection: (1) Since the encryption protocol shields the payload information, existing methods can only rely on shallow statistical features such as packet length, time interval, and protocol type, resulting in low differentiation between malicious traffic and normal traffic and poor detection performance. (2) A single network structure is difficult to capture the spatial texture and temporal dependency of traffic at the same time. Although hybrid models (such as CNN-LSTM (Convolutional Neural Network-Long Short-Term Memory)) can improve feature expression capabilities, they are complex in structure and have high inference latency, making it difficult to meet the real-time requirements of industry. In addition, most existing methods extract features in the spatial domain, ignoring the inherent periodic fluctuations and high-frequency changes in traffic data, resulting in insufficient detection capabilities for covert attacks such as low-rate DDoS and protocol vulnerability attacks. (3) In industrial network traffic data, normal traffic samples dominate, while attack traffic, especially covert attack samples, accounts for a very small proportion. This makes the model training process easily dominated by majority class samples, resulting in a serious lack of recall for attack categories and serious security risks. In addition, existing solutions such as oversampling are prone to introducing synthetic noise, and the reweighted loss function has limited adaptability to extreme imbalance scenarios, making it difficult to achieve high recall while maintaining high accuracy.

[0004] There is currently no effective solution to the problems of poor detection performance and security risks in the network traffic anomaly detection methods in related technologies. Summary of the Invention

[0005] The present invention provides a method and related equipment for detecting abnormal network traffic, which at least partially solves the problems of poor detection effect and security risks in the network traffic anomaly detection methods of the related art.

[0006] To address the aforementioned problems, one aspect of this invention provides a method for detecting abnormal network traffic, comprising: The network traffic data to be detected is acquired, and the payload byte features and statistical features of the network traffic data are extracted; wherein, the statistical features include traffic scale features, time dynamic features and protocol interaction features; The payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, are converted into grayscale images in two-dimensional matrix form using a pixel filling strategy. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and weighting the grayscale image corresponding to the payload byte features as amplitude information and integrating it into each color channel to obtain the traffic visualization image. The traffic visualization image is input into the abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; The spatial domain feature map of the traffic visualization image is extracted by the convolutional neural network and input into the frequency domain enhancement module. The frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature map to obtain frequency domain enhanced features. The frequency domain enhanced features are then inversely transformed back to the spatial domain and fused with the spatial domain feature map to obtain enhanced features. The output layer of the convolutional neural network determines whether the network traffic data is abnormal based on the enhanced features and outputs the network traffic anomaly detection result.

[0007] In some embodiments, the step of mapping the grayscale images corresponding to the traffic scale feature, the time dynamic feature, and the protocol interaction feature to the principal components of the red, green, and blue channels, respectively, and then weighting the grayscale image corresponding to the payload byte feature as amplitude information and integrating it into each color channel to obtain the traffic visualization image includes: The grayscale image corresponding to the traffic scale feature is used as the principal component of the red channel to characterize the traffic flooding feature; the grayscale image corresponding to the time dynamic feature is used as the principal component of the green channel to characterize the time jitter and interval anomaly features of the traffic; the grayscale image corresponding to the protocol interaction feature is used as the principal component of the blue channel to characterize the protocol behavior and connection state regularity features of the traffic. The grayscale image corresponding to the payload byte feature is used as amplitude information and superimposed onto the red, green and blue channels respectively through a weighted method to obtain the grayscale image of each channel; The grayscale images of each channel are weighted and fused to synthesize an initial image. The initial image is then optimized using a non-zero pixel mask enhancement strategy to obtain the traffic visualization image.

[0008] In some embodiments, the step of converting the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, into grayscale images in two-dimensional matrix form using a pixel filling strategy includes: The one-dimensional vectors corresponding to the payload byte feature, the traffic scale feature, the time dynamic feature, and the protocol interaction feature are each normalized. A pixel filling strategy is adopted, which uses modulo operation to iteratively expand the normalized one-dimensional vector until the preset total number of pixels of the target grayscale image is reached; the pixel filling strategy includes a periodic extension filling strategy. The values ​​in the expanded vector are mapped to pixel values ​​in the range of 0-255 to obtain a quantized one-dimensional vector. The quantized one-dimensional vector is then rearranged into a two-dimensional matrix in row-major order to obtain the grayscale image corresponding to each feature.

[0009] In some embodiments, the frequency domain enhancement module is serially disposed after the spatial pyramid pooling module of the convolutional neural network; wherein, the step of performing frequency domain enhancement processing on the spatial domain feature map using the frequency domain enhancement module to obtain frequency domain enhanced frequency domain features includes: The frequency domain enhancement module is used to perform a two-dimensional fast Fourier transform on the spatial domain feature map to obtain a complex frequency spectrum, and the complex frequency spectrum is divided into multiple frequency bands according to the radial frequency. The features within each frequency band are normalized to eliminate energy differences, and a learnable frequency band energy adjustment factor is introduced to enhance the high-frequency components in each frequency band. The enhanced frequency domain features are obtained by weighting and summing the features within each frequency band using learnable weights.

[0010] In some embodiments, the step of inversely transforming the frequency-domain enhanced features back to the spatial domain and fusing them with the spatial domain feature map to obtain enhanced features includes: The frequency domain enhancement module performs a two-dimensional inverse Fourier transform on the frequency domain features after frequency domain enhancement and takes the real part to obtain the spatial domain feature map after frequency domain enhancement. The enhanced spatial domain feature map is fused with the original spatial domain feature map output by the spatial pyramid pooling module through residual connection to obtain the enhanced feature.

[0011] In some embodiments, a training step for the abnormal traffic detection model is also included: Construct a training dataset containing normal network traffic samples and abnormal network traffic samples, and convert each sample in the training dataset into a traffic visualization training image with multidimensional semantic information; The traffic visualization training image is input into the abnormal traffic detection model to be trained to obtain the detection result; A loss function is used to calculate the loss value based on the detection results and the true labels of each sample. The loss function introduces a class balance coefficient and a hard case mining factor. The class balance coefficient is used to assign different weights to different classes according to the sample distribution to alleviate the imbalance in the contribution of normal traffic samples and abnormal traffic samples in the loss calculation. The hard case mining factor is used to dynamically reduce the loss weight of easily classified samples so that the model focuses on difficult-to-classify abnormal samples. The parameters of the abnormal traffic detection model are updated based on the loss value until the model converges.

[0012] In some embodiments, the step of optimizing the initial image using a non-zero pixel mask enhancement strategy includes: Generate a binary mask corresponding to the initial image; wherein the binary mask is used to identify non-zero pixel regions in the initial image; The binary mask preserves and enhances the features of the non-zero pixel regions while suppressing interference from zero-value regions, thereby achieving optimized processing of the initial image.

[0013] To address the aforementioned problems, one aspect of this invention provides a network traffic anomaly detection system, comprising: The acquisition module is used to acquire network traffic data to be detected and extract payload byte features and statistical features of the network traffic data; wherein, the statistical features include traffic scale features, time dynamic features and protocol interaction features; The traffic visualization module is used to convert the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, into grayscale images in two-dimensional matrix form using a pixel filling strategy. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and weighting the grayscale image corresponding to the payload byte features as amplitude information and integrating it into each color channel to obtain the traffic visualization image. An input module is used to input the traffic visualization image into an abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; An anomaly detection module is used to extract the spatial domain feature map of the traffic visualization image through the convolutional neural network, and input the spatial domain feature map into the frequency domain enhancement module; the frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature map to obtain frequency domain enhanced features, then inversely transforms the frequency domain enhanced features back to the spatial domain, and fuses them with the spatial domain feature map to obtain enhanced features; through the output layer of the convolutional neural network, it determines whether the network traffic data is abnormal traffic based on the enhanced features, and outputs the network traffic anomaly detection result.

[0014] To address the aforementioned problems, one aspect of this invention provides an electronic device, including: a processor and a memory storing a program, the program including instructions that, when executed by the processor, cause the processor to perform any of the aforementioned network traffic anomaly detection methods.

[0015] To address the aforementioned problems, one aspect of this invention provides a non-transitory machine-readable medium storing computer instructions for causing a computer to execute any of the aforementioned network traffic anomaly detection methods.

[0016] The beneficial effects of this invention are as follows: By acquiring network traffic data to be detected, payload byte features and statistical features of the network traffic data are extracted; wherein, the statistical features include traffic scale features, temporal dynamic features, and protocol interaction features; the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, are converted into grayscale images in two-dimensional matrix form through a pixel filling strategy; the grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information; wherein, the fusion process includes: mapping the grayscale images corresponding to traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and weighting the grayscale images corresponding to the payload byte features as amplitude information and integrating them into each color channel to obtain the traffic visualization image; the traffic visualization image is input into an abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; traffic is extracted through the convolutional neural network. This method visualizes the spatial domain feature map of an image and inputs it into a frequency domain enhancement module. The frequency domain enhancement module then performs frequency domain enhancement processing on the spatial domain feature map to obtain enhanced frequency domain features. These enhanced frequency domain features are then inversely transformed back to the spatial domain and fused with the spatial domain feature map to obtain enhanced features. The output layer of a convolutional neural network determines whether network traffic data is abnormal based on these enhanced features and outputs the network traffic anomaly detection result. This overcomes the problems of poor detection performance and security risks in related network traffic anomaly detection methods. By converting network traffic data from one-dimensional, shallow features into a traffic visualization image with multi-dimensional semantic information, and utilizing a "spatial domain + frequency domain" dual-domain joint feature extraction architecture, enhanced features are obtained that simultaneously capture both the macroscopic distribution patterns and microscopic high-frequency anomaly patterns of traffic. Finally, based on these enhanced features, high-precision anomaly detection results are output, achieving the technical effect of improving the accuracy of network traffic anomaly detection and enhancing network security.

[0017] Specifically, based on the aforementioned network traffic anomaly detection method, this invention, in its first aspect, differs from traditional single-channel grayscale mapping by innovatively designing a three-channel color encoding strategy. It proposes an RGB traffic image construction method for multi-dimensional DDoS feature representation, mapping traffic scale, temporal dynamics, and protocol interaction features to the RGB three channels respectively. This enables the convolutional neural network to simultaneously capture multi-modal attack patterns such as traffic flooding, temporal fluctuations, and protocol anomalies from the spatial visual structure, improving the model's representation ability and robustness in complex attack scenarios. Secondly, unlike the original spatial domain pyramid pooling of YOLOv11, it innovatively introduces frequency domain feature analysis. This paper proposes a multi-scale feature enhancement method based on a frequency domain pyramid (SFFP) to map traffic features to the frequency domain using a two-dimensional Fourier transform and perform multi-band decomposition, energy alignment, and adaptive fusion. This method can mine the periodicity, abrupt changes, and covert attack patterns of traffic in the frequency domain, achieving complementary enhancement of spatial and frequency domain features, and improving the model's feature representation ability and fine-grained detection performance for complex DDoS attacks. Thirdly, unlike the uneven gradient distribution of imbalanced samples caused by traditional cross-entropy loss, this paper innovatively introduces a class balance coefficient and a hard sample focusing mechanism, proposing a weighted loss function method suitable for imbalanced DDoS traffic samples. By dynamically weighting and reconstructing the loss gradient distribution, it effectively suppresses the problem of majority class dominating gradient updates and minority class features being weakened. This method can strengthen the learning weights for minority attack categories in extremely imbalanced DDoS traffic scenarios, improve the model's ability to identify rare attack categories and its recall rate, and better meet the actual needs of imbalanced samples in network security scenarios.

[0018] Details of one or more embodiments of the present invention are set forth in the following drawings and description, so that other features, objects and advantages of the invention will be more readily understood. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the main process of a network traffic anomaly detection method according to one embodiment of the present invention; Figure 2 This is a schematic diagram of the main processing flow of a network traffic anomaly detection method according to another embodiment of the present invention; Figure 3This is a schematic diagram of the main process for generating a traffic visualization image according to one embodiment of the present invention; Figure 4 This is a schematic diagram of the generation of frequency domain enhanced frequency domain features according to one embodiment of the present invention; Figure 5 This is a schematic diagram of the main modules of a network traffic anomaly detection system according to one embodiment of the present invention; Figure 6 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0021] Embodiments of the present invention will now be described in more detail with reference to the accompanying drawings. While some embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the invention. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of the invention.

[0022] To address the above problems, embodiments of the present invention provide a method for detecting abnormal network traffic; such as... Figure 1 As shown, this network traffic anomaly detection method mainly includes: Step S101: Obtain the network traffic data to be detected, and extract the payload byte features and statistical features of the network traffic data; wherein, the statistical features include traffic scale features, time dynamic features and protocol interaction features; Step S102: Using a pixel filling strategy, the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in the form of one-dimensional vectors, are converted into grayscale images in the form of two-dimensional matrices. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively. The grayscale image corresponding to the payload byte features is then weighted and integrated into each color channel as amplitude information to obtain the traffic visualization image. Step S103: Input the traffic visualization image into the abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; Step S104: Extract the spatial domain feature map of the traffic visualization image through a convolutional neural network, and input the spatial domain feature map into the frequency domain enhancement module; perform frequency domain enhancement processing on the spatial domain feature map using the frequency domain enhancement module to obtain the frequency domain enhanced features, then inversely transform the frequency domain enhanced features back to the spatial domain, and fuse them with the spatial domain feature map to obtain the enhanced features; through the output layer of the convolutional neural network, determine whether the network traffic data is abnormal traffic based on the enhanced features, and output the network traffic anomaly detection result.

[0023] Based on the above settings, by transforming network traffic data from one-dimensional, shallow features into a traffic visualization image with multi-dimensional semantic information, and utilizing a feature extraction architecture that combines the spatial domain and frequency domain, enhanced features are obtained that simultaneously capture the macroscopic distribution patterns and microscopic high-frequency anomaly patterns of traffic. Finally, based on these enhanced features, high-precision anomaly detection results are output, thereby achieving the technical effect of improving the accuracy of network traffic anomaly detection and enhancing network security.

[0024] Specifically, according to an embodiment of the present invention, based on the above step S101, deep packet inspection fails in an encrypted environment, but the statistical distribution and temporal characteristics of traffic data are not affected by encryption. By extracting payload byte features and statistical features (including at least traffic scale features, temporal dynamic features, and protocol interaction features) from the network traffic data to be detected, the payload byte features retain the underlying transmission patterns of the traffic, while the statistical features respectively characterize the macroscopic flooding degree, temporal fluctuation patterns, and protocol behavior patterns of the traffic. This enables subsequent processing to perceive traffic behavior from multiple independent dimensions, providing semantically clear basic materials for visualization conversion.

[0025] In some embodiments, based on step S102 above, firstly, a pixel filling strategy (such as a periodic extension filling strategy) is used to solve the sparsity problem where the dimension of the one-dimensional feature vector is much smaller than the total number of image pixels, enabling the features to be densely distributed in two-dimensional space; secondly, the three types of statistical features are mapped to three independent color channels, R, G, and B, respectively, so that the subsequent convolutional neural network can perceive attack patterns of different dimensions, avoiding information mixing in single-channel encoding; finally, the payload byte features are incorporated into each channel as amplitude weights, which is equivalent to superimposing the underlying transmission details on all visual dimensions, enhancing the image's ability to depict the original distribution of traffic. That is, by converting one-dimensional, difficult-to-understand traffic features into a visualized image with spatial visual structure, different attack patterns will present differentiated color and texture features in the RGB channels (e.g., flooding attacks present a bright area in the red channel, and low-speed attacks present abrupt textures in the green channel).

[0026] In some examples, based on step S103 above, an end-to-end processing link from visual image to detection result is established, and the cascaded embedding of the frequency domain enhancement module enables the abnormal traffic detection model to gain additional frequency domain analysis capabilities while retaining its spatial domain feature extraction capabilities. Specifically, convolutional neural networks are inherently adept at extracting spatial texture features of images, while the cascaded embedded frequency domain enhancement module, as an additional path, does not replace the original spatial pyramid pooling structure, thereby achieving dual-domain feature extraction of "spatial domain + frequency domain," with the two complementing and enhancing each other without interference.

[0027] In some examples, based on step S104 above, frequency domain enhancement processing maps spatial domain features to the frequency domain through Fourier transform, decomposes and calibrates different frequency bands in the frequency domain, and highlights high-frequency components related to attacks through learnable weights. Then, it is inversely transformed back to the spatial domain and fused with the original spatial domain feature map. This can capture weak, high-frequency attack textures that are difficult for spatial domain convolution kernels to respond to directly. The resulting enhanced features contain both the macroscopic spatial structure of the traffic (low-frequency information) and subtle high-frequency change patterns (such as sudden attack fluctuations and hidden periodic jitters), significantly improving the ability to identify covert attacks such as low-rate DDoS and protocol vulnerability attacks. Based on this enhanced feature, accurate detection results can be output, improving the sensitivity and robustness of detection.

[0028] In some embodiments, the steps of mapping the grayscale images corresponding to traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of red, green, and blue channels, respectively, and weighting and integrating the grayscale image corresponding to the payload byte features into each color channel as amplitude information to obtain a traffic visualization image include: using the grayscale image corresponding to the traffic scale features as the principal component of the red channel to characterize traffic flooding features; using the grayscale image corresponding to the temporal dynamic features as the principal component of the green channel to characterize the temporal jitter and interval anomaly features of traffic; using the grayscale image corresponding to the protocol interaction features as the principal component of the blue channel to characterize the protocol behavior and connection state regularity features of traffic; using the grayscale image corresponding to the payload byte features as amplitude information, and weighting and superimposing it into the red, green, and blue channels respectively to obtain grayscale images for each channel; performing channel weighted fusion on the grayscale images of each channel to synthesize an initial image; and optimizing the initial image using a non-zero pixel mask enhancement strategy to obtain a traffic visualization image.

[0029] Based on the above settings, the payload byte features, traffic scale features, time dynamic features, and protocol interaction features are combined into a color traffic visualization image with clear physical semantics through principal component mapping and amplitude superposition of the RGB channels. Among them, the red channel highlights the flooding intensity, the green channel depicts the timing anomaly, and the blue channel reflects the protocol behavior. The payload information serves as the underlying amplitude to uniformly enhance each channel. Finally, through channel weighted fusion and non-zero pixel mask enhancement, a high-discrimination, low-interference RGB image is generated and input into the abnormal traffic detection model, thereby significantly improving the visual perception capability and detection accuracy of the convolutional neural network for complex DDoS attack patterns (especially flooding, low-rate, and protocol abuse types) in encrypted environments.

[0030] Specifically, according to embodiments of the present invention, the red channel is assigned a principal component weight sensitive to traffic scale. When the traffic scale feature value is high, the red component value of the corresponding pixel increases accordingly, thereby forming a striking "red highlight area" in the image. This explicit color coding transforms the abstract degree of traffic flooding into visually recognizable color intensity, facilitating the rapid location of abnormal traffic burst areas by the convolutional neural network. Temporal dynamic features characterize temporal information such as packet arrival intervals and traffic rate changes. Mapping these features to the green channel transforms minute temporal fluctuations into rapid changes in pixel grayscale values ​​(i.e., local texture differences). Thus, the convolutional kernel of the convolutional neural network can learn these temporal anomaly patterns by observing the magnitude of grayscale changes within the receptive field. Protocol interaction features include behavioral information such as connection status, flag distribution, and protocol type. Normal traffic protocol interactions often exhibit stable statistical patterns, while attack traffic introduces abnormal connection state transitions or protocol combinations. By mapping protocol interaction features to the blue channel, the separation between normal and abnormal patterns in the color space is increased, reducing the detection difficulty.

[0031] Accordingly, by mapping the grayscale images corresponding to traffic scale characteristics, temporal dynamic characteristics, and protocol interaction characteristics to the principal components of red, green, and blue channels, respectively, in the generated color image, areas with large traffic scales (such as DDoS flood attacks) exhibit high brightness and high density visual responses in the red channel, enabling the model to intuitively perceive the absolute size and sudden increase of traffic. Irregular temporal fluctuations and sudden interval changes unique to low-rate DDoS attacks or pulse attacks will manifest as high-frequency texture mutations or abnormal grayscale gradients in the green channel, enabling the model to capture temporal dimension anomalies that are difficult to perceive by traditional spatial domain methods. Protocol abuse attacks (such as TCP SYN Flood and protocol vulnerability exploitation) will disrupt normal protocol interaction patterns. These anomalies will manifest as grayscale distributions and spatial structures that are completely different from normal traffic in the blue channel, thereby improving the model's ability to identify protocol layer attacks.

[0032] In some embodiments, payload byte features are the underlying representation of the original encrypted traffic. Although they cannot be decrypted, their statistical distribution still has distinguishing value. By using the grayscale images corresponding to the payload byte features as amplitude information, and superimposing them onto the red, green, and blue channels in a weighted manner, grayscale images for each channel are obtained. This ensures that the underlying transmission distribution patterns carried by the payload byte features (such as byte value frequency and payload length pattern) are uniformly injected into all color channels as background amplitude information. This enhances the fidelity of the image to the original content of the traffic and avoids the semantic loss that may be caused by using only statistical features. This is equivalent to adding a common basis layer in all visual dimensions, so that the final generated color image not only contains high-level statistical semantics but also retains low-level physical transmission characteristics, improving the completeness of feature representation.

[0033] In some examples, the channel-weighted fusion used in synthesizing the initial image is a linear combination method. Channel-weighted fusion merges the information from the three color channels according to a preset weight ratio (the contribution ratio of each channel can also be optimized by adjusting the weights), generating a richly colored RGB image. Furthermore, in the process of optimizing the initial image based on non-zero pixel mask enhancement to obtain the traffic visualization image, the introduced non-zero pixel mask enhancement further strengthens the non-zero pixel regions with traffic characteristics and suppresses the interference of zero-value-filled regions (informationless regions generated by periodic extension), making the effective features in the image more prominent.

[0034] In some embodiments, the steps of optimizing the initial image using a non-zero pixel mask enhancement strategy include: generating a binary mask corresponding to the initial image; wherein the binary mask is used to identify non-zero pixel regions in the initial image; and retaining and enhancing the features of the non-zero pixel regions while suppressing interference from zero-value regions through the binary mask, so as to achieve optimization of the initial image.

[0035] Based on the above settings, by generating a binary mask corresponding to the initial image, the effective non-zero pixel regions and invalid zero-value regions in the initial image are accurately distinguished. Furthermore, the non-zero pixel regions are selectively enhanced, while the zero-value regions are suppressed to become background, resulting in an optimized traffic visualization image with significant features and reduced redundancy interference. This provides a cleaner and more discriminative input for subsequent feature extraction by the convolutional neural network. Specifically, the generation of the binary mask provides spatial prior knowledge; preserving and enhancing non-zero regions highlights effective traffic features; and suppressing zero-value regions eliminates redundant interference introduced by periodic extensions. The combination of these three factors optimizes the initial image, which might otherwise contain noise and invalid padding. The subsequent abnormal traffic detection model can then focus its limited attention on pixel regions that truly reflect traffic behavior, thereby improving the robustness and generalization ability of the detection without changing the network structure.

[0036] In some embodiments, the initial image is generated by a periodic extension and filling strategy. Zero-value pixels mainly originate from areas where the original feature vector dimension is insufficient, and after expansion via modulo operation, some positions may be exactly zero due to normalization or quantization, or redundant regions introduced by extension. These zero-value pixels do not carry effective flow feature information. By generating a binary mask, the pixels in the initial image are distinguished into "effective pixels" (non-zero pixels, i.e., mask value 1) and "ineffective pixels" (zero-value pixels, i.e., mask value 0), thereby generating a 0-1 matrix of the same size as the original image. This accurately marks the spatial distribution of effective features, providing spatial location guidance for subsequent selective enhancement.

[0037] In some examples, a binary mask acts as a selector, performing element-wise multiplication or weighted fusion with the pixel values ​​of non-zero pixel regions. In non-zero pixel mask enhancement operations, pixel values ​​within the mask region can be multiplied by a gain coefficient greater than 1, or enhancement algorithms such as histogram equalization can be applied, while zero-value regions outside the mask remain unchanged. This ensures that effective features dominate the traffic visualization image, reducing the probability of the model being interfered with by invalid regions. Understandably, enhancing only non-zero pixel regions carrying traffic features (such as increasing contrast, amplifying pixel values, or increasing gradients) improves the visual saliency of these regions, making it easier for the convolutional neural network to focus more on effective regions in subsequent feature extraction.

[0038] In some cases, while periodic extension solves the feature sparsity problem, it can also introduce repetitive patterns in the image that may have no real physical meaning. If left unprocessed, these patterns may be mistakenly identified as valid features by the convolutional neural network, leading to overfitting or misjudgment. By using a binary mask to force zero-value regions to zero (pixels in zero-value regions (i.e., locations with a mask value of 0) are set to background values ​​(such as 0 or a fixed grayscale)), or by assigning extremely low fusion weights to regions outside the mask during channel fusion, the negative impact of redundant information introduced by periodic extension on feature extraction can be eliminated. This can prevent the forward propagation of this redundant information, thereby helping to improve detection accuracy.

[0039] In some embodiments, the steps described above for converting the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in the form of one-dimensional vectors, into grayscale images in the form of two-dimensional matrices using pixel filling strategies include: normalizing the one-dimensional vectors corresponding to the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features respectively; using a pixel filling strategy, cyclically expanding the normalized one-dimensional vectors using modulo operations until the preset target total number of pixels in the grayscale image is reached; wherein, the pixel filling strategy includes a periodic extension filling strategy; mapping the values ​​in the expanded vectors to pixel values ​​in the range of 0-255 to obtain quantized one-dimensional vectors, and then rearranging the quantized one-dimensional vectors in row-major order into a two-dimensional matrix to obtain the grayscale images corresponding to each feature.

[0040] Based on the above settings, the one-dimensional vectors of the payload byte features and the three types of statistical features are normalized to a unified scale. Then, a periodic extension and padding strategy (modulo operation cyclic expansion) is used to extend the short vectors to the length required by the target grayscale image. After quantization mapping to 0-255 pixel values, they are reshaped into a two-dimensional grayscale matrix in row-major order. This generates four independent grayscale images that completely preserve the original feature distribution and have spatial structure, providing a high-information-density visual input foundation for subsequent RGB fusion and model detection. Specifically, the normalization operation eliminates the dimensional differences between features, ensuring fairness in subsequent mapping; the periodic extension and padding operation solves the feature sparsity problem and preserves the original distribution pattern using modulo operation; quantization adapts the feature values ​​to the standard grayscale image format; and the reshaping operation gives the data spatial structure, facilitating convolution operations. This solves the problem of information loss or sparsity when converting one-dimensional features to two-dimensional images in traditional methods, enabling the multi-dimensional features extracted from encrypted traffic to be presented in high-fidelity grayscale image form.

[0041] Specifically, raw traffic features (such as packet length, time interval, and traffic size) have different physical units and value ranges. If pixel mapping is performed directly, features with larger magnitudes will dominate image brightness, while features with smaller magnitudes will be suppressed. By uniformly mapping feature vectors with different dimensions and numerical ranges to the same numerical interval, such as by using the min-max normalization formula, the value of each feature dimension is linearly transformed to the [0,1] interval, eliminating the scale difference between features, making all features numerically comparable, and ensuring that the contribution of each feature is relatively balanced when generating the grayscale image.

[0042] According to an embodiment of the present invention, the dimension d of the one-dimensional feature vector is much smaller than the total number of pixels P of the target grayscale image (P = H × W). If it is directly truncated or zero-padding is used, information will be lost or a large number of invalid values ​​will be introduced. Using modulo operations for cyclic expansion is equivalent to repeatedly splicing short feature vectors, so that the expanded vector maintains the original feature order and relative proportions while meeting the requirements of the target grayscale image. Periodic extension padding does not generate new values; instead, it periodically copies the original features, thus preserving the distribution pattern and periodic structure of the original features. This solves the sparsity problem of the original feature vector length being much smaller than the total number of pixels in the image while avoiding information distortion caused by random padding.

[0043] In some embodiments, digital images typically use 8-bit unsigned integers to represent the grayscale value of each pixel, with a value range of 0-255. Converting the normalized continuous values ​​in the [0,1] interval into discrete integer pixel values ​​of 0-255 completes the mapping from continuous feature space to discrete pixel space. This quantization step preserves the relative magnitude relationship of the original feature values ​​(the larger the value, the brighter the corresponding pixel), while also conforming to the input specifications of subsequent image processing libraries and convolutional neural networks.

[0044] In some examples, row priority (i.e., filling the first row from left to right, then the second row, and so on) is a common way to store images. By reshaping the one-dimensional pixel sequence into a two-dimensional matrix with height and width, adjacent pixel values ​​in the one-dimensional vector remain adjacent in the two-dimensional matrix, thus preserving the local continuity of the periodic patterns formed during the expansion process. The convolutional kernels of subsequent convolutional neural networks extract these local neighborhood features through a sliding window; therefore, the grayscale image in two-dimensional matrix form provides the necessary spatial structure for subsequent convolutional operations.

[0045] In some embodiments, the frequency domain enhancement module is cascaded after the spatial pyramid pooling module of the convolutional neural network; wherein, the step of performing frequency domain enhancement processing on the spatial domain feature map using the frequency domain enhancement module to obtain frequency domain enhanced features includes: performing a two-dimensional fast Fourier transform on the spatial domain feature map using the frequency domain enhancement module to obtain a complex frequency spectrum, and dividing the complex frequency spectrum into multiple frequency bands according to the radial frequency; normalizing the features in each frequency band to eliminate energy differences, and introducing a learnable frequency band energy adjustment factor to enhance the high-frequency components in each frequency band; and performing a weighted summation of the features in each frequency band using learnable weights to obtain the frequency domain enhanced features.

[0046] Based on the above setup, a frequency domain enhancement module is connected in series after the spatial pyramid pooling module. A two-dimensional fast Fourier transform is used to convert the spatial domain feature map to the frequency domain, and the map is divided into multiple frequency bands according to radial frequency. Energy normalization is performed on each frequency band to eliminate magnitude differences. Simultaneously, a learnable frequency band energy adjustment factor is introduced to selectively enhance high-frequency components. Finally, a weighted summation of each frequency band is performed using learnable weights to generate an adaptively enhanced and fused frequency domain feature. This allows the model to explicitly capture and highlight subtle high-frequency changes related to DDoS attacks (such as sudden fluctuations, timing jitter, and protocol anomalies), compensating for the insufficient response of pure spatial domain feature extraction to covert attacks. Specifically, the Fourier transform operation provides a frequency domain perspective; frequency band division enables differentiated processing; normalization ensures fair participation of each frequency band; the learnable frequency band energy adjustment factor specifically strengthens attack-related high-frequency components; and the learnable weights achieve adaptive frequency band selection and fusion. Together, these elements construct a frequency domain processing flow that can automatically mine and enhance weak high-frequency attack features in traffic visualization images.

[0047] In one specific embodiment, the above-mentioned division of the complex frequency spectrum into multiple frequency bands according to radial frequency specifically includes: dividing the complex frequency spectrum into K concentric annular frequency bands with the center of the spectrum (zero-frequency component) as the center and according to multiple preset radial radius thresholds; wherein the radius increases sequentially from the inside to the outside, the first frequency band is the low-frequency band (central region), and the Kth frequency band is the high-frequency band (edge ​​region). The radial radius threshold refers to the radial distance from the boundary of each frequency band to the center of the spectrum, and can be preset according to the feature map size in an equal interval or a geometric interval manner: the equal interval means that the difference between adjacent thresholds is constant; the geometric interval means that the ratio of adjacent thresholds is constant (for example, the thresholds increase in a geometric sequence). The value of K is preferably 3 or 4, and can be adaptively set according to the complexity of the detection task.

[0048] In yet another specific implementation, the aforementioned learnable bandgap energy adjustment factor For trainable parameters that correspond one-to-one with each frequency band, their initial value can be set to 1, indicating that no additional frequency band energy adjustment is introduced in the initial state; during model training, Automatic optimization and updates are achieved through backpropagation, with the value range constrained to the [0.5, 2.0] interval as needed to prevent gradient instability in the early stages of training. For high-frequency bands, After training, the value is usually greater than 1 to enhance high-frequency attack features; for low-frequency bands, It may take a value less than 1 to suppress interference from stable background features.

[0049] Among them, the spatial pyramid pooling module in convolutional neural networks excels at capturing the macroscopic texture and local spatial structure of traffic images, but it is insensitive to the inherent periodic fluctuations and sudden high-frequency changes in the traffic. By connecting the frequency domain enhancement module after the spatial pyramid pooling module, it is equivalent to superimposing frequency domain analysis on the basis of spatial feature extraction. This allows the feature map to seamlessly enter the frequency domain for further analysis after completing multi-scale aggregation in the spatial domain, forming a "spatial domain → frequency domain" concatenated enhancement link. In this way, the original spatial features are not destroyed, while information in the frequency domain dimension is supplemented, and the two complement each other.

[0050] Meanwhile, the two-dimensional Fast Fourier Transform (FFT) is a classic time-frequency transformation tool that decomposes grayscale changes in an image into superimposed sine waves of different frequencies. For traffic visualization images, slowly changing regions (such as the stable pattern of normal traffic) correspond to low-frequency components, while regions with drastic changes (such as sudden increases and decreases in DDoS attacks or pulses in low-rate attacks) correspond to high-frequency components. Through the two-dimensional FFT, the feature map in the spatial domain (pixel coordinates) is transformed into the frequency domain (frequency coordinates), allowing the energy distribution of traffic features to be reorganized according to frequency (that is, the "rate of change," which is difficult to quantify directly in the spatial domain, is explicitly expressed as amplitude and phase in the frequency domain). Among these, low frequencies correspond to the stable background and macroscopic trend of traffic, while high frequencies correspond to subtle changes such as sudden attacks and timing jitter.

[0051] Furthermore, radial frequency refers to the distance radiated outward from the center of the spectrum (DC component), reflecting the texture coarseness of the image. The area near the spectrum center is low frequency, while the area further away is high frequency. By dividing the spectrum into frequency bands (e.g., setting multiple concentric rings), spectral energy can be grouped according to frequency range, decomposing the continuous spectrum into several discrete frequency bands (such as low-frequency, mid-frequency, and high-frequency bands). This allows subsequent model processing to perform differentiated operations based on the characteristics of different frequency bands, especially enabling stronger independent attention to high-frequency components. Simultaneously, the spectral energy distribution of different flow samples may vary significantly (e.g., flooding attacks have high low-frequency energy, while low-rate attacks have relatively prominent high-frequency energy). Without normalization, high-energy frequency bands will dominate in subsequent weighted summations, suppressing information from other frequency bands. According to a specific embodiment of the present invention, L2 norm normalization (or a similar method) can be used to scale the feature vector of each frequency band to a unit length, so that the contribution of each frequency band is determined only by its relative mode, rather than absolute energy. This helps to eliminate the difference in energy magnitude between different frequency bands due to the different original image content, making the features of each frequency band comparable and avoiding the frequency band with excessively high energy from dominating the subsequent weighted fusion.

[0052] Furthermore, the learnable band energy adjustment factor is a band-dependent scalar parameter that is automatically optimized through backpropagation during model training. For attack-related high-frequency components, the loss function drives the factor to increase to enhance the contribution of these features; for irrelevant or noisy high-frequency components, the factor tends to be close to 1 or smaller. By introducing this trainable parameter, the feature responses in high-frequency bands can be adaptively amplified, enabling the model to more sensitively capture high-frequency changes related to DDoS attacks (such as burst traffic, timing jitter, and abnormal protocol fluctuations), thereby improving the detection capability of covert attacks. Understandably, this adaptive enhancement mechanism is more flexible than fixed high-pass filtering and can learn the optimal high-frequency amplification strategy for specific datasets.

[0053] According to embodiments of the present invention, different frequency bands contribute differently to DDoS detection (e.g., low frequencies mainly reflect the background pattern of normal traffic, while high frequencies mainly reflect the attack pattern). During training, learnable weights automatically learn the importance of each frequency band. Multiple frequency band features, after normalization and high-frequency enhancement, are linearly combined according to learnable weight coefficients to generate a single frequency domain feature representation that integrates information from each frequency band. The weights reflect the importance of different frequency bands to the current detection task. This process is essentially an attention mechanism, enabling the model to focus on the most discriminative frequency band while suppressing redundant or noisy frequency bands, thereby obtaining more discriminative (i.e., frequency domain enhancement) frequency domain features.

[0054] In some embodiments, the steps of inversely transforming the frequency-domain enhanced features back to the spatial domain and fusing them with the spatial domain feature map to obtain enhanced features include: performing a two-dimensional inverse Fourier transform on the frequency-domain enhanced features through the frequency-domain enhancement module and taking the real part to obtain a frequency-domain enhanced spatial domain feature map; and performing residual connection fusion between the frequency-domain enhanced spatial domain feature map and the original spatial domain feature map output by the spatial pyramid pooling module to obtain enhanced features.

[0055] Based on the above settings, the frequency domain features obtained through frequency domain enhancement processing (multi-band decomposition, energy calibration, high-frequency component enhancement, and learnable weighted fusion) are restored to spatial domain feature maps via two-dimensional inverse Fourier transform. These spatial domain feature maps are then fused with the original spatial domain feature map output by the spatial pyramid pooling module using residual connections. This results in an enhanced feature that simultaneously retains the original spatial structure information and the high-frequency detail information after frequency domain enhancement. This allows subsequent detection layers to utilize both the macroscopic distribution patterns of traffic and microscopic attack fluctuations, improving the model's ability to identify covert DDoS attacks. Specifically, the inverse Fourier transform "translates" the frequency domain processing results back to the spatial domain, aligning the enhanced information with the original spatial features in the same coordinate system. The residual connection achieves lossless superposition of the two features, preserving the original features while injecting newly enhanced information, avoiding information loss that might occur with feature substitution. This forms a complete closed loop of "spatial domain → frequency domain → enhanced spatial domain," achieving effective alignment and complementary fusion of spatial and frequency domain features.

[0056] The two-dimensional inverse Fourier transform (IFT) is the inverse of the two-dimensional fast Fourier transform (FFT), capable of losslessly mapping the complex spectrum from the frequency domain back to the spatial domain. Since the spectrum obtained from the forward Fourier transform contains both real and imaginary parts (phase information), the inverse transform typically produces a complex result. The real part is taken because the feature map itself is a real matrix, and the imaginary part should be zero (theoretically, the inverse transform result should be real, but numerical calculation errors can produce a tiny imaginary part; taking the real part eliminates this error). After the IFT operation, the enhancement operations performed in the frequency domain (such as high-frequency amplification and band weighting) are "projected" back to the spatial domain, allowing the enhanced information from the frequency domain to be presented in the pixel coordinate space, facilitating subsequent fusion with the original spatial domain features.

[0057] Meanwhile, residual connections are a commonly used feature fusion method. Directly replacing the original spatial domain feature map with the frequency-enhanced version might result in the loss of effective spatial patterns learned by the spatial pyramid pooling module. Residual connections allow convolutional neural network models to superimpose frequency-enhanced information while preserving the original features, essentially performing an "incremental update" (by adding the frequency-enhanced feature map element-wise (or weightedly) to the original spatial domain feature map, the final feature retains both the multi-scale structural information of the original spatial domain feature map and the high-frequency detail information introduced by the frequency enhancement, forming a complementary enhancement). The original spatial domain feature map provides the macroscopic texture and spatial structure of the flow (low-frequency information), while the frequency-enhanced feature map provides subtle anomaly information amplified by high frequencies. After addition, the model can adaptively choose which part of the information to rely on based on task requirements, or further fuse them through subsequent convolutional layers. This avoids information loss and the gradient vanishing problem, while maintaining feature diversity.

[0058] In some embodiments, the above method further includes a training step for the abnormal traffic detection model: constructing a training dataset containing normal network traffic samples and abnormal network traffic samples, and converting each sample in the training dataset into a traffic visualization training image with multi-dimensional semantic information; inputting the traffic visualization training image into the abnormal traffic detection model to be trained to obtain detection results; using a loss function to calculate the loss value based on the detection results and the true labels of each sample; wherein, the loss function introduces a class balance coefficient and a hard example mining factor; the class balance coefficient is used to assign different weights to different classes according to the sample distribution to alleviate the imbalance of contributions between normal traffic samples and abnormal traffic samples in loss calculation; the hard example mining factor is used to dynamically reduce the loss weight of easily classified samples, so that the model focuses on difficult-to-classify abnormal samples; updating the parameters of the abnormal traffic detection model according to the loss value until the model converges.

[0059] Based on the above settings, a training dataset containing normal and abnormal samples is constructed, converted into traffic visualization training images, and then input into the model. A loss function that simultaneously incorporates a class balance coefficient and a hard case mining factor is used to calculate the loss value between the prediction and the true label. The model parameters are then iteratively updated based on this loss value until convergence, thereby training an abnormal traffic detection model that can effectively alleviate the sample imbalance problem and focus on difficult-to-classify abnormal samples. This enables the model to have higher recall and overall detection accuracy against minority class attacks and covert attacks during the inference phase.

[0060] If the method for generating training images differs from the method for generating traffic visualization images during the detection phase, the features learned by the model will fail to generalize to actual detection scenarios. Therefore, the method described above for converting each sample in the training dataset into traffic visualization training images with multi-dimensional semantic information adopts the aforementioned traffic visualization image generation method. This ensures that the model faces the same data distribution during training and inference, and is able to learn the discrimination patterns between normal and abnormal traffic from visual features.

[0061] Meanwhile, inputting the traffic visualization training images into the abnormal traffic detection model to be trained and obtaining the detection results is the standard forward propagation process for deep learning model training. After receiving the input images, the model to be trained is processed by the convolutional neural network and the frequency domain enhancement module, and finally the output layer generates the detection results (also called predicted values ​​since it is the training phase). The difference between the predicted values ​​and the true labels of the samples is the current performance of the model.

[0062] According to embodiments of the present invention, traditional cross-entropy loss treats all samples equally, which can easily bias towards the majority class when the data is imbalanced. The loss function provided in this embodiment of the present invention (i) introduces a class balance coefficient, which assigns higher weights to the fewer outlier classes, making the model pay more attention to the gradient contribution of these rare samples when updating parameters. (ii) By introducing a hard-case mining factor, the loss value of easily classified samples with high confidence is exponentially reduced, while the loss value of misclassified or low-confidence hard-case samples is relatively amplified. Thus, the above loss function not only measures the difference between the predicted value and the true label, but also applies differentiated influences to different types of samples through two adjustable parameters (class balance coefficient and hard-case mining factor), thereby guiding the model to concentrate limited optimization resources on the most difficult-to-distinguish outlier samples (such as minority classes and hard-to-classify samples).

[0063] On the one hand, in industrial network traffic, normal samples may account for more than 90%, while abnormal samples account for less than 10%. Without weighting, the model only needs to predict all samples as normal to achieve 90% accuracy, but the recall is 0. By adjusting the weight ratio of each class in the total loss, even if the number of abnormal samples is much less than the number of normal samples, their contribution to the loss will not be overwhelmed, thus avoiding the problem of the model being biased towards predicting the majority class (normal). According to a specific embodiment of the present invention, the class balance coefficient can be set to be inversely proportional to the class frequency (e.g., abnormal sample weight = number of normal samples / number of abnormal samples), so that each sample of the minority class contributes a larger loss gradient, forcing the model to learn its decision boundary.

[0064] On the other hand, the hard example mining factor acts on the modulation term of the prediction probability. When the model's prediction probability of the true class is close to 1 (easy samples), the modulation term is close to 0, and the loss is significantly reduced. When the model's prediction probability of the true class is low (hard samples), the modulation term is close to 1, and the loss is preserved. As training progresses, the model's prediction confidence for a large number of normal samples and simple attack samples gradually increases, and the loss contribution of these samples is automatically suppressed. Meanwhile, those abnormal samples that are consistently difficult to classify correctly (such as covert DDoS attacks) become the focus of training, improving the model's ability to distinguish difficult samples. Understandably, the dynamic adjustment mechanism based on the hard example mining factor ensures that the model does not waste computational resources on already learned samples in the later stages of training, but instead continuously challenges those samples that are still misclassified, thereby continuously improving the granularity of the classification boundary.

[0065] In some embodiments, since the loss value is a measure of the difference between the model's predicted value and the true label, the model's weight parameters are iteratively updated through backpropagation and optimization algorithms (such as SGD (Stochastic Gradient Descent) and Adam (Adaptive Moment Estimation)) to gradually decrease the loss value and eventually stabilize it at a low level, resulting in an abnormal traffic detection model that can accurately identify network traffic anomalies. For example, by calculating the gradient of the loss with respect to the parameters of each layer of the model and updating the parameters along the gradient descent direction, the model can gradually approach the optimal decision boundary. This process is repeated until the loss value no longer decreases significantly (convergence), thus obtaining a model that can be used for practical detection.

[0066] The network traffic anomaly detection method provided in this embodiment of the invention acquires the network traffic data to be detected and extracts the payload byte features and statistical features of the network traffic data. The statistical features include traffic scale features, temporal dynamic features, and protocol interaction features. A pixel-filling strategy is used to convert the one-dimensional vector-like payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features into two-dimensional matrix-like grayscale images. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and using the grayscale image corresponding to the payload byte features as the amplitude matrix. Value information is weighted and integrated into each color channel to obtain a traffic visualization image. This traffic visualization image is then input into an abnormal traffic detection model, which includes a convolutional neural network (CNN) with a frequency domain enhancement module embedded in series within it. The CNN extracts spatial domain feature maps from the traffic visualization image and inputs these maps into the frequency domain enhancement module. The frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature maps to obtain enhanced frequency domain features. These enhanced frequency domain features are then inversely transformed back to the spatial domain and fused with the spatial domain feature maps to obtain enhanced features. The output layer of the CNN determines whether the network traffic data is abnormal based on these enhanced features and outputs the network traffic anomaly detection result. This technique improves the accuracy of network traffic anomaly detection and enhances network security.

[0067] According to a specific embodiment of the present invention, in order to solve the problem that the network traffic anomaly detection methods provided by related technologies are difficult to meet the "high reliability and low latency" requirements of industrial control systems, a network traffic anomaly detection method is proposed, mainly for DDoS attack traffic visualization detection.

[0068] First, considering the significant differences in the distribution of DDoS attacks and normal network traffic across dimensions such as traffic scale and temporal dynamics, these differences are transformed into distinguishable features of pixel grayscale and spatial texture after visualization and image conversion, without losing the core attack semantics, thus providing a feasible foundation for visual detection. The end-to-end single-stage architecture of the YOLO series models can quickly complete the entire process from image input to category judgment. Its convolutional pooling structure and multi-scale feature pyramid can accurately capture local attack anomalies and multi-scale features of traffic images. Its lightweight design is more in line with the low latency and edge deployment requirements of industrial DDoS detection. Among them, YOLOv11's ability to extract weak features and its independent classification branch optimization characteristics are highly compatible with the detection approach of this invention, so it was selected as the basic framework. Therefore, addressing the issues of insufficient feature representation, difficulty in balancing feature extraction and semantic integrity, and poor robustness under imbalanced sample conditions in existing DDoS traffic visualization detection methods, this specific implementation proposes a traffic visualization enhancement YOLO detection method for DDoS attacks (denoted as VisDDoS-YOLO). This method is based on traffic image representation and combines lightweight feature enhancement and adaptive balance learning strategies to achieve accurate and efficient identification of complex, covert, and imbalanced DDoS attack traffic. The main processing flow of the corresponding network traffic anomaly detection method is shown in Figure 2. Specifically, Figure 2 The overall architecture of the VisDDoS-YOLO method is implemented in this paper, consisting of four main units: traffic processing, backbone network, frequency domain enhancement, and classification header. This enables end-to-end detection from raw traffic data acquisition to attack identification. Traffic processing unit: The acquired raw network traffic data first undergoes traffic processing, extracting four types of features: payload bytes, traffic scale, time dynamics, and protocol interaction. After normalization, these features are extended to 128×128 pixels using a periodic extension and padding strategy, generating four grayscale images. Subsequently, the traffic scale, time dynamics, and protocol interaction features are mapped to RGB three-channel principal components, and the payload byte features are used as amplitude weights and integrated into each channel to synthesize a 128×128 three-channel RGB image, preserving the attack semantics while achieving visual representation.

[0069] Backbone Network Units: The backbone network adopts the lightweight YOLOv11 architecture and progressively extracts multi-scale spatial features: the first layer Conv16 (3×3, stride=2) downsamples the input image, and the subsequent Conv32, Conv64, Conv128, and Conv256 expand the receptive field layer by layer. The C3k2 module enhances local texture features, and finally outputs a high-dimensional feature map with 256 channels, which balances feature extraction accuracy and edge deployment efficiency.

[0070] The frequency domain enhancement unit comprises SPP (Spatial Pyramid Pooling) and SFPP (Spectral Frequency Pyramid Pooling, also known as the frequency domain enhancement module described earlier, which is placed after the spatial pyramid pooling module of the convolutional neural network). SPP performs multi-scale pooling on the feature map, while SPP further transforms the spatial features to the frequency domain. It enhances high-frequency anomalous features through radial band division, L2 normalization, and a learnable band energy adjustment factor. After the inverse transformation, it is fused with the residual of the original spatial features to improve sensitivity to weak attack patterns.

[0071] Classification Head Unit: The enhanced feature map is compressed into a 1×1×256 vector through global pooling, input into a fully connected layer (FC) for dimension mapping, and finally outputs a binary classification result (normal / abnormal) through the classification head (Classify) to achieve end-to-end DDoS attack detection.

[0072] Secondly, addressing the core issues of Deep Packet Inspection (DPI) technology failing in encrypted traffic environments and traditional single-channel traffic visualization losing multi-dimensional semantic information, this specific implementation method, based on the classic traffic visualization framework of feature decoupling and structured mapping, constructs a three-channel collaborative coding mechanism of grayscale image encoding, non-zero pixel mask, and RGB fusion. This transforms high-dimensional traffic features into RGB three-channel images with physical semantics, providing a highly discriminative structured visual representation foundation for YOLOv11 feature extraction. Figure 3 This is a schematic diagram of the main process for generating a traffic visualization image according to one embodiment of the present invention, such as... Figure 3 As shown: Through three core steps—"raw traffic data cleaning," "spatial mapping of features to grayscale images," and "weighted fusion of grayscale images to RGB images"—high-dimensional network traffic features are transformed into three-channel RGB images with physical semantics, providing a structured visual representation foundation for feature extraction in subsequent YOLOv11 models.

[0073] (1) Cleaning of raw traffic data: First, the DDoS traffic is filtered and cleaned to remove redundant and invalid data and ensure feature quality. Then, traffic features and labels are separated to provide a labeling basis for subsequent supervised learning. For discrete features (such as protocol type, service type, etc.), numerical transformation (such as one-hot encoding) is performed to adapt them to the model input. Finally, all features are globally normalized to compress the numerical range to the [0,1] interval, eliminate the dimensional differences between different features, and provide standardized input for subsequent grayscale image generation.

[0074] (2) Spatial mapping of features to grayscale images: The normalized traffic features are divided into two dimensions: original byte features and statistical features, and grayscale images are encoded separately for each dimension. Among them, the original byte features: retain the distribution pattern of the underlying traffic transmission, and after normalization, they are transformed into two-dimensional grayscale images through a periodic extension and filling strategy (modulo operation cyclic expansion), which serves as the "amplitude information base" for subsequent RGB fusion. Statistical features: further decoupled into three sets of sub-features with clear physical meaning: traffic scale (such as packet length, traffic rate), time dynamics (such as packet interval, timing jitter), and protocol interaction (such as flag distribution, connection status). The corresponding semantic grayscale images are generated through the process of "two-dimensional manifold learning of high-dimensional features → feature distribution boundary regularization → quantization and reshaping → feature to grayscale pixel mapping", ensuring that the physical semantics of each type of feature are accurately preserved in the grayscale image.

[0075] (3) Weighted fusion of grayscale image to RGB image: Based on the strategy of “channel weighted fusion + non-zero pixel mask enhancement”, four grayscale images (original bytes + three types of statistical features) are synthesized into a 128×128 three-channel RGB image. Specifically, (31) Channel principal component mapping: The traffic scale grayscale image is used as the red channel principal component (strengthening the traffic flooding representation), the time dynamic grayscale image is used as the green channel principal component (highlighting timing jitter and interval anomalies), and the protocol interaction grayscale image is used as the blue channel principal component (preserving the protocol behavior and connection state rules). (32) Amplitude information fusion: The grayscale image of the original byte features is used as the “amplitude base” and superimposed on the RGB three channels in a weighted manner to enhance the expression weight of the underlying transmission features. (33) Non-zero pixel mask enhancement: The initial RGB image after fusion is optimized by a non-zero pixel mask strategy (preserving effective feature areas and suppressing background noise) to finally generate a three-channel RGB traffic visualization image with multi-dimensional semantic information, providing a highly discriminative input representation for the YOLOv11 model.

[0076] According to another specific embodiment of the present invention, in order to generate the above-mentioned grayscale image, it is necessary to convert the one-dimensional feature vector into a two-dimensional image. Since the dimension d of the one-dimensional feature vector is much smaller than the total number of pixels P=H×W of the target image, direct mapping will lead to information sparsity. Therefore, a periodic extension and filling strategy is introduced to achieve feature density, and the steps are as follows: First, the eigenvectors are subjected to min-max normalization to eliminate dimensional differences, i.e.: (1) in, Here, f represents the normalized flow characteristic value, and f represents the original flow characteristic value. and These are the global minimum and maximum values ​​for this type of feature, respectively. It is a very small constant used to avoid numerical calculation anomalies caused by a denominator of zero, and to ensure the numerical stability of the normalization operation.

[0077] Subsequently, the eigenvector is expanded cyclically through modulo operations, i.e.: (2) in, Let i be the feature value at the i-th position after expansion, where i is the index of the expanded feature vector (ranging from 0 to P-1), d is the dimension of the original one-dimensional feature vector, and mod is the modulo operation. This operation realizes the cyclic filling of the original short feature vector, expanding the feature dimension from d to the total number of pixels P in the target image, solving the feature sparsity problem while preserving the original feature distribution pattern.

[0078] The expanded vector is then quantized into an 8-bit unsigned integer and reshaped into a two-dimensional matrix: (3) Where M is the generated single-channel grayscale image matrix, P is the expanded one-dimensional feature vector, multiplied by 255 to map the feature values ​​in the [0,1] interval to the pixel grayscale values ​​in the [0,255] interval, unit8() means converting the numerical type to an 8-bit unsigned integer (conforming to the pixel format of the standard grayscale image), and reshape(H,W) means reshaping the one-dimensional vector into a two-dimensional matrix of size H×W, where H and W are the height and width of the target grayscale image, respectively.

[0079] The above operations are performed on the original byte features and the three types of statistical features respectively to obtain four single-channel grayscale matrices. Channel-weighted fusion and non-zero pixel mask enhancement are used to generate red, green, and blue channel images, which are then stacked along the channel dimension. (4) Where X represents the final generated RGB three-channel flow image. These are single-channel grayscale image matrices corresponding to the red, green, and blue channels, respectively. Concat is the channel stitching operation, and axis=-1 indicates that the stitching is performed along the channel dimension. Finally, an RGB image with a size of H×W×3 is generated, realizing a structured visual representation of multi-dimensional traffic characteristics.

[0080] Based on the above specific implementation method, while preserving the original semantics of traffic, the feature sparsity problem is solved by periodic extension, so that flooding attacks appear as high-amplitude bright white areas in the red channel, low-rate attacks appear as temporal abrupt textures in the green channel, and protocol vulnerability attacks appear as abnormal interaction patterns in the blue channel, providing interpretable and highly discriminative visual input for subsequent multi-scale feature extraction of YOLOv11.

[0081] Furthermore, addressing the issue that traditional spatial domain feature extraction is insufficient in representing weak attack features, such as the high-frequency temporal texture of low-rate DDoS attacks and the weak interaction patterns of protocol vulnerability attacks, in the task of accurate DDoS traffic detection, this specific implementation method, combining the advantages of YOLOv11 multi-scale feature pyramid for extracting small targets, embeds frequency domain feature pyramid pooling (SFPP) into the YOLOv11 feature extraction link. This forms a "spatial-frequency domain" serial feature fusion structure with the original spatial pyramid pooling (SPP) module, without replacing the original SPP module. While retaining the spatial domain multi-scale feature aggregation capability, it supplements the frequency domain feature decomposition, alignment, and enhancement capabilities, further improving the detection accuracy and robustness of the task of accurate DDoS traffic detection.

[0082] The original YOLOv11 detection relies solely on spatial domain pyramid pooling to aggregate multi-scale features. While it can capture the macroscopic spatial distribution and texture structure of traffic images, it lacks sensitivity to hidden features such as high-frequency fluctuations in low-rate DDoS attacks and weak anomalies from protocol vulnerability attacks, making it difficult to achieve feature decoupling and anomaly enhancement at the frequency domain level. Therefore, this specific implementation integrates the SFPP module in series after spatial feature extraction. Without disrupting the original spatial feature learning process, it performs frequency domain decomposition, energy calibration, and adaptive fusion on the extracted spatial features, achieving a complete mapping of traffic features from the spatial domain to the frequency domain and then to the enhanced spatial domain.

[0083] A schematic diagram of frequency domain features generated based on specific modules is shown below. Figure 4 As shown. Specifically, the Frequency Domain Feature Pyramid Pooling (SFPP) module is embedded in the YOLOv11 feature extraction chain in a series manner. It aims to address the insufficient sensitivity of traditional spatial domain feature extraction to weak anomalies such as low-rate DDoS attacks and protocol vulnerability attacks, achieving precise feature enhancement through "frequency domain decomposition - energy calibration - inverse transform fusion". Its main steps are as follows: (1) Input and Frequency Domain Decomposition: The input of the SFPP module is the spatial domain feature map extracted by the backbone network. First, the features are transformed from the spatial domain to the frequency domain through two-dimensional fast Fourier transform (FFT2). In the frequency domain, the features are decomposed into three core frequency bands: High frequency component (HF): corresponding to the subtle texture and abrupt change information in the traffic image (such as the timing jitter of low-rate DDoS and the weak anomalies of protocol interaction), which is the key carrier of attack features; Mid frequency component (MF): corresponding to the transition region of the features, balancing spatial details and overall structure; Low frequency component (LF): corresponding to the overall distribution and macroscopic pattern of the traffic image (such as the stable baseline of normal traffic).

[0084] (2) Frequency domain feature processing and fusion: The features of each frequency band after decomposition are processed by L2 normalization to eliminate the energy dimension difference between different frequency bands and ensure the stability of subsequent fusion. Then, through the weighted fusion mechanism, based on the learnable frequency band energy adjustment factor, the high frequency components are enhanced in a targeted manner (increasing the weight of weak attack features), and the mid- and low-frequency components are moderately suppressed (reducing background interference of normal traffic) to achieve adaptive calibration of frequency domain features.

[0085] (3) Inverse Transformation and Output: The fused frequency domain features are transformed back into the spatial domain through a two-dimensional inverse fast Fourier transform (IFFT2) to generate a feature map with enhanced frequency domain features. This output feature map retains the macroscopic structure of the original spatial domain features and strengthens the high-frequency weak attack features. Finally, it forms a "space-frequency domain" cascade fusion with the original spatial features, providing a more discriminative multi-domain feature representation for subsequent detection heads.

[0086] According to another specific embodiment of the present invention, a two-dimensional fast Fourier transform is first performed on the input feature map to map the spatial domain features to the frequency domain to obtain a complex spectrum: (5) in, The frequency domain complex spectrum obtained after transformation. This represents a two-dimensional fast Fourier transform operation, used to transform spatial data into frequency data. This transformation decomposes the traffic image features into different frequency components. Low frequencies correspond to the global distribution and macroscopic structure of traffic, while high frequencies correspond to local attack textures and weak abnormal fluctuations. The spatial domain feature map is the input, which is usually extracted by a convolutional neural network, preserving the structure of the image in the spatial domain; This indicates the data type and shape definition; among them, hollow solid... Represents the field of complex numbers, characterizing Every element in the text is a complex number; italics These represent the number of channels, height, and width of the feature map, respectively.

[0087] Secondly, the spectrum is divided into K frequency bands according to the radial frequency. L2 normalization is performed on each frequency band to eliminate energy differences, and a learnable frequency band energy adjustment factor is introduced. Strengthen the high-frequency attack feature components.

[0088] (6) in, The frequency domain characteristics of the k-th frequency band are... The L2 norm of the k-th frequency band feature is used to measure the frequency band energy. It is a very small constant to prevent division by zero anomalies. It is a learnable frequency band energy adjustment factor used for adaptive enhancement of attack-related high-frequency components.

[0089] Subsequently, through learnable weights Weighted fusion of the calibrated frequency band features is performed to achieve adaptive aggregation of frequency domain features: (7) in, The learnable weights for the k-th frequency band are used to automatically learn the importance of different frequency bands, achieving adaptive enhancement of maintaining the global structure at low frequencies and detecting attack anomalies at high frequencies.

[0090] Then, by performing a two-dimensional inverse Fourier transform, the fused spectrum is mapped back to the spatial domain and the real part is taken to obtain the frequency domain enhancement features: (8) in, ( Re( ) represents the two-dimensional inverse Fourier transform operation. () is the operation to extract the real part of a complex number. This is the spatial domain feature map after frequency domain enhancement. The feature map F output by the backbone network first passes through the SPP module to extract multi-scale spatial features, and then is input into the SFFP module for frequency domain enhancement. The output of SFFP is then fused with the original spatial domain feature map channel by channel using weighted fusion. Finally, feature enhancement and channel alignment are completed through residual structure and 1×1 convolution, resulting in an enhanced feature representation that combines spatial structure and frequency domain details.

[0091] This tandem frequency domain enhancement strategy can deeply mine weak, high-frequency, and hidden attack patterns in traffic images while preserving the integrity of the original spatial features, align features, and improve the model's ability to represent complex DDoS attacks and its robustness.

[0092] Furthermore, in the task of accurate DDoS traffic detection, the imbalance in the distribution of training samples (Class Imbalance) is the core bottleneck restricting the model's recognition performance. Normal traffic samples dominate the dataset, while attack traffic (DDoS) samples, especially the covert attack samples (such as low-rate DDoS and protocol vulnerability attacks), account for a very small proportion. This extreme imbalance makes it impossible for the standard optimization objective to effectively guide the model to learn the features of rare samples, making the model training process easily dominated by majority class samples, ultimately resulting in a severely insufficient recall rate for attack samples, especially covert attacks. To address this problem, this specific implementation abandons the standard cross-entropy (CE) loss that treats all samples equally. By deeply analyzing the statistical characteristics of traffic data, a weighted loss function (denoted as Focal Loss) is designed to address the above problem. While retaining the basic optimization idea of ​​the original loss function, a dual mechanism of class weighting and Focal hard example mining is introduced. Its core mathematical expression is: (9) Where N is the total number of samples in the batch. For the true labels of the samples, To predict probabilities for the model, For cross-entropy loss, For category weighting coefficients, This involves identifying a hard case mining factor. The loss function balances the contribution of different classes in the loss calculation through class weighting coefficients, assigning higher weights to the less numerous attack classes based on the sample distribution, thus mitigating the model bias problem caused by global class imbalance. Simultaneously, it leverages… An exponential modulation mechanism is constructed to dynamically reduce the loss weight of easily distinguishable samples and amplify the loss contribution of difficult-to-distinguish samples, so that the model focuses on hidden DDoS samples with weak features and high identification difficulty during training, thereby enhancing the learning ability of key attack features.

[0093] The weighted Focal Loss provided in this specific implementation form a synergistic optimization relationship with the spatial-frequency domain dual-branch feature fusion structure constructed above. The dual-branch feature fusion structure improves the model's ability to extract and express attack features, especially weak features, while the weighted Focal Loss guides the model to converge toward a more reasonable decision boundary from the perspective of optimization objectives. The two complement each other from the two dimensions of feature enhancement and loss guidance, effectively improving the overall performance and robustness of the model in the task of accurate DDoS traffic detection.

[0094] Meanwhile, the method provided in this embodiment of the invention is validated on a public dataset. Experimental results show that the method achieves lower inference latency while ensuring high accuracy, and can meet the application requirements of real-time intrusion detection and efficient deployment in real network environments.

[0095] Based on the network traffic anomaly detection method provided in the embodiments of the present invention, the present invention also provides a network traffic anomaly detection system 500. Figure 5 As shown, the network traffic anomaly detection system 500 includes: The acquisition module 501 is used to acquire network traffic data to be detected and extract payload byte features and statistical features of the network traffic data; among which, the statistical features include traffic scale features, time dynamic features and protocol interaction features; The traffic visualization module 502 is used to convert the payload byte features, traffic scale features, time dynamic features, and protocol interaction features, which are in the form of one-dimensional vectors, into grayscale images in the form of two-dimensional matrices through a pixel filling strategy. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, time dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and incorporating the grayscale image corresponding to the payload byte features as amplitude information into each color channel to obtain the traffic visualization image. The input module 503 is used to input the traffic visualization image into the abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; The anomaly detection module 504 is used to extract the spatial domain feature map of the traffic visualization image through a convolutional neural network and input the spatial domain feature map into the frequency domain enhancement module; the frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature map to obtain the frequency domain enhanced features, and then inversely transforms the frequency domain enhanced features back to the spatial domain and fuses them with the spatial domain feature map to obtain the enhanced features; through the output layer of the convolutional neural network, it determines whether the network traffic data is abnormal traffic based on the enhanced features and outputs the network traffic anomaly detection result.

[0096] Based on the above settings, by transforming network traffic data from one-dimensional, shallow features into a traffic visualization image with multi-dimensional semantic information, and utilizing a feature extraction architecture that combines the spatial domain and frequency domain, enhanced features are obtained that simultaneously capture the macroscopic distribution patterns and microscopic high-frequency anomaly patterns of traffic. Finally, based on these enhanced features, high-precision anomaly detection results are output, thereby achieving the technical effect of improving the accuracy of network traffic anomaly detection and enhancing network security.

[0097] Meanwhile, since the aforementioned network traffic anomaly detection system is a system-class solution corresponding to the aforementioned network traffic anomaly detection method, and it is used to implement the aforementioned network traffic anomaly detection method, each module in the aforementioned network traffic anomaly detection system can execute all the corresponding operations in the aforementioned network traffic anomaly detection method, and thus possesses all the technical effects that the aforementioned network traffic anomaly detection method can achieve, which will not be elaborated here.

[0098] It should be noted that the specific modules in the above-mentioned network traffic anomaly detection system are defined based on the corresponding operations performed, and are not intended to limit the specific modules.

[0099] This invention also provides a non-transitory machine-readable medium storing a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform a method according to an embodiment of this invention.

[0100] This invention also provides a computer program product, including a computer program, wherein the computer program, when executed by a computer's processor, is used to cause the computer to perform the methods of embodiments of this invention. The computer program product should be understood as a software product that primarily implements the methods of this invention through a computer program.

[0101] This invention also provides an electronic device, including: at least one processor; and a memory communicatively connected to the at least one processor. The memory stores a computer program executable by the at least one processor, which, when executed by the at least one processor, causes the electronic device to perform the method of this invention.

[0102] refer to Figure 6 The present invention will now be described in the form of a structural block diagram of an electronic device that can serve as an embodiment of the present invention, which is an example of a hardware device that can be applied to various aspects of the present invention. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0103] like Figure 6As shown, the electronic device includes a computing unit 601, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. The RAM 603 may also store various programs and data required for the operation of the electronic device. The computing unit 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0104] Multiple components in the electronic device are connected to I / O interface 605, including: input unit 606, output unit 607, storage unit 608, and communication unit 609. Input unit 606 can be any type of device capable of inputting information into the electronic device. Input unit 606 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of the electronic device. Output unit 607 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 608 may include, but is not limited to, disks and optical discs. Communication unit 609 allows the electronic device to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, and / or wireless communication transceivers, such as Bluetooth devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0105] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, CPUs, graphics processing units (GPUs), various special-purpose artificial intelligence (AI) computing units, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above. For example, in some embodiments, the method embodiments of the present invention can be implemented as a computer program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on an electronic device via ROM 602 and / or communication unit 609. In some embodiments, the computing unit 601 can be configured to perform the methods described above by any other suitable means (e.g., by means of firmware).

[0106] Computer programs for implementing the methods of embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0107] In the context of embodiments of the present invention, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable signal medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, or infrared systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, compact optical disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0108] It should be noted that the term "comprising" and its variations used in the embodiments of the present invention are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of the present invention are illustrative and not restrictive. Those skilled in the art should understand that, unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0109] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in the embodiments of the present invention are all information and data that have been permitted by the user or have been fully agreed upon by all parties. Furthermore, the collection, use and processing of the relevant data must comply with relevant laws, regulations and standards, and corresponding operation entry points are provided for users to choose to agree or refuse.

[0110] The steps described in the method embodiments provided by this invention can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of this invention is not limited in this respect.

[0111] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of the invention. The appearance of this phrase in various places in the specification does not necessarily imply the same embodiment, nor does it imply independence or alternativeity from other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0112] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A method for detecting network traffic anomalies, characterized in that, include: The network traffic data to be detected is acquired, and the payload byte features and statistical features of the network traffic data are extracted; wherein, the statistical features include traffic scale features, time dynamic features and protocol interaction features; The payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, are converted into grayscale images in two-dimensional matrix form using a pixel filling strategy. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and weighting the grayscale image corresponding to the payload byte features as amplitude information and integrating it into each color channel to obtain the traffic visualization image. The traffic visualization image is input into the abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; The spatial domain feature map of the traffic visualization image is extracted by the convolutional neural network and input into the frequency domain enhancement module. The frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature map to obtain frequency domain enhanced features. The frequency domain enhanced features are then inversely transformed back to the spatial domain and fused with the spatial domain feature map to obtain enhanced features. The output layer of the convolutional neural network determines whether the network traffic data is abnormal based on the enhanced features and outputs the network traffic anomaly detection result.

2. The method according to claim 1, characterized in that, The step of mapping the grayscale images corresponding to the traffic scale feature, the time dynamic feature, and the protocol interaction feature to the principal components of the red, green, and blue channels, respectively, and then weighting the grayscale image corresponding to the payload byte feature as amplitude information and integrating it into each color channel to obtain the traffic visualization image includes: The grayscale image corresponding to the traffic scale feature is used as the principal component of the red channel to characterize the traffic flooding feature; the grayscale image corresponding to the time dynamic feature is used as the principal component of the green channel to characterize the time jitter and interval anomaly features of the traffic; the grayscale image corresponding to the protocol interaction feature is used as the principal component of the blue channel to characterize the protocol behavior and connection state regularity features of the traffic. The grayscale image corresponding to the payload byte feature is used as amplitude information and superimposed onto the red, green and blue channels respectively through a weighted method to obtain the grayscale image of each channel; The grayscale images of each channel are weighted and fused to synthesize an initial image. The initial image is then optimized using a non-zero pixel mask enhancement strategy to obtain the traffic visualization image.

3. The method according to claim 1, characterized in that, The step of converting the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, into grayscale images in two-dimensional matrix form using a pixel filling strategy, includes: The one-dimensional vectors corresponding to the payload byte feature, the traffic scale feature, the time dynamic feature, and the protocol interaction feature are each normalized. A pixel filling strategy is adopted, which uses modulo operation to iteratively expand the normalized one-dimensional vector until the preset total number of pixels of the target grayscale image is reached; the pixel filling strategy includes a periodic extension filling strategy. The values ​​in the expanded vector are mapped to pixel values ​​in the range of 0-255 to obtain a quantized one-dimensional vector. The quantized one-dimensional vector is then rearranged into a two-dimensional matrix in row-major order to obtain the grayscale image corresponding to each feature.

4. The method according to claim 1, characterized in that, The frequency domain enhancement module is connected in series after the spatial pyramid pooling module of the convolutional neural network; wherein, the step of performing frequency domain enhancement processing on the spatial domain feature map using the frequency domain enhancement module to obtain the frequency domain enhanced frequency domain features includes: The frequency domain enhancement module is used to perform a two-dimensional fast Fourier transform on the spatial domain feature map to obtain a complex frequency spectrum, and the complex frequency spectrum is divided into multiple frequency bands according to the radial frequency. The features within each frequency band are normalized to eliminate energy differences, and a learnable frequency band energy adjustment factor is introduced to enhance the high-frequency components in each frequency band. The enhanced frequency domain features are obtained by weighting and summing the features within each frequency band using learnable weights.

5. The method according to claim 4, characterized in that, The step of inversely transforming the frequency-domain enhanced features back to the spatial domain and fusing them with the spatial domain feature map to obtain enhanced features includes: The frequency domain enhancement module performs a two-dimensional inverse Fourier transform on the frequency domain features after frequency domain enhancement and takes the real part to obtain the spatial domain feature map after frequency domain enhancement. The enhanced spatial domain feature map is fused with the original spatial domain feature map output by the spatial pyramid pooling module through residual connection to obtain the enhanced feature.

6. The method according to claim 1, characterized in that, It also includes the training steps for the abnormal traffic detection model: Construct a training dataset containing normal network traffic samples and abnormal network traffic samples, and convert each sample in the training dataset into a traffic visualization training image with multidimensional semantic information; The traffic visualization training image is input into the abnormal traffic detection model to be trained to obtain the detection result; A loss function is used to calculate the loss value based on the detection results and the true labels of each sample. The loss function introduces a class balance coefficient and a hard case mining factor. The class balance coefficient is used to assign different weights to different classes according to the sample distribution to alleviate the imbalance in the contribution of normal traffic samples and abnormal traffic samples in the loss calculation. The hard case mining factor is used to dynamically reduce the loss weight of easily classified samples so that the model focuses on difficult-to-classify abnormal samples. The parameters of the abnormal traffic detection model are updated based on the loss value until the model converges.

7. The method according to claim 2, characterized in that, The step of optimizing the initial image using a non-zero pixel mask enhancement strategy includes: Generate a binary mask corresponding to the initial image; wherein the binary mask is used to identify non-zero pixel regions in the initial image; The binary mask preserves and enhances the features of the non-zero pixel regions while suppressing interference from zero-value regions, thereby achieving optimized processing of the initial image.

8. A network traffic anomaly detection system, characterized in that, include: The acquisition module is used to acquire network traffic data to be detected and extract payload byte features and statistical features of the network traffic data; wherein, the statistical features include traffic scale features, time dynamic features and protocol interaction features; The traffic visualization module is used to convert the payload byte features, traffic scale features, temporal dynamic features, and protocol interaction features, which are in one-dimensional vector form, into grayscale images in two-dimensional matrix form using a pixel filling strategy. The grayscale images are then fused to generate a traffic visualization image with multi-dimensional semantic information. The fusion process includes mapping the grayscale images corresponding to the traffic scale features, temporal dynamic features, and protocol interaction features to the principal components of the red, green, and blue channels, respectively, and weighting the grayscale image corresponding to the payload byte features as amplitude information and integrating it into each color channel to obtain the traffic visualization image. An input module is used to input the traffic visualization image into an abnormal traffic detection model; wherein, the abnormal traffic detection model includes a convolutional neural network, and a frequency domain enhancement module is embedded in series in the convolutional neural network; An anomaly detection module is used to extract the spatial domain feature map of the traffic visualization image through the convolutional neural network, and input the spatial domain feature map into the frequency domain enhancement module; the frequency domain enhancement module performs frequency domain enhancement processing on the spatial domain feature map to obtain frequency domain enhanced features, then inversely transforms the frequency domain enhanced features back to the spatial domain, and fuses them with the spatial domain feature map to obtain enhanced features; through the output layer of the convolutional neural network, it determines whether the network traffic data is abnormal traffic based on the enhanced features, and outputs the network traffic anomaly detection result.

9. An electronic device, comprising: A processor and a memory storing a program, characterized in that the program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1 to 7.

10. A non-transitory machine-readable medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 7.

Images