A network flow data monitoring and early warning method based on a local area network

Abstract

This invention belongs to the field of computer network technology, and particularly relates to a method for monitoring and early warning of network traffic data based on a local area network (LAN). Through a micro-motion early warning and dynamic baseline system confidence scoring filtering mechanism, a low-latency sliding window is first used to trigger a micro-motion early warning, and then the confidence score is calculated using the dynamic baseline system. This effectively eliminates interference caused by instantaneous jitter and periodic fluctuations, significantly reducing the number of invalid warnings and improving the accuracy of anomaly detection. The constructed multi-dimensional correlation analysis engine integrates multiple analysis paths to perform composite verification of abnormal events, providing a reliable basis for subsequent precise handling. This invention employs a dynamic weighting algorithm in the risk assessment stage, effectively reducing the risk of erroneous operations due to human intervention. The introduced federated learning framework enables cross-domain knowledge sharing and improves the ability of each LAN to identify unknown attack patterns, while ensuring that the original traffic data does not leave the domain, meeting compliance requirements for data security and privacy protection.

Description

Technical Field

[0001] This invention belongs to the field of computer network technology, and in particular relates to a method for monitoring and early warning of network traffic data based on a local area network. Background Technology

[0002] With the rapid development of enterprise informatization and IoT technology, the scale of local area networks (LANs) is constantly expanding, and network traffic data is showing explosive growth and complex and volatile characteristics. Abnormal fluctuations in network traffic can not only lead to network congestion and service interruptions, but may also indicate network attacks or equipment failures. Therefore, real-time monitoring and accurate early warning of LAN traffic are crucial. Existing network traffic monitoring methods, such as polling based on Simple Network Management Protocol (SMLP) or sampling based on NetFlow, have the following main shortcomings: First, the data collection granularity is coarse, mostly using fixed-period sampling or aggregation statistics, with sampling periods typically on the order of minutes, making it difficult to capture micro-bursts of traffic at the second level. Second, threshold settings are rigid, relying on manually set static thresholds, which cannot adapt to the dynamic patterns of network traffic changes over time and business models. Static thresholds either result in a large number of missed alarms due to being set too high, or a large number of false alarms due to being set too low, requiring maintenance personnel to handle hundreds of invalid alarms on average every day, leading to "alarm fatigue." Third, the analysis dimensions are limited, often based on a single indicator, lacking correlation analysis of multi-dimensional information such as packet content, connection status, and host behavior. A single indicator is insufficient to distinguish between normal business peaks and abnormal traffic, making misjudgments easy. The early warning mechanism is passive, only issuing alerts and lacking linkage with the network management system. Summary of the Invention

[0003] This invention addresses the technical problems existing in computer network technology by proposing a reasonable, simple, and theoretically sound method for monitoring and early warning of network traffic data based on local area networks.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows: a method for monitoring and early warning of network traffic data based on a local area network, comprising the following steps:

[0005] S1. Deploy probes at key nodes of the local area network to collect raw traffic data in real time, calculate traffic characteristics based on a sliding time window, and trigger a micro-motion warning when the abnormal index of traffic characteristics exceeds a preset threshold.

[0006] S2. Construct a dynamic baseline system to calculate a confidence score for the traffic characteristics corresponding to the micro-motion warning. When the confidence score is lower than a preset threshold, mark the corresponding event as a suspicious candidate and ignore the suspicious candidate. When the confidence score is higher than the preset threshold, upgrade the corresponding event to an abnormal event to be verified.

[0007] S3. For the abnormal event to be verified, start the multidimensional correlation analysis engine. The multidimensional correlation analysis engine integrates multiple analysis paths to perform composite verification of the abnormal event. After the composite verification is passed, the causal direction between events is determined based on the causal inference layer, and the valid abnormal event is output.

[0008] S4. For the aforementioned valid abnormal events, a dynamic weighting algorithm is used to conduct a comprehensive risk assessment of the abnormal events, and different levels of early warning information are output based on the risk score.

[0009] S5. When the early warning information reaches the preset handling level, automatically extract the network information related to the abnormal event, construct a twin subnet in the isolated environment, simulate and calculate the handling strategy score in the twin subnet and recommend the optimal strategy;

[0010] S6. A federated learning framework is used to achieve cross-domain knowledge sharing among multiple local area networks. Each local node uploads model parameter information to the central server, and the central server aggregates and generates a global model and distributes it to each local node.

[0011] S7. Using the early warning information and handling results as labeled data, periodically perform incremental training on the baseline calculation parameters of the dynamic baseline system and the correlation analysis model parameters of the multidimensional correlation analysis engine.

[0012] Preferably, the traffic characteristics in S1 include the temporal entropy of the data packet arrival time interval and the spatial entropy of the data packet length, and the formulas for calculating the temporal entropy and spatial entropy are as follows:

[0013] ,

[0014] ,

[0015] in, For time entropy, Number of categories for time intervals For the first The probability of class interval, For spatial entropy, For the first The probability of a long class package. The number of categories for package length.

[0016] Preferably, the formula for calculating the flow characteristic anomaly index in S1 is:

[0017] ,

[0018] ,

[0019] ,

[0020] ,

[0021] in, This is an abnormal index of traffic characteristics. The historical average of spatial entropy. The historical average of time entropy. To prevent division by zero constant, The time entropy weighting index, It is the spatial entropy weighting index. For the length of the history window, For the first The spatial entropy of a window The historical standard deviation of spatial entropy. For the first The time entropy of a window, The historical standard deviation of time entropy.

[0022] Preferably, the dynamic baseline system in S2 includes a generator. Discriminator The confidence anchoring module includes a generator for predicting expected normal traffic values, a discriminator for determining the degree of deviation between actual traffic and predicted values, and a confidence score calculated based on the discriminator's determination result. The calculation formula is:

[0023] ,

[0024] ,

[0025] in, In order to be in Predicted flow rate at any given time From time arrive Historical flow sequence For generator Model parameters, For at any time The observed actual flow rate, This is the core discrimination function of the discriminator. For discriminator Model parameters, For the backtracking window length, For a moment The observed actual flow rate, For at any time The predicted flow value.

[0026] Preferably, the multiple analysis paths in S3 include spatiotemporal feature analysis, host behavior profiling comparison, and deep application protocol analysis. The causal inference layer constructs a dynamic causal graph by calculating the propagation entropy between events. The formula for calculating the propagation entropy is:

[0027] ,

[0028] in, To transfer entropy, For time series of events that may be the cause, For time series events that may be the outcome, For the event exist Intensity at any moment For the event exist Before the moment The historical state vector at each moment, For the event exist Before the moment The historical state vector at each moment, For conditional probability density, For joint probability density, For conditional probability density, This represents the length of the time series.

[0029] Preferably, the dynamic causal graph employs an incremental causal structure learning algorithm to determine the causal direction in real time. This incremental causal structure learning algorithm... Time only for new event sets Related node subset For local updates, the calculation formula for local updates in the incremental causal structure learning algorithm is as follows:

[0030] ,

[0031] in, It is a node in a causal graph. This represents all nodes in the cause-effect graph.

[0032] Preferably, the dimension in the dynamic weight algorithm in S4 weight The calculation formula is:

[0033] ,

[0034] in, For dimension The basic weights, For dimension Historical false alarm rate False alarm penalty coefficient, This is an adjustment factor based on business importance. To assign importance scores to the affected business, the risk score calculation formula in S4 is as follows:

[0035] ,

[0036] ,

[0037] ,

[0038] ,

[0039] ,

[0040] in, These are the weighting coefficients for spatiotemporal feature analysis. For spatiotemporal anomaly degree, Weighting coefficients for host behavior profiles Host behavior deviation Weighting coefficients for application protocol parsing For protocol parsing anomaly degree, Weighting coefficients in causal path analysis For the severity of the causal path, Due to the abnormal propagation speed, This is the baseline for normal transmission speed. For the propagation path length, Network diameter, This is the current behavior feature vector. This is a vector of historical behavior mean values. For packet payload, For abnormal signatures, Accumulated weights for the paths, For the maximum cumulative weight, For signature library.

[0041] Preferably, the formula for calculating the treatment strategy score in S5 is as follows:

[0042] ,

[0043] ,

[0044] ,

[0045] in, As a disposal strategy score, The weighting coefficient for the degree of abnormal mitigation. For a moment Degree of abnormal relief The attenuation rate, The weighting coefficients represent the degree of impact on normal business operations. For a moment The extent of the impact on normal business operations For a moment Disposal strategy Simulate the degree of abnormality before execution. To ensure smoothness and prevent the denominator from being zero, For a moment Disposal strategy Normal business throughput before execution time Disposal strategy Normal business throughput after execution For a moment Disposal strategy The degree of abnormality after simulation execution.

[0046] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0047] This invention employs a micro-motion early warning and dynamic baseline system confidence scoring filtering mechanism. It first triggers a micro-motion early warning with a low-latency sliding window, then combines this with the dynamic baseline system to calculate a confidence score. Low-confidence events are marked as suspicious candidates and ignored, effectively eliminating interference from instantaneous jitter and periodic fluctuations, significantly reducing the number of invalid alarms and improving the accuracy of anomaly detection. This invention constructs a multi-dimensional correlation analysis engine, integrating multiple analysis paths to perform composite verification of anomaly events. It also determines the causal direction between events through a causal inference layer, outputting a causal subgraph, providing a reliable basis for subsequent precise handling. In the risk assessment stage, this invention uses a dynamic weighting algorithm to output tiered early warnings. For events reaching the handling level, it automatically constructs a twin subnet in an isolated environment, simulates and calculates the effects of various handling strategies, and recommends the optimal strategy, effectively reducing the risk of human intervention errors. By introducing a federated learning framework, each local node only uploads model parameter information to the central server. After the global model is aggregated and generated, it is distributed to each local node. This enables cross-domain knowledge sharing, improves the ability of each local network to identify unknown attack patterns, and ensures that the original traffic data does not leave the domain, thus meeting the compliance requirements for data security and privacy protection. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a schematic diagram of a network traffic data monitoring and early warning method based on a local area network. Detailed Implementation

[0050] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described below in conjunction with the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0051] Numerous specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways than those described herein, and therefore the invention is not limited to the specific embodiments disclosed in the following specification.

[0052] Traditional network traffic monitoring methods employ fixed-period sampling, typically aggregating data at a minute-level granularity. This approach suffers from three fundamental drawbacks: first, a time blind zone where micro-burst traffic within the sampling interval is completely lost; second, a boundary effect where abnormal events crossing sampling boundaries are fragmented into isolated segments, making it difficult to identify their continuity and correlation; and third, a response lag where the detection delay equals the sampling period, often resulting in attacks or faults being discovered only after damage has occurred. To address these shortcomings, this invention proposes a local area network (LAN)-based network traffic data monitoring and early warning method. First, by using continuously overlapping windows to cover every micro-moment, the time blind zone is eliminated, enabling precise capture of burst traffic. Second, calculation results are output every 10 microseconds, compressing the early warning delay from minutes to microseconds for real-time sensing. Third, the dense, continuous time series provides stable and smooth input data for the dynamic baseline model, making the estimation of historical statistics more accurate and reliable. Fourth, the unified time granularity ensures natural alignment of different event sequences, providing a precise temporal alignment basis for the causal inference engine, enabling the transfer entropy calculation to accurately identify causal relationships between events.

[0053] Traditional network traffic monitoring methods focus on the absolute value of traffic, which is fundamentally limited by using changes in "quantity" as the sole basis for anomaly detection. However, network attacks and faults often manifest as anomalies in the "quality" of traffic—that is, sudden changes in the internal structure and regularity of traffic. The absolute value of traffic may not exceed a preset threshold, leading to misjudgments of normal business peaks and missed detections of micro-burst attacks. Time entropy and spatial entropy are scientific tools from an information theory perspective to solve this problem: time entropy measures the regularity of packet arrival intervals, distinguishing between periodic normal business traffic and random attack traffic; spatial entropy measures the orderliness of packet length distribution, identifying unique packet length fingerprints of different application behaviors and attack types. The two complement each other—a single dimension has blind spots, but the combination of the two dimensions—time entropy captures temporal anomalies, and spatial entropy captures structural anomalies, jointly constructing a dimensional leap from "quantity" to "chaos," enabling the system to accurately capture microsecond-level early anomaly signals through changes in microstructure when the absolute value of traffic does not exceed the threshold, achieving a leap from "passive response" to "proactive early warning." Therefore, probes are deployed at key nodes of the local area network to collect raw traffic data in real time. Traffic characteristics are calculated based on a sliding time window, and a micro-motion warning is triggered when the traffic characteristic anomaly index exceeds a preset threshold. Specifically, the traffic characteristics include the temporal entropy of the data packet arrival time interval and the spatial entropy of the data packet length. The formulas for calculating the temporal entropy and spatial entropy are as follows:

[0054] ,

[0055] ,

[0056] in, For time entropy, Number of categories for time intervals For the first The probability of class interval, For spatial entropy, For the first The probability of a long class package. The number of categories for package length.

[0057] Preferably, the formula for calculating the flow characteristic anomaly index in S1 is:

[0058] ,

[0059] ,

[0060] ,

[0061] ,

[0062] in, This is an abnormal index of traffic characteristics. The historical average of spatial entropy. The historical average of time entropy. To prevent division by zero constant, The time entropy weighting index, It is the spatial entropy weighting index. For the length of the history window, For the first The spatial entropy of a window The historical standard deviation of spatial entropy. For the first The time entropy of a window, The historical standard deviation of time entropy.

[0063] Traditional dynamic baseline systems, built upon generative adversarial networks (GANs), rely on generators that passively learn all historical traffic data, including attack traffic. This approach suffers from three fundamental flaws: First, the model becomes "poisoned." When attackers employ adaptive strategies like slow, low-speed attacks to simulate normal traffic patterns, the generator mistakenly identifies the attack traffic as normal and incorporates it into training, causing the baseline to gradually shift and subsequent attacks to become more covert. Second, single-point fluctuations lead to model instability. Traffic fluctuations at any given moment can trigger model updates, causing drastic parameter oscillations and preventing the formation of a stable normal traffic baseline. Third, the system cannot distinguish between model misjudgments and genuine anomalies. The discriminator's single judgment is directly used for model training; when the discriminator itself makes a mistake, it propagates the error signal back, contaminating the generator and creating a vicious cycle. Therefore, a dynamic baseline system is constructed that calculates a confidence score for the traffic features corresponding to the micro-motion warning. When the confidence score is below a preset threshold, the corresponding event is marked as a suspicious candidate and ignored. When the confidence score is above the preset threshold, the corresponding event is upgraded to an anomaly event awaiting verification. Specifically, the dynamic baseline system includes a generator... Discriminator The confidence anchoring module includes a generator for predicting expected normal traffic values, a discriminator for determining the degree of deviation between actual traffic and predicted values, and a confidence score calculated based on the discriminator's determination result. The calculation formula is:

[0064] ,

[0065] ,

[0066] in, In order to be in Predicted flow rate at any given time From time arrive Historical flow sequence For generator Model parameters, For at any time The observed actual flow rate, This is the core discrimination function of the discriminator. For discriminator Model parameters, For the backtracking window length, For a moment The observed actual flow rate, For at any time The predicted flow value.

[0067] The core design idea of ​​the confidence score is to replace single-point judgments with collective judgments through historical windows. The length of the backtracking window ensures that the assessment focuses on persistence rather than occasional fluctuations. The discriminator output, as the judgment result of professional experts, directly reflects the degree of matching between actual traffic and predicted values. The judgment threshold converts continuous outputs into binary judgments: values ​​above the threshold indicate "normal," and values ​​below indicate "abnormal." The indicator function counts the number of normal judgments, and the summation and averaging yield a confidence score between 0 and 1. Its core advantage lies in the fact that when the confidence score falls below the preset threshold, the system proactively pauses model updates, marks the traffic in the current period as a "suspicious candidate," and waits for confirmation through multidimensional correlation analysis before deciding whether to include it in training. This achieves a leap from passive learning to proactive defense. Through the backtracking window, the system smooths out short-term fluctuations, and only persistent anomalies trigger isolation, ensuring the robustness of the model and effectively resisting poisoning attacks against the model itself. This gives the dynamic baseline system the ability to be self-immune and continuously evolve.

[0068] Traditional network monitoring methods have three fundamental limitations: First, the monitoring perspective is fragmented. Single-node monitoring can only see local anomalies and cannot perceive the overall propagation of attacks within the local area network, causing maintenance personnel to only see the trees and not the forest. Second, the detection methods are superficial. Port-based identification is completely ineffective against modern covert attacks. Attackers can easily bypass detection by simply disguising malicious traffic as normal HTTP / HTTPS traffic on ports 80 or 443. Third, the analysis logic is shallow, staying at the level of "event correlation". It can only determine that A and B occur simultaneously, but cannot distinguish between "correlation" and "causation". This leads to concurrent but unrelated events being incorrectly linked, misleading maintenance personnel to repeatedly deal with symptoms while the real root cause continues to cause harm. Traditional early warning systems employ static weight allocation, where the weights of each analysis dimension are fixed during deployment. This fails to adapt to dynamic changes in the network environment—dimensional reliability evolves over time (a dimension may initially perform well, but its false positive rate may increase with the emergence of new attacks), and business importance varies depending on the event (the severity of the same anomaly affecting the core database differs drastically from its impact on the test environment). Static weights lead to three fundamental problems: high false positive dimensions continuously outputting invalid alarms, treating core business anomalies and peripheral business anomalies equally, and the system's inability to learn from historical errors. Therefore, for the anomaly event to be verified, a multi-dimensional correlation analysis engine is activated. This engine integrates multiple analysis paths to perform composite verification of the anomaly event. After successful composite verification, a causal inference layer determines the causal direction between events and outputs valid anomaly events. Specifically, the multiple analysis paths include spatiotemporal feature analysis, host behavior profiling comparison, and deep application protocol analysis. The causal inference layer constructs a dynamic causal graph by calculating the propagation entropy between events. The formula for calculating the propagation entropy is:

[0069] ,

[0070] in, To transfer entropy, For time series of events that may be the cause, For time series events that may be the outcome, For the event exist Intensity at any moment For the event exist Before the moment The historical state vector at each moment, For the event exist Before the moment The historical state vector at each moment, For conditional probability density, For joint probability density, For conditional probability density, The time series length is specified. The dynamic causal graph employs an incremental causal structure learning algorithm to determine causal directions in real time. This incremental causal structure learning algorithm... Time only for new event sets Related node subset For local updates, the calculation formula for local updates in the incremental causal structure learning algorithm is as follows:

[0071] ,

[0072] in, It is a node in a causal graph. This represents all nodes in the cause-effect graph. For the valid abnormal events, a dynamic weighting algorithm is used to perform a comprehensive risk assessment, and different levels of early warning information are output based on the risk score. Specifically, in the dynamic weighting algorithm of S4, the dimension... weight The calculation formula is:

[0073] ,

[0074] in, For dimension The basic weights, For dimension Historical false alarm rate False alarm penalty coefficient, This is an adjustment factor based on business importance. To assign importance scores to the affected business, the risk score calculation formula in S4 is as follows:

[0075] ,

[0076] ,

[0077] ,

[0078] ,

[0079] ,

[0080] in, These are the weighting coefficients for spatiotemporal feature analysis. For spatiotemporal anomaly degree, Weighting coefficients for host behavior profiles Host behavior deviation Weighting coefficients for application protocol parsing For protocol parsing anomaly degree, Weighting coefficients in causal path analysis For the severity of the causal path, Due to the abnormal propagation speed, This is the baseline for normal transmission speed. For the propagation path length, Network diameter, This is the current behavior feature vector. This is a vector of historical behavior mean values. For packet payload, For abnormal signatures, Accumulated weights for the paths, For the maximum cumulative weight, For signature library.

[0081] Spatiotemporal feature analysis expands the monitoring perspective from single nodes to the entire network topology. By analyzing the propagation path, speed, and correlation of abnormal traffic across regions, it enables operations and maintenance personnel to determine whether a local fault is a global attack. Host behavior profiling establishes a refined behavioral baseline for each host. By calculating the Mahalanobis distance between the current behavior and the baseline, it identifies the degree of deviation, leaving no room for internal lateral movement, compromised hosts, and unauthorized behavior to hide. Deep application protocol analysis delves into the packet load level, identifying DNS tunnels, HTTP backdoors, and encrypted malicious traffic hidden in normal protocols through deep packet inspection and signature matching, breaking through the limitations of port-based detection. The causal inference layer uses transfer entropy—a non-linear, directional, and latency-intensive information theory tool—to construct a dynamic causal graph. From the perspective of information flow, it accurately determines the causal direction between events, elevating anomaly identification from "correlation" to "causation." Network anomalies are complex systemic problems involving multiple dimensions, and no single dimension can independently provide accurate diagnosis. Spatiotemporal feature analysis can trace the propagation path of anomalies, but it cannot identify the source host or the type of attack; host behavior profiling can detect deviations in the behavior of a single host, but it cannot determine whether the deviation is a localized problem or a network-wide spread; application protocol analysis can identify malicious features in the load, but it cannot pinpoint the source of the attack or its propagation direction; causal inference can determine the causal direction between events, but it cannot independently determine the degree of anomaly and the nature of the attack. The essence of four-dimensional collaboration is to use the spatial dimension to answer "where does the anomaly spread," the subject dimension to answer "which host is suspicious," the content dimension to answer "what type of attack," and the logical dimension to answer "who is the real root cause." These four dimensions complement each other to form a cross-validation mechanism—the consistency between the propagation path of spatiotemporal analysis and the direction of causal inference verifies the accuracy of root cause location; the matching of the abnormal host in the behavior profiling with the attack features in the protocol analysis verifies the reliability of attack identification; and each dimension fills in the cognitive blind spots of the others.

[0082] Traditional methods require recalculating the propagation entropy between all node pairs in the entire causal graph every time a new event occurs, resulting in extremely high complexity. In high-speed network environments where tens of thousands of events are generated per second, a full recalculation can instantly exhaust computing resources, leading to system crashes. Due to the excessive computational load, traditional causal inference can only be used for offline analysis and cannot meet the real-time requirements of network monitoring. By the time the causal graph calculation is complete, the attack has already caused damage, and the early warning has lost its time window value. Full graph recalculation requires a large amount of CPU and memory resources, competing for resources with other tasks of the network monitoring system (data acquisition, feature calculation, and early warning output), leading to a decline in overall system performance. Each full graph recalculation causes drastic fluctuations in causal relationships; a single, sporadic event can cause significant changes to the entire causal graph structure, resulting in unstable output and failing to provide a reliable basis for operational decisions.

[0083] The incremental causal structure learning algorithm reduces computational complexity by limiting the update scope to a subset of local nodes affected by new events, thus transforming causal inference from offline analysis to an online real-time engine and achieving a balance between real-time performance, resource efficiency, scalability, and system stability.

[0084] The false alarm penalty coefficient dynamically reduces the weight of poorly performing dimensions based on historical false alarm rates, while the business adjustment factor dynamically increases the weight based on business importance, giving higher attention to core business anomalies. These three elements work together to achieve a shift from "fixed presets" to "dynamic adaptation." This design solves three major problems: static weights cannot adapt to changes in dimension reliability, cannot perceive differences in business importance, and cannot learn from historical errors. It brings five major benefits: adaptive evolution, false alarm suppression, enhanced robustness, and interpretability, transforming the early warning system from a "static rule executor" into a "dynamic adaptive decision engine."

[0085] Traditional methods typically rely on a single indicator to identify anomalies, but a sudden surge in bandwidth could be a peak in video conferencing or a network attack, which cannot be distinguished by a single dimension. Risk scoring integrates four dimensions—spatiotemporal characteristics, host behavior, protocol parsing, and causal paths—to comprehensively characterize anomalies from four perspectives: "scope of impact, behavioral deviation, attack identification, and root cause chain," avoiding misjudgments based on a single dimension. Traditional systems use fixed weights, where a dimension initially performs well but still dominates when the false positive rate increases, continuously outputting invalid alarms. Risk scoring uses dynamic weights to automatically reduce the weight of dimensions with high false positive rates and automatically increase the weight of dimensions with core business anomalies, achieving dynamic matching between weights and actual conditions. Traditional methods can only determine that "event A is related to event B," but cannot determine the severity of A causing B. Traditional systems treat core database anomalies and test environment anomalies the same, causing operations personnel to be overwhelmed by a large number of low-value alarms, delaying the handling of core business issues.

[0086] The risk scoring employs a multi-factor weighted summation because network anomalies are complex phenomena involving multiple dimensions, and no single dimension can independently measure the true severity of the risk. The selection of factors for each dimension follows the core principle of "using the most direct physical quantities to characterize the essence of the anomaly"—the spatiotemporal anomaly degree is selected based on propagation speed and path because the risk of an anomaly is jointly determined by its spread speed and affected area; the host behavior deviation degree is selected using Mahalanobis distance instead of simple Euclidean distance because the correlation between behavioral characteristics needs to be considered; the protocol parsing anomaly degree is selected based on the maximum matching degree between the payload and the signature database because modern attacks are highly covert and require in-depth analysis. Layer-based rather than port-based identification; causal path severity selection path cumulative weighting This is because the longer and stronger the causal chain from the source to the symptoms of an anomaly, the higher its severity. The four-dimensional factors answer "how significant is the impact" from a spatial dimension, "who is abnormal" from a subject dimension, "what is the attack" from a content dimension, and "who caused whom" from a logical dimension. Through weighted summation, complementary information and cross-validation are achieved, solving the fundamental problem of traditional methods where "a single indicator cannot comprehensively assess risk." This allows risk scoring to accurately reflect the urgency, scope of impact, attack type, and root cause chain of the anomaly, providing a scientific basis for early warning grading.

[0087] In traditional operations and maintenance (O&M), handling strategies (such as host isolation and rate limiting) are directly implemented on the real network. This may lead to the accidental blocking of core servers, causing business interruptions, or insufficient handling, resulting in the continued spread of anomalies. All trial and error costs are borne by the actual business operations. Traditional methods only focus on whether the anomaly is mitigated, not whether normal business operations are damaged. Rate limiting to block attack traffic can lead to the degradation of critical business services. When faced with multiple optional strategies such as isolation, rate limiting, and traffic redirection, traditional O&M lacks quantitative data and can only rely on experience to choose, making it difficult to guarantee optimal decision-making.

[0088] Traditional methods treat early and delayed interventions equally, failing to reflect the "golden window" principle of cybersecurity intervention—the earlier the intervention, the better the effect. Delays may allow anomalies to spread, and the effectiveness of strategies cannot be continuously evaluated. Traditional methods only conduct single-point assessments before and after strategy implementation, making it impossible to observe the cumulative effect of the strategy throughout the entire intervention window and to determine whether the strategy is "continuously effective" or just a "short-term rebound."

[0089] S5. When the early warning information reaches the preset handling level, automatically extract network information related to the abnormal event, construct a twin subnet in the isolated environment, simulate and calculate the handling strategy score in the twin subnet, and recommend the optimal strategy. Specifically, the calculation formula for the handling strategy score is as follows:

[0090] ,

[0091] ,

[0092] ,

[0093] in, As a disposal strategy score, The weighting coefficient for the degree of abnormal mitigation. For a moment Degree of abnormal relief The attenuation rate, The weighting coefficients represent the degree of impact on normal business operations. For a moment The extent of the impact on normal business operations For a moment Disposal strategy Simulate the degree of abnormality before execution. To ensure smoothness and prevent the denominator from being zero, For a moment Disposal strategy Normal business throughput before execution time Disposal strategy Normal business throughput after execution For a moment Disposal strategy The degree of abnormality after simulation execution.

[0094] A federated learning framework is employed to achieve cross-domain knowledge sharing across multiple local area networks. Each local node uploads model parameter information to the central server, which then aggregates and generates a global model and distributes it to each local node. Early warning information and handling results are used as labeled data to periodically perform incremental training on the baseline calculation parameters of the dynamic baseline system and the correlation analysis model parameters of the multi-dimensional correlation analysis engine.

[0095] This solution offers five major benefits: verifiable pre-action measures, a balance between benefits and costs, timely incentives, comparability of multiple strategies, and a continuous optimization loop. It elevates strategy evaluation from "experience-based guesswork" to scientific decision-making that is "calculable, comparable, and optimizable," achieving a fundamental shift from "experience-driven" to "simulation-driven" approaches. Early warning information and action results are used as labeled data for periodic incremental training of the dynamic baseline system and multi-dimensional correlation analysis engine. Continuous optimization reduces false alarms, freeing operations personnel from dealing with massive amounts of invalid alerts and allowing them to focus on truly high-risk events, forming a virtuous cycle of "automatic system optimization—reduced false alarms—human intervention to focus on real threats—higher quality labeled feedback." This enhances system credibility. Incremental training ensures that the model's decision-making basis aligns with historical experience. As operations personnel discover that the system can self-correct historical errors, their trust in the system gradually increases, driving the evolution from a "human-led" to a "human-machine collaborative" operations model.

[0096] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments for application in other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for monitoring and early warning of network traffic data based on a local area network, characterized in that, Includes the following steps: S1. Deploy probes at key nodes of the local area network to collect raw traffic data in real time, calculate traffic characteristics based on a sliding time window, and trigger a micro-motion warning when the abnormal index of traffic characteristics exceeds a preset threshold. S2. Construct a dynamic baseline system to calculate a confidence score for the traffic characteristics corresponding to the micro-motion warning. When the confidence score is lower than a preset threshold, mark the corresponding event as a suspicious candidate and ignore the suspicious candidate. When the confidence score is higher than the preset threshold, upgrade the corresponding event to an abnormal event to be verified. S3. For the abnormal event to be verified, start the multidimensional correlation analysis engine. The multidimensional correlation analysis engine integrates multiple analysis paths to perform composite verification of the abnormal event. After the composite verification is passed, the causal direction between events is determined based on the causal inference layer, and the valid abnormal event is output. S4. For the aforementioned valid abnormal events, a dynamic weighting algorithm is used to conduct a comprehensive risk assessment of the abnormal events, and different levels of early warning information are output based on the risk score. S5. When the early warning information reaches the preset handling level, automatically extract the network information related to the abnormal event, construct a twin subnet in the isolated environment, simulate and calculate the handling strategy score in the twin subnet and recommend the optimal strategy; S6. A federated learning framework is used to achieve cross-domain knowledge sharing among multiple local area networks. Each local node uploads model parameter information to the central server, and the central server aggregates and generates a global model and distributes it to each local node. S7. Using the early warning information and handling results as labeled data, periodically perform incremental training on the baseline calculation parameters of the dynamic baseline system and the correlation analysis model parameters of the multidimensional correlation analysis engine.

2. The network traffic data monitoring and early warning method based on a local area network according to claim 1, characterized in that, The traffic characteristics in S1 include the temporal entropy of the data packet arrival time interval and the spatial entropy of the data packet length. The formulas for calculating the temporal entropy and spatial entropy are as follows: ， ， in, For time entropy, Number of categories for time intervals For the first The probability of class interval, For spatial entropy, For the first The probability of a long class package. The number of categories for package length.

3. The method for monitoring and early warning of network traffic data based on a local area network according to claim 1, characterized in that, The formula for calculating the flow characteristic anomaly index in S1 is as follows: ， ， ， ， in, This is an abnormal index of traffic characteristics. The historical average of spatial entropy. The historical average of time entropy. To prevent division by zero constant, The time entropy weighting index, It is the spatial entropy weighting index. For the length of the history window, For the first The spatial entropy of a window The historical standard deviation of spatial entropy. For the first The time entropy of a window, The historical standard deviation of time entropy.

4. The method for monitoring and early warning of network traffic data based on a local area network according to claim 1, characterized in that... The dynamic baseline system in S2 includes a generator. Discriminator The confidence anchoring module includes a generator for predicting expected normal traffic values, a discriminator for determining the degree of deviation between actual traffic and predicted values, and a confidence score calculated based on the discriminator's determination result. The calculation formula is: ， ， in, In order to be in Predicted flow rate at any given time From time arrive Historical flow sequence For generator Model parameters, For at any time The observed actual flow rate, This is the core discrimination function of the discriminator. For discriminator Model parameters, For the backtracking window length, For a moment The observed actual flow rate, For at any time The predicted flow value.

5. A method for monitoring and early warning of network traffic data based on a local area network according to claim 1, characterized in that... The S3 layer includes multiple analysis paths such as spatiotemporal feature analysis, host behavior profiling comparison, and deep application protocol analysis. The causal inference layer constructs a dynamic causal graph by calculating the propagation entropy between events. The formula for calculating the propagation entropy is: ， in, To transfer entropy, For time series of events that may be the cause, For time series events that may be the outcome, For the event exist Intensity at any moment For the event exist Before the moment The historical state vector at each moment, For the event exist Before the moment The historical state vector at each moment, For conditional probability density, For joint probability density, For conditional probability density, This represents the length of the time series.

6. A method for monitoring and early warning of network traffic data based on a local area network according to claim 5, characterized in that... The dynamic causal graph uses an incremental causal structure learning algorithm to determine the causal direction in real time. This incremental causal structure learning algorithm... Time only for new event sets Related node subset For local updates, the calculation formula for local updates in the incremental causal structure learning algorithm is as follows: ， in, It is a node in a causal graph. This represents all nodes in the cause-effect graph.

7. A method for monitoring and early warning of network traffic data based on a local area network according to claim 1, characterized in that... In the dynamic weighting algorithm described in S4, the dimension weight The calculation formula is: ， in, For dimension The basic weights, For dimension Historical false alarm rate False alarm penalty coefficient, This is an adjustment factor based on business importance. To assign importance scores to the affected business, the risk score calculation formula in S4 is as follows: ， ， ， ， ， in, These are the weighting coefficients for spatiotemporal feature analysis. For spatiotemporal anomaly degree, Weighting coefficients for host behavior profiles Host behavior deviation Weighting coefficients for application protocol parsing For protocol parsing anomaly degree, Weighting coefficients in causal path analysis For the severity of the causal path, Due to the abnormal propagation speed, This is the baseline for normal transmission speed. For the propagation path length, Network diameter, This is the current behavior feature vector. This is a vector of historical behavior mean values. For packet payload, For abnormal signatures, Accumulated weights for the paths, For the maximum cumulative weight, For signature library.

8. A method for monitoring and early warning of network traffic data based on a local area network according to claim 1, characterized in that... The formula for calculating the handling strategy score in S5 is as follows: ， ， ， in, As a disposal strategy score, The weighting coefficient for the degree of abnormal mitigation. For a moment Degree of abnormal relief The attenuation rate, The weighting coefficients represent the degree of impact on normal business operations. For a moment The extent of the impact on normal business operations For a moment Disposal strategy Simulate the degree of abnormality before execution. To ensure smoothness and prevent the denominator from being zero, For a moment Disposal strategy Normal business throughput before execution time Disposal strategy Normal business throughput after execution For a moment Disposal strategy The degree of abnormality after simulation execution.

Images