MPLS label feature flow monitoring anomaly detection method, device and storage medium

Abstract

The application discloses an MPLS label feature flow monitoring anomaly detection method and device and a storage medium, comprising: collecting label-level statistical data of a single MPLS label in an MPLS network; constructing a multi-dimensional feature vector in each sliding time window according to the label-level statistical data; inputting the multi-dimensional feature vector into an isolation forest model to obtain an anomaly score; if the anomaly score is in a warning interval, inputting the multi-dimensional feature vector into a self-encoder model to calculate a reconstruction error, and determining that the flow is abnormal when the reconstruction error exceeds a reconstruction error threshold; and if the anomaly score is not in the warning interval, determining whether the flow is normal or abnormal according to the deviation direction of the anomaly score relative to the warning interval. The application constructs a multi-dimensional vector based on MPLS label fine-grained features, uses an isolation forest to quickly screen normal and clear abnormal flows, calls a self-encoder to review boundary samples, and achieves the technical effect of giving consideration to detection efficiency and accuracy.

Description

Technical Field

[0001] This application relates to the field of MPLS network communication technology, and in particular to an MPLS tag feature traffic monitoring anomaly detection method, device and storage medium. Background Technology

[0002] In MPLS networks, traffic monitoring typically combines static threshold alarms with signature-based intrusion detection systems. Network administrators manually set alarm thresholds for metrics such as bandwidth utilization and packet loss rate, triggering alarms when real-time metrics exceed these thresholds. Some solutions also incorporate polling data collection and basic statistical analysis based on Simple Network Management Protocols (SMMPs). However, static thresholds struggle to adapt to the dynamic characteristics of network traffic; sudden or periodic traffic fluctuations can easily lead to missed or false alarms, and alarm response exhibits significant lag. This passive, fixed-boundary monitoring architecture suffers a sharp decline in detection accuracy when facing high-speed, bursty network traffic.

[0003] Traditional traffic monitoring solutions only collect coarse-grained aggregated metrics such as bandwidth utilization, packet loss rate, and latency, which are severely lacking in feature dimensions. For complex attack patterns such as distributed denial-of-service attacks, port scanning, and data breaches, macroscopic traffic fluctuations alone are insufficient for accurate identification. Especially when attack traffic is covertly mixed into normal business traffic, coarse-grained features are completely unable to extract effective anomaly patterns. At the same time, conventional solutions do not perform deep analysis of the label stack structure of MPLS networks, and cannot utilize label dimensions such as T-Labels and P-Labels to construct fine-grained flow features, resulting in a lack of tenant-level and path-level fine-grained monitoring, and security threats are often submerged in aggregated data.

[0004] Mainstream detection models lack self-learning capabilities, and their detection rules and model parameters remain fixed once deployed. Faced with slow changes in network behavior over time (such as business expansion and user behavior migration), these fixed models gradually deviate from the actual traffic baseline, leading to a continuous increase in false positive rates. More importantly, for unknown types or newly emerging attack methods, the models are completely unable to identify them because there are no corresponding signatures in the feature library. Traditional solutions struggle to update detection logic through online incremental learning; each model upgrade requires manual retraining and offline deployment, resulting in lengthy adaptation cycles and security protection lagging behind threat evolution.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide an MPLS tag feature traffic monitoring anomaly detection method, device and storage medium, which aims to solve the technical problem that existing MPLS network traffic monitoring and anomaly detection methods cannot simultaneously achieve detection efficiency and detection accuracy.

[0007] To achieve the above objectives, this application proposes an MPLS tag feature traffic monitoring anomaly detection method, applied to an MPLS tag feature traffic monitoring anomaly detection device, the method comprising: Collect label-level statistics based on a single MPLS label in the MPLS network, wherein the MPLS label includes T-Label and / or P-Label; Based on the aforementioned label-level statistical data, a multidimensional feature vector is constructed within each sliding time window; The multidimensional feature vector is input into the isolated forest model to obtain anomaly scores, and it is determined whether the anomaly scores are within the warning range. If the abnormal score is within the warning range, the multidimensional feature vector is input into the autoencoder model to calculate the reconstruction error, and when the reconstruction error exceeds the reconstruction error threshold, the traffic in the current time window is determined to be abnormal. If the abnormal score is not within the warning range, the traffic flow within the current time window is determined to be normal or abnormal based on the deviation direction of the abnormal score relative to the warning range. Specifically, if the abnormal score is lower than the lower threshold of the warning range, the traffic flow is determined to be normal; if the abnormal score is higher than the upper threshold of the warning range, the traffic flow is determined to be abnormal.

[0008] In one embodiment, the label-level statistics include label counter data and 5-tuple information, and the step of collecting label-level statistics based on a single MPLS label in the MPLS network includes: The tag counter data is read for each active MPLS tag by a collection agent deployed on the MPLS router or by actively pulling data through the southbound interface. The tag counter data includes tag value, number of inbound bytes, number of inbound packets, number of outbound bytes, number of outbound packets, current rate, and packet loss count. While reading the tag counter data, the data packets are sampled at the flow level to extract five-tuple information from the data packets within the same MPLS tag. The five-tuple information includes the source Internet Protocol address, the destination Internet Protocol address, the source port, the destination port, and the protocol type.

[0009] In one embodiment, before the step of inputting the multidimensional feature vector into the isolated forest model to obtain the anomaly score, the method further includes: Based on historical normal traffic data, establish a normal behavior baseline for each MPLS label; Based on the normal behavior baseline, the deviation of each traffic indicator within the current time window from the baseline is calculated, and the deviation is configured as a feature component of the multidimensional feature vector. In one embodiment, after the step of establishing a normal behavior baseline for each MPLS label based on historical normal traffic data, the method further includes: At the end of each evaluation period, the normal traffic data of the most recent period is included in the baseline calculation, and the normal behavior baseline is updated using the exponentially weighted moving average method. When a sudden change in traffic distribution is detected, a change point detection is triggered and a baseline reset operation is performed. After clearing historical data, the normal behavior baseline is re-established with the data after the change.

[0010] In one embodiment, the step of inputting the multidimensional feature vector into the autoencoder model to calculate the reconstruction error if the abnormal score is within the warning interval, and determining that the traffic is abnormal within the current time window when the reconstruction error exceeds the reconstruction error threshold, includes: The multidimensional feature vector is input into a pre-trained autoencoder neural network, and the mean square error between the original input and the restored output is calculated through the autoencoder neural network. The mean squared error is used as the reconstruction error, and the reconstruction error threshold is calculated based on the average error of the training sample set. When the reconstruction error is determined to be greater than the reconstruction error threshold, the traffic within the current time window is determined to be abnormal.

[0011] In one embodiment, after the step of determining traffic anomalies within the current time window, the method further includes: The multidimensional feature vectors that confirm the anomaly are input into a pre-trained classification model, and the classification model outputs the anomaly type and confidence level. The anomaly type includes distributed denial-of-service attack type, scanning and probing type, and abnormal behavior type. The abnormal score, the degree of deviation of the current traffic metric from the normal behavior baseline, the number of abnormal MPLS tags, and the number of time windows with continuous abnormality within the current time window are obtained. The anomaly severity score is obtained by weighted summation of the anomaly score, the degree of deviation, the number of anomaly MPLS tags, and the number of time windows. Based on the preset score range to which the severity score belongs, a structured alarm of the corresponding level is generated, wherein different score ranges correspond to different alarm levels.

[0012] In one embodiment, the MPLS tag feature traffic monitoring anomaly detection method further includes: The multidimensional feature vectors that are deemed normal are asynchronously added to the online training dataset of the isolated forest model; Based on a preset update cycle, the segmentation tree structure of the isolated forest model is updated using the online training dataset, resulting in an updated isolated forest model.

[0013] In one embodiment, the MPLS tag feature traffic monitoring anomaly detection method further includes: When the abnormal score is within the warning range and the reconstruction error does not exceed the reconstruction error threshold, the traffic in the current time window is marked as an abnormality to be confirmed, and the automated traffic handling action is not triggered. Based on the traffic flow of the current time window, generate anomaly samples to be confirmed and push the anomaly samples to be confirmed to the security analysis interface for manual judgment; The identified abnormal samples are added to the labeled dataset for incremental training of the classification model.

[0014] In addition, to achieve the above objectives, this application also proposes an MPLS label feature traffic monitoring anomaly detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the MPLS label feature traffic monitoring anomaly detection method as described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the MPLS tag feature traffic monitoring anomaly detection method described above.

[0016] One or more technical solutions proposed in this application have at least the following technical effects: Collect label-level statistical data based on a single MPLS label in the MPLS network, where the MPLS label includes T-Label and / or P-Label; construct a multi-dimensional feature vector within each sliding time window based on the label-level statistical data; input the multi-dimensional feature vector into an isolated forest model to obtain an anomaly score, and determine whether the anomaly score is within a warning interval; if the anomaly score is within the warning interval, input the multi-dimensional feature vector into an autoencoder model to calculate the reconstruction error, and determine that the traffic within the current time window is abnormal when the reconstruction error exceeds a reconstruction error threshold; if the anomaly score is not within the warning interval, determine whether the traffic within the current time window is normal or abnormal based on the deviation direction of the anomaly score relative to the warning interval, wherein if it is lower than the lower limit threshold of the warning interval, the traffic is determined to be normal, and if it is higher than the upper limit threshold of the warning interval, the traffic is determined to be abnormal.

[0017] The technical solution of this application utilizes isolated forests to quickly screen most samples and calls an autoencoder only for samples with blurred boundaries for fine verification. While ensuring detection accuracy, it significantly reduces computational overhead, solves the technical problem that traditional detection methods cannot balance detection efficiency and detection accuracy, and achieves a technical leap from single-model detection of the entire sample set to hierarchical linkage adaptive judgment and from passive alarm to active closed-loop processing. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart illustrating the first embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application; Figure 2 This is a detailed process diagram based on step S10 in the first embodiment; Figure 3 This is a detailed schematic diagram of step S40 based on the first embodiment; Figure 4 This is a flowchart illustrating the second embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application; Figure 5 This is a flowchart illustrating the third embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application; Figure 6 This is a flowchart illustrating the fourth embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application; Figure 7 This is a flowchart illustrating the fifth embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application; Figure 8 A flowchart showing the complete steps from data collection to result analysis; Figure 9 This is a schematic diagram of the hardware operating environment involved in the MPLS tag feature traffic monitoring anomaly detection method in this application embodiment.

[0021] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0023] In the field of MPLS network traffic monitoring and anomaly detection, traditional methods mainly rely on static threshold alarms, signature-based intrusion detection, and simple statistical analysis. These solutions typically involve network administrators manually setting alarm thresholds for metrics such as bandwidth utilization and packet loss rate, or collecting aggregated data through simple network management protocols for basic statistics. In scenarios with stable traffic patterns and known attack types, these solutions can achieve basic anomaly warning functions with low implementation complexity, facilitating rapid deployment and parameter configuration. However, these solutions are essentially a static, passive detection paradigm, failing to incorporate the dynamic characteristics and multidimensional information of traffic into the analysis loop. Static thresholds cannot adapt to the periodic fluctuations and sudden bursts of network traffic, easily leading to missed or false alarms; coarse-grained aggregated metrics struggle to extract fine-grained flow features, resulting in the inability to identify complex attack patterns; the detection model becomes fixed once deployed, lacking online self-learning capabilities and completely ineffective against newly emerging attack types; and alarms are only generated after anomalies occur, failing to proactively trigger device traffic handling. When network services expand, user behavior migrates, or attack methods evolve, detection performance deteriorates sharply, and security protection lags behind threat changes.

[0024] A comprehensive analysis reveals that the core dilemma faced by the aforementioned technical approaches lies in the fact that while the traditional architecture, which uses static thresholds or fixed signatures for detection and open-loop passive alarms as a response method, is intuitive and easy to understand, its single detection dimension, inability to adaptively update the model, and lagging response mechanism are fundamentally contradictory to the inherent requirements of high-speed dynamic network environments for real-time performance, accuracy, adaptability, and proactive closed-loop processing. Consequently, it is impossible to balance detection efficiency and accuracy under complex and ever-changing network conditions.

[0025] To address the aforementioned shortcomings, this application proposes an MPLS label-based traffic monitoring anomaly detection method. This method uses a single label in the MPLS network as the monitoring granularity, collects label-level statistical data, and constructs a multi-dimensional feature vector within a sliding time window, including basic traffic, time series, statistical distribution, and label-specific features. This vector is input into an isolated forest model to obtain an anomaly score, and a warning interval is defined based on a first threshold and a second threshold: if the anomaly score does not fall within the warning interval, it is quickly determined based on its deviation direction from the warning interval (below the lower limit is considered normal, above the upper limit is considered abnormal); if the anomaly score falls within the warning interval, the feature vector is further input into an autoencoder model to calculate the reconstruction error, and anomalies are only determined when the reconstruction error exceeds a threshold. After an anomaly is determined, automatic actions such as rate limiting, path switching, or blacklist blocking are triggered.

[0026] Through the above-mentioned technical means, this application uses isolated forest to quickly screen most samples and calls autoencoder to perform fine verification only for samples with blurred boundaries. While ensuring detection accuracy, it significantly reduces computational overhead, solves the technical problem that traditional detection methods cannot balance detection efficiency and detection accuracy, and realizes a technical leap from single model detection of the entire sample set to hierarchical linkage adaptive judgment and from passive alarm to active closed-loop processing.

[0027] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0028] Based on this, embodiments of this application provide an MPLS tag feature traffic monitoring anomaly detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the MPLS label feature traffic monitoring anomaly detection method of this application. In this embodiment, the MPLS label feature traffic monitoring anomaly detection method includes steps S10 to S60: Step S10: Collect label-level statistics based on a single MPLS label in the MPLS network, wherein the MPLS label includes T-Label and / or P-Label; In this embodiment, label-level statistical data based on a single MPLS label is collected from the MPLS network. The MPLS label includes a T-Label, a P-Label, or both. This collection process is performed by a lightweight collection agent deployed on the MPLS edge router and core router, or by actively pulling data from the device via the southbound interface protocol. The collection agent polls the hardware counter of each active MPLS label at fixed intervals to obtain the label value, inbound byte count, inbound packet count, outbound byte count, outbound packet count, current rate, and packet loss count. To achieve fine-grained monitoring of tenant-level or path-level traffic, the collection process uses a single label as the smallest granularity, rather than the aggregation port granularity used in traditional solutions.

[0029] While reading tag counter data, the acquisition agent also performs flow-level sampling of data packets. Normally, a lower initial sampling rate, such as 1:100, is used to extract five-tuple information from packets within the same MPLS tag, including the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type. When a tag's current rate is detected to suddenly exceed twice its historical baseline rate, the system automatically increases the tag's sampling rate to a higher second sampling rate, such as 1:10, or even full sampling, to more accurately analyze abnormal traffic characteristics.

[0030] The collected raw data is first written to a circular buffer in memory for caching. Then, aggregation calculations are performed in sliding time windows, with a default window width of ten seconds and a sliding step size of five seconds. Within each time window, the inbound and outbound byte counts for each tag are summed, and the average and peak rates are calculated to obtain the average rate, peak rate, and packet loss rate within that window. For stream-level sampled 5-tuple data, the number of newly established connections, completed connections, and packet distributions for various protocol types are statistically analyzed within the window.

[0031] The aggregated data is stored in a time-series database for short-term backtesting and in a data warehouse for long-term model training. The above data collection process further optimizes performance through differentiated collection frequencies: a 30-second collection cycle is used for label-level counters that change slowly, a 5-second collection cycle is used for stream-level statistics requiring higher time resolution, and a 60-second collection cycle is used for device-level CPU utilization and other metrics. Lightweight compression is performed before data reporting to reduce bandwidth consumption. Through these methods, fine-grained statistical data collection based on a single MPLS label granularity is achieved, providing a rich data foundation for subsequent feature construction.

[0032] Step S20: Based on the label-level statistical data, construct a multi-dimensional feature vector within each sliding time window; Based on the aforementioned tag-level statistical data, a multi-dimensional feature vector is constructed within each sliding time window. This multi-dimensional feature vector has more than thirty dimensions and is divided into four main categories: basic traffic features, time series features, statistical distribution features, and tag-specific features. Basic traffic features include the average rate within the current window, the ratio of peak rate to average rate as a burst indicator, the rate of change (the percentage change in rate between adjacent windows), average packet size, and packet rate. These features reflect the basic volume of traffic.

[0033] Time-series features include the linear regression slope of the rate over the most recent five windows, representing the trend direction; the periodicity strength measured by the autocorrelation coefficient; the variance of the rate within the window, representing the jitter; and the number of times the rate exceeded the historical mean. These features reflect the dynamic evolution of traffic. Statistical distribution features include the average, median, and decimals of the size of all flows within the window; the distribution parameters of flow duration; port number distribution entropy; and Internet Protocol address distribution entropy. The port number distribution entropy is calculated by summing the negative logarithms of the probabilities of occurrence of all target ports. A lower entropy value indicates that traffic is concentrated on a few ports, while a higher entropy value indicates a more random distribution. This feature is used to identify port scanning attacks.

[0034] Protocol behavior characteristics include the ratio of Transmission Control Protocol (TCP) synchronization packets to reset packets (used to identify synchronization packet flooding attacks), the ratio of TCP to UDP traffic, the proportion of IPC traffic (used to identify IPC flooding attacks), the new connection rate, and the connection completion rate (i.e., the ratio of synchronization packet acknowledgment packets to synchronization packets). Label-specific characteristics vary depending on the label type. For T-Labels (tenant-level labels), these include the traffic distribution entropy of each P-Label under that tenant (used to identify internal lateral movement behavior) and the number of cross-tenant access attempts obtained from the security management module. For P-Labels (path-level labels), these also include the path latency change rate and path hop count.

[0035] Before constructing feature vectors, a baseline for normal behavior needs to be established for each MPLS label based on historical normal traffic data. For enterprise office network tenants exhibiting obvious daily and weekly periodicity, a seasonal decomposition model is used to decompose the time series into trend, periodic, and residual components. The sum of the trend and periodic components plus or minus 2.5 times the residual standard deviation is used as the normal range. For internet data center tenants with greater volatility, a nonparametric method based on quantiles is used to calculate the fifth, fiftieth, and ninety-fifth quantiles for historical data in each hourly window. The range from the fifth quantile minus 1.5 times the interquartile range to the ninety-fifth quantile plus 1.5 times the interquartile range is used as the normal range. For newly established tenants lacking historical data, a transfer learning method is used to borrow the initial baseline from similar tenants in the same cluster.

[0036] After establishing the baseline, the deviation of each traffic indicator from the baseline within the current time window is calculated, and this deviation is used as a feature component of the multidimensional feature vector. In this way, a high-dimensional feature vector capable of comprehensively characterizing traffic behavior patterns is constructed.

[0037] Step S30: Input the multidimensional feature vector into the isolated forest model to obtain anomaly scores, and determine whether the anomaly scores are within the warning range; Multidimensional feature vectors are input into the Isolation Forest model to obtain anomaly scores, and it is determined whether these scores fall within the warning range. The Isolation Forest model is an unsupervised anomaly detection algorithm based on the isolation principle. During the training phase, this model uses only normal traffic data and constructs multiple isolation trees by recursively and randomly selecting feature dimensions and split points. Each isolation tree divides the data space into several sub-regions. Normal data points located in deeper leaf nodes require multiple splits to be isolated, while anomaly data points located in shallower leaf nodes require only a few splits to be isolated.

[0038] After model deployment, for each time window, the Isolation Forest model inputs a multidimensional feature vector into each isolation tree, records the path length from the root node to the leaf node, averages the path lengths of all trees, and performs a normalization transformation to obtain an anomaly score between zero and one. A higher score indicates that the sample is more easily isolated, i.e., more anomalous, while a lower score indicates that the sample is closer to a dense region of the normal pattern.

[0039] In addition, the warning interval is defined by a first threshold and a second threshold. The first threshold is set to 0.6 as the lower limit of the warning, and the second threshold is set to 0.8 as the upper limit of the warning. Samples with anomaly scores below 0.6 are considered clearly normal, samples with anomaly scores above 0.8 are considered clearly abnormal, and samples with anomaly scores between 0.6 and 0.8 belong to the ambiguous boundary region and require further verification. The feature vector has been assembled before being input into the Isolation Forest model. This vector contains more than thirty dimensions, including basic traffic features, time series features, statistical distribution features, protocol behavior features, and label-specific features. The Isolation Forest model comprehensively scores these features.

[0040] To ensure the model's timeliness, the Isolation Forest model is retrained every seven days using normal traffic data collected within the last seven days, enabling the model to adapt to slow changes in network behavior. Furthermore, every ten detection cycles (approximately fifty seconds), feature vectors within the time window deemed normal are asynchronously added to the online training dataset, triggering a rolling update of the Isolation Forest model's segmentation tree structure, allowing it to quickly adapt to minor fluctuations in traffic. Through these methods, a preliminary and rapid screening of traffic within each time window is achieved, classifying samples into three categories: clearly normal, clearly abnormal, and requiring further verification.

[0041] Step S40: If the abnormal score is within the warning interval, the multidimensional feature vector is input into the autoencoder model to calculate the reconstruction error, and when the reconstruction error exceeds the reconstruction error threshold, the traffic in the current time window is determined to be abnormal. If the aforementioned anomaly score falls within the warning range (between 0.6 and 0.8), the multidimensional feature vector is input into the autoencoder model to calculate the reconstruction error. When this reconstruction error exceeds the reconstruction error threshold, the traffic within the current time window is determined to be abnormal. The autoencoder model shown is a dimensionality reduction and reconstruction model based on a neural network. During the training phase, this model uses pure normal traffic data. The encoder network compresses the high-dimensional input features into a low-dimensional latent code, and the decoder network reconstructs the original input from this low-dimensional code. The training objective is to make the reconstructed output as close as possible to the original input, minimizing the reconstruction error. For normal samples, the network learns how to accurately reconstruct the data; for abnormal samples, since the network has never seen this pattern before, the reconstruction error will increase significantly.

[0042] When the anomaly score output by the Isolation Forest model falls within the warning interval, the multi-dimensional feature vector of that time window is fed into a pre-trained autoencoder neural network. The autoencoder neural network first compresses the feature vector into a lower-dimensional representation through the encoder part, which captures the main variation patterns of normal traffic. Then, the decoder part recovers the reconstructed vector from the low-dimensional representation. The mean squared error between the original input vector and the reconstructed vector is calculated as the reconstruction error. This error value reflects the degree of deviation between the current sample and the normal pattern.

[0043] To determine the judgment threshold, after the autoencoder model is trained, the reconstruction error of all training samples is recorded, and the average and standard deviation of the reconstruction error on the training set are calculated. The reconstruction error threshold is set to three times the standard deviation of the average error of the training set. If the reconstruction error of the current sample is greater than this threshold, it is judged as abnormal; otherwise, it is judged as normal. Since the autoencoder model is only called on samples within the warning interval of the isolated forest output, the computational overhead of performing neural network forward propagation on all samples is avoided. At the same time, the autoencoder can capture the nonlinear correlation between features, providing supplementary judgments for subtle abnormal patterns that may be missed by the isolated forest.

[0044] To ensure the timeliness of the autoencoder model, it is retrained every seven days on the normal traffic data of the most recent seven days, and the reconstruction error threshold is updated synchronously. Through this method, highly accurate secondary verification of samples with blurred boundaries is achieved, significantly reducing the false positive and false negative rates.

[0045] Step S50: If the abnormal score is not within the warning interval, the traffic flow within the current time window is determined to be normal or abnormal based on the deviation direction of the abnormal score relative to the warning interval. If the abnormal score is lower than the lower threshold of the warning interval, the traffic flow is determined to be normal; if the abnormal score is higher than the upper threshold of the warning interval, the traffic flow is determined to be abnormal.

[0046] If the aforementioned anomaly score is not within the warning range, the traffic within the current time window is determined to be normal or abnormal based on the direction of deviation of the anomaly score relative to the warning range. Specifically, the determination rule is as follows: if the anomaly score is below the lower threshold of the warning range, the traffic within the current time window is considered normal; if the anomaly score is above the upper threshold of the warning range, the traffic within the current time window is considered abnormal. This determination logic is based on the algorithmic characteristics of the isolated forest model, where a higher anomaly score indicates that the sample is more easily isolated (i.e., more anomalous), and a lower score indicates that the sample is closer to a dense region of normal samples. Therefore, samples below the lower threshold have clear normal characteristics and require no further verification; samples above the upper threshold have clear anomalous characteristics and also require no further verification.

[0047] In actual operation, the threshold of the warning interval is not completely fixed. After the Isolation Forest model is retrained every seven days, it automatically calculates the distribution of abnormal scores of normal samples on the new training set, and uses the 95th quantile of the normal sample scores as the low threshold and the 99th quantile as the high threshold, thereby achieving adaptive adjustment of the threshold. When there is a significant change in network traffic patterns, the original threshold may no longer be applicable, and the system triggers a threshold reset through change point detection.

[0048] For samples with anomaly scores clearly exceeding the upper threshold, they are directly identified as abnormal traffic and enter the subsequent automated processing flow. For samples with anomaly scores clearly below the lower threshold, the system treats them as normal samples and adds their feature vectors to the online training dataset of the Isolation Forest model for rolling model updates. Through this process, rapid identification of most traffic is achieved, avoiding unnecessary autoencoder computation and significantly improving the system's real-time processing capabilities while ensuring detection accuracy. This step, together with the aforementioned autoencoder verification step, constitutes a hierarchical linkage detection mechanism, achieving an optimal balance between detection efficiency and accuracy.

[0049] Furthermore, you can also view Figure 2 , Figure 2 This is a detailed process diagram based on step S10 in the first embodiment. Figure 2 The label-level statistical data includes label counter data and quintuple information. The step of collecting label-level statistical data based on a single MPLS label in the MPLS network includes S11~S13: Step S11: Read the tag counter data for each active MPLS tag by means of the acquisition agent deployed on the MPLS router or by actively pulling through the southbound interface. The tag counter data includes tag value, number of inbound bytes, number of inbound packets, number of outbound bytes, number of outbound packets, current rate, and packet loss count. Step S12: While reading the tag counter data, stream-level sampling is performed on the data packets to extract five-tuple information from the data packets within the same MPLS tag. The five-tuple information includes the source Internet Protocol address, the destination Internet Protocol address, the source port, the destination port, and the protocol type.

[0050] In this embodiment, tag counter data is read for each active MPLS tag by a collection agent deployed on the MPLS router or by actively pulling data through the southbound interface. The tag counter data includes tag value, number of inbound bytes, number of inbound packets, number of outbound bytes, number of outbound packets, current rate, and packet loss count.

[0051] In actual deployment, the data acquisition agent runs as a lightweight process in the control plane of MPLS edge routers and core routers, polling the hardware counter corresponding to each active label in the forwarding plane every 30 seconds. An active label is a label stack entry that has been pushed onto or swapped by at least one packet passing through the router within the current time window. For each active label, the data acquisition agent directly accesses the counter register in the dedicated forwarding IC through the processor to read the cumulative inbound byte count and packet count, and the cumulative outbound byte count and packet count since the label was last cleared.

[0052] To calculate the current rate, the difference in the number of bytes and the time difference between two consecutive polls are read. The difference in the number of bytes is multiplied by eight to convert it to bits, and then divided by the time difference to obtain the rate value in bits per second. Packet loss counts are obtained from the queue management module, recording the number of packets that failed to be forwarded due to queue overflow or policy dropping. When the network is large and there are many active labels on each router, the collection agent adopts a differentiated collection strategy: for popular labels with high rates, the collection cycle is shortened to ten seconds; for less popular labels with low rates, the collection cycle is extended to sixty seconds, controlling collection overhead while ensuring monitoring accuracy. The southbound interface active pull method is suitable for modern routers that support network configuration protocols. The collection server, acting as a client, sends a remote procedure call request to the router to request counter data within a specified label range. The router responds by returning the corresponding value. This method does not require deploying an additional agent on the router, but the device needs to support the corresponding data model. Through the above methods, the most basic volumetric statistics for each MPLS label are obtained.

[0053] While reading the tag counter data, flow-level sampling is performed on data packets. Five-tuple information is extracted from data packets within the same MPLS tag. This five-tuple information includes the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type. Since extracting the five-tuple information from all data packets would incur significant processing overhead, a 1:100 sampling rate is used for flow-level sampling by default. The sampling algorithm employs a hash modulo method based on data packet content. Specifically, a hash calculation is performed on the five-tuple consisting of the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type for each data packet. If the hash value modulo 100 equals a preset value, the packet is sampled. This method ensures that all data packets within the same flow are consistently sampled or not sampled, avoiding flow information fragmentation.

[0054] The sampled data packets are further parsed, including their Internet Protocol (IP) headers and Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) headers, to extract the source address, destination address, source port, destination port, and protocol type. For packets encapsulated through tunnels, the tunnel header is removed before parsing the original IPP header. The extracted 5-tuple information is associated with and stored in relation to the MPLS label of the current data packet, forming a label-to-5-tuple mapping record. At the end of the sliding time window, all sampled 5-tuple records are aggregated and statistically analyzed. For each label, the number of different source addresses, different destination addresses, different destination ports, and the number of newly established TCP connections within the window are identified by synchronization packet identifiers, while the number of completed connections is identified by synchronization packet acknowledgment packet identifiers. The port number distribution entropy is calculated by counting the frequency of each destination port, calculating the probability of each port's occurrence, and then multiplying the negative probabilities of all ports by the sum of the base-2 logarithms.

[0055] The above statistical results serve as an important source of statistical distribution characteristics and protocol behavior characteristics in the multidimensional feature vector. When the rate of a certain label suddenly increases by more than twice the historical baseline, the system automatically increases the flow-level sampling rate of that label from 1:100 to 1:10 or even 1:1, in order to obtain more refined flow features for analysis during anomalies. Through this method, fine-grained flow-level feature extraction based on label granularity is achieved, providing rich structured data for subsequent detection models.

[0056] Furthermore, you can also view Figure 3 , Figure 3 This is a detailed process diagram based on step S40 in the first embodiment. Figure 3 The step of inputting the multidimensional feature vector into the autoencoder model to calculate the reconstruction error if the abnormal score is within the warning interval, and determining the traffic abnormality within the current time window when the reconstruction error exceeds the reconstruction error threshold, includes S41~S44: Step S41: Input the multidimensional feature vector into a pre-trained autoencoder neural network, and calculate the mean square error between the original input and the restored output through the autoencoder neural network; Step S42: Use the mean squared error as the reconstruction error, and calculate the reconstruction error threshold based on the average error of the training sample set; Step S43: When it is determined that the reconstruction error is greater than the reconstruction error threshold, the traffic within the current time window is determined to be abnormal.

[0057] In this embodiment, the aforementioned multidimensional feature vector is input into a pre-trained autoencoder neural network, which calculates the mean square error between the original input and the reconstructed output. The structure of the autoencoder neural network is as follows: the number of nodes in the input layer is equal to the dimension of the multidimensional feature vector, for example, thirty dimensions. The encoder part contains two hidden layers. The number of nodes in the first hidden layer is set to two-thirds of the input dimension rounded down, and the number of nodes in the second hidden layer is set to one-third of the input dimension rounded down, forming a bottleneck layer. The decoder part symmetrically contains two hidden layers, first restoring to the dimension of the second hidden layer and then restoring to the original input dimension. The activation function is a linear rectified function. This network is pre-trained on a pure normal traffic dataset, and the training objective is to minimize the reconstruction error. When the anomaly score output by the isolated forest model falls within the warning interval, i.e., between 0.6 and 0.8, the multidimensional feature vector of the current time window is fed into the aforementioned autoencoder neural network.

[0058] During forward propagation, the input vector first passes through the encoder's first hidden layer, undergoes a linear transformation, and is then activated by a linear rectified function to obtain the first intermediate feature. It then passes through the encoder's second hidden layer, undergoing another linear transformation and activation to obtain the low-dimensional latent code. The decoder starts from the low-dimensional latent code, sequentially passing through its first and second hidden layers, ultimately outputting a reconstructed vector with the same dimension as the original input. The mean squared error (MSE) between the original input vector and the reconstructed vector is calculated by squaring the differences in each dimension, summing the results, and then dividing by the dimension. This MSE reflects the degree of reconstruction deviation between the current sample and the normal patterns in the training set.

[0059] The mean squared error (MSE) is used as the reconstruction error, and a reconstruction error threshold is calculated based on the average error of the training sample set. After the autoencoder model is trained, all training samples are input into the model one by one, and the reconstruction error, i.e., the MSE, of each sample is calculated. The training sample set consists entirely of manually verified or automatically selected pure normal traffic data, typically numbering in the tens of thousands to hundreds of thousands of time windows. The distribution of the reconstruction errors is statistically analyzed, and their arithmetic mean and standard deviation are calculated. The reconstruction error threshold is set as the average error of the training set plus three times the standard deviation.

[0060] According to statistical principles, for data following a normal distribution, an interval of three standard deviations covers approximately 99.7% of the samples. Therefore, samples exceeding this threshold are highly likely not part of a normal distribution. If the reconstruction error distribution of the training samples is skewed, the system can use the median plus three interquartile ranges as an alternative threshold. This threshold is updated synchronously with the retraining of the autoencoder model, typically every seven days. During the threshold update process, the system retains the exponentially weighted moving average of historical thresholds to prevent drastic jumps in the threshold due to fluctuations in a single training data session.

[0061] When the reconstruction error exceeds the aforementioned threshold, the traffic flow within the current time window is deemed abnormal. The specific logic is as follows: the reconstruction error value of the current sample is compared with the calculated reconstruction error threshold. If the reconstruction error is greater than the threshold, it indicates that the reconstruction deviation of the current sample significantly exceeds the reconstruction deviation range of normal samples, suggesting a fundamental difference between the traffic flow pattern within this time window and the normal pattern learned during training; therefore, it is deemed abnormal. If the reconstruction error is less than or equal to the threshold, it is deemed normal, indicating that the warning signal output by the isolated forest model may be a false positive, and the current sample actually belongs to the boundary region of normal traffic.

[0062] The above method utilizes an autoencoder to perform a high-confidence secondary verification of the boundary samples output by the Isolation Forest. This determination result will be passed to the subsequent automated processing module or the pending anomaly handling module. The entire autoencoder verification process is only performed on samples falling within the warning range, avoiding the computational overhead of running the neural network on all samples. Simultaneously, the autoencoder can capture the nonlinear correlations between high-dimensional features, providing a complementary perspective for the random segmentation-based detection of Isolation Forests.

[0063] Furthermore, you can also view Figure 4 , Figure 4 This is a flowchart illustrating the second embodiment of the MPLS label feature traffic monitoring anomaly detection method of this application, based on the shown... Figure 4 Before the step of inputting the multidimensional feature vector into the isolated forest model to obtain the anomaly score, steps S60-S70 are also included: Step S60: Based on historical normal traffic data, establish a normal behavior baseline for each MPLS label; Step S70: Based on the normal behavior baseline, calculate the degree of deviation of each flow index relative to the baseline within the current time window, and configure the degree of deviation as a feature component of the multidimensional feature vector.

[0064] Before inputting the aforementioned multidimensional feature vectors into the isolated forest model to obtain anomaly scores, it is necessary to establish a normal behavior baseline for each MPLS label based on historical normal traffic data, and calculate the degree of deviation of the current traffic from this baseline as a feature component, as shown below: Based on historical normal traffic data, a normal behavior baseline is established for each MPLS label. This step assumes that the system has collected a sufficiently long period of purely normal traffic data, typically a time window of the past thirty days confirmed by security audits to have no major security incidents. The baseline establishment method varies depending on the tenant or path's business characteristics. For enterprise office network tenants exhibiting clear daily and weekly periodicity, a seasonal decomposition model is used. This model decomposes the rate time series of each label into three components: a trend component reflecting long-term slow changes, a periodic component reflecting daily or weekly repetitive patterns, and a residual component reflecting random fluctuations. After decomposition, for each time point, such as Monday at 10:00 AM, the normal behavior baseline is the sum of the trend and periodic components, and the normal range is set as this sum plus or minus 2.5 times the residual standard deviation.

[0065] For internet data center tenants with large traffic fluctuations and no obvious cycle, a nonparametric method based on quantiles is used. First, historical data is grouped by hourly windows; for example, all data from Monday mornings from 9:00 to 10:00 is grouped together. For each group, the fifth quantile, fiftieth quantile, and ninety-fifth quantile are calculated. The lower boundary of the normal range is set as the fifth quantile minus 1.5 times the interquartile range, and the upper boundary is set as the ninety-fifth quantile plus 1.5 times the interquartile range. The interquartile range is the difference between the ninety-fifth quantile and the fifth quantile. For new tenants lacking historical data, a transfer learning method is used. First, existing tenants are clustered based on traffic pattern characteristics, categorized into several classes, such as online video, enterprise office, and data backup. When a new tenant is initialized, the most similar category is matched using preset business type labels or traffic characteristics from the previous few hours, and the typical baseline of that category is used as the initial baseline. As the new tenant's runtime exceeds two weeks, a personalized baseline is gradually established for it. Through this method, a behavioral baseline reflecting the normal fluctuation range is established for each MPLS label.

[0066] Based on the aforementioned baseline of normal behavior, the deviation of each traffic indicator within the current time window from this baseline is calculated, and this deviation is configured as a feature component of the multidimensional feature vector. Specifically, for each traffic indicator, such as average rate, number of new connections, port number distribution entropy, etc., the measured value of the indicator is obtained from the aggregated data of the current time window, and the expected value and normal range at this time point are obtained from the established baseline. The calculation method of the deviation varies depending on the type of indicator. For indicators with absolute values, such as rate and number of connections, the difference between the measured value and the expected value is calculated, and this difference is divided by the width of the normal range to obtain the normalized deviation. For dimensionless indicators such as distribution entropy, the system directly calculates the difference between the measured value and the expected value as the deviation. If the measured value falls within the normal range, the deviation can be set to zero or a small positive number. If the measured value exceeds the normal range, the deviation is positive, and the larger the multiple of the exceedance, the higher the deviation. The deviation calculated above is added as an independent dimension to the multidimensional feature vector.

[0067] In the actual feature vector, this deviation feature exists alongside the original traffic metric feature, enabling the Isolation Forest model to simultaneously know both the absolute value of the current traffic and its deviation from historical normal patterns. For example, if the current average rate is 52 megabits per second, the baseline expected value is 50 megabits per second, and the normal range is 45 to 55 megabits per second, then the deviation is relatively small. However, if the current number of new connections is 1,500 per second, the baseline expected value is 150 per second, and the upper limit of the normal range is 180 per second, then the deviation is very large, and this feature will guide the Isolation Forest model to assign a higher anomaly score to this sample. By encoding historical behavior patterns as part of the feature vector in this way, the model's sensitivity to deviations from normal behavior patterns is enhanced.

[0068] Furthermore, after establishing a normal behavior baseline for each MPLS label based on historical normal traffic data, the method further includes: At the end of each evaluation period, the normal traffic data of the most recent period is included in the baseline calculation, and the normal behavior baseline is updated using the exponentially weighted moving average method. When a sudden change in traffic distribution is detected, a change point detection is triggered and a baseline reset operation is performed. After clearing historical data, the normal behavior baseline is re-established with the data after the change.

[0069] After establishing a normal behavior baseline for each MPLS label based on historical normal traffic data, the baseline needs to be dynamically maintained to adapt to changes in network behavior. This includes the following two aspects of processing.

[0070] Firstly, at the end of each evaluation period, normal traffic data from the most recent period is incorporated into the baseline calculation, and the aforementioned normal behavior baseline is updated using an exponentially weighted moving average method. The evaluation period is set to one hour by default. At the end of each evaluation period, traffic data from all time windows deemed normal within that period are collected. This data is aggregated by time point to obtain statistical values ​​for indicators such as average rate and average number of connections at each time point within that evaluation period, such as the tenth minute of each hour. Then, these new statistical values ​​are fused with the historical baseline using an exponentially weighted moving average. The specific calculation formula for the exponentially weighted moving average fusion is: the updated baseline value equals the new observation multiplied by the decay factor plus the original baseline value multiplied by one minus the decay factor. The decay factor is set to 0.05, meaning the weight of the new data is only 5%, while the weight of the historical cumulative data is 95%. This smooth update method allows the baseline to gradually adapt to the gradual trend of network traffic, such as the gradual increase in the number of users or the gradual migration of business traffic, while avoiding excessive impact on the baseline from short-term traffic bursts. The system also uses the same exponentially weighted moving average method to update the normal range width of the baseline, so that the width of the normal range can reflect the long-term changes in flow volatility.

[0071] Secondly, when a sudden change in traffic distribution is detected, a change point detection is triggered, and a baseline reset operation is performed. Historical data is cleared, and the baseline for normal behavior is re-established using data after the change. Sudden change scenarios include new service launches, network expansion, routing policy changes, and major promotional events. These events can cause fundamental changes in traffic patterns within a short period, which cannot be quickly adapted to by gradual exponentially weighted moving average updates. A change point detection algorithm is run, employing either the cumulative sum statistical method or the Bayesian change point detection method. The principle of the cumulative sum method is to maintain the cumulative deviation of the current traffic metric relative to the historical mean. When this cumulative deviation exceeds a preset threshold, a change point is determined. Change point detection is performed on multiple key metrics for each MPLS label, such as average rate and the number of new connections. If at least two metrics trigger a change point alarm within three consecutive time windows, a traffic change is confirmed. After confirming the change point, a baseline reset operation is performed: all historical baseline data for that label is cleared, and normal traffic data collected after the change point occurs is used as the new historical dataset to re-establish the baseline from scratch. In the initial phase after a reset, a fast learning mode is entered, updating the baseline every ten minutes instead of hourly, in order to converge to the new normal pattern as quickly as possible. After the reset operation is complete, regular exponentially weighted moving average updates are resumed. Through the coordinated maintenance of these two aspects, this embodiment achieves the adaptive update capability of the baseline, which can smoothly track gradual changes and quickly respond to abrupt changes, ensuring that the baseline always reflects the current normal traffic behavior.

[0072] Furthermore, you can also view Figure 5 , Figure 5 This is a flowchart illustrating the third embodiment of the MPLS label feature traffic monitoring anomaly detection method of this application, based on the shown... Figure 5 Following the step of determining abnormal traffic within the current time window, steps S80~S110 are also included: Step S80: Input the confirmed anomaly multidimensional feature vector into the pre-trained classification model, and output the anomaly type and confidence level through the classification model. The anomaly type includes distributed denial-of-service attack type, scanning and probing type, and abnormal behavior type. Step S90: Obtain the anomaly score, the degree of deviation of the current traffic indicator from the normal behavior baseline, the number of abnormal MPLS tags, and the number of time windows with continuous anomalies within the current time window; Step S100: The anomaly score is obtained by weighted summation of the anomaly score, the degree of deviation, the number of anomaly MPLS tags, and the number of time windows. Step S110: Generate a structured alarm of the corresponding level according to the preset score range to which the severity score belongs, wherein different score ranges correspond to different alarm levels.

[0073] After determining the traffic anomalies within the current time window, it is necessary to conduct in-depth analysis of the confirmed anomalies, quantify their severity, and generate structured alerts.

[0074] The multi-dimensional feature vectors of confirmed anomalies are input into a pre-trained classification model, which outputs the anomaly type and confidence level. These anomaly types include Distributed Denial-of-Service (DDoS) attacks, scanning and probing attacks, and anomalous behavior. The classification model employs a supervised learning algorithm, such as an extreme gradient boosting tree model, and is pre-trained on a labeled historical anomaly dataset. Each sample in the training dataset contains a multi-dimensional feature vector and a manually labeled anomaly type. During model training, a multi-class loss function is used, with the output layer consisting of three nodes corresponding to DDoS attacks, scanning and probing attacks, and anomalous behavior, respectively. A flexible maximum function is used to convert the output into a probability distribution. Upon confirmation of an anomaly, the system inputs the multi-dimensional feature vector of the current time window into the classification model. The model internally performs a non-linear transformation on the features, ultimately outputting three probability values ​​representing the confidence level of each category, and outputting the category with the highest probability as the anomaly type. DDoS attacks can be further subdivided into subtypes such as sync packet flood attacks, User Datagram Protocol (UDP) flood attacks, Internet Control Message Protocol (ICP-TCP) flood attacks, and Hypertext Transfer Protocol (HTTP) flood attacks. Scanning and probing attacks include port scanning and Internet Protocol address scanning. Anomaly types include data breaches, anomalous lateral movement, and traffic bursts. The classification model is only invoked after the main detection model confirms the anomaly and is not included in the real-time detection path to reduce computational overhead. The output will be used for subsequent handling strategy selection, such as triggering traffic rate limiting for distributed denial-of-service attacks, blacklisting for scanning and probing, and session blocking for data breaches.

[0075] The following parameters are obtained: anomaly score, deviation of current traffic metrics from the normal behavior baseline, number of anomalous MPLS labels, and number of time windows with continuous anomalies within the current time window. The anomaly score is directly obtained from the output of the Isolation Forest model. The deviation of current traffic metrics from the normal behavior baseline is taken from the calculated feature components, reflecting the magnitude of current traffic deviation from historical normal patterns. The number of anomalous MPLS labels refers to the number of labels judged as anomalous within the same time window. If multiple P-Labels under a certain T-Label tenant-level label simultaneously exhibit anomalies, a high number of anomalous MPLS labels indicates a possible overall attack rather than a single link issue. This number is obtained by querying the list of anomalous labels in the current window and counting duplicates. The number of time windows with continuous anomalies refers to the number of time windows consecutively judged as anomalous from the first anomaly judgment to the current window. Each time window has a width of ten seconds and a step size of five seconds; therefore, multiplying this number by the window step size can approximate the duration of the anomaly. An anomaly counter is maintained for each MPLS label; the counter increments by one each time an anomaly is judged and resets to zero when normal is judged. The above four parameters characterize the severity of the anomaly from different dimensions: the anomaly score reflects the confidence level of the model's judgment, the deviation reflects the magnitude of the difference from the normal pattern, the number of anomaly labels reflects the breadth of the impact, and the number of persistence windows reflects the duration of the impact.

[0076] The anomaly severity score is obtained by weighted summation of the anomaly score, deviation degree, number of abnormal MPLS labels, and number of time windows. The specific calculation method for the weighted summation is as follows: Severity score equals anomaly score multiplied by the first weight, plus deviation degree multiplied by the second weight, plus the number of abnormal MPLS labels multiplied by the third weight, plus the number of time windows multiplied by the fourth weight. Specifically, the first weight is set to 40%, because the anomaly score is the core confidence indicator of the model output; the second weight is set to 30%, as the deviation degree directly reflects the magnitude of traffic deviation from the normal baseline; the third weight is set to 20%, as the number of affected labels reflects the scope of the anomaly; and the fourth weight is set to 10%, as the duration reflects the persistence of the anomaly. The sum of all weights is 100%.

[0077] The anomaly score itself ranges from zero to one, and the deviation level, after normalization, also ranges from zero to one. The number of anomalous MPLS tags needs to be normalized by dividing by a preset maximum number of tags, such as ten, and the number of time windows needs to be normalized by dividing by a preset maximum number of windows, such as twenty, to ensure the comparability of various indicators. The severity score obtained after weighted summation ranges from zero to one hundred, with a higher score indicating a more severe anomaly.

[0078] Based on the preset score range to which the severity score belongs, structured alarms of corresponding levels are generated. The preset score ranges are divided as follows: severity scores greater than or equal to 70 are high-risk events, severity scores greater than or equal to 40 but less than 70 are medium-risk events, and severity scores less than 40 are low-risk events. Different levels correspond to different alarm methods and response times.

[0079] High-risk events trigger real-time alerts, notifying security analysts via email, SMS, system pop-ups, and other channels, and automatically entering the highest-priority handling queue. Medium-risk events are recorded in the alert list and a daily summary email is sent for analysts to handle in the next work session. Low-risk events are only recorded in the log system for post-event auditing and trend analysis. Structured alerts include a timestamp, affected MPLS tag value, anomaly type and confidence level, severity score, key feature deviation value, and suggested actions. Suggested actions are generated by the system based on anomaly type and severity score; for example, for high-risk distributed denial-of-service attacks, rate limiting and blocking the source address are suggested; for medium-risk port scanning, blocking only the target port is suggested; and for low-risk traffic bursts, continued observation is suggested. Alerts are stored in the alert database and simultaneously pushed to the security analyst interface. Through this approach, this embodiment achieves a complete output process from anomaly confirmation to classification, scoring, and alerting, providing a structured basis for both manual response and automated handling.

[0080] Furthermore, you can also view Figure 6 , Figure 6 This is a flowchart illustrating the fourth embodiment of the MPLS tag feature traffic monitoring anomaly detection method of this application, based on the shown... Figure 6 The MPLS tag feature traffic monitoring anomaly detection method further includes steps S120-S130: Step S120: The multidimensional feature vectors that are determined to be normal are asynchronously added to the online training dataset of the isolated forest model; Step S130: Based on a preset update cycle, the segmentation tree structure of the isolated forest model is updated using the online training dataset to obtain the updated isolated forest model.

[0081] In this embodiment, the multi-dimensional feature vectors of those deemed normal are asynchronously added to the online training dataset of the Isolation Forest model. The traffic flow within the time window of the determined normal state is used as normal samples; the multi-dimensional feature vectors of these normal samples represent typical behavioral patterns in the current network environment. Instead of immediately updating the Isolation Forest model with these samples, they are temporarily stored in a circular buffer with a capacity of one thousand samples. Asynchronous addition means that the collection process of normal samples is decoupled from the model's real-time detection process. The model detection thread returns immediately after completing the determination for each window, without waiting for the model update to complete; another background thread periodically reads the accumulated normal samples from the buffer and adds them to the online training dataset.

[0082] The online training dataset and the static training dataset are maintained independently. The static dataset is used for periodic full retraining, while the online dataset is used for frequent incremental updates. To control the size of the dataset, a sliding window strategy is used for the online training dataset, retaining only the most recent seven days or the most recent ten thousand samples. Before adding new samples, deduplication and outlier filtering are performed to remove vectors that highly overlap with existing samples and potentially abnormal samples that deviate significantly from the normal distribution, preventing model contamination. Through these methods, the continuous collection and accumulation of normal samples is achieved.

[0083] Based on a preset update cycle, the segmentation tree structure of the Isolation Forest model is continuously updated using the aforementioned online training dataset, resulting in an updated Isolation Forest model. The preset update cycle is set to trigger an update every ten detection cycles, approximately fifty seconds. During each update, a subset is randomly selected from the online training dataset, with a size set to a small fraction (e.g., 10%) of the original model's training samples, for incremental adjustments to the existing Isolation Forest. The rolling update mechanism of the Isolation Forest model does not involve training from scratch, i.e., it does not require rebuilding all isolation trees; instead, it performs local adjustments to the existing tree structure. Specifically, for each isolation tree, a batch of samples is randomly selected from the new sample subset, and these samples are passed down the tree branches to the leaf nodes. If the number of samples gathered in a leaf node exceeds a preset threshold, the leaf node is split, and a feature dimension and split point are randomly selected to expand the node into two child nodes. Simultaneously, leaf nodes that have not received new samples for an extended period are pruned and merged to reduce model complexity. This rolling update method can be completed within tens of milliseconds, without affecting the latency requirements of real-time detection.

[0084] After the update, the performance of the new model is evaluated using a small subset of validation samples. If the distribution of abnormal scores shifts significantly, for example, the average abnormal score of normal samples rises from 0.1 to 0.3, the system triggers an alarm indicating that manual intervention or a full retraining may be necessary. If the update is successful, the new model replaces the old model for detection in subsequent windows. Simultaneously, a full retraining is performed every seven days, using all normal samples collected in the last seven days to construct a new set of isolation trees from scratch, ensuring that the model does not deviate from its optimal state due to the accumulated error of incremental updates. Through this approach, this embodiment achieves online incremental learning of the Isolation Forest model, enabling the model to quickly adapt to gradual changes in network traffic while maintaining long-term stability.

[0085] Furthermore, you can also view Figure 7 , Figure 7 This is a flowchart illustrating the fifth embodiment of the MPLS label feature traffic monitoring anomaly detection method of this application, based on the shown... Figure 7 The MPLS tag feature traffic monitoring anomaly detection method further includes steps S140~S160: Step S140: When the abnormal score is within the warning range and the reconstruction error does not exceed the reconstruction error threshold, the traffic in the current time window is marked as an abnormality to be confirmed, and the automated traffic handling action is not triggered. Step S150: Generate anomaly samples to be confirmed based on the traffic of the current time window, and push the anomaly samples to be confirmed to the security analysis interface for manual judgment. Step S160: Add the identified abnormal samples to the labeled dataset for incremental training of the classification model.

[0086] When the aforementioned anomaly score falls within the warning range and the reconstruction error does not exceed the reconstruction error threshold, the traffic in the current time window is marked as an anomaly awaiting confirmation, and no automated traffic handling action is triggered. This situation occurs when the Isolation Forest model considers the sample to be in a boundary region requiring verification, i.e., the anomaly score is between 0.6 and 0.8, but the autoencoder model gives a reconstruction error below the threshold, meaning the autoencoder considers the sample to be normally reconstructable and a normal sample. The two judgments conflict. The Isolation Forest's random segmentation approach may be overly sensitive to certain boundary samples, producing false positives, while the autoencoder's reconstruction approach may be insufficiently sensitive to certain minor anomalies, producing false negatives. To avoid automatically handling normal business traffic, rate limiting, blocking, or other handling actions are not directly executed on such conflicting samples; instead, they are marked as an anomaly awaiting confirmation, awaiting manual intervention. This marking records the occurrence time, the affected MPLS label, the anomaly score, the reconstruction error, and a multi-dimensional feature vector summary.

[0087] Based on the traffic within the current time window, a sample of anomalies to be confirmed is generated and pushed to the security analysis interface for manual judgment. Traffic data marked as anomalies to be confirmed is encapsulated into a structured sample containing the following information: timestamp, MPLS label value, anomaly score, reconstruction error, key features from the multidimensional feature vector such as average rate, number of new connections, port number distribution entropy, and, if applicable, the prediction result of the anomaly type classification model for this sample.

[0088] Once generated, samples are sent to the security analyst's user interface via message queue or real-time push channel. This interface typically displays all samples awaiting confirmation in a list format, sorted in reverse chronological order, with samples showing higher anomaly scores or larger deviations highlighted. Security analysts can click to view detailed characteristic curves, historical comparison charts, and relevant contextual information, such as traffic trends in other time windows under the same label. Analysts then assess the sample based on their experience and supplementary information, selecting to label it as "confirmed anomaly" or "confirmed normal," and can further supplement the anomaly type or add comments. The entire assessment process is simple and typically completes within ten seconds.

[0089] The identified anomalous samples are added to the labeled dataset for incremental training of the classification model. Security analysts provide manual assessments of each anomalous sample, creating labeled data with accurate labels. These labeled data are then collected into the labeled dataset. The labeled dataset and the online training dataset are maintained separately; the former stores manually verified samples with high label confidence, while the latter stores automatically identified normal samples. When the labeled dataset accumulates to a certain size, for example, adding one hundred new samples, incremental training of the classification model is triggered. The classification model was originally trained on labeled historical anomalous data; incremental training uses the newly labeled data to fine-tune the model. Fine-tuning employs a small learning rate, for example, one-tenth of the initial training learning rate, and trains for only a few epochs to avoid overfitting to the new data.

[0090] After incremental training, the classification model's ability to identify newly emerging anomaly types is enhanced. For cases where the autoencoder classifies anomalies as normal but the isolated forest classifies them as boundary conditions, if manually confirmed as genuine anomalies, it indicates that the autoencoder is insensitive to this type of anomaly, and this labeled data can be used to subsequently adjust the autoencoder's structure or threshold. If manually confirmed as normal, it indicates that the isolated forest is overly sensitive, and this type of data can be used in the online training dataset for the isolated forest to optimize its segmentation tree. Through these methods, this embodiment establishes a human-machine collaborative feedback loop, continuously improving the accuracy and adaptability of the detection system.

[0091] Additionally, you can view Figure 8 , Figure 8This is a flowchart illustrating the complete steps from data collection to result analysis. Figure 8 This paper demonstrates the deployment of lightweight data acquisition agents on edge and core routers in an MPLS network to acquire three types of statistical data with differentiated acquisition cycles: tag-level statistics, which read hardware counters for each active MPLS label, including label value, inbound and outbound byte and packet counts, current rate, and packet loss count; flow-level statistics, which extract five-tuple information from packets using an adjustable sampling rate, including source and destination Internet Protocol addresses, port numbers, and protocol types; and device-level statistics, which collect router CPU utilization, memory usage, and port error counts. Raw data is first written to a memory circular buffer and then aggregated in a sliding window with a 10-second width and a 5-second step to obtain statistics such as average rate, peak rate, packet rate, packet loss rate, and port number distribution entropy for each window. For labels with a rate surge exceeding twice the historical baseline, the sampling rate is automatically increased from 1:100 to 1:10, achieving adaptive fine-grained acquisition.

[0092] The aggregated data enters the feature engineering module. A feature vector of over thirty dimensions is constructed for each MPLS label, divided into basic traffic features, time-series features, statistical distribution features, and label-specific features. Simultaneously, based on historical normal data from the past thirty days, a baseline for normal behavior is established for each label: a seasonal decomposition model is used for tenants with obvious cycles, a quantile method is used for tenants without cycles, and transfer learning is used for newly established tenants. The deviation of each indicator in the current window is calculated based on the baseline and used as a component of the feature vector. After feature assembly, the system inputs the feature vector into an isolation forest model, which outputs an anomaly score between zero and one.

[0093] Next, we proceed to the threshold-based judgment stage. A low threshold of 0.6 and a high threshold of 0.8 are preset, dividing the anomaly score into three intervals. If the anomaly score is less than 0.6, the current window traffic is directly determined to be normal, and the feature vector is asynchronously added to the online training dataset of the Isolation Forest for subsequent rolling updates. If the anomaly score is greater than 0.8, it is directly determined to be an anomaly, and the anomaly handling branch begins. If the anomaly score is between 0.6 and 0.8, the feature vector is fed into a pre-trained autoencoder neural network, and the mean squared error between the original input and the reconstructed output is calculated as the reconstruction error. The reconstruction error is compared with three standard deviations of the average error on the training set: if the reconstruction error is greater than the threshold, an anomaly is confirmed; otherwise, it is determined to be normal, and the sample is classified as an anomaly to be confirmed and pushed to the security analyst interface for manual review.

[0094] For confirmed abnormal traffic, further classification and scoring are performed. The abnormal feature vector is input into an extreme gradient boosting tree classification model, which outputs the anomaly type and confidence level. Anomaly types include distributed denial-of-service attacks, scanning probes, and abnormal behavior. Simultaneously, the anomaly score, deviation degree, number of affected MPLS labels, and number of persistent anomaly windows are obtained and assigned weights of 40%, 30%, 20%, and 10%, respectively. The weighted sum yields an anomaly severity score ranging from 0 to 100. Based on the severity score, three levels are defined: high risk (≥70), medium risk (40-70), and low risk (<40). A structured alert is generated, containing a timestamp, label value, anomaly type, severity score, and suggested action. The alert is pushed to the security analyst interface and stored in the database, simultaneously triggering automated action: sending instructions to the software-defined network controller to perform rate limiting, path switching, or blacklisting blocking on the MPLS labels corresponding to the abnormal traffic. Different severity levels correspond to different combinations of action strategies.

[0095] The entire process also includes two online update loops. The first loop: After each detection cycle, the multi-dimensional feature vectors deemed normal are asynchronously added to the online training dataset of the isolated forest. A rolling update of the segmentation tree structure is triggered every 50 seconds, enabling the isolated forest model to adapt to slow, gradual changes in traffic. The second loop: For anomalous samples generated during the autoencoder review phase, after manual confirmation, they are added to the labeled dataset for incremental fine-tuning of the classification model every 24 hours, improving the ability to identify new anomaly types. Furthermore, the baseline learning module updates the normal behavior baseline using an exponentially weighted moving average method after each evaluation cycle. When the change point detection algorithm detects a sudden change in traffic distribution, historical data is cleared and a new baseline is established. The steps shown in the flowchart work together to form a complete closed-loop system from data collection, feature construction, hierarchical linkage detection to automated processing and online self-learning.

[0096] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the MPLS label feature traffic monitoring anomaly detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0097] This application provides an MPLS tag feature traffic monitoring anomaly detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the MPLS tag feature traffic monitoring anomaly detection method in the above embodiment 1.

[0098] The following is for reference. Figure 9This document illustrates a structural schematic diagram of an MPLS tag feature traffic monitoring anomaly detection device suitable for implementing embodiments of this application. The MPLS tag feature traffic monitoring anomaly detection device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 9 The MPLS tag feature traffic monitoring anomaly detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0099] like Figure 9 As shown, the MPLS tag-feature traffic monitoring anomaly detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the MPLS tag-feature traffic monitoring anomaly detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the MPLS tag-feature traffic monitoring anomaly detection device to communicate wirelessly or wiredly with other devices to exchange data. Although various MPLS tag-feature traffic monitoring anomaly detection devices are shown in the figures, it should be understood that implementation or possession of all of them is not required. More or fewer may be implemented alternatively.

[0100] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0101] The MPLS label feature traffic monitoring anomaly detection device provided in this application employs the MPLS label feature traffic monitoring anomaly detection method described in the above embodiments, which can solve the technical problem that existing MPLS network traffic monitoring and anomaly detection methods cannot simultaneously achieve both detection efficiency and detection accuracy. Compared with the prior art, the beneficial effects of the MPLS label feature traffic monitoring anomaly detection device provided in this application are the same as those of the MPLS label feature traffic monitoring anomaly detection method provided in the above embodiments, and other technical features in this MPLS label feature traffic monitoring anomaly detection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0102] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0103] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0104] This application provides a storage medium, which is a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the MPLS tag feature traffic monitoring anomaly detection method in the above embodiments.

[0105] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or flash memory, optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be executed by instructions, used by devices, or used in conjunction with them. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0106] The aforementioned computer-readable storage medium may be included in the MPLS tag feature traffic monitoring anomaly detection device; or it may exist independently and not be assembled into the MPLS tag feature traffic monitoring anomaly detection device.

[0107] The aforementioned computer-readable storage medium carries one or more programs. When the aforementioned one or more programs are executed by the MPLS tag feature traffic monitoring anomaly detection device, the MPLS tag feature traffic monitoring anomaly detection device implements the technical content of the MPLS tag feature traffic monitoring anomaly detection method embodiment shown above.

[0108] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0109] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of methods and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using dedicated hardware-based implementations that perform the specified functions or operations, or can be implemented using a combination of dedicated hardware and computer instructions.

[0110] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0111] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described MPLS label feature traffic monitoring anomaly detection method. This solves the technical problem that existing MPLS network traffic monitoring and anomaly detection methods cannot simultaneously achieve both detection efficiency and detection accuracy. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the MPLS label feature traffic monitoring anomaly detection method provided in the above embodiments, and will not be repeated here.

Claims

1. A method for detecting anomalies in MPLS tag-feature traffic monitoring, characterized in that, The MPLS tag feature traffic monitoring anomaly detection method includes the following steps: Collect label-level statistics based on a single MPLS label in the MPLS network, wherein the MPLS label includes T-Label and / or P-Label; Based on the aforementioned label-level statistical data, a multidimensional feature vector is constructed within each sliding time window; The multidimensional feature vector is input into the isolated forest model to obtain anomaly scores, and it is determined whether the anomaly scores are within the warning range. If the abnormal score is within the warning range, the multidimensional feature vector is input into the autoencoder model to calculate the reconstruction error, and when the reconstruction error exceeds the reconstruction error threshold, the traffic in the current time window is determined to be abnormal. If the abnormal score is not within the warning range, the traffic flow within the current time window is determined to be normal or abnormal based on the deviation direction of the abnormal score relative to the warning range. Specifically, if the abnormal score is lower than the lower threshold of the warning range, the traffic flow is determined to be normal; if the abnormal score is higher than the upper threshold of the warning range, the traffic flow is determined to be abnormal.

2. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, The label-level statistical data includes label counter data and 5-tuple information. The steps for collecting label-level statistical data based on a single MPLS label in the MPLS network include: The tag counter data is read for each active MPLS tag by a collection agent deployed on the MPLS router or by actively pulling data through the southbound interface. The tag counter data includes tag value, number of inbound bytes, number of inbound packets, number of outbound bytes, number of outbound packets, current rate, and packet loss count. While reading the tag counter data, the data packets are sampled at the flow level to extract five-tuple information from the data packets within the same MPLS tag. The five-tuple information includes the source Internet Protocol address, the destination Internet Protocol address, the source port, the destination port, and the protocol type.

3. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, Before the step of inputting the multidimensional feature vector into the isolated forest model to obtain the anomaly score, the method further includes: Based on historical normal traffic data, establish a normal behavior baseline for each MPLS label; Based on the normal behavior baseline, calculate the degree of deviation of each traffic indicator relative to the baseline within the current time window, and configure the degree of deviation as a feature component of the multidimensional feature vector.

4. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 3, characterized in that, Following the step of establishing a normal behavior baseline for each MPLS label based on historical normal traffic data, the method further includes: At the end of each evaluation period, the normal traffic data of the most recent period is included in the baseline calculation, and the normal behavior baseline is updated using the exponentially weighted moving average method. When a sudden change in traffic distribution is detected, a change point detection is triggered and a baseline reset operation is performed. After clearing historical data, the normal behavior baseline is re-established with the data after the change.

5. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, The step of inputting the multidimensional feature vector into the autoencoder model to calculate the reconstruction error if the abnormal score is within the warning range, and determining the traffic abnormality within the current time window when the reconstruction error exceeds the reconstruction error threshold, includes: The multidimensional feature vector is input into a pre-trained autoencoder neural network, and the mean square error between the original input and the restored output is calculated through the autoencoder neural network. The mean squared error is used as the reconstruction error, and the reconstruction error threshold is calculated based on the average error of the training sample set. When the reconstruction error is determined to be greater than the reconstruction error threshold, the traffic within the current time window is determined to be abnormal.

6. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, Following the step of determining abnormal traffic within the current time window, the method further includes: The multidimensional feature vectors that confirm the anomaly are input into a pre-trained classification model, and the classification model outputs the anomaly type and confidence level. The anomaly type includes distributed denial-of-service attack type, scanning and probing type, and abnormal behavior type. The abnormal score, the degree of deviation of the current traffic metric from the normal behavior baseline, the number of abnormal MPLS tags, and the number of time windows with continuous abnormality within the current time window are obtained. The anomaly severity score is obtained by weighted summation of the anomaly score, the degree of deviation, the number of anomaly MPLS tags, and the number of time windows. Based on the preset score range to which the severity score belongs, a structured alarm of the corresponding level is generated, wherein different score ranges correspond to different alarm levels.

7. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, The MPLS tag feature traffic monitoring anomaly detection method further includes: The multidimensional feature vectors that are deemed normal are asynchronously added to the online training dataset of the isolated forest model; Based on a preset update cycle, the segmentation tree structure of the isolated forest model is updated using the online training dataset, resulting in an updated isolated forest model.

8. The MPLS tag feature traffic monitoring anomaly detection method as described in claim 1, characterized in that, The MPLS tag feature traffic monitoring anomaly detection method further includes: When the abnormal score is within the warning range and the reconstruction error does not exceed the reconstruction error threshold, the traffic in the current time window is marked as an abnormality to be confirmed, and the automated traffic handling action is not triggered. Based on the traffic flow of the current time window, generate anomaly samples to be confirmed and push the anomaly samples to be confirmed to the security analysis interface for manual judgment; The identified abnormal samples are added to the labeled dataset for incremental training of the classification model.

9. An MPLS tag-feature traffic monitoring anomaly detection device, characterized in that, The MPLS label feature traffic monitoring anomaly detection device stores a computer program, which, when executed by a processor, implements the MPLS label feature traffic monitoring anomaly detection method according to any one of claims 1-8.

10. A storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the MPLS tag feature traffic monitoring anomaly detection method according to any one of claims 1-8.

Images