An abnormal flow intelligent detection and real-time blocking system based on network security
By building an intelligent detection and real-time blocking system in edge computing scenarios, and by using lightweight models and federated learning to optimize feature fusion, we have achieved efficient abnormal traffic identification and real-time blocking. This solves the problems of limited computing power of edge nodes and insufficient linkage between defense and tracing, and provides legitimate attack tracing data support.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Filing Date
- 2026-04-21
- Publication Date
- 2026-07-10
AI Technical Summary
Existing technologies struggle to effectively identify unknown attacks in edge computing scenarios. Traditional detection systems have high false positive rates, model iteration relies on fixed cycles and cannot respond to sudden attacks, defense and tracing lack coordination, edge nodes have limited computing power, model training carries privacy and compliance risks, firewall updates are delayed, and real-time blocking of new threats is impossible.
An intelligent detection and real-time blocking system for abnormal traffic based on network security is adopted, including a traffic acquisition layer, a knowledge fusion preprocessing layer, a federated learning detection layer, an intelligent decision-making layer, and an edge blocking layer. Through a lightweight pooled flexible random forest model, an improved FedAvg algorithm, a BFV homomorphic encryption processing unit, and an attack tracing unit, dynamic feature fusion, model optimization, and real-time blocking are achieved.
It improves the accuracy and response efficiency of abnormal traffic detection, forming a closed-loop protection system of detection, blocking, tracing, and iteration. It is adapted to the computing power of edge nodes, realizes real-time blocking of new attacks and legitimate tracing data support, and makes up for the lack of linkage between defense and tracing in existing technologies.
Smart Images
Figure CN122372290A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, specifically a network security-based intelligent detection and real-time blocking system for abnormal traffic. Background Technology
[0002] With the popularization of 5G and edge computing technologies, the frequency of interaction between terminal devices and edge nodes has surged. A large amount of data converges at network edge nodes between terminals and the cloud, which can easily form a data dam, leading to a surge in network bandwidth pressure and enhanced concealment of attack traffic. Abnormal traffic such as DDoS attacks, port scanning, and transmission of unknown malicious code not only consume network resources, but may also infiltrate core business systems through edge nodes, posing a serious threat to data security and service continuity.
[0003] Traditional detection systems often rely on single features, such as static rule features or raw traffic features, for identification. Signature-based detection methods cannot cope with unknown attacks, while simple unsupervised anomaly detection is prone to misjudgment. At the same time, existing feature fusion often adopts a fixed weight strategy, failing to dynamically adjust according to the contribution of different features to attack identification, thus limiting the effectiveness of fused features. In edge computing scenarios, data from multiple nodes is stored in a dispersed manner and involves privacy information. Aggregating raw data for modeling poses compliance risks. Existing federated learning frameworks, such as FedAvg, are not optimized for the heterogeneity of edge nodes, differences in hardware performance, and uneven sample distribution. Abnormal parameters are prone to interfering with the accuracy of the global model, and there is a lack of collaborative design for encrypted parameter transmission and efficient aggregation. Traditional firewalls rely on local rule bases or asynchronous cloud query modes, resulting in high rule update latency and an inability to achieve real-time blocking of the first packet of new threats, leaving vulnerabilities in boundary protection. In addition, detection models are mostly heavyweight architectures, which are difficult to adapt to the limited computing power of edge nodes, and model iteration depends on a fixed cycle, making them unable to respond to sudden escape attacks. Existing attack tracing and attribution technologies focus primarily on defense and blocking, with less consideration for evidence collection needs. The generated attribution data lacks relevance and legitimacy, making it difficult to serve as effective electronic data evidence to support post-incident accountability. Furthermore, the attribution results lack a linkage mechanism with the blocking execution, failing to form a closed-loop protection system encompassing detection, blocking, attribution, and iteration. Summary of the Invention
[0004] The purpose of this invention is to provide an intelligent detection and real-time blocking system for abnormal traffic based on network security, so as to solve the problems mentioned in the background art.
[0005] To achieve the above objectives, the present invention provides the following technical solution: An intelligent detection and real-time blocking system for abnormal traffic based on network security includes a traffic acquisition layer with data interaction connection, a knowledge fusion preprocessing layer, a federated learning detection layer, an intelligent decision-making layer and an edge blocking layer, a periodic iteration unit, an emergency update unit and a system hardware deployment architecture; The traffic acquisition layer, deployed on the programmable switch hardware, integrates the DPDK data acquisition component to capture the raw traffic of the entire network segment; The knowledge fusion preprocessing layer includes a rule translation module and a data augmentation module. The rule translation module constructs a structured finite state machine based on regular expression matching rules and outputs a fixed-dimensional feature vector. The federated learning detection layer includes an edge-side local model group and a federated training module: the edge-side local model group is a lightweight pooled flexible random forest model; The intelligent decision-making layer has a built-in adaptive weight fusion computing unit that integrates local model output data and global model feedback data through a dynamic weight allocation mechanism to output three-level control commands. The edge blocking layer adopts a bypass networking deployment, is compatible with TCP / UDP communication protocols, and is configured with packet construction units and routing configuration units to complete communication link isolation.
[0006] Preferably, the data augmentation module is configured to generate an adversarial network, construct a simulated attack traffic feature vector, and then concatenate and fuse the finite state machine feature vector and the simulated attack traffic feature vector according to the dimension index alignment. The feature fusion calculation formula is as follows: in To fuse feature vectors, For the eigenvectors of a finite state machine, To simulate attack traffic feature vectors, This is the original flow feature vector. For feature weight coefficients, satisfying Furthermore, it is dynamically calibrated based on feature contribution. The federated training module is equipped with an improved FedAvg algorithm framework and integrates a BFV homomorphic encryption processing unit. Each edge node completes the encrypted transmission of model parameters through the encryption unit and adopts a collaborative training mechanism that combines local iteration and global aggregation.
[0007] Preferably, the lightweight pooled flexible random forest model of the federated learning detection layer is configured with a two-layer traffic identification architecture, including a static feature matching unit and a temporal feature mining unit. The static feature matching unit calls finite state machine features to complete fixed rule matching, and the temporal feature mining unit extracts temporal correlation features of traffic load data.
[0008] Preferably, the periodic iteration unit calls the federated training module at a fixed period to complete the synchronous iteration of multi-node model parameters. The emergency update unit is linked with the traffic identification signal of the federated learning detection layer. When the matching degree of the detected attack behavior features reaches a set threshold, the immediate parameter update process of the federated training module is triggered.
[0009] Preferably, the lightweight pooled flexible random forest model is adapted to a general server deployment mode and has a fixed feature extraction dimension selection logic.
[0010] Preferably, the system hardware deployment architecture includes edge acquisition hardware nodes, cloud federated training nodes, and local blocking execution nodes. The edge acquisition hardware nodes and local blocking execution nodes are deployed in an integrated manner, relying on the DPDK high-speed data plane to complete data acquisition and control packet forwarding. The cloud federated training nodes are used for global model parameter aggregation and updating.
[0011] Preferably, the improved FedAvg algorithm framework has a built-in abnormal parameter filtering unit, which removes abnormal model parameters uploaded by edge nodes through a filtering mechanism. The abnormal parameter determination formula is as follows: in For the first Model parameters uploaded by each edge node The mean of all node parameters. For the standard deviation of the parameter, is the confidence coefficient, ranging from 1.5 to 3.0. Parameters identified as outliers are removed. Global parameter aggregation uses a weighted average method, calculated using the following formula: in These are global aggregation parameters. For the first The weight of the number of samples for each edge node. To remove the abnormal node model parameters, The total number of edge nodes participating in federated training.
[0012] Preferably, the edge blocking layer is configured with an attack tracing unit. This unit collects the source address, port, and transmission path information of the attack traffic, generates a standardized attack tracing report, and supports integration with a security management platform. The attack tracing correlation formula is as follows: in The correlation between attack traffic and known attack characteristics ranges from 0 to 1. This is the cosine similarity calculation function. The source address characteristics of the traffic to be traced. The interaction characteristics of the traffic ports to be traced. This is a database of known attack port signatures. For the characteristics of the traffic transmission path to be traced, This is a database of known attack path signatures. The correlation weight coefficient satisfies .
[0013] A method for intelligent detection and real-time blocking of abnormal traffic based on network security includes the following steps: S1. The traffic acquisition layer collects raw traffic data from the entire network segment through the DPDK component. The knowledge fusion preprocessing layer generates finite state machine feature vectors through the rule translation module. The data augmentation module constructs simulated attack traffic feature vectors through the generative adversarial network. Based on the feature fusion operation formula, the finite state machine feature vectors, simulated attack traffic feature vectors, and raw traffic feature vectors are spliced and fused in a multi-dimensional way according to the dimension index alignment method to form a unified dimension fused feature vector. S2, a lightweight pooled flexible random forest model deployed at edge nodes, extracts the fused traffic features in layers through a two-layer traffic identification architecture. The static feature matching unit completes fixed rule matching, and the temporal feature mining unit extracts temporal correlation features and outputs local identification data. S3, the federated training module is based on the improved FedAvg algorithm. It summarizes the model parameters of each edge node after BFV encryption. After the abnormal parameter filtering unit removes abnormal parameters according to the abnormal parameter judgment calculation formula, it uses a mechanism that combines local iteration and global aggregation and a global parameter aggregation calculation formula to complete the global model parameter aggregation and weight update. S4. The intelligent decision-making layer integrates local identification data and global model feedback data through the adaptive weight fusion computing unit based on the dynamic weight allocation mechanism to generate three-level control commands. S5. The edge blocking layer receives the three-level control command, generates a reset packet for the TCP protocol link, configures a black hole routing table entry for the UDP protocol link, and completes the isolation of the bidirectional communication link. S6. Continuously monitor the traffic interaction behavior of isolated targets. When the matching degree of escape attack behavior characteristics reaches the set threshold, start the emergency update unit to complete the synchronous iteration of edge nodes and global model.
[0014] Preferably, the feature fusion process described in step S1 integrates the attack sample set and extracts features independently for each individual traffic data point, thereby completing the standardized preprocessing of batch traffic data. The dynamic weight allocation mechanism described in step S4 is implemented using the Sigmoid function, and the weight coefficients are updated in real time according to a set period.
[0015] The beneficial effects of this invention are as follows: 1. This invention achieves dynamic calibration and fusion of multi-dimensional features by combining the static rule features of structured finite state machines with the simulated attack traffic features constructed by generative adversarial networks through the dynamic weight feature fusion mechanism of the knowledge fusion preprocessing layer. This solves the problems of high false positive rate and weak unknown attack identification ability of traditional single feature detection. At the same time, it adapts the limited computing power of edge nodes to the lightweight pooled flexible random forest model, which significantly improves the accuracy of abnormal traffic detection and real-time response efficiency.
[0016] 2. This invention integrates a BFV homomorphic encryption processing unit and an anomaly parameter filtering unit through an improved FedAvg algorithm framework. After removing anomaly parameters from heterogeneous edge nodes, it completes global model optimization. This achieves privacy protection by keeping multi-node data within the local machine and avoids interference from anomaly parameters on model accuracy. At the same time, by combining periodic iteration and emergency update mechanisms, the system can dynamically adapt to new attack methods, effectively solving the contradiction between distributed training and model robustness in edge computing scenarios.
[0017] 3. This invention, through the collaborative design of the bypass networking deployment of the edge blocking layer and the attack tracing unit, uses reset packets and black hole routing table entries to achieve precise blocking of TCP / UDP protocols respectively, while generating standardized tracing reports, forming a closed-loop protection system of detection, blocking, tracing, and iteration. This not only improves the targeting and reliability of boundary protection, but also provides legitimate and effective data support for post-attack accountability, making up for the shortcomings of insufficient linkage between defense and tracing in existing technologies. Attached Figure Description
[0018] Figure 1 This is a schematic diagram of the overall system architecture of the present invention; Figure 2 This is a schematic diagram illustrating the feature fusion of the present invention; Figure 3 This is a schematic diagram of the federated training method of the present invention; Figure 4 This is a schematic diagram of the edge blocking mechanism of the present invention; Figure 5 This is a schematic diagram of the complete method flow of the present invention. Detailed Implementation
[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0020] like Figures 1 to 5 As shown, embodiments of the present invention provide Example 1: An intelligent detection and real-time blocking system for abnormal traffic based on network security includes a traffic acquisition layer with data interaction connection, a knowledge fusion preprocessing layer, a federated learning detection layer, an intelligent decision-making layer and an edge blocking layer, a periodic iteration unit, an emergency update unit and a system hardware deployment architecture; The traffic acquisition layer, deployed on the programmable switch hardware, integrates the DPDK data acquisition component to capture the raw traffic of the entire network segment; The knowledge fusion preprocessing layer includes a rule translation module and a data augmentation module. The rule translation module constructs a structured finite state machine based on regular expression matching rules and outputs a fixed-dimensional feature vector. The federated learning detection layer includes an edge-side local model group and a federated training module: the edge-side local model group is a lightweight pooled flexible random forest model; The intelligent decision-making layer has a built-in adaptive weight fusion computing unit that integrates local model output data and global model feedback data through a dynamic weight allocation mechanism to output three-level control commands. The edge blocking layer adopts a bypass networking deployment, is compatible with TCP / UDP communication protocols, and is configured with packet construction units and routing configuration units to complete communication link isolation.
[0021] The data augmentation module is configured to generate an adversarial network, construct a simulated attack traffic feature vector, and then concatenate and fuse the finite state machine feature vector and the simulated attack traffic feature vector according to the dimension index alignment. The feature fusion calculation formula is as follows: in To fuse feature vectors, For the eigenvectors of a finite state machine, To simulate attack traffic feature vectors, This is the original flow feature vector. For feature weight coefficients, satisfying Furthermore, it is dynamically calibrated based on feature contribution. The federated training module is equipped with an improved FedAvg algorithm framework and integrates a BFV homomorphic encryption processing unit. Each edge node completes the encrypted transmission of model parameters through the encryption unit and adopts a collaborative training mechanism that combines local iteration and global aggregation.
[0022] The initial values for the weighting coefficients are: Finite state machine feature weights, Simulated attack traffic feature weights, The original traffic feature weights are calibrated under the following conditions: dynamic calibration is initiated when the attack identification accuracy of a single feature fluctuates by more than ±10%, or when the system detects a new attack feature with a matching degree of ≥70%. The calibration adjustment range is: The adjustment range is 0.2-0.6. The adjustment range is 0.2-0.5. The adjustment range is 0.2-0.5. After calibration, the sum of the three values is still 1, and the calibration period is consistent with the fixed period of the system's periodic iteration unit.
[0023] The lightweight pooled flexible random forest model of the federated learning detection layer is configured with a two-layer traffic identification architecture, including a static feature matching unit and a temporal feature mining unit. The static feature matching unit calls finite state machine features to complete fixed rule matching, and the temporal feature mining unit extracts temporal correlation features of traffic load data.
[0024] The periodic iteration unit calls the federated training module at a fixed period to complete the synchronous iteration of multi-node model parameters. The emergency update unit is linked with the traffic identification signal of the federated learning detection layer. When the matching degree of the attack behavior feature is detected to reach a set threshold, the immediate parameter update process of the federated training module is triggered.
[0025] The lightweight pooled flexible random forest model is adapted to general server deployment modes and has solidified the dimension selection logic for feature extraction.
[0026] The system hardware deployment architecture includes edge acquisition hardware nodes, cloud federated training nodes, and local blocking execution nodes. The edge acquisition hardware nodes and local blocking execution nodes are deployed in an integrated manner, relying on the DPDK high-speed data plane to complete data acquisition and control packet forwarding. The cloud federated training nodes are used for global model parameter aggregation and updating.
[0027] The improved FedAvg algorithm framework incorporates an anomaly parameter filtering unit, which uses a filtering mechanism to remove abnormal model parameters uploaded by edge nodes. The formula for determining anomaly parameters is as follows: in For the first Model parameters uploaded by each edge node The mean of all node parameters. For the standard deviation of the parameter, is the confidence coefficient, ranging from 1.5 to 3.0. Parameters identified as outliers are removed. Global parameter aggregation uses a weighted average method, calculated using the following formula: in These are global aggregation parameters. For the first The weight of the number of samples for each edge node. To remove the abnormal node model parameters, The total number of edge nodes participating in federated training.
[0028] pass The value is limited to 0.05-0.3, representing the total number of edge nodes participating in federated training. The value range is 3-20, which is suitable for small and medium-sized edge computing cluster deployment scenarios. The convergence threshold of global parameter aggregation is set to 0.001, that is, when the absolute value of the difference between global parameters after two consecutive aggregations is ≤0.001, the current aggregation iteration stops.
[0029] The edge blocking layer is configured with an attack tracing unit. This unit collects the source address, port, and transmission path information of attack traffic, generates a standardized attack tracing report, and supports integration with the security management platform. The attack tracing correlation formula is as follows: in The correlation between attack traffic and known attack characteristics ranges from 0 to 1. This is the cosine similarity calculation function. The source address characteristics of the traffic to be traced. The interaction characteristics of the traffic ports to be traced. This is a database of known attack port signatures. For the characteristics of the traffic transmission path to be traced, This is a database of known attack path signatures. The correlation weight coefficient satisfies .
[0030] pass The initial values for the correlation weight coefficients are 0.4 for source address feature weight, 0.3 for port interaction feature weight, and 0.3 for transmission path feature weight. These values can be dynamically adjusted based on tracing needs, especially when focusing on tracking the attack source. Adjust to 0.5-0.6. When the value is simultaneously reduced to 0.2-0.3, and precise matching of attack types is required, Adjust to 0.4-0.5. When adjusting to 0.25-0.3, and focusing on tracing the attack propagation chain, Adjust to 0.4-0.5. The value was lowered to 0.25-0.3, and the adjustment still met the requirements. Cosine similarity calculation function The matching threshold is set to 0.7. That is, when the similarity of a single-dimensional feature is ≥0.7, the feature is considered to have matched successfully. When the correlation coefficient R calculated using the weighting coefficient is ≥0.75, the attack feature is confirmed to have matched, and the source tracing report marks it as a high-confidence match. When the score is between 0.5 and 0.75, it is marked as a medium confidence match and requires manual review. When the score is less than 0.5, it is marked as a low-confidence match and is only considered as a suspected attack record.
[0031] Example 2: A method for intelligent detection and real-time blocking of abnormal traffic based on network security includes the following steps: S1. The traffic acquisition layer collects raw traffic data from the entire network segment through the DPDK component. The knowledge fusion preprocessing layer generates finite state machine feature vectors through the rule translation module. The data augmentation module constructs simulated attack traffic feature vectors through the generative adversarial network. Based on the feature fusion operation formula, the finite state machine feature vectors, simulated attack traffic feature vectors, and raw traffic feature vectors are spliced and fused in a multi-dimensional way according to the dimension index alignment method to form a unified dimension fused feature vector. S2, a lightweight pooled flexible random forest model deployed at edge nodes, extracts the fused traffic features in layers through a two-layer traffic identification architecture. The static feature matching unit completes fixed rule matching, and the temporal feature mining unit extracts temporal correlation features and outputs local identification data. S3, the federated training module is based on the improved FedAvg algorithm. It summarizes the model parameters of each edge node after BFV encryption. After the abnormal parameter filtering unit removes abnormal parameters according to the abnormal parameter judgment calculation formula, it uses a mechanism that combines local iteration and global aggregation and a global parameter aggregation calculation formula to complete the global model parameter aggregation and weight update. S4. The intelligent decision-making layer integrates local identification data and global model feedback data through the adaptive weight fusion computing unit based on the dynamic weight allocation mechanism to generate three-level control commands. S5. The edge blocking layer receives the three-level control command, generates a reset packet for the TCP protocol link, configures a black hole routing table entry for the UDP protocol link, and completes the isolation of the bidirectional communication link. S6. Continuously monitor the traffic interaction behavior of isolated targets. When the matching degree of escape attack behavior characteristics reaches the set threshold, start the emergency update unit to complete the synchronous iteration of edge nodes and global model.
[0032] The traffic acquisition layer collects raw traffic data from the entire network segment using the DPDK component. The knowledge fusion preprocessing layer generates finite state machine feature vectors through the rule translation module. The data augmentation module constructs simulated attack traffic feature vectors through a generative adversarial network. Based on the feature fusion calculation formula, the three types of feature vectors are aligned and fused according to their dimensional indices to form a unified fused feature vector. By integrating a public and self-built mutant attack sample set in a 7:3 ratio, feature logic is extracted independently for each traffic stream. After standardization preprocessing to eliminate dimensional differences, a lightweight pooled flexible random forest model for edge nodes is used to extract fused features layer by layer through a two-layer recognition architecture. The static matching unit completes the matching of known attack rules, and the time-series mining unit captures unknown attack patterns. The system outputs local identification data. The federated training module aggregates the model parameters of each edge node encrypted with BFV. After removing outliers through the abnormal parameter filtering unit, the model is updated using a local iteration and global weighted aggregation mechanism. The intelligent decision layer integrates local and global model data through the adaptive weight fusion unit to generate three-level control commands. Weights are dynamically allocated through the Sigmoid function and updated every 5 to 15 minutes. Combined with a smoothing mechanism, decision oscillations are avoided. The edge blocking layer generates reset packets for the TCP protocol and configures black hole routing table entries for the UDP protocol to complete bidirectional link isolation. It continuously monitors the isolated targets. When the evasion attack feature matching degree reaches the 85% threshold, the emergency update unit is activated to complete the synchronous iteration of the model.
[0033] Among them, the feature fusion process described in step S1 integrates the attack sample set and extracts features independently for each individual traffic data point, thus completing the standardized preprocessing of batch traffic data. The dynamic weight allocation mechanism described in step S4 is implemented using the Sigmoid function, and the weight coefficients are updated in real time according to a set period.
[0034] Working principle and usage process: In the data acquisition and feature preprocessing stage, the traffic acquisition layer relies on the DPDK data acquisition component of the programmable switch to efficiently capture raw traffic data from the entire network segment, ensuring the comprehensiveness and real-time nature of traffic acquisition. The knowledge fusion preprocessing layer simultaneously starts the collaborative work of the two modules. The rule translation module constructs a structured finite state machine based on regular expression matching rules and extracts static rule feature vectors with fixed dimensions from the raw traffic. The data augmentation module constructs simulated attack traffic feature vectors through generative adversarial networks to make up for the lack of real attack samples. Subsequently, the system performs multi-dimensional splicing and fusion of finite state machine features, simulated attack traffic features and raw traffic features according to the feature dimension index alignment method. During the fusion process, a dynamic weight calibration strategy based on feature contribution is adopted to ensure that the fused features can fully reflect the differences between normal traffic and abnormal traffic, providing high-quality data support for subsequent detection. In the distributed detection and model training phase, the lightweight pooled flexible random forest model deployed on the edge nodes performs layered detection of fused features through a two-layer traffic identification architecture. The static feature matching unit calls finite state machine features to complete the fixed rule matching of known attacks, quickly identifying common abnormal traffic. The temporal feature mining unit extracts the temporal correlation features of traffic load data, accurately capturing the hidden patterns of unknown attacks. After dual detection, the local identification results are output. At the same time, the federated training module starts distributed collaborative training. The model parameters of each edge node are transmitted to the cloud federated training node after being homomorphically encrypted by BFV to avoid data privacy leakage. The improved FedAvg algorithm framework removes abnormal parameters of heterogeneous nodes through the abnormal parameter filtering unit, and then uses the weighted average method to complete the global model parameter aggregation and update, forming an optimized model that takes into account both local adaptability and global universality, and synchronously feeds back to each edge node. In the intelligent decision-making and real-time blocking phase, the adaptive weight fusion computing unit of the intelligent decision-making layer integrates local identification data of edge nodes and global model feedback data in the cloud based on the dynamic weight allocation mechanism. It generates three levels of control commands based on factors such as the degree of traffic anomaly and model confidence: low-risk warning, medium-risk flow restriction, and high-risk blocking. The edge blocking layer adopts a bypass networking deployment mode, which is compatible with both TCP and UDP protocols. After receiving the control commands, it generates a reset packet for abnormal TCP protocol links to forcibly terminate the illegal connection, and configures black hole routing table entries for abnormal UDP protocol links to block the data transmission channel. Finally, it achieves precise isolation of bidirectional communication links and avoids the spread of abnormal traffic. During the dynamic iteration and closed-loop optimization phase, the system achieves continuous optimization through a dual mechanism of periodic iteration and emergency update: the periodic iteration unit calls the federated training module at fixed intervals to complete the synchronous iteration of multi-node model parameters and adapt to the slow changes in traffic characteristics; the emergency update unit is linked with the traffic identification signal of the federated learning detection layer. When the feature matching degree of unconventional attack behaviors such as escape attacks is detected to reach a set threshold, the real-time parameter update process of the federated training module is immediately triggered to quickly respond to new attack methods. At the same time, the attack tracing unit of the edge blocking layer collects the source address, port and transmission path information of the attack traffic, generates a standardized tracing report and links it with the security management platform to provide data support for post-event accountability, forming a closed-loop protection system of detection, blocking, tracing and iteration.
[0035] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.
[0036] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A network security-based intelligent detection and real-time blocking system for abnormal traffic, characterized in that: It includes a data interaction connection traffic acquisition layer, a knowledge fusion preprocessing layer, a federated learning detection layer, an intelligent decision-making layer, and an edge blocking layer, as well as a periodic iteration unit, an emergency update unit, and a system hardware deployment architecture; The traffic acquisition layer, deployed on the programmable switch hardware, integrates the DPDK data acquisition component to capture the raw traffic of the entire network segment; The knowledge fusion preprocessing layer includes a rule translation module and a data augmentation module. The rule translation module constructs a structured finite state machine based on regular expression matching rules and outputs a fixed-dimensional feature vector. The federated learning detection layer includes an edge-side local model group and a federated training module: the edge-side local model group is a lightweight pooled flexible random forest model; The intelligent decision-making layer has a built-in adaptive weight fusion computing unit that integrates local model output data and global model feedback data through a dynamic weight allocation mechanism to output three-level control commands. The edge blocking layer adopts a bypass networking deployment, is compatible with TCP / UDP communication protocols, and is configured with packet construction units and routing configuration units to complete communication link isolation.
2. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The data augmentation module is configured to generate an adversarial network, construct a simulated attack traffic feature vector, and then the finite state machine feature vector and the simulated attack traffic feature vector are concatenated and fused according to the dimension index alignment. The feature fusion calculation formula is as follows: in To fuse feature vectors, For the eigenvectors of a finite state machine, To simulate attack traffic feature vectors, This is the original flow feature vector. For feature weight coefficients, satisfying Furthermore, it is dynamically calibrated based on feature contribution. The federated training module is equipped with an improved FedAvg algorithm framework and integrates a BFV homomorphic encryption processing unit. Each edge node completes the encrypted transmission of model parameters through the encryption unit and adopts a collaborative training mechanism that combines local iteration and global aggregation.
3. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The lightweight pooled flexible random forest model of the federated learning detection layer is configured with a two-layer traffic identification architecture, including a static feature matching unit and a temporal feature mining unit. The static feature matching unit calls finite state machine features to complete fixed rule matching, and the temporal feature mining unit extracts temporal correlation features of traffic load data.
4. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The periodic iteration unit calls the federated training module at a fixed period to complete the synchronous iteration of multi-node model parameters. The emergency update unit is linked with the traffic identification signal of the federated learning detection layer. When the matching degree of the detected attack behavior features reaches a set threshold, the immediate parameter update process of the federated training module is triggered.
5. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The lightweight pooled flexible random forest model is adapted to general server deployment modes and has solidified the dimension selection logic for feature extraction.
6. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The system hardware deployment architecture includes edge acquisition hardware nodes, cloud federated training nodes, and local blocking execution nodes. The edge acquisition hardware nodes and local blocking execution nodes are deployed in an integrated manner, relying on the DPDK high-speed data plane to complete data acquisition and control packet forwarding. The cloud federated training nodes are used for global model parameter aggregation and updating.
7. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 2, characterized in that: The improved FedAvg algorithm framework has a built-in abnormal parameter filtering unit, which removes abnormal model parameters uploaded by edge nodes through a filtering mechanism. The abnormal parameter determination formula is as follows: in For the first Model parameters uploaded by each edge node The mean of all node parameters. For the standard deviation of the parameter, is the confidence coefficient, ranging from 1.5 to 3.
0. Parameters identified as outliers are removed. Global parameter aggregation uses a weighted average method, calculated using the following formula: in These are global aggregation parameters. For the first The weight of the number of samples for each edge node. To remove the abnormal node model parameters, The total number of edge nodes participating in federated training.
8. The intelligent detection and real-time blocking system for abnormal traffic based on network security according to claim 1, characterized in that: The edge blocking layer is configured with an attack tracing unit. This unit collects the source address, port, and transmission path information of attack traffic, generates a standardized attack tracing report, and supports integration with the security management platform. The attack tracing correlation formula is as follows: in The correlation between attack traffic and known attack characteristics ranges from 0 to 1. This is the cosine similarity calculation function. The source address characteristics of the traffic to be traced. The interaction characteristics of the traffic ports to be traced. This is a database of known attack port signatures. For the characteristics of the traffic transmission path to be traced, This is a database of known attack path signatures. The correlation weight coefficient satisfies .
9. A method for intelligent detection and real-time blocking of abnormal traffic based on network security, characterized in that, The system applied to any one of claims 1 to 8 includes the following steps: S1. The traffic acquisition layer collects raw traffic data from the entire network segment through the DPDK component. The knowledge fusion preprocessing layer generates finite state machine feature vectors through the rule translation module. The data augmentation module constructs simulated attack traffic feature vectors through the generative adversarial network. Based on the feature fusion operation formula, the finite state machine feature vectors, simulated attack traffic feature vectors, and raw traffic feature vectors are spliced and fused in a multi-dimensional way according to the dimension index alignment method to form a unified dimension fused feature vector. S2, a lightweight pooled flexible random forest model deployed at edge nodes, extracts the fused traffic features in layers through a two-layer traffic identification architecture. The static feature matching unit completes fixed rule matching, and the temporal feature mining unit extracts temporal correlation features and outputs local identification data. S3, the federated training module is based on the improved FedAvg algorithm. It summarizes the model parameters of each edge node after BFV encryption. After the abnormal parameter filtering unit removes abnormal parameters according to the abnormal parameter judgment calculation formula, it uses a mechanism that combines local iteration and global aggregation and a global parameter aggregation calculation formula to complete the global model parameter aggregation and weight update. S4. The intelligent decision-making layer integrates local identification data and global model feedback data through the adaptive weight fusion computing unit based on the dynamic weight allocation mechanism to generate three-level control commands. S5. The edge blocking layer receives the three-level control command, generates a reset packet for the TCP protocol link, configures a black hole routing table entry for the UDP protocol link, and completes the isolation of the bidirectional communication link. S6. Continuously monitor the traffic interaction behavior of isolated targets. When the matching degree of escape attack behavior characteristics reaches the set threshold, start the emergency update unit to complete the synchronous iteration of edge nodes and global model.
10. The method for intelligent detection and real-time blocking of abnormal traffic based on network security according to claim 9, characterized in that: The feature fusion process described in step S1 integrates the attack sample set and extracts features independently for each individual traffic data point, thus completing the standardized preprocessing of batch traffic data. The dynamic weight allocation mechanism described in step S4 is implemented using the Sigmoid function, and the weight coefficients are updated in real time according to a set period.