Network traffic anomaly detection method, apparatus, device, medium, and program product

Abstract

Embodiments of the present application disclose a network traffic anomaly detection method, device, equipment, medium and program product. The network traffic anomaly detection method comprises: performing feature preprocessing on network traffic data to obtain to-be-detected traffic features; determining a normal traffic confidence of the network traffic data according to the to-be-detected traffic features by using a discriminator in a generative adversarial network, wherein the generative adversarial network is trained based on normal traffic features; determining whether the network traffic is abnormal traffic based on the normal traffic confidence; and in a case where the normal traffic confidence is in a doubtful interval, obtaining simulated normal traffic features generated by a generator in the generative adversarial network, and determining whether the network traffic is abnormal traffic according to a difference between the to-be-detected traffic features and the simulated normal traffic features. The technical solution of the embodiments of the present application can reduce the false positive rate and improve the accuracy of network traffic anomaly detection.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, medium, and program product for detecting abnormal network traffic. Background Technology

[0002] As communication networks continue to expand and service types become increasingly diverse, the traffic carried by the core network exhibits characteristics of high concurrency, strong dynamism, and complexity. Existing technologies for anomaly detection in core network traffic have developed into various solutions, including threshold judgment, machine learning classification, rule matching, and single deep learning models.

[0003] However, the above-mentioned solutions rely on known attack characteristics or the discrimination results of a single model to determine anomalies. When faced with new attacks with concealed characteristics and varied patterns, the detection accuracy is insufficient and the false alarm rate is high. Summary of the Invention

[0004] This application addresses some of the deficiencies mentioned in the background art by providing a method, apparatus, device, medium, and program product for detecting abnormal network traffic.

[0005] In a first aspect, embodiments of this application provide a method for detecting abnormal network traffic, including: Feature preprocessing is performed on network traffic data to obtain the characteristics of the traffic to be detected; The discriminator in a generative adversarial network is used to determine the confidence level of normal traffic based on the characteristics of the traffic to be detected, wherein the generative adversarial network is trained based on the normal traffic characteristics; Based on the normal traffic confidence level, determine whether the network traffic is abnormal traffic; Specifically, when the confidence level of the normal traffic is in the questionable range, simulated normal traffic features generated by the generator in the generative adversarial network are obtained, and the network traffic is determined to be abnormal based on the difference between the traffic features to be detected and the simulated normal traffic features.

[0006] In one embodiment of the first aspect, the doubtful interval is an interval greater than a first threshold and less than a second threshold; The step of determining whether the network traffic is abnormal based on the normal traffic confidence level includes: When the confidence level of the normal traffic is less than or equal to the first threshold, the network traffic is determined to be abnormal traffic. When the confidence level of the normal traffic is greater than or equal to the second threshold, the network traffic is determined to be normal traffic.

[0007] In one embodiment of the first aspect, the training process of the generative adversarial network includes: Perform the following steps alternately until the training termination condition is met: The parameters of the generator are fixed, and the discriminator is trained to distinguish between real normal traffic characteristics and simulated traffic characteristics generated by the generator. The parameters of the discriminator are fixed, and the generator is trained so that the simulated flow characteristics it generates approximate the distribution of real normal flow characteristics.

[0008] The discriminator in one embodiment of the first aspect includes: Convolutional neural networks are used to extract protocol layer spatial features from input traffic features; Long Short-Term Memory (LSTM) networks are used to extract temporal features from input traffic characteristics. A multi-head attention module is used to perform attention operations on the fused features, wherein the fused features are features resulting from the fusion of the protocol layer spatial features and the temporal features.

[0009] In one embodiment of the first aspect, the objective function for training the generative adversarial network includes an attention loss term, which constrains the multi-head attention module's attention allocation to a preset protocol field.

[0010] In one embodiment of the first aspect, the convolutional neural network includes at least two one-dimensional convolutional kernels of different sizes for extracting protocol field association features of different ranges, respectively.

[0011] In one embodiment of the first aspect, the difference is determined by at least one of the following methods: Euclidean distance, cosine similarity, and relative entropy.

[0012] In one embodiment of the first aspect, the generator is a Transformer architecture used to capture temporal dependencies in traffic features using a multi-head self-attention mechanism.

[0013] In one embodiment of the first aspect, the feature preprocessing of network traffic data to obtain the traffic features to be detected includes: The network traffic data is parsed to obtain parsed data; Feature extraction is performed on the parsed data to obtain initial traffic features; The initial flow characteristics are cleaned and standardized to obtain standardized characteristics; The standardized features are vectorized and processed using a time window to obtain the traffic features to be detected.

[0014] In one embodiment of the first aspect, the training data for the generative adversarial network is obtained in the following manner: The normal traffic features are obtained by using a single-class support vector machine to filter the traffic features corresponding to the traffic data to be trained.

[0015] In one embodiment of the first aspect, the method further includes: The detection parameters are adaptively updated based on the results of abnormal traffic determination. The detection parameters include the boundary values ​​of the suspicious interval and / or the model parameters of the generative adversarial network.

[0016] Secondly, embodiments of this application provide a network traffic anomaly detection device, comprising: The preprocessing module is used to perform feature preprocessing on network traffic data to obtain the features of the traffic to be detected; The discrimination module is used to determine the confidence level of normal traffic based on the characteristics of the traffic to be detected by using the discriminator in the generative adversarial network, wherein the generative adversarial network is trained based on the normal traffic characteristics; The decision module determines whether the network traffic is abnormal based on the normal traffic confidence level; wherein, when the normal traffic confidence level is in the doubtful range, it obtains the simulated normal traffic features generated by the generator in the generative adversarial network, and determines whether the network traffic is abnormal based on the difference between the traffic features to be detected and the simulated normal traffic features.

[0017] Thirdly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any of the methods described in the first aspect.

[0018] Fourthly, embodiments of this application provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0019] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the methods described in the first aspect.

[0020] According to the network traffic anomaly detection method, apparatus, device, medium, and program product of this application, network traffic data is preprocessed to obtain the characteristics of the traffic to be detected. A discriminator in a pre-trained generative adversarial network is used to determine the confidence level of normal traffic, and an anomaly judgment result is determined based on the confidence level. When the confidence level is in the doubtful range, a generator is used to generate simulated normal traffic characteristics for secondary verification. Thus, through a two-layer decision-making mechanism of initial screening by the discriminator and auxiliary verification by the generator, anomaly detection can identify unknown attacks without relying on a known attack feature library, reducing the false alarm rate and improving the accuracy of network traffic anomaly detection. Attached Figure Description

[0021] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0022] Figure 1 This is a flowchart of a network traffic anomaly detection method provided in an embodiment of this application.

[0023] Figure 2 This is an overall architecture diagram of a network traffic anomaly detection method provided in this application embodiment.

[0024] Figure 3 This is a flowchart of traffic feature preprocessing in a network traffic anomaly detection method provided in this application embodiment.

[0025] Figure 4 This is a flowchart of model training in a network traffic anomaly detection method provided in this application embodiment.

[0026] Figure 5 This is another flowchart of a network traffic anomaly detection method provided in an embodiment of this application.

[0027] Figure 6 This is a block diagram of a network traffic anomaly detection device provided in an embodiment of this application.

[0028] Figure 7 This is a schematic diagram of a computer program product provided in an embodiment of this application.

[0029] Figure 8 This is a hardware block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this application more apparent, exemplary embodiments according to this application will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0031] See Figure 1 A method for detecting network traffic anomalies, comprising: S101, perform feature preprocessing on network traffic data to obtain the traffic features to be detected.

[0032] Network traffic data can be traffic data from networks such as the core network. It can include data packets and their associated information during network transmission, such as traffic data from various protocols such as Transmission Control Protocol (TCP) packets, User Datagram Protocol (UDP) packets, and Internet Protocol (IP) packets.

[0033] In this step, feature preprocessing is performed on the network traffic data to obtain the traffic features to be detected. Feature preprocessing is the process of transforming network traffic data into a structured feature representation that can be processed by the subsequent network model. After feature preprocessing, the traffic features to be detected can be obtained.

[0034] S102, using the discriminator in the generative adversarial network, the confidence level of normal traffic is determined based on the characteristics of the traffic to be detected. The generative adversarial network is trained based on the characteristics of normal traffic.

[0035] Generative Adversarial Networks (GANs) are pre-trained based on normal traffic features. During training, the generator learns the distribution patterns of normal traffic to generate simulated normal traffic features that are highly similar to real normal traffic. The discriminator, in distinguishing between real normal traffic features and the simulated traffic features generated by the generator, gradually masters the feature boundaries of normal traffic. After training, the discriminator can provide a confidence level for the input traffic features to indicate that they belong to normal traffic, and the generator can generate simulated normal traffic features that conform to the normal traffic distribution.

[0036] In this step, the characteristics of the traffic flow to be detected can be input into the discriminator. The discriminator outputs the normal traffic confidence score based on the characteristics of the traffic flow to be detected. The normal traffic confidence score indicates the probability that the traffic data is normal traffic.

[0037] S103, Based on the confidence level of normal traffic, determine whether the network traffic is abnormal traffic. Specifically, when the confidence level of normal traffic is in the questionable range, obtain the simulated normal traffic features generated by the generator in the generative adversarial network, and determine whether the network traffic is abnormal traffic based on the difference between the features of the traffic to be detected and the simulated normal traffic features.

[0038] In this step, network traffic is determined to be abnormal based on the confidence level of normal traffic. Specifically, if the confidence level of normal traffic is in the questionable range, the anomaly determination is based on the difference between the characteristics of the traffic to be detected and the characteristics of simulated normal traffic. It can be understood that if the confidence level of normal traffic is not in the questionable range, the anomaly determination can be directly based on the magnitude of the normal traffic confidence level. The questionable range can be preset according to requirements.

[0039] The network traffic anomaly detection method, apparatus, device, medium, and program product according to embodiments of this application obtain the characteristics of the traffic to be detected by preprocessing network traffic data, converting unstructured raw traffic data into a structured feature representation that can be processed by the model, providing high-quality input data for subsequent detection; using a discriminator in a pre-trained generative adversarial network, the normal traffic confidence of the network traffic is determined based on the characteristics of the traffic to be detected. Since the discriminator has mastered the distribution boundary of normal traffic through adversarial training, it can generate a low-confidence response to traffic that deviates from the normal distribution without relying on a known attack feature library, thus possessing the ability to identify unknown attacks; the anomaly judgment result is determined based on the normal traffic confidence, wherein when the normal traffic confidence is in the doubtful range, a generator in the generative adversarial network generates simulated normal traffic characteristics as a normal benchmark, and a secondary verification is performed based on the difference between the characteristics of the traffic to be detected and the simulated normal traffic characteristics, transforming the uncertain probability judgment of the discriminator into a deterministic difference comparison, solving the problem of inaccurate judgment by the discriminator in the confidence ambiguity range, reducing the false alarm rate, and improving the accuracy of network traffic anomaly detection.

[0040] To facilitate understanding of the technical implementation of the above steps, the following will combine... Figure 2 The overall architecture shown provides a detailed explanation of the specific implementation methods for each step. Figure 2 The architecture shown includes a traffic data acquisition layer 200, a traffic feature preprocessing layer 201, an adversarial network layer 202, and an anomaly detection decision layer 203. The traffic feature preprocessing layer 201 corresponds to S101, the adversarial network layer 202 corresponds to S102, and the anomaly detection decision layer 203 corresponds to S103.

[0041] Step S101: Perform feature preprocessing on the network traffic data to obtain the traffic features to be detected.

[0042] The traffic data acquisition layer 200 collects network traffic data, covering the entire protocol stack including TCP, UDP, and IP, as well as signaling and user service data traffic. It can adapt to different traffic characteristics for various application scenarios such as telecom operator core networks and the industrial internet, including real-time voice and video streams and periodic industrial control messages. The acquisition captures high-speed network traffic with millisecond-level latency, avoiding distortion of timing characteristics caused by acquisition delays. In one implementation, high-performance packet capture can be achieved based on the Data Plane Development Kit (DPDK), overcoming the performance bottleneck of traditional kernel-mode capture through user-mode driving. A distributed acquisition architecture is adopted, deploying acquisition probes at key network nodes to acquire traffic through mirror ports or optical splitters. The raw traffic is temporarily stored in a circular buffer to prevent data overflow, sorted by timestamp, and then transmitted to the feature preprocessing stage in packet-based encapsulation units.

[0043] Feature preprocessing may include operations such as protocol parsing, feature extraction, data cleaning and standardization, and vectorization. After feature preprocessing, the traffic features to be detected are obtained. These traffic features are structured features formed by processing network traffic data and can be used for adversarial network processing.

[0044] See Figure 3 In one optional implementation, feature preprocessing includes: S301 performs protocol parsing on network traffic data to obtain parsed data.

[0045] Protocol parsing of collected network traffic data can be performed by parsing the protocol structure layer by layer from the network layer to the application layer, extracting protocol field information from each protocol layer to obtain parsed data.

[0046] In one example, the extracted protocol fields include: TCP / UDP port information and connection status flags, IP source / destination addresses and TTL values, HTTP request URLs and response status codes, DNS query domain names, etc. After protocol parsing, a parsed data set containing information from each layer of the protocol is formed.

[0047] S302, extract features from the parsed data to obtain initial traffic features.

[0048] Extract initial traffic features from the parsed dataset. These features include packet count, average packet length, connection establishment frequency, and byte transfer rate. Initial traffic features can be key traffic indicators with discriminative power. Key indicators are those that can more effectively characterize the behavioral properties of traffic and enhance the ability to distinguish between normal and abnormal traffic. It should be understood that the feature extraction process can be implemented through feature engineering.

[0049] S303 performs data cleaning and standardization on the initial traffic characteristics to obtain standardized characteristics.

[0050] The extracted initial flow features are cleaned and normalized to obtain standardized features. Cleaning and normalization may include: removing redundant data, erroneous messages, and outliers; standardizing numerical features; encoding categorical features; and unifying feature units and formats. Standardization may include Z-score standardization, and encoding may include one-hot encoding.

[0051] S304 performs vectorization and time window processing on the standardized features to obtain the traffic features to be detected.

[0052] The standardized features are converted into fixed-dimensional numerical vectors, and the numerical vectors are organized in conjunction with time windows to construct a feature matrix containing time series information, so as to obtain the traffic features to be detected, so that the traffic features to be detected simultaneously contain static features and time-series behavioral features.

[0053] Through a layered processing approach involving protocol parsing, feature extraction, data cleaning and standardization, vectorization, and time window handling, unstructured traffic data is transformed into a well-structured feature representation that can be directly processed by the model. This ensures the quality and consistency of the input features, providing a reliable data foundation for subsequent training and detection of the generative adversarial network.

[0054] In an optional implementation, feature preprocessing also includes One-Class Support Vector Machine (One-Class SVM) filtering. One-Class SVM is an unsupervised anomaly detection algorithm based on density estimation, particularly suitable for scenarios where normal samples are plentiful but anomalous samples are difficult to obtain. In fields such as core networks, normal core network traffic data is relatively easy to collect, while anomalous traffic is sporadic and concealed, making systematic collection difficult. One-Class SVM can effectively utilize a large number of normal samples to construct a data distribution model.

[0055] Accordingly, the training data for the generative adversarial network is obtained by using a single-class support vector machine to filter out abnormal traffic features corresponding to the traffic data to be trained, thereby obtaining normal traffic features.

[0056] The advantages of using a single-class support vector machine for training data pre-filtering are as follows: In feature preprocessing scenarios, normal network traffic data is relatively easy to collect, while abnormal traffic such as attack traffic is often sporadic and hidden, making it difficult to collect systematically. One-Class SVM can utilize a large number of normal samples to build a data distribution model; the characteristic of not needing to label abnormalities significantly reduces the cost and time of manual labeling, which is in line with the characteristics of rapid dynamic changes and significant labeling lag in traffic data; through kernel function mapping, it can effectively process non-linearly distributed traffic data, accurately identify abnormal features that deviate from the normal pattern, and provide reliable support for subsequent analysis and decision-making.

[0057] This implementation method ensures that the input data for training the generative adversarial network (GAN) consists of high-quality traffic features corresponding to normal traffic, preventing interference from abnormal traffic during the GAN training process. This reduces the amount of data and noise in subsequent training stages, lowers the risk of misjudgment, and improves detection accuracy.

[0058] The workflow of a single-class support vector machine can include model training, anomaly detection, and data filtering: During the model training phase, normal traffic samples are extracted from historical traffic data. These samples need to cover normal network activity across different time periods and service types to ensure the model has sufficient generalization ability. Key features such as packet size distribution, transmission frequency, and protocol type proportion are extracted from the traffic data to construct a multi-dimensional feature vector as model input. A single-class support vector machine searches for an optimal hyperplane in the feature space to enclose the normal traffic data as tightly as possible, forming a normal traffic region. In one example, the traffic features to be detected include packet size distribution, transmission frequency, and protocol type proportion.

[0059] During the anomaly detection phase, the preprocessed traffic data is input into a trained single-class support vector machine model. The model calculates the distance of each data point from the hyperplane based on its positional relationship with the normal traffic area. If a data point is located outside the normal traffic area or its distance from the hyperplane exceeds a set threshold, the traffic is determined to be abnormal.

[0060] During the data filtering phase, abnormal traffic deviating from the normal pattern is marked and filtered. The normal traffic features obtained after filtering are used as training data for the generative adversarial network, reducing the amount of data and noise interference in subsequent processing stages, and improving the efficiency and accuracy of the entire traffic analysis system.

[0061] The traffic features to be detected generated after the above feature preprocessing, along with the filtered normal traffic features, will serve as input data for the adversarial network layer. The generator learns the distribution pattern of normal traffic based on the normal traffic features and generates simulated traffic; the discriminator continuously optimizes its ability to identify normal traffic features by comparing real traffic with simulated traffic, and provides preliminary traffic discrimination criteria for the anomaly detection decision layer.

[0062] Step S102: Using the discriminator in the generative adversarial network, the confidence level of normal traffic is determined based on the characteristics of the traffic to be detected. The generative adversarial network is trained based on the characteristics of normal traffic.

[0063] Generative Adversarial Networks (GANs) are deep learning frameworks that include generators and discriminators.

[0064] Generative Adversarial Networks (GANs) are pre-trained. The discriminator of a pre-trained GAN assesses the probability that input traffic features belong to normal traffic and outputs a normal traffic confidence score. This score can be represented by the probability of traffic being abnormal or normal. The normal traffic confidence score ranges from 0 to 1; values ​​closer to 1 indicate that the discriminator is more likely to consider the traffic normal, while values ​​closer to 0 indicate that the discriminator is more likely to consider the traffic abnormal. The GAN also includes a generator. This pre-trained generator generates simulated normal traffic features. The generator learns the distribution patterns of normal network traffic data and generates simulated data that is highly similar to it.

[0065] The discriminator outputs a normal flow confidence score based on the input flow characteristics. This normal flow confidence score represents the degree of certainty that the input flow characteristics belong to normal flow. The higher the normal flow confidence score, the more likely the discriminator is to consider the input flow characteristics to be normal flow; the lower the normal flow confidence score, the more likely the discriminator is to consider the input flow characteristics to be abnormal flow.

[0066] Generative Adversarial Networks (GANs) can be pre-trained based on normal traffic characteristics. The generator learns the distribution patterns of normal traffic and generates simulated normal traffic features, while the discriminator, in the process of distinguishing between real and simulated normal traffic, develops a precise understanding of the boundaries of normal traffic features, jointly constructing a "normal traffic feature benchmark." After training, based on the "normal feature benchmark," the discriminator can provide a confidence level for the input traffic features to determine whether they belong to normal traffic, serving as a preliminary judgment result passed to the anomaly detection decision layer. By mastering normal traffic rules through adversarial training, both a normal standard and a preliminary conclusion are provided, improving the accuracy and efficiency of anomaly identification.

[0067] In one optional implementation, the discriminator includes: Convolutional neural networks are used to extract protocol layer spatial features from input traffic features; Long Short-Term Memory (LSTM) networks are used to extract temporal features from input traffic characteristics; The multi-head attention module is used to perform attention operations on the fused features, which are the features after fusing spatial and temporal features from the protocol layer.

[0068] In one example, the multi-head attention module outputs weighted features and attention weights. The discriminator includes an output module that outputs normal traffic confidence based on the weighted features and outlier field location information based on the attention weights. The outlier field location information may include an attention heatmap generated based on the attention weights.

[0069] LSTM is used to extract temporal features from input traffic characteristics. Temporal features refer to the behavioral patterns and changes in traffic data over time, such as periodic fluctuations in traffic rate and trends in connection establishment frequency.

[0070] LSTM, through its gating mechanisms such as input gates, forget gates, and output gates, can effectively capture long-short-term temporal dependencies in traffic sequences. For example, a normal HTTP request typically exhibits a temporal pattern of establishing a connection, sending a request, receiving a response, and closing the connection; LSTM can learn and remember this temporal pattern. When abnormal temporal patterns occur, the temporal features extracted by LSTM will deviate from the normal pattern. The final output is a fixed-dimensional temporal feature vector.

[0071] Protocol layer spatial and temporal features can be fused by a fusion module. For example, the protocol layer spatial feature vector output by a convolutional neural network and the temporal feature vector output by a long short-term memory network can be fused through dimensional concatenation. Before concatenation, a linear layer ensures that the dimensions of the two are consistent, and after concatenation, a fused feature vector is formed. This fusion method directly preserves the complete information of both spatial and temporal features, avoiding the additional training difficulty caused by complex attention weight calculations. Spatial features can be anomalous combinations of protocol fields, while temporal features can be patterns in traffic fluctuations.

[0072] The multi-head attention module performs attention operations on the fused protocol layer spatial and temporal features, outputting weighted features and attention weights. After receiving the fused feature vector, the multi-head attention module performs the following operations: It splits the fused feature vector into multiple parallel sub-feature vectors, for example, splitting a 128-dimensional fused vector into eight 16-dimensional sub-feature vectors, i.e., eight attention heads. Each attention head independently calculates the relationships between dimensions within its sub-feature. The attention calculation process can be as follows: The input features are mapped using a weight matrix to obtain the query vector Q, key vector K, and value vector V. The dot product similarity between Q and K is calculated and normalized using softmax to obtain the attention weight α. Then, the value vector V is weighted and summed according to the attention weight to obtain the output of that attention head. Each attention head focuses on feature relationships in different dimensions, such as the correspondence between port numbers and packet lengths, and the matching degree between connection intervals and protocol types, outputting features with different focuses. The outputs of all attention heads are concatenated and compressed back to the original dimensions, such as 128 dimensions, through a linear layer to obtain the final weighted features.

[0073] During the attention operation described above, an attention weight matrix A can be generated simultaneously. The dimension of matrix A is the number of samples multiplied by the number of protocol fields; the larger the weight, the more critical the field is for anomaly detection.

[0074] The output module can calculate the confidence level of normal traffic based on weighted features, using a fully connected layer and activation function. An attention heatmap is generated based on the attention weight matrix A. The attention heatmap is a visual representation of the attention weight matrix A, intuitively showing the weight distribution of each protocol field in the discrimination process through color intensity; the darker the color, the greater the contribution of that field to anomaly detection. The attention heatmap is used to locate the protocol layer fields where anomalies occur. For example, when an anomaly occurs where both the TCP flags SYN and FIN are set simultaneously, the TCP flag field in the heatmap will have the darkest color, thus accurately locating the anomaly from the traffic level to the protocol field level.

[0075] This embodiment employs a hybrid architecture design that utilizes convolutional neural networks to extract spatial features at the protocol layer, long short-term memory networks to extract temporal features, and a multi-head attention module for dynamic weighting. This allows the discriminator to simultaneously detect both spatial structural anomalies and temporal behavioral anomalies in traffic. The multi-head attention module dynamically weights each protocol field using a weight matrix, enabling the discriminator not only to determine whether traffic is abnormal but also to accurately pinpoint which protocol field the anomaly occurs in, achieving a leap from traffic anomalies to protocol field-level anomalies.

[0076] In one example, the convolutional neural network includes at least two different sizes of one-dimensional convolutional kernels, used to extract protocol field association features of different ranges respectively; the convolutional neural network is used to perform activation function processing and pooling operations on the protocol field association features and then perform fusion processing to generate protocol layer spatial features.

[0077] Specifically, three types of one-dimensional convolution kernels can be used: small kernel, medium kernel, and large kernel. For example, the size of the small kernel is set to 2, the size of the medium kernel is set to 3, and the size of the large kernel is set to 7.

[0078] Small kernel: The convolution kernel covers two adjacent protocol fields to capture local correlations between adjacent fields. For example, for HTTP request feature sequences, the small kernel can capture the correlation between the request method and the URL length, and detect abnormal behavior such as the data body length being 0 for POST methods.

[0079] Mid-core: The convolution kernel covers three consecutive protocol fields, used to capture the correlation between a range of fields in a series of consecutive fields. For example, the mid-core can capture the correlation between protocol version, number of header fields, and data body length, and identify malicious packets that use the HTTP / 1.1 protocol but carry an excessive number of header fields.

[0080] Large kernel: The convolution kernel covers all fields and is used to capture global structural relationships. For example, the large kernel can detect the compliance of the overall request structure, such as exceptions where the request method is GET but carries a large data body, which violates HTTP specifications.

[0081] The protocol field association features extracted by convolutional kernels at each scale are processed by the LeakyReLU activation function to retain weak feature information; then, dimensionality reduction is performed by max pooling to filter key features; finally, the pooling results at multiple scales are concatenated and fused, compressed by 1×1 convolution and then global pooled to generate the final protocol layer spatial feature vector, which is used to fuse with LSTM temporal features.

[0082] By employing a parallel design of multi-scale convolutional kernels, convolutional neural networks can simultaneously extract correlation features between protocol fields from local, intermediate, and global levels, overcoming the limitation of single-scale convolutional kernels that can only perceive correlations within a fixed range. Features from different scales are fused to form a complete spatial feature representation of the protocol layer, providing a rich feature foundation for subsequent attention weighting and anomaly detection.

[0083] The discriminator can distinguish between real, normal traffic characteristics and simulated traffic data generated by the generator, and locate the specific protocol layer where anomalies occur through an attention mechanism.

[0084] In one example, the discriminator structure is as follows: Input layer: Iterative training phase: Receives two types of inputs: real normal traffic features and simulated normal traffic features output by the generator.

[0085] Abnormal traffic detection phase: Only receive characteristics of real and normal traffic.

[0086] Network structure: It adopts a hybrid architecture of CNN and LSTM, and embeds a multi-head attention module.

[0087] CNNs are used to capture spatial features of the protocol layer, such as flags in the TCP header and UDP packet size; LSTMs are used to capture temporal features of traffic data.

[0088] CNNs are typically used to process two-dimensional data, and this approach requires data transformation. First, the one-dimensional field sequence is converted to a format suitable for CNN input. Then, three types of 1D convolutional kernels—small, medium, and large—are used to capture local correlations between adjacent fields, range correlations within consecutive fields, and global correlations across all fields, respectively, resulting in feature outputs of different ranges. Next, LeakyReLU activation preserves weak features, and max pooling is used for dimensionality reduction to filter key features. Afterward, the multi-scale pooled features are concatenated, compressed using 1×1 convolution, and output as a spatial feature vector through global pooling, which is then fused with the LSTM temporal features. A direct concatenation method is used to fuse the 64-dimensional spatial feature vector FCNN extracted by CNN and the 64-dimensional temporal feature vector FLSTM extracted by LSTM: the concatenated vector forms a 128-dimensional fused feature vector Ffusion=[FCNN;FLSTM]; a linear layer is used before concatenation to ensure that the dimensions of the two vectors are consistent, eliminating the need for additional weight calculations. An example is shown below: Select the core features of an HTTP request and arrange them in order: [request method, URL length, protocol version, number of header fields, body length, response status code, connection duration]. After preprocessing, convert them into numerical features, forming a one-dimensional input: [0, 0.62, 1.1, 0.35, 0.0, 0.9, 0.48].

[0089] Processing steps: 1. Input format conversion. Convert the one-dimensional features to the [1, 7, 1] format to adapt to CNN processing, where [1, 7, 1] represents height=1, width=7, and single channel. 2. Multi-scale convolution to extract features. 3. Activation, pooling, and fusion. After LeakyReLU activation, max pooling (pool_size=2) is used to filter key features, such as retaining [0.53, 0.34, 0.57] after small kernel feature pooling. Multi-scale features are concatenated and compressed by 1×1 convolution, finally outputting a 64-dimensional spatial feature vector.

[0090] CNNs, through multi-scale convolutions, extract features from a one-dimensional HTTP feature sequence: using small kernels to detect discrepancies between the request method and the data body length (e.g., GET requests carrying a data body); using medium kernels to identify anomalous matches between the protocol version and the number of headers (e.g., older protocols carrying excessive headers); and using large kernels to detect the compliance of the overall request structure (e.g., mismatches between status codes and request behavior). The fused 128-dimensional feature vector F fusion The processing logic is simplified by directly inputting into the multi-head attention module: Feature splitting: F fusion It is split into 8 parallel sub-feature vectors, each with 16 dimensions; Multi-head computation: Each head independently calculates the correlation within sub-features, such as the "correspondence between port number and packet length" and the "matching degree between connection interval and protocol type", and outputs features with different focuses; Result merging: The 8-head output is concatenated and compressed back to 128 dimensions through a single linear layer to obtain the final feature vector F. final .

[0091] By focusing on the correlation of features in different dimensions in a multi-head parallel manner, the ability to identify composite anomalies of "spatial + temporal" is enhanced.

[0092] The multi-head attention module dynamically weights the importance of each protocol field using a weight matrix A. The specific calculation process is as follows: Calculate attention weights :

[0093] in, Represents the query vector With key vector Similarity score; This represents the number of key vectors involved in the attention calculation; Represents the query vector With key vector The similarity score.

[0094]

[0095] Based on attention weight value vector Perform a weighted summation:

[0096] in, This represents the weighted sum. This represents the number of key vectors involved in the attention calculation.

[0097] In this way, the discriminator can focus on things like TCP flags and UDP packet size.

[0098] Output layer: Output normal flow confidence level ,in 0 indicates that the data is abnormal, and 1 indicates that the data is normal. An attention heatmap is also output, visually displaying the weight distribution of each protocol field during the judgment process, thus indicating the specific protocol layer where the anomaly occurred.

[0099] In one implementation, the generator is a Transformer architecture used to capture temporal dependencies in traffic features using a multi-head self-attention mechanism.

[0100] The Transformer architecture is a deep learning network structure based on an attention mechanism. It captures long-term and short-term dependencies in traffic features through a multi-head self-attention mechanism. This multi-head self-attention mechanism concatenates and linearly transforms the outputs of multiple self-attention heads to learn richer feature representations. Compared to traditional recurrent neural network architectures, the Transformer's self-attention mechanism can directly model the dependencies between any two positions in a sequence, regardless of sequence length. This allows it to more effectively capture long-distance temporal dependencies in traffic data, such as the correlation between an anomaly detection action and an actual attack minutes later.

[0101] In one example, the generator structure is as follows: Input layer: During the pre-training phase: receive random noise vectors Compared with historical normal traffic characteristics The input is a combination of two vectors. The combination method is as follows: a random noise vector z of dimension dz is directly concatenated with a historical normal traffic feature xnormal of dimension dx, forming a mixed input vector [z;xnormal] of dimension dz+dx, where the semicolon indicates dimension concatenation. This mixed input vector is then directly fed into the first layer of the generator network. The random noise vector is used to introduce data diversity, while the historical normal traffic feature provides characteristic information about the actual traffic flow.

[0102] During the iterative training phase: Receive random noise vectors. .

[0103] Output layer: Outputs simulated normal traffic flow characteristics. It can be a high-dimensional feature distribution, and through training, the distribution of simulated normal traffic flow characteristics G(z) is made as close as possible to the distribution of real normal traffic flow p_data(x).

[0104] Network architecture: Transformer architecture; For a flow sequence of length L :

[0105] in, Represents flow sequence The first in Traffic volume.

[0106] The computational process of the self-attention mechanism is as follows: Calculate the query, key, and value vector:

[0107] in, , , These represent the query, key, and value vectors, respectively. This represents the learnable weight matrix.

[0108] Calculate attention score :

[0109] in, , , These represent the query, key, and value vectors, respectively. This represents the dimension of the key vector.

[0110] The training process of a generative adversarial network is a dynamic game between the generator and the discriminator. In one example, the objective function for:

[0111]

[0112] in, This indicates that the discriminator distinguishes between "real traffic" and "real traffic". The output is rated on its authenticity. The closer the output is to 1, the more the discriminator considers X to be real traffic; the closer it is to 0, the more it considers it to be simulated traffic.

[0113] This represents the discriminator's ability to distinguish between real data. The goal is to maximize this part so that the discriminator can accurately identify real data.

[0114] This represents the "simulated normal traffic characteristics" output by the generator. The generator learns the characteristics of real normal traffic X and maps the random noise vector z to a near-normal flow. The simulated sample of the distribution, namely "pseudo-normal flow".

[0115] This represents the discriminator's score on the realism of the "simulated traffic characteristics". The closer the output is to 1, the stronger the generator's ability to fool the discriminator; the closer it is to 0, the stronger the discriminator's ability to distinguish.

[0116] This represents the generator's ability to generate data. The goal is to minimize this part so that the data generated by the generator can fool the discriminator.

[0117] This represents the attention loss weight coefficient, a hyperparameter. It can be manually set, such as 0.1 or 0.5, to balance the importance of "traditional GAN ​​game theory loss" and "attention loss". The larger the size, the more emphasis is placed on focusing attention.

[0118] This represents the attention loss term, used to constrain the focus of the attention matrix A. For example, for key features of the TCP protocol such as the SYN / FIN ratio and UDP packet size distribution, by designing an appropriate loss function (such as L1 or L2 regularization), the discriminator's attention can be forced to focus on these important fields.

[0119] This represents the attention matrix in the discriminator. The dimension is "number of samples × number of protocol fields", and each element... Indicates the first In the nth sample, the nth The attention weight of each protocol field is determined by the number of attention weights. The larger the weight, the more critical the field is to anomaly detection, thereby improving the accuracy and interpretability of anomaly detection.

[0120] In one example for:

[0121] in: This indicates a loss of attention.

[0122] A represents the attention weight matrix output by the discriminator, with dimension N. M.

[0123] N represents the number of samples in a batch for training. For example, if each training session inputs 32 traffic samples, then N=32.

[0124] M represents the total number of protocol fields contained in a single traffic sample. For example, if a TCP packet contains 10 fields such as source port, destination port, SYN flag, and FIN flag, then M=10.

[0125] Represents the first... Line 1 Column element, i.e., the first In the nth sample Attention weights for each field.

[0126] This represents a preset "field importance mask". The dimension is 1. M can be set manually or through prior knowledge. If the first... These fields are key characteristics, such as the TCP SYN flag and the UDP packet size. If it is a non-critical field, such as a reserved bit in TCP, then .

[0127] This indicates that the total loss is normalized to avoid imbalance in the magnitude of the loss value due to excessively large N or M, and to ensure that it can be weighted and integrated with the main loss term of GAN.

[0128] The design of "forcing attention to focus on important fields" can be achieved through the backpropagation mechanism during training: Initial state: The weights of the attention matrix A are randomly distributed. The value is relatively large.

[0129] Loss constraint: The objective function is required to minimize Therefore, during training, attention-related parameters in the discriminator, such as the weight matrix of the multi-head attention module, are adjusted through backpropagation. Results-oriented: parameter tuning will... Towards Approaching, Attention weights of key fields Forced to increase, Attention weights for non-critical fields Forced to decrease.

[0130] By introducing an attention loss term into the training objective function, the importance of [the target value] is integrated into the model training process, enabling the multi-head attention module to focus more on protocol fields related to anomaly detection after training. Compared with ordinary attention mechanisms without an attention loss term, this improves the rationality of attention allocation and the accuracy of anomaly localization.

[0131] During training, the generator and discriminator are optimized alternately. The generator is kept stationary while the discriminator's parameters are updated to maximize V(D, G); conversely, the discriminator is kept stationary while the generator's parameters are updated to minimize V(D, G). Through continuous iteration, when the data generated by the generator becomes difficult for the discriminator to distinguish, it means the generator has grasped the distribution pattern of normal traffic. At this point, the discriminator can efficiently detect abnormal traffic deviating from the normal distribution pattern by comparing the generated data with the real data, achieving accurate identification of network traffic anomalies. The quantitative termination condition during training is "the data generated by the generator becomes difficult for the discriminator to distinguish."

[0132] This can be determined based on three indicators: Indicator 1: The discriminator's classification accuracy remains stable at 45%-55%, for example, unchanged for 5 consecutive rounds of training.

[0133] The accuracy of random guessing is 50%. At this point, the discriminator can no longer distinguish between real normal traffic and generated simulated traffic, indicating that the generator has fitted the normal distribution.

[0134] Indicator 2: The discriminant loss LD and the generator loss LG no longer decrease. For example, if the fluctuation is less than 0.05 for 5 consecutive rounds and the difference between the two is less than 0.1, it indicates that the generator and the discriminator are evenly matched and neither is excessively dominant.

[0135] Indicator 3: Anomaly detection pre-validation accuracy ≥ 90%.

[0136] The model, when tested with a small number of labeled abnormal traffic samples, can accurately identify them, indicating that the model has met the core requirements for traffic anomaly detection.

[0137] Training can be terminated once the first two indicators are met and the third indicator is achieved.

[0138] In one embodiment, see Figure 4 The training process for generative adversarial networks includes: Pre-training phase: S401, Output normal traffic features (pre-training data). In this step, the traffic feature preprocessing layer outputs normal traffic features to the generator as pre-training data.

[0139] S402, Pre-training based on pre-training data. In this step, the generator is pre-trained based on the pre-training data so that it can generate simulated traffic characteristics based on random noise.

[0140] Iterative training phase: S403, Output normal flow characteristics (training data). In this step, the flow characteristic preprocessing layer outputs normal flow characteristics (training data) to the discriminator, which can be marked as 1. Marking as 1 represents the true normal flow characteristics, and marking as 0 represents the simulated flow characteristics.

[0141] S404, Generate simulated flow characteristics based on random noise. In this step, the generator generates simulated flow characteristics based on random noise.

[0142] S405, Output simulated flow characteristics. In this step, the generator outputs simulated flow characteristics to the discriminator, which can be marked as 0.

[0143] S406, Receive normal flow characteristics (marked as 1) and simulated flow characteristics (marked as 0). In this step, the discriminator receives the normal flow characteristics output by the flow characteristic preprocessing layer, marked as 1, and the simulated flow characteristics output by the generator, marked as 0.

[0144] S407, Output the discrimination result. In this step, the discriminator outputs the discrimination result to the loss calculation module based on the characteristics of normal flow and simulated flow.

[0145] S408, Output Discriminant Loss. In this step, the loss calculation module outputs the discriminant loss to the discriminator based on the true labels.

[0146] S409, Update parameters based on discriminant loss. In this step, the discriminator updates its parameters based on the discriminant loss to improve its discriminative ability.

[0147] S410, Output simulated flow characteristics (marked as 1). In this step, the generator outputs simulated flow characteristics (marked as 1) to the discriminator. It should be understood that this is a deceptive mark; it is a simulated flow characteristic, but it is marked as a real, normal flow characteristic.

[0148] S411, Output the discrimination result. In this step, the discriminator outputs the discrimination result to the loss calculation module based on the simulated flow characteristics (marked as 1).

[0149] S412, Output Generation Loss. In this step, the loss calculation module outputs the generation loss to the generator based on the deception tag.

[0150] S413, Update parameters based on generation loss. In this step, the generator updates parameters based on the generation loss.

[0151] After training is complete, it can output a generator that simulates normal traffic characteristics, a discriminator that identifies abnormal traffic, and the discriminator outputs the confidence level of normal traffic.

[0152] In each iteration, the generator G first outputs the generated simulated traffic features to the discriminator D. The discriminator D receives the simulated traffic features (marked as 0) and the real normal traffic features (marked as 1), distinguishes between them, and outputs the result to the loss calculation module. The loss calculation module calculates the discrimination loss based on the real labels and feeds it back to the discriminator D. The discriminator D updates its own parameters based on this loss to improve its ability to distinguish between real and simulated traffic.

[0153] Discriminator Loss (LD) measures the discriminator's ability to distinguish between "real traffic" and "simulated traffic," and is expressed by the following formula:

[0154] in: N represents the batch sample size (the number of real / simulated traffic samples input in each iteration); This represents the i-th real normal traffic feature (marked as 1); This represents the i-th simulated flow feature generated by the generator based on noise (marked as 0); This represents the discriminator's "authenticity score" for real traffic (the closer to 1, the better); This represents the "realism score" of the discriminator for the simulated traffic (the closer to 0, the better).

[0155] The discriminant loss is the negative of the discriminator maximization term in the objective function, while the generator loss LG is the core part of the generator minimization term in the objective function. Both are essentially the same as the objective function, but they are converted into the form of "minimizing loss" for the convenience of training.

[0156] Generator G outputs new simulated flow characteristics and marks them as 1, which is then passed to discriminator D. Discriminator D discriminates the new simulated flow, and the result is sent to the loss calculation module again. The loss calculation module calculates the generation loss (used to measure the deception effect of the generator) and feeds it back to generator G. Generator G updates its parameters based on the generation loss to enhance the realism of the simulated flow.

[0157] Generator Loss (LG) measures how well the simulated traffic generated by the generator "fools" the discriminator. The formula is:

[0158] in: N represents the batch sample size (the number of real / simulated traffic samples input in each iteration); This represents the i-th simulated flow feature generated by the generator based on noise (marked as 0); This represents the "realism score" of the discriminator for the simulated traffic (the closer to 0, the better).

[0159] The above iterative process is repeated until the preset training rounds are reached. After training, the generator G output can be used to generate a model for simulating traffic flow, and the discriminator D output can be used to generate a discriminative model for anomaly detection.

[0160] Step S103: Based on the confidence level of normal traffic, determine whether the network traffic is abnormal traffic. Specifically, if the confidence level of normal traffic is in the questionable range, obtain the simulated normal traffic features generated by the generator in the generative adversarial network, and determine whether the network traffic is abnormal traffic based on the difference between the features of the traffic to be detected and the simulated normal traffic features.

[0161] When the confidence level of normal traffic is in the questionable range, it indicates that the discriminator's traffic judgment is questionable, making it difficult to determine whether it is normal or abnormal traffic. In this case, a generator in a generative adversarial network (GAN) generates simulated normal traffic features. The difference between the detected traffic features and these simulated normal traffic features is used to determine whether the corresponding network traffic is normal or abnormal. A larger difference indicates that the detected traffic features deviate more from normal traffic. If the difference exceeds a preset difference threshold, the corresponding network traffic is determined to be abnormal; if the difference does not exceed the preset difference threshold, the corresponding network traffic is determined to be normal. The difference can be considered as the degree of deviation, and the preset difference threshold can be considered as a preset deviation threshold.

[0162] The aforementioned suspicious range can be configured and adjusted according to specific business scenarios. For example, in some general scenarios, the suspicious range is set to 0.3 to 0.7; in scenarios with high security requirements, such as financial transaction networks, the suspicious range can be set wider, such as 0.2 to 0.8, to increase the trigger frequency of secondary verification and reduce the risk of missed detection; in scenarios with high requirements for detection efficiency, the suspicious range can be set narrower, such as 0.4 to 0.6, to reduce unnecessary secondary verification and improve detection speed.

[0163] It should be understood that when the confidence level of normal traffic is not in the questionable range, the discriminator is considered to be able to give a relatively clear judgment, and the anomaly judgment result can be determined directly based on the value of the confidence level of normal traffic.

[0164] In one optional implementation, when the confidence level of normal traffic is in the questionable range, the generator generates simulated normal traffic characteristics based on the contextual information of the traffic characteristics to be detected. The contextual information includes at least one of the following: protocol type, source address information, and time window information. When generating simulated normal traffic characteristics based on the contextual information of the traffic characteristics to be detected, the generator can use both the contextual information of the traffic characteristics to be detected and a random noise vector.

[0165] In one optional implementation, the suspicious interval is the interval greater than a first threshold and less than a second threshold. Based on the normal traffic confidence level, determining whether network traffic is abnormal includes: determining network traffic as abnormal when the normal traffic confidence level is less than or equal to the first threshold; determining network traffic as normal when the normal traffic confidence level is greater than or equal to the second threshold. When the normal traffic confidence level is less than the first threshold, it indicates that the discriminator is highly inclined to consider the traffic as abnormal, and in this case, the network traffic is directly determined to be abnormal. For example, if the first threshold is set to 0.3, when the normal traffic confidence level is 0.1, the discriminator considers the traffic abnormal with a high confidence level, requiring no further verification. When the normal traffic confidence level is greater than the second threshold, it indicates that the discriminator is highly inclined to consider the traffic as normal, and in this case, the network traffic is directly determined to be normal. For example, if the second threshold is set to 0.7, when the normal traffic confidence level is 0.9, the discriminator considers the traffic normal with a high confidence level, requiring no further verification.

[0166] In practice, the first and second thresholds can be dynamically adjusted according to the security requirements of the business scenario. For example, in financial scenarios, where sensitivity to anomalies is higher, the first threshold can be adjusted to 0.2 and the second threshold to 0.8 to expand the suspicious range and improve security; in ordinary office networks, the first threshold can be set to 0.4 and the second threshold to 0.6 to narrow the suspicious range and improve detection efficiency.

[0167] In this implementation, by setting a first threshold and a second threshold, the confidence space of normal traffic is divided into three judgment regions: the abnormal region, the questionable region, and the normal region. This makes the judgment logic clear and operable. Clear judgment results can be output quickly, ensuring detection efficiency; questionable judgment results are eliminated through secondary verification, ensuring detection accuracy. The configurability of the thresholds allows this solution to adapt to business scenarios with different security requirements, balancing security and efficiency.

[0168] In one specific embodiment, see Figure 5 Methods for detecting abnormal network traffic include: S501, Output network traffic data. In this step, the traffic data acquisition layer can collect raw network traffic data in real time and output the network traffic data to the traffic feature preprocessing layer.

[0169] S502, Feature Preprocessing. In this step, the traffic feature preprocessing layer performs feature preprocessing on the network traffic data to generate the traffic features to be detected. Specifically, the traffic feature preprocessing layer may perform protocol parsing, feature standardization, and data cleaning on the network traffic data, outputting standardized traffic features to be detected, providing well-organized input data for subsequent analysis.

[0170] S503, Output the flow characteristics to be detected. In this step, the flow characteristic preprocessing layer outputs the flow characteristics to be detected to the generator.

[0171] S504, Determine the confidence level of normal traffic. In this step, the discriminator determines the confidence level of normal traffic data based on the characteristics of the traffic to be detected. Specifically, the discriminator receives the characteristics of the traffic to be detected and performs analysis: extracting spatial features of the protocol layer through CNN, capturing temporal features of the traffic through LSTM, and focusing on key features using an attention mechanism. After the analysis is completed, the discriminator can output a confidence level of normal traffic. The confidence level of normal traffic can be an abnormal normal traffic confidence level in the range of 0 to 1, where 0 indicates a high probability of abnormality and 1 indicates a high probability of normality. Simulated data from the generator is not introduced at this stage to improve detection efficiency in normal scenarios.

[0172] S504, Output Normal Traffic Confidence. In this step, the discriminator outputs the normal traffic confidence level to the anomaly detection decision layer.

[0173] S506, Based on the confidence level of normal traffic, determine whether the network traffic is abnormal. In this step, the anomaly detection decision layer determines whether the network traffic is abnormal based on the confidence level of normal traffic.

[0174] Among them, determining whether network traffic is abnormal based on normal traffic confidence includes two cases: If the confidence level of normal traffic is not within the doubtful interval (A, B), the network traffic is directly determined to be abnormal based on the normal traffic confidence level ZXD. If the normal traffic confidence level is less than or equal to A, the network traffic is determined to be abnormal; if the normal traffic confidence level is greater than or equal to B, the network traffic is determined to be normal. In other words, when the normal traffic confidence level is not within the doubtful interval (A, B), it is directly determined that ≥ B is normal and ≤ A is abnormal.

[0175] When the confidence level of normal traffic is within the questionable range (A, B), the anomaly detection decision layer triggers a "secondary verification mechanism": The anomaly detection decision layer triggers a simulated feature generation request to the generator. The generator produces simulated normal traffic characteristics; The generator outputs simulated normal traffic characteristics to the anomaly detection decision layer; The anomaly detection decision layer calculates the difference between the characteristics of the traffic flow to be detected and the characteristics of the simulated normal traffic flow. The anomaly detection decision layer determines whether traffic is abnormal based on discrepancies. If the discrepancy exceeds a preset threshold, it is determined to be abnormal traffic; otherwise, it is considered normal traffic. The anomaly detection decision layer can output the determination result and processing suggestions.

[0176] In one optional implementation, the training process of the generative adversarial network includes alternately performing the following steps until a training termination condition is met: The parameters of the generator are fixed, and the discriminator is trained to distinguish between real normal traffic characteristics and simulated traffic characteristics generated by the generator. The parameters of the discriminator are fixed, and the generator is trained so that the simulated flow characteristics it generates approximate the distribution of real normal flow characteristics.

[0177] In the discriminator training step, the discriminator receives two types of input: one is the real normal traffic features from the training data, which can be labeled as real traffic; the other is the simulated traffic features generated by the generator based on random noise, which can be labeled as simulated traffic. The training objective of the discriminator is to maximize its ability to distinguish between the two, that is, to classify real normal traffic features as real and simulated traffic features as simulated as much as possible.

[0178] In one example, during the training iteration phase, the generator first outputs the generated simulated traffic features to the discriminator. The discriminator receives real normal traffic features (labeled as 1) and simulated traffic features (labeled as 0), distinguishes between them, and outputs the result to the loss calculation module. The loss calculation module calculates the discriminator loss (DL) based on the real labels and feeds it back to the discriminator. The discriminator updates its own parameters based on this loss to improve its ability to distinguish between real and simulated traffic.

[0179] Discriminant loss measures the discriminator's ability to distinguish between "real traffic" and "simulated traffic," and is expressed by the following formula:

[0180] in: Indicates the determination of loss; This represents the number of samples in the batch, specifically the number of real / simulated traffic features input in each iteration. Indicates the first A true, normal traffic characteristic can be marked as 1; Indicates that the generator is based on noise The generated first A simulated flow characteristic can be marked as 0; This represents the "authenticity score" that the discriminator gives to real traffic; the closer to 1, the better. This represents the "authenticity score" of the discriminator for the simulated traffic; the closer to 0, the better.

[0181] In the generator training step, the generator generates simulated traffic features and inputs them into the discriminator. The training objective of the generator is to make the discriminator unable to distinguish between the simulated traffic it generates and the real normal traffic, that is, to minimize the generation loss.

[0182] In one example, the generator outputs a new simulated flow characteristic and marks it as 1, then passes it to the discriminator. The discriminator judges the new simulated flow, and the result is sent to the loss calculation module again. The loss calculation module calculates the generator loss (GL) based on this and feeds it back to the generator. The generator updates its parameters based on the generator loss to enhance the realism of the simulated flow.

[0183] The generation loss is used to measure the effectiveness of the generator in "deceiving" the discriminator with the simulated traffic it generates. The formula is:

[0184] in: Indicates the generation loss; This represents the number of samples in the batch, specifically the number of real / simulated traffic features input in each iteration. Indicates that the generator is based on noise The generated first Each simulated flow characteristic is marked as 0; This represents the "authenticity score" of the discriminator for the simulated traffic; the closer to 0, the better.

[0185] Determine the loss It is the negative of the discriminator maximization term in the objective function. It is the core part of the generator minimization term in the objective function. Both are essentially the same as the objective function, but they are converted into the form of "minimizing loss" for the convenience of training.

[0186] The two steps described above are executed alternately, forming a dynamic game process between the generator and the discriminator. Training continues until the training termination condition is met.

[0187] In one example, the training termination condition is determined jointly by the following three metrics: Indicator 1: The discriminator's classification accuracy remained stable between 45% and 55% (unchanged for 5 consecutive training rounds), indicating that the discriminator could no longer effectively distinguish between real traffic and simulated traffic.

[0188] Indicator 2: The discriminator loss and generator loss no longer decrease significantly (fluctuation less than 0.05 for 5 consecutive rounds), and the difference between the two is less than 0.1, indicating that the generator and discriminator have reached an equilibrium state.

[0189] Indicator 3: The model was pre-validated using a small number of labeled abnormal traffic samples, and the anomaly detection accuracy reached over 90%.

[0190] If the first two indicators are met and the third indicator is also met, the termination condition is considered met, and the training is terminated.

[0191] In one example, the training termination condition could include whether a preset number of training rounds has been reached; if so, the training is terminated.

[0192] After training, the generator has mastered the distribution pattern of normal traffic and can generate simulated normal traffic features that conform to the normal distribution; the discriminator has the ability to recognize the boundaries of normal traffic features and can provide accurate normal traffic confidence scores for input traffic features. Normal traffic confidence scores can be represented in various forms, such as abnormal normal traffic confidence scores.

[0193] Through alternating adversarial training between the generator and discriminator, the generator gradually approximates the distribution of real, normal traffic, while the discriminator continuously strengthens its ability to recognize the boundaries of normal traffic characteristics. Unlike traditional methods based on known attack feature libraries, this training method shifts the model's focus from learning what an attack is to learning what is normal. This enables the trained discriminator to detect various traffic deviations from normal distributions, including novel attacks that have never appeared before, effectively solving the problem of low recognition rate for unknown attacks in existing technologies.

[0194] In one optional implementation, the discriminator includes a multi-head attention module. The objective function used to train the generative adversarial network includes an attention loss term, which constrains the attention allocation of the multi-head attention module to a preset protocol field.

[0195] In the training process of generative adversarial networks (GANs), the objective function includes not only the traditional adversarial loss term but also an attention loss term. The role of the attention loss term is to constrain the attention weights of the multi-head attention module in the discriminator to focus on preset key protocol fields. For example, for key features of the TCP protocol such as the SYN / FIN ratio and UDP packet size distribution, by designing an appropriate loss function (such as L1 or L2 regularization), the discriminator's attention is forced to concentrate on these important fields, avoiding distraction on irrelevant fields, thereby improving the accuracy and interpretability of anomaly detection.

[0196] Specifically, the adaptive update targets detection parameters, which include boundary values ​​of the suspicious interval and / or model parameters of the generative adversarial network (GAN). The model parameters of the GAN may include weight features, etc.

[0197] For example, detection parameters include: Boundary values ​​for the suspicious interval. The first and second thresholds are dynamically adjusted based on the anomaly detection results. For example, if statistics show a high misjudgment rate for a certain probability interval (e.g., abnormal traffic in the 0.3 to 0.4 interval is frequently misjudged as normal), the first threshold can be increased from 0.3 to 0.4, expanding the suspicious interval to increase the probability of traffic in that interval triggering secondary verification. Conversely, if statistics show a high accuracy rate for a certain probability interval (e.g., a 99% accuracy rate for normal traffic in the 0.6 to 0.7 interval), the second threshold can be decreased from 0.7 to 0.6, narrowing the suspicious interval to improve detection efficiency.

[0198] Feature weights. For traffic samples that are identified as abnormal and subsequently confirmed as real attacks, their normal traffic confidence level and feature difference values ​​are recorded to strengthen the weights of the corresponding features. For traffic samples that are identified as normal but actually cause problems, their differences from simulated normal traffic are analyzed, and the weights of the relevant features are updated, or the features of this type of traffic are added to the training dataset for iterative optimization of the model.

[0199] Adaptive updates can be executed automatically according to preset time periods or event triggers, or they can be manually triggered by operations and maintenance personnel.

[0200] Through an adaptive update mechanism, detection parameters can be continuously optimized based on detection feedback during actual operation, enabling the anomaly detection system to self-evolve. As the system operates for an extended period, the detection parameters become increasingly aligned with the characteristics of the actual network environment, resulting in continuously improved detection accuracy. This effectively solves the performance degradation problem of traditional static detection models when facing dynamic changes in the network environment.

[0201] As the decision-making center of the traffic detection architecture, the anomaly detection decision layer undertakes the core responsibilities of integrating analysis results, eliminating ambiguity in judgment, and outputting clear conclusions. Its working logic is closely linked to the preliminary analysis results of the discriminator, and when necessary, it links with the simulation data of the generator to form a closed-loop mechanism of "accurate judgment + flexible verification".

[0202] In one implementation, the anomaly detection decision layer includes: Input consists of two parts: first, the confidence level of normal traffic output by the discriminator, such as the probability that real-time traffic is real data, which can be in the range of 0-1. The closer to 1, the more normal the data is, and the closer to 0, the more likely the data is to be abnormal; second, when the confidence level of normal traffic is in the doubtful range, the simulated normal traffic features generated by the generator serve as a quantitative reference for the "normal baseline".

[0203] Output: Traffic determination results, auxiliary annotations for anomaly types, and corresponding handling suggestions.

[0204] Traffic determination results are, for example, normal or abnormal. Auxiliary annotations for abnormal types include protocol field abnormalities, timing behavior abnormalities, and location results based on discriminator attention mechanisms. Handling suggestions include, for example, allowing traffic, issuing alarms, blocking, and further tracing the source.

[0205] The core objective of the anomaly detection decision layer is to solve the problem of "fuzzy judgment" when the discriminator analyzes alone. By comparing rules and quantification, probabilistic results are transformed into more certain conclusions, ensuring the interpretability of the decision.

[0206] Taking the interval of doubt (0.3, 0.7) as an example: When the confidence level of normal traffic output by the discriminator is ≥0.7 or ≤0.3, the anomaly detection decision layer initiates a rapid decision-making mode. The specific process is as follows: Probability threshold matching: Directly call the preset judgment rules (the threshold can be dynamically adjusted according to the business scenario. For example, the financial scenario is more sensitive to anomalies, so the normal threshold can be increased to 0.8) to map the probability to a clear result: ≥0.7 is marked as "normal" and ≤0.3 is marked as "abnormal".

[0207] Supplementary information: Combine the “high-weight features” output by the discriminator’s attention mechanism (such as extracting the protocol field or time segment with the highest attention weight when the confidence of normal traffic is ≤0.3) to mark the core cause of the anomaly (such as “TCP flags SYN and FIN are set at the same time, which does not conform to the standard protocol specification”).

[0208] Processing suggestion generation: Match the preset strategy according to the result type: Normal traffic is directly output as "allow"; Abnormal traffic is classified according to the severity (e.g., probability ≤0.1 is "high risk", triggering "immediate interception + alarm"; 0.1-0.3 is "medium risk", triggering "alarm + traffic isolation and observation").

[0209] Secondary verification of the "questionable judgment result": When the confidence level of the normal traffic output by the discriminator is between 0.3 and 0.7, the anomaly detection decision layer initiates deep verification mode, eliminating uncertainty through the generator's simulated data. The specific steps are as follows: Trigger generator call: Send instructions to the generator to generate matching simulated normal traffic characteristics based on the context information of the current traffic (such as protocol type, source IP, time window). For example, for suspicious traffic of a certain HTTP request, the generator should output the characteristics of normal HTTP requests from the same IP in the same time period.

[0210] Feature difference quantification: Calculate the difference between real-time traffic characteristics and simulated normal traffic characteristics. The difference can be determined by at least one of the following methods: Euclidean distance, cosine similarity, and relative entropy.

[0211] Euclidean distance. Used to measure the absolute difference in numerical dimensions (such as packet length and transmission rate) between the characteristics of traffic to be detected and those of simulated normal traffic.

[0212] Taking samples A and B as examples, the calculation formula is as follows:

[0213] in, This represents the Euclidean distance between the flow characteristics of sample A and sample B. A larger value indicates a greater difference in the numerical characteristics of the two samples. For example, here, the flow characteristic of sample A can be the flow characteristic to be detected, and the flow characteristic of sample B can be the simulated normal flow characteristic. This represents the total number of numerical features involved in the calculation. For example, when considering packet length, transmission rate, and connection duration simultaneously, n=3. The first characteristic representing the flow characteristics of sample A Numerical features, for example, here, the traffic features of sample A can be the traffic features to be detected, such as the data packet length of sample A being 1500 bytes, then... ; The first characteristic representing the flow characteristics of sample B Numerical features, for example, here, the traffic characteristics of sample A can be simulated normal traffic characteristics, such as the data packet length of sample B being 60 bytes. .

[0214] The larger the Euclidean distance, the more significant the difference in numerical characteristics between the two. For example, it can be used to compare differences in numerical characteristics such as packet length, transmission rate, and connection duration.

[0215] Cosine similarity. Used to measure the directional consistency between the detected traffic features and the simulated normal traffic features. For example, it can measure whether the combination patterns of feature vectors match. It should be understood that the traffic features such as the processed traffic features and simulated normal traffic features in the embodiments of this application can be represented in the form of feature vectors.

[0216] The calculation formula is as follows:

[0217] This represents the cosine similarity between the traffic features of sample A and the traffic features of sample B, with a value ranging from [-1, 1]. The closer to 1, the more consistent the directions of the two vectors and the more similar the feature combination patterns (such as the protocol field pairings in normal traffic); the closer to 0 or a negative number, the greater the difference in direction and the more the feature combination patterns deviate from normal patterns, which may indicate an anomaly. This represents two traffic characteristics to be compared. For example, A represents the traffic characteristics of normal traffic, and B represents the protocol characteristics of the traffic to be detected. n represents the dimension of the traffic characteristics, that is, the number of protocol fields involved in the calculation. For example, when TCP SYN, FIN, and ACK bits are included, n=3. This represents the i-th component of the traffic characteristics of sample A, such as the value of the TCP SYN bit being 1 in the traffic characteristics to be detected; This represents the i-th component of the traffic characteristics of sample B, such as the TCP SYN bit being 1 in the simulated normal traffic characteristics.

[0218] The cosine similarity value ranges from -1 to 1. The closer it is to 1, the more consistent the directions (the more similar the feature combination patterns), and the closer it is to 0 or a negative number, the greater the difference in directions. For example, it can be used to compare whether the combination patterns of protocol fields conform to normal rules (such as the combination relationship of TCP SYN bit, FIN bit, and ACK bit).

[0219] Relative entropy (also known as KL divergence) is used to quantify the degree of deviation between the characteristics of the flow to be detected and the characteristics of the simulated normal flow in terms of probability distribution.

[0220] For two discrete probability distributions P (the true time series characteristic distribution) and q (the normal time series characteristic distribution simulated by the generator), the KL divergence is calculated as follows:

[0221] Among them, represents the KL divergence of distribution P relative to distribution q. The larger the value, the more significant the difference between the two (the more the true temporal characteristics deviate from the normal mode). A value of 0 indicates that the two distributions are exactly the same.

[0222] P represents the temporal characteristic probability distribution of the traffic characteristics to be detected, such as the distribution of the number of data packets in a 10ms window in the actual network: P(1 packet)=0.3, P(2 packets)=0.5, P(3 packets)=0.2.

[0223] q represents the temporal characteristic probability distribution of the simulated normal traffic characteristics learned by the generator, such as the distribution of the number of data packets in a 10ms window in the simulated normal traffic: Q(1 packet)=0.6, Q(2 packets)=0.3, Q(3 packets)=0.1).

[0224] represents the possible values of the temporal characteristics, such as the number of data packets in a 10ms window can be 1, 2, 3, etc.

[0225] P(x) represents the probability that the feature value in distribution P is x. For example, the probability that 2 packets appear in a 10ms window in the real traffic is 0.5.

[0226] q(x) represents the probability that the feature value in distribution q is x. For example, the probability that 2 packets appear in a 10ms window in the simulated normal traffic is 0.3.

[0227] is used to measure the difference between the two distributions at a single point. When (P(x)>q(x), it is a positive value, amplifying the difference; when (P(x)<q(x), it is a negative value, and after multiplying by P(x), the overall still reflects the degree of distribution deviation. The KL divergence is asymmetric and only represents the deviation of distribution P from distribution q.

[0228] In practical applications, the difference is compared with a preset difference threshold. The preset difference threshold can be set separately, such as the preset difference threshold of 0.3 for the Euclidean distance threshold and 0.8 for the cosine similarity threshold. If the difference exceeds the preset difference threshold, it is determined as abnormal; otherwise, it is determined as normal.

[0229] In practical applications, a combination of the above-mentioned difference calculation methods can be used for multi-dimensional cross-validation. Specifically, a corresponding difference threshold is set for each difference indicator. If most indicators, such as two or more of the three, show differences exceeding their respective difference thresholds, the traffic is ultimately determined to be abnormal; otherwise, it is determined to be normal. In addition, attention weights can be combined to focus on calculating the differences of the top few protocol fields with the highest attention weights, further reducing the risk of misjudgment. For example, focusing on the top 3 protocol fields with the highest attention weights, when most key features deviate from the simulation baseline, it is determined to be abnormal, reducing the risk of misjudgment and achieving multi-dimensional cross-validation.

[0230] By combining multiple difference measurement methods, this approach comprehensively measures the difference between the traffic to be processed and the normal baseline from three complementary dimensions: absolute numerical difference (Euclidean distance), directional consistency (cosine similarity), and distribution deviation (relative entropy), avoiding the randomness and limitations of a single indicator. The multi-dimensional cross-validation mechanism further reduces the risk of misjudgment, making the results of secondary validation more robust and reliable.

[0231] In an optional implementation, the method further includes: adaptively updating the detection parameters based on the abnormal traffic determination result; wherein the detection parameters include boundary values ​​of the suspicious interval and / or model parameters of the generative adversarial network.

[0232] For traffic that is judged as "abnormal" and subsequently confirmed as a real attack, record its normal traffic confidence level and feature difference value, which can be used to lower the abnormal judgment threshold or strengthen the weight of the corresponding feature. For traffic that is judged as "normal" but actually causes problems, analyze the differences between it and simulated traffic, update the generator's training data or adjust the weights of the indicators for difference calculation. Regularly analyze the accuracy of judgments in different probability intervals and dynamically optimize the threshold division of "clear / doubtful". If the misjudgment rate is found to be high in the 0.3-0.6 interval, the doubtful interval can be expanded to 0.2-0.7.

[0233] In summary, the anomaly detection decision layer, through a two-layer logic of "rule-based rapid decision-making + quantitative comparison secondary verification," not only ensures the detection efficiency of regular traffic, but also solves the problem of judging fuzzy scenarios through the generator's simulation benchmark, while continuously improving decision accuracy through an adaptive optimization mechanism.

[0234] In one embodiment, a network traffic anomaly detection method includes: S1: Collect network traffic data.

[0235] S2: Perform feature preprocessing on network traffic data.

[0236] S3: Generates the traffic characteristics of the generated network traffic data. After processing by S2, the output regularized traffic characteristics serve as the model input and training basis.

[0237] S4: Pre-train the generator and use traffic features to learn the normal traffic distribution in advance.

[0238] The generator should first grasp the data patterns and distribution rules of normal network traffic based on traffic characteristics.

[0239] S5: Start the formal training of the Generative Adversarial Network. After pre-training is completed, begin the complete training process of the Generative Adversarial Network (including the generator and discriminator).

[0240] S6: Fix the generator parameters, train the discriminator, and update the parameters to maximize the objective function V(D, G).

[0241] By fixing the current parameters of the generator, the discriminator learns to distinguish between "real normal traffic characteristics" and "simulated traffic characteristics generated by the generator," thereby optimizing the discriminator parameters and improving its discrimination ability.

[0242] S7: Fix the discriminator parameters, train the generator, and update the parameters to minimize the objective function V(D, G).

[0243] By fixing the discriminator parameters, the generator learns to generate data that is closer to the "characteristics of real normal traffic". The generator parameters are optimized so that the simulated traffic it generates is more difficult for the discriminator to identify.

[0244] S8: Determine whether the iteration termination condition has been met.

[0245] The iteration terminates when the generator produces data that the discriminator cannot distinguish. Check if the training has converged: if the discriminator cannot effectively distinguish between "real traffic" and "generator-simulated traffic," it means the generator has learned normal traffic patterns; otherwise, continue training.

[0246] S8: Training complete. The generator has mastered the normal traffic distribution pattern.

[0247] Once the termination condition is met, the generator can stably generate data that closely approximates the characteristics of real, normal traffic flow, and the GAN model training ends.

[0248] S9: Generator for obtaining simulated traffic) and discriminator for anomaly detection.

[0249] The trained generator is used to simulate normal traffic in the future, and the trained discriminator is used to initially determine abnormal traffic and output the confidence level of normal traffic.

[0250] S10: Analyze real-time traffic using a discriminator and output the confidence level of normal traffic.

[0251] The confidence level of normal traffic can be represented by the probability of normal traffic, which is a probability value in the range of 0-1. The closer it is to 1, the more it tends to be "normal traffic"; the closer it is to 0, the more it tends to be "abnormal traffic".

[0252] S11: Based on the overview of the analysis results, determine (normal, abnormal, questionable).

[0253] Preliminary classification based on probability values: S12: High probability value (e.g., close to 1): judged as normal traffic.

[0254] S13: Low probability value (e.g., close to 0): judged as abnormal traffic.

[0255] S14: Probability values ​​in the middle range (e.g., 0.3-0.7): Determined as suspicious traffic.

[0256] Further verification is needed: call the generator to generate simulated normal traffic characteristics as a comparison benchmark.

[0257] S15: Calculate the difference between real-time traffic characteristics and simulated characteristics.

[0258] Compare “questionable traffic characteristics” and “simulated normal traffic characteristics”, and calculate the differences between the two.

[0259] S16: Determine whether the difference exceeds the threshold.

[0260] Set a difference threshold to determine whether the difference between real-time traffic and simulated normal traffic is "too large": Traffic exceeding the threshold is considered abnormal and triggers an alarm / blocking action. If the threshold is not exceeded: the traffic is considered normal and allowed.

[0261] S17: Output detection results (normal / abnormal determination). Output a clear result (allow if normal, alarm / block if abnormal).

[0262] The entire process achieves anomaly detection of network traffic by means of two core steps: "model training (generator pre-training → alternating training → generator / discriminator output)" and "traffic detection (discriminator initial screening → suspicious traffic generator auxiliary verification)". It balances detection accuracy and efficiency.

[0263] refer to Figure 6 A network traffic anomaly detection device, comprising: Preprocessing module 601 is used to perform feature preprocessing on network traffic data to obtain the traffic features to be detected; The discrimination module 602 is used to determine the confidence level of normal traffic based on the characteristics of the traffic to be detected by the discriminator in the generative adversarial network; wherein the generative adversarial network is trained based on the characteristics of normal traffic. Decision module 603 determines whether network traffic is abnormal based on the confidence level of normal traffic; wherein, when the confidence level of normal traffic is in the doubtful range, it obtains the simulated normal traffic features generated by the generator in the generative adversarial network, and determines whether the network traffic is abnormal based on the difference between the features of the traffic to be detected and the simulated normal traffic features.

[0264] In one embodiment, the network traffic anomaly detection device includes an update module for adaptively updating detection parameters based on the determination result of abnormal traffic.

[0265] The technical features of the network traffic anomaly detection device correspond to the network traffic anomaly detection method. The relevant implementation methods and optional implementation methods can be referred to in the section on network traffic anomaly detection methods, and will not be described again here.

[0266] An exemplary embodiment of this application also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of any method of the embodiments of this application.

[0267] Exemplary embodiments of this application also provide a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of any method of the embodiments of this application.

[0268] refer to Figure 7 An exemplary embodiment of this application also provides a computer program product 700, including a computer program 701, wherein the computer program, when executed by a processor, implements the steps of any method of the embodiments of this application.

[0269] refer to Figure 8 The present invention describes a structural block diagram of an electronic device 800 that can serve as a server or client of this application, which is an example of a hardware device that can be applied to various aspects of this application. The electronic device is intended to represent various forms of digital electronic computer devices, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0270] Electronic device 800 includes a computing unit 801, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 802 or a computer program loaded from storage unit 808 into random access memory (RAM) 803. RAM 803 may also store various programs and data required for device operation. The computing unit 801, ROM 802, and RAM 803 are interconnected via bus 804. Input / output (I / O) interface 805 is also connected to bus 804.

[0271] Multiple components in electronic device 800 are connected to I / O interface 805, including: input unit 806, output unit 807, storage unit 808, and communication unit 809. Input unit 806 can be any type of device capable of inputting information to electronic device 800. Input unit 806 can receive input digital or character information and generate key signal inputs related to user settings and / or function control of electronic device. Output unit 807 can be any type of device capable of presenting information and may include, but is not limited to, a display, speaker, video / audio output terminal, vibrator, and / or printer. Storage unit 808 may include, but is not limited to, disks and optical discs. Communication unit 809 allows electronic device 800 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication transceivers, and / or chipsets, such as Bluetooth™ devices, WiFi devices, WiMax devices, cellular communication devices, and / or the like.

[0272] The computing unit 801 can be any general-purpose and / or special-purpose processing component with processing and computing capabilities. The computing unit 801 executes the various methods and processes described above.

[0273] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for detecting network traffic anomalies, characterized in that, include: Feature preprocessing is performed on network traffic data to obtain the characteristics of the traffic to be detected; The discriminator in a generative adversarial network is used to determine the confidence level of normal traffic based on the characteristics of the traffic to be detected, wherein the generative adversarial network is trained based on the normal traffic characteristics; Based on the normal traffic confidence level, determine whether the network traffic is abnormal traffic; Specifically, when the confidence level of the normal traffic is in the questionable range, simulated normal traffic features generated by the generator in the generative adversarial network are obtained, and the network traffic is determined to be abnormal based on the difference between the traffic features to be detected and the simulated normal traffic features.

2. The method according to claim 1, characterized in that, The process of preprocessing network traffic data to obtain the features of the traffic to be detected includes: The network traffic data is parsed to obtain parsed data; Feature extraction is performed on the parsed data to obtain initial traffic features; The initial flow characteristics are cleaned and standardized to obtain standardized characteristics; The standardized features are vectorized and processed using a time window to obtain the traffic features to be detected.

3. The method according to claim 1, characterized in that, The discriminator includes: Convolutional neural networks are used to extract protocol layer spatial features from input traffic features; Long Short-Term Memory (LSTM) networks are used to extract temporal features from input traffic characteristics. A multi-head attention module is used to perform attention operations on the fused features, wherein the fused features are features resulting from the fusion of the protocol layer spatial features and the temporal features.

4. The method according to claim 3, characterized in that, The convolutional neural network includes at least two different sizes of one-dimensional convolutional kernels, used to extract protocol field association features of different ranges respectively.

5. The method according to claim 3, characterized in that, The objective function used to train the generative adversarial network includes an attention loss term, which is used to constrain the attention allocation of the multi-head attention module to a preset protocol field.

6. The method according to claim 1, characterized in that, The generator is based on the Transformer architecture and is used to capture temporal dependencies in traffic features using a multi-head self-attention mechanism.

7. The method according to claim 1, characterized in that, The training process of the generative adversarial network includes: Perform the following steps alternately until the training termination condition is met: The parameters of the generator are fixed, and the discriminator is trained to distinguish between real normal traffic characteristics and simulated traffic characteristics generated by the generator. The parameters of the discriminator are fixed, and the generator is trained so that the simulated flow characteristics it generates approximate the distribution of real normal flow characteristics.

8. The method according to claim 1, characterized in that, The questionable interval is the interval that is greater than the first threshold and less than the second threshold; The step of determining whether the network traffic is abnormal based on the normal traffic confidence level includes: When the confidence level of the normal traffic is less than or equal to the first threshold, the network traffic is determined to be abnormal traffic. When the confidence level of the normal traffic is greater than or equal to the second threshold, the network traffic is determined to be normal traffic.

9. The method according to claim 1, characterized in that, The difference is determined by at least one of the following methods: Euclidean distance, cosine similarity, and relative entropy.

10. The method according to claim 1, characterized in that, The training data for the generative adversarial network is obtained in the following way: The normal traffic features are obtained by using a single-class support vector machine to filter the traffic features corresponding to the traffic data to be trained.

11. The method according to claim 1, characterized in that, The method further includes: The detection parameters are adaptively updated based on the results of abnormal traffic determination. The detection parameters include the boundary values ​​of the suspicious interval and / or the model parameters of the generative adversarial network.

12. A network traffic anomaly detection device, characterized in that, include: The preprocessing module is used to perform feature preprocessing on network traffic data to obtain the features of the traffic to be detected; The discrimination module is used to determine the confidence level of normal traffic based on the characteristics of the traffic to be detected using the discriminator in the generative adversarial network; wherein the generative adversarial network is trained based on the normal traffic characteristics; The decision module determines whether the network traffic is abnormal based on the normal traffic confidence level; wherein, when the normal traffic confidence level is in the doubtful range, it obtains the simulated normal traffic features generated by the generator in the generative adversarial network, and determines whether the network traffic is abnormal based on the difference between the traffic features to be detected and the simulated normal traffic features.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 11.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 11.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method described in any one of claims 1 to 11.

Images