A Distributed Network Intrusion Real-time Monitoring and Alarm Method Based on Edge Computing

Abstract

This invention relates to the fields of network security and edge computing technology, specifically to a distributed network intrusion real-time monitoring and alarm method based on edge computing. The method includes: collecting data packet header sampling streams between the network interface of edge nodes and the central processing unit; caching source addresses, destination addresses, and port information locally; statistically analyzing the number of arriving packets, the number of newly established connections, the dispersion of destination port distribution, the variance of data packet length, and the ratio of the number of unique source addresses to the total number of packets according to preset time windows and micro-windows; performing a discrete Fourier transform on the statistical sequence and extracting frequency component amplitudes to generate frequency component data; combining historical benchmark values, historical fluctuation values, and traffic load ratios to determine local anomalies; exchanging interactive messages and performing global judgment, blocking, and log reporting; this invention performs real-time monitoring and alarming even without parsing the service load.

Description

Technical Field

[0001] This invention relates to the fields of network security and edge computing technology, specifically to a distributed network intrusion real-time monitoring and alarm method based on edge computing. Background Technology

[0002] With the development of edge computing, industrial internet and distributed access networks, network security monitoring for multi-edge node collaborative scenarios has become an important research direction in the field of network protection. In order to achieve rapid identification and timely handling of intrusion behavior, real-time monitoring, anomaly analysis and collaborative alarm of network traffic have become particularly important. In existing network intrusion detection processes, while centralized analysis methods can perform relatively complete traffic analysis, the large amount of raw data backhaul leads to high link overhead, high response latency, and difficulty in timely handling of local anomalies. On the other hand, while single-node detection methods can quickly complete preliminary judgments at the access side, they rely solely on local traffic characteristics and are easily affected by business fluctuations, changes in node load, and the dispersed distribution of attack traffic, resulting in insufficient ability to identify low-intensity, multi-point coordinated abnormal behavior. Especially in network environments with multiple edge nodes accessing the network, traffic often exhibits correlated but not completely consistent variation characteristics across different nodes, requiring a balance between local real-time processing capabilities and cross-node collaborative analysis capabilities. Therefore, how to perform lightweight collection and statistical processing of data packet header information at the edge node side, combine it with historical benchmarks to achieve local anomaly detection, and further perform feature interaction, joint analysis and collaborative alarms among multiple edge nodes, so as to improve the real-time monitoring and handling capabilities of single-point attacks and distributed attacks while reducing processing burden and communication overhead, is crucial to ensuring the safe and stable operation of the distributed network environment. Summary of the Invention

[0003] The purpose of this invention is to provide a real-time monitoring and alarm method for distributed network intrusion based on edge computing, addressing the following technical problems: Existing network intrusion detection technologies suffer from decreased accuracy in rapidly handling local anomalies and controlling communication overhead in network environments with multiple edge nodes and dispersed attack traffic, as well as in identifying low-intensity, multi-point coordinated abnormal behaviors. Therefore, a method based on edge computing for real-time monitoring and alarm of distributed network intrusions is needed, combining lightweight real-time processing of edge-side data packet headers with cross-node feature interaction and joint analysis. This improves the real-time monitoring and handling capabilities for both single-point and distributed attacks. The objective of this invention can be achieved through the following technical solutions: A distributed network intrusion real-time monitoring and alarm method based on edge computing includes: Collect the packet header sampling stream between the network interface of the edge node and the central processing unit, cache the packet header information locally, and obtain a statistical sequence by segmenting the data according to a preset time window; The statistical sequence is decomposed into frequencies, and a preset number of frequency component amplitudes are extracted to form frequency component data. Obtain the historical baseline value and historical fluctuation value of the edge node for the preset time window, and calculate the deviation value of the frequency component data relative to the historical baseline value; Obtain a historical average arrival rate benchmark value, calculate the traffic load ratio by comparing the average arrival rate of data packets within the preset time window with the historical average arrival rate benchmark value, calculate a dynamic alarm threshold based on the traffic load ratio and a preset basic alarm threshold, and compare the deviation value with the dynamic alarm threshold to obtain a local judgment result indicating whether the local situation is normal or abnormal. The frequency component data is compressed into compressed data, and an interactive message containing the compressed data, the deviation value, and the local determination result is generated. The interactive message is sent to the pre-configured adjacent edge nodes according to the preset topology, and the set of interactive messages forwarded by the adjacent edge nodes is received. Based on the deviation value of each edge node in the interactive message set and the compressed data, the overall deviation and node proximity are calculated respectively, and the sum is used to obtain a joint anomaly value. The joint anomaly value is compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal.

[0004] Optionally, the packet header sampling stream between the edge node network interface and the central processing unit is collected and the packet header information is cached locally. Statistical sequences are obtained by segmenting the data according to a preset time window, including: The kernel layer extension program collects the packet header information of the network interface and caches the source address, destination address and port information of the packet header within the current time window locally on the edge node. The data packet header sampling stream is segmented according to the fixed preset time window; Within each preset time window, the number of arriving packets, the number of newly established connection packets with synchronization flags, the distribution dispersion of destination ports, the variance of packet length, and the ratio of the number of unique source addresses to the total number of packets are counted according to the preset micro-window granularity, thereby generating the statistical sequence.

[0005] Optionally, the statistical sequence is frequency decomposed to extract a preset number of frequency component amplitudes to form frequency component data, including: The number of arriving packets and the number of newly established connection data packets with synchronization flags in the statistical sequence are subjected to discrete Fourier transform processing, and the frequency component amplitudes of a first preset number are extracted respectively. Discrete Fourier transform is performed on the distribution dispersion of the destination port, the variance of the data packet length, and the ratio of the number of unique source addresses to the total number of packets in the statistical sequence, and the frequency component amplitudes of the second preset number are extracted respectively. The frequency component data is generated by concatenating the first preset number of frequency component amplitudes with the second preset number of frequency component amplitudes.

[0006] Optionally, calculating the deviation of the frequency component data relative to the historical reference value includes: Calculate the normalized distance between the amplitude of each dimension of the frequency component data and the corresponding dimension reference value of the historical reference value, and determine the deviation value based on the normalized distance of each dimension.

[0007] Optionally, a historical average arrival rate benchmark value is obtained, and a traffic load ratio is calculated as the ratio of the average arrival rate of data packets within the preset time window to the historical average arrival rate benchmark value. A dynamic alarm threshold is calculated based on the traffic load ratio and a preset basic alarm threshold. The deviation value is compared with the dynamic alarm threshold to obtain a local determination result indicating whether the local situation is normal or abnormal, including: Obtain the average arrival rate of data packets in the current time window, and calculate the ratio of the average arrival rate of data packets to the historical average arrival rate baseline value to obtain the traffic load ratio; Based on the traffic load ratio, the preset adjustment coefficient, and the preset basic alarm threshold, the dynamic alarm threshold is calculated and generated through a dynamic adjustment algorithm. When the deviation value is greater than the dynamic alarm threshold, a local judgment result indicating a local anomaly is generated; when the deviation value is not greater than the dynamic alarm threshold, a local judgment result indicating a local normality is generated.

[0008] Optionally, the frequency component data is compressed into compressed data, generating an interactive message containing the compressed data, the deviation value, and the local determination result. The interactive message is then sent to pre-configured adjacent edge nodes according to a preset topology, and a set of interactive messages forwarded by the adjacent edge nodes is received, including: The preset dimension reduction projection matrix is ​​generated by the management center in advance based on principal component analysis or orthogonal linear transformation training based on historical normal network traffic characteristics. Using the preset dimension reduction projection matrix issued and pre-shared by the management center for mapping high-dimensional features to low-dimensional space, the high-dimensional frequency component data is multiplied by the dimension reduction projection matrix to compress it into low-dimensional compressed data. The node identifier, current timestamp, compressed data, deviation value, and local determination result are encapsulated into an interactive message; According to the preset ring topology path, the interaction message is sent to the subsequent adjacent edge node, and the set of interaction messages forwarded by the preceding adjacent edge node is received, until the set of interaction messages of multiple edge nodes in the same node cluster under the same time window is obtained.

[0009] Optionally, based on the deviation value of each edge node in the interaction message set and the compressed data, the overall deviation and node proximity are calculated respectively, and the sum is used to obtain a joint anomaly value. The joint anomaly value is compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal, including: The overall deviation is calculated by aggregating the deviation values ​​of each edge node in the set of interactive messages; the feature direction similarity is calculated by extracting the compressed data of any two edge nodes, and the node proximity is determined by combining the preset weight factor. The overall deviation is added to the node proximity to obtain the joint outlier value; The combined outlier is compared with a preset global threshold. When the combined outlier is greater than the preset global threshold, a global judgment result indicating a global anomaly is generated; when the combined outlier is not greater than the preset global threshold, a global judgment result indicating a global normality is generated.

[0010] Optionally, the method further includes: executing a traffic blocking strategy based on the local determination result and the global determination result, combined with the packet header information, and reporting logs to a preset management center, including: When the local determination result indicates a local anomaly and the global determination result indicates a global normal state, it is determined to be a single-point attack. Local rate limiting or temporary source address blocking strategies are implemented for the edge node, and the action of freezing the current time window baseline update is triggered. When the global judgment result indicates a global anomaly, regardless of the local judgment result, it is determined to be a distributed attack. The global blocking strategy is executed synchronously, the cached packet header information is extracted, and joint rate limiting is implemented on connections with the same destination address range or the same port set. When the local determination result indicates that the local condition is normal and the global determination result indicates that the global condition is abnormal, the node acts as a cooperating node to execute the global blocking strategy. The log, which includes node identifier, timestamp, deviation value, joint anomaly value, compressed data, and processing result, is reported to the management center.

[0011] Optionally, the method further includes: when both the local determination result and the global determination result indicate normal and no benchmark pause update instruction has been received from the management center, updating the historical benchmark value and the historical fluctuation value according to the frequency component data; updating the historical benchmark value and the historical fluctuation value according to the frequency component data includes: The moving average update method is adopted, and a preset time decay weight is used to update the current historical reference value based on the amplitude of the frequency component data and the historical reference value of the previous moment; and the current historical fluctuation value is updated based on the deviation between the amplitude of the frequency component data and the updated historical reference value, combined with the historical fluctuation value of the previous moment. The system receives benchmark correction parameters and policy control instructions generated by the management center based on log data over a preset time span for business cycle statistics. After prioritizing the use of the benchmark correction parameters to update the historical benchmark value and the historical fluctuation value, it proceeds to the next time window processing flow.

[0012] Compared with the prior art, the present invention has the following beneficial effects: 1. This method only collects the data packet header sampling stream of edge nodes to generate statistical sequences and extracts frequency component data through frequency decomposition, which reduces the processing burden of edge nodes. At the same time, by calculating the ratio of the average arrival rate of data packets to the traffic load of historical benchmarks, a dynamic alarm threshold is obtained and local judgment is performed, which overcomes the interference caused by business load fluctuations and improves the accuracy of anomaly identification when a single node faces traffic changes. 2. This method reduces the dimensionality of frequency component data, compresses it, encapsulates it into interactive messages, and forwards it between edge nodes, effectively reducing the communication overhead of cross-node collaboration. By calculating the overall deviation of each node in the interactive message set and the node proximity based on cosine similarity, the joint outlier value is obtained for global judgment, which makes up for the limitations of single-point detection and realizes reliable monitoring of distributed network intrusion behavior. Attached Figure Description

[0013] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0014] Figure 1 This is a flowchart illustrating the distributed network intrusion real-time monitoring and alarm method based on edge computing provided in an embodiment of this application. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0016] like Figure 1As shown, this embodiment uses a network scenario with multiple edge nodes set up within the same collaborative domain as an example for illustration. Each edge node includes a network interface, a central processing unit (CPU), and local memory. The network interface handles data packet input and output, the CPU performs statistics, frequency decomposition, judgment, and packet forwarding, and the local memory stores the cached data packet header information, historical baseline values, historical fluctuation values, historical average arrival rate baseline values, and control parameters issued by the management center within the current time window. The management center maintains a management communication connection with each edge node to receive log data and issue baseline pause update instructions, baseline correction parameters, and policy control instructions. A distributed network intrusion real-time monitoring and alarm method based on edge computing includes: Collect the packet header sampling stream between the network interface of the edge node and the central processing unit, cache the packet header information locally, and obtain a statistical sequence by segmenting the data according to a preset time window; The frequency of the statistical sequence is decomposed, and a preset number of frequency component amplitudes are extracted to form frequency component data. Obtain the historical baseline value and historical fluctuation value of the edge node for a preset time window, and calculate the deviation value of the frequency component data relative to the historical baseline value; Obtain the historical average arrival rate benchmark value, calculate the traffic load ratio by comparing the average arrival rate of data packets within the preset time window with the historical average arrival rate benchmark value, calculate the dynamic alarm threshold based on the traffic load ratio and the preset basic alarm threshold, and compare the deviation value with the dynamic alarm threshold to obtain the local judgment result indicating whether the local situation is normal or abnormal. The frequency component data is compressed into compressed data, generating an interactive message containing the compressed data, deviation value, and local judgment result. The interactive message is sent to the pre-configured adjacent edge nodes according to the preset topology, and the set of interactive messages forwarded by the adjacent edge nodes is received. The overall deviation and node proximity are calculated based on the deviation values ​​of each edge node in the interactive message set and the compressed data, respectively. The sum of these values ​​yields a joint anomaly value. The joint anomaly value is then compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal.

[0017] The system collects packet header sampling streams between the edge node network interface and the central processing unit, caches the packet header information locally, and obtains statistical sequences by segmenting them according to a preset time window, including: The kernel-level extension program collects data packet header information from the network interface and caches the source address, destination address, and port information of the data packet header within the current time window locally on the edge node. The data packet header sampling stream is segmented according to a fixed preset time window; Within each preset time window, the number of arriving packets, the number of newly established connection packets with synchronization flags, the distribution dispersion of destination ports, the variance of packet length, and the ratio of the number of unique source addresses to the total number of packets are counted according to the preset micro-window granularity, and a statistical sequence is generated.

[0018] The statistical sequence is decomposed into frequencies, and a predetermined number of frequency component amplitudes are extracted to form frequency component data, including: The number of packets arriving and the number of newly established connection packets with synchronization flags in the statistical sequence are processed by discrete Fourier transform, and the frequency component amplitudes of the first preset number are extracted respectively. Discrete Fourier transform is performed on the distribution dispersion of destination ports, the variance of data packet length, and the ratio of the number of unique source addresses to the total number of packets in the statistical sequence, and the frequency component amplitude of the second preset number is extracted respectively. The frequency component amplitudes of the first preset number and the second preset number are concatenated to generate frequency component data.

[0019] In this embodiment, the packet header sampling stream is configured as a sequence of packet header fields intercepted by the edge node through a kernel-level extension program on the data path between the network interface and the central processing unit. The sampling stream does not require parsing the service payload, but retains the header information for statistical purposes. The header information includes at least the source address, destination address, source port, destination port, protocol field, packet length, and synchronization flag in the packet flags used to identify newly established connections. Network intrusion behavior typically changes in the number of packets arriving, the number of connections established, port distribution, and the dispersion of source addresses. These changes can be reflected by header statistics without relying on full packet deep parsing, thereby reducing the CPU's computational resource consumption. At the start of a processing cycle, the kernel layer extension program of the edge node first collects the headers of data packets passing through the network interface and writes the header information of data packets belonging to the current preset time window into the local cache. The preset time window is configured as a fixed segment unit within the system cycle to ensure that statistics, frequency decomposition, local judgment and global judgment are all performed on the same batch of data. Each preset time window is further divided into finer micro-windows to generate statistical values ​​at multiple time points for subsequent Discrete Fourier Transform (DFT). The granularity of the micro-windows should be smaller than the preset time window and remain fixed within the same edge node to ensure consistent sampling intervals for the same type of statistical sequence. Those skilled in the art can select the micro-window granularity based on the computing power and link speed of the edge node, as long as it can generate a statistical sequence that meets the requirements for the number of nodes for DFT computation within a preset time window. During the statistical phase, the central processing unit performs segmented statistics on the data packet header sampling stream within the current preset time window according to the implementation method of this application; for each micro-window, the number of arriving packets is first counted, which corresponds to the total number of data packets passing through the network interface within the current micro-window; then the number of newly established connection data packets with synchronization flag bits is counted, which is used to reflect the changes in connection initiation behavior in a short period of time; for the distribution dispersion of the destination port, this implementation method can use a port histogram with a fixed number of buckets to approximate the dispersion, so that different micro-windows can output a comparable distribution value; Regarding the variance of packet length, the CPU updates it online each time it receives a packet, obtaining the dispersion of packet length within the current micro-window. Regarding the ratio of the number of unique source addresses to the total number of packets, the CPU maintains a source address counting structure within the micro-window to obtain the number of unique source addresses, then divides it by the total number of packets in that micro-window to form a source address dispersion index. Thus, after a preset time window ends, the edge nodes will obtain five statistical sequences arranged in micro-window order: a sequence of packet arrivals, a sequence of newly established connection packets with synchronization flags, a sequence of destination port dispersion, a sequence of packet length variance, and a sequence of the ratio of the number of unique source addresses to the total number of packets. After the above statistical sequence is formed, the central processing unit immediately enters the frequency decomposition process; the amplitude of the frequency component represents the magnitude of the complex result corresponding to each discrete frequency point after performing a discrete Fourier transform on a certain statistical sequence; due to the periodic scanning, periodic heartbeat connection and pulsed flow injection in the network, certain fixed rhythmic fluctuations are usually formed on the statistical sequence, so the amplitude of the frequency component can be used to distinguish periodic anomalies from general fluctuations. According to the embodiment, the central processing unit performs discrete Fourier transform on the sequence of packet arrivals and the sequence of newly established connection data packets with synchronization flags, and extracts the frequency component amplitude of a first preset number respectively; the first preset number is preferably less than the total number of discrete frequency points in the sequence, and frequency components in the low-frequency to mid-low-frequency range are preferentially selected, and the frequency distribution corresponding to the network behavior characteristics within the preset time window is configured in the preset mid-low frequency band range; Meanwhile, the central processing unit performs discrete Fourier transform on the distribution discreteness sequence of the destination port, the variance sequence of the data packet length, and the ratio sequence of the number of unique source addresses to the total number of packets, and extracts the frequency component amplitude of a second preset number of packets respectively; the first preset number and the second preset number can be the same or different; if the fluctuation amplitude of the number of packets arriving and the number of newly established connections exceeds the preset sensitivity threshold, the first preset number is increased according to the preset step size. Based on the preset business characteristics, a second preset quantity is allocated according to the matching weight. After extraction, the central processing unit concatenates the frequency component amplitudes of the first preset quantity and the frequency component amplitudes of the second preset quantity in a fixed order to generate the frequency component data corresponding to the current time window. This concatenation order remains unchanged in the same edge node to ensure that the meaning of each dimension of the historical benchmark value and the historical fluctuation value is consistent. Before local anomaly detection, edge nodes need to maintain historical baseline values ​​and historical fluctuation values ​​corresponding to the current time window. The historical baseline values ​​are configured as reference values ​​of the amplitude of each frequency component formed when the edge node operates normally for a long period of time in the same time period. The historical fluctuation values ​​are configured as the range of fluctuations allowed for the corresponding dimension under normal conditions. Since business traffic has periodic variation characteristics, this implementation prefers to save multiple sets of historical baseline values ​​and historical fluctuation values ​​according to periodic time periods, so that the current time window can read the reference data of the corresponding time period, instead of using a uniform baseline for the entire time period. After the central processing unit reads the historical baseline values ​​and historical fluctuation values ​​corresponding to the current time window from the local memory, it can perform deviation calculation on the current frequency component data. After the edge node completes the deviation calculation, it also needs to calculate the traffic load ratio to dynamically adjust the local alarm threshold. The average arrival rate of data packets is configured as the average number of packets arriving within the current preset time window, which is obtained by averaging the number of packets arriving in each micro-window within that window. The historical average arrival rate benchmark value is configured as the reference value of the average arrival rate of data packets under historical normal conditions during the current period. The central processing unit divides the current average arrival rate of data packets by the historical average arrival rate benchmark value to obtain the traffic load ratio. When the traffic load ratio is greater than 1, it indicates that the current service load is higher than the historical benchmark, and normal fluctuations may increase. When the traffic load ratio is less than 1, it indicates that the current service load is lower than the historical benchmark, and abnormal traffic is more likely to be highlighted. Therefore, this embodiment calculates the dynamic alarm threshold based on the preset basic alarm threshold and the traffic load ratio, so that the same deviation value has different judgment boundaries under high load and low load conditions. After obtaining the deviation value and the dynamic alarm threshold, the central processing unit performs local judgment. If the deviation value is greater than the dynamic alarm threshold, a local judgment result indicating a local anomaly is generated; if the deviation value is not greater than the dynamic alarm threshold, a local judgment result indicating a local normality is generated. The local judgment result, the local deviation value, and the time window identifier together constitute the basic data for the node to participate in subsequent collaborative computing. At this point, the edge node has completed the complete processing chain from the packet header sampling stream to the local judgment result. The output result enters the neighborhood collaboration stage on the one hand, and retains the cached packet header information for subsequent blocking strategy calls on the other hand. In edge gateway applications of industrial access networks, if within a preset time window, multiple micro-windows continuously show an increase in the number of newly established connection data packets with synchronization flags, and the destination port distribution changes from centralized access to discrete access, then the sequence of newly established connections and the port distribution dispersion sequence formed within this window will exhibit amplitudes higher than historical benchmark values ​​on several frequency components after Discrete Fourier Transform. Based on this, the central processing unit obtains the deviation value of the frequency component data exceeding the preset deviation threshold relative to the historical benchmark value, combines it with the average arrival rate of data packets in the current time window to form a dynamic alarm threshold, and outputs a local judgment result indicating local anomaly or normality. In this way, without parsing the service payload, abnormal connection establishment and scanning behavior can be reflected using changes in network header statistics. In terms of engineering implementation, this implementation requires each edge node to adopt consistent settings for the preset time window and micro-window granularity within the same collaborative domain; by configuring a consistent time base, it corresponds to the same network state period, thereby providing comparable input for subsequent interaction message aggregation and global determination; if individual nodes do not form a complete statistical sequence, the node only outputs a local unavailable flag in this window, and does not use the incomplete sequence to participate in the frequency decomposition and local determination of the current window, so as to avoid interfering with the subsequent collaborative results; This implementation mainly corresponds to the execution process of edge nodes from local deviation calculation to neighborhood collaboration determination; wherein, the deviation value represents the standardized distance of the frequency component data of the current time window relative to the historical benchmark value; the compressed data is configured as a low-dimensional feature mapping obtained after dimensionality reduction of high-dimensional frequency component data; the overall deviation is used to reflect the superposition degree of local deviations of multiple edge nodes in the same collaboration domain; the node proximity is used to quantify the similar change direction of frequency features of different edge nodes in the same time window; the joint outlier is formed by the combined effect of the overall deviation and the node proximity, and serves as the basis for global determination; Calculate the deviation of the frequency component data relative to this historical reference value, including: Calculate the normalized distance between the amplitude of each dimension of the frequency component data and the corresponding dimension of the historical benchmark value, and determine the deviation value based on the normalized distance of each dimension.

[0020] Obtain the historical average arrival rate baseline value, calculate the traffic load ratio (the ratio of the average arrival rate of data packets within a preset time window to the historical average arrival rate baseline value), calculate the dynamic alarm threshold based on the traffic load ratio and a preset basic alarm threshold, and compare the deviation value with the dynamic alarm threshold to obtain a local judgment result indicating whether the local situation is normal or abnormal, including: Obtain the average arrival rate of data packets in the current time window, and calculate the ratio of the average arrival rate of data packets to the historical average arrival rate baseline to obtain the traffic load ratio; Based on the traffic load ratio, preset adjustment coefficient, and preset basic alarm threshold, a dynamic alarm threshold is calculated and generated through a dynamic adjustment algorithm. When the deviation value is greater than the dynamic alarm threshold, a local judgment result indicating a local anomaly is generated; when the deviation value is not greater than the dynamic alarm threshold, a local judgment result indicating a local normality is generated.

[0021] Frequency component data is compressed into compressed data, generating an interactive message containing the compressed data, deviation value, and local determination result. This interactive message is then sent to pre-configured adjacent edge nodes according to a preset topology. The system also receives a set of interactive messages forwarded by adjacent edge nodes, including: The preset dimension reduction projection matrix is ​​generated by the management center in advance based on principal component analysis or orthogonal linear transformation training based on historical normal network traffic characteristics. Using a pre-defined dimension reduction projection matrix distributed and shared by the management center to map high-dimensional features to a low-dimensional space, the high-dimensional frequency component data is multiplied by the dimension reduction projection matrix and compressed into low-dimensional compressed data. Encapsulate the node identifier, current timestamp, compressed data, deviation value, and local judgment result into an interactive message; Following a preset ring topology path, the interaction message is sent to the subsequent adjacent edge node, and the set of interaction messages forwarded by the preceding adjacent edge node is received, until the set of interaction messages of multiple edge nodes in the same node cluster under the same time window is obtained.

[0022] Based on the deviation values ​​of each edge node in the interactive message set and the compressed data, the overall deviation and node proximity are calculated respectively, and summed to obtain a joint outlier value. The joint outlier value is compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal, including: The overall deviation is calculated by aggregating the deviation values ​​of each edge node in the interactive message set; the feature direction similarity is calculated by extracting the compressed data of any two edge nodes, and the node proximity is determined by combining the preset weight factor. The joint outlier is obtained by adding the overall deviation to the node proximity. The combined outlier is compared with a preset global threshold. When the combined outlier is greater than the preset global threshold, a global judgment result indicating a global anomaly is generated; when the combined outlier is not greater than the preset global threshold, a global judgment result indicating a global normality is generated.

[0023] For deviation calculation, after reading the historical baseline value and historical fluctuation value corresponding to the current time period, the central processing unit first subtracts the baseline value of the corresponding dimension in the historical baseline value from the amplitude of each dimension in the current frequency component data to obtain the difference in the same dimension. The corresponding dimension indicates that each dimension in the spliced ​​frequency component data corresponds one-to-one with the same sequential dimension in the historical baseline value and historical fluctuation value. For example, if a certain dimension of the frequency component data represents the amplitude of a certain frequency point in the packet arrival sequence, then the corresponding dimension in the historical baseline value and historical fluctuation value must also represent the historical reference value of the same statistical sequence and the same frequency point. This can avoid cross-comparison of features with different physical meanings. After obtaining the difference, the central processing unit divides the difference of each dimension by the fluctuation value of the corresponding dimension in the historical fluctuation values ​​to obtain the normalized deviation of each dimension. In order to suppress the calculation offset caused by high fluctuation dimensions, the deviation of the current frequency component from the historical normal state is unified to the same scale after the historical fluctuation values ​​are normalized. In order to avoid the calculation anomaly of zero denominator caused by the historical fluctuation values ​​of individual dimensions being close to zero, this implementation adds a preset non-zero compensation parameter to the historical fluctuation values ​​in the system implementation before participating in the calculation. This processing does not change the deviation size pattern of each dimension. After calculating the normalized deviation for each dimension, the central processing unit performs a square root calculation on the sum of squares of all normalized deviations to obtain the deviation value. The deviation value is positively correlated with the degree of deviation of the frequency component data of the current time window from the historical normal state. Since this calculation only involves subtraction, division, multiplication and square root operations, edge nodes can complete real-time processing in scenarios with limited computing power. For the calculation of dynamic alarm threshold, the central processing unit first obtains the average arrival rate of data packets from the statistical sequence of packet arrivals in the current time window, and then divides it by the historical average arrival rate benchmark value to obtain the traffic load ratio. The historical average arrival rate benchmark value can be maintained with the historical benchmark value in the same time period to reflect the typical load level of the edge node in the corresponding business cycle. Then, the central processing unit multiplies the difference between the traffic load ratio and one by a preset adjustment coefficient, and then adds it to the preset basic alarm threshold to obtain the dynamic alarm threshold. In this embodiment, the preset basic alarm threshold is configured as the local alarm threshold of the edge node under normal business load, and the preset adjustment coefficient is configured to adjust the sensitivity of the threshold to changes in traffic load; the preset adjustment coefficient should be set to a non-negative value; when the traffic load ratio is greater than one, the dynamic alarm threshold is increased to suppress false alarms caused by normal business peaks; when the traffic load ratio is less than one, the dynamic alarm threshold is decreased to enhance the detection capability of abnormal disturbances under low load conditions; To prevent the adjusted dynamic alarm threshold from becoming negative or too low due to an excessively small traffic load ratio under extremely low load conditions, thereby causing a large number of false alarms, this implementation sets a preset lower limit for the dynamic alarm threshold that is greater than zero. If the calculated dynamic alarm threshold is less than the preset lower limit, the dynamic alarm threshold is forcibly assigned to the preset lower limit. If the deviation value is greater than the dynamic alarm threshold, the central processing unit generates a local judgment result indicating a local anomaly. If the deviation value is not greater than the dynamic alarm threshold, a local judgment result indicating a local normality is generated. After generating the local judgment result, the central processing unit writes the deviation value and the local judgment result into the local status record of the current time window for subsequent message encapsulation and calling. For compression processing and interactive message transmission, in this embodiment, the management center pre-issues and shares the same preset dimension reduction projection matrix to all edge nodes in the same collaborative domain; the preset dimension reduction projection matrix is ​​configured as a fixed matrix that linearly maps high-dimensional frequency component data to low-dimensional space; The dimension reduction projection matrix is ​​configured to reduce the amount of data exchanged between edge nodes on the one hand, and retain the main structural information in the original frequency component data used to determine the similarity between nodes on the other hand. The central processing unit multiplies the high-dimensional frequency component data of the current time window with the dimension reduction projection matrix to obtain low-dimensional compressed data. Since this matrix is ​​shared by all nodes in the cooperative domain, the compressed data of different edge nodes are comparable. After obtaining the compressed data, the central processing unit (CPU) encapsulates the node identifier, current timestamp, compressed data, deviation value, and local judgment result into an interactive message. The node identifier is used to identify the message source, the current timestamp ensures that messages in the same batch correspond to the same preset time window, the compressed data is used for subsequent node proximity calculations, the deviation value is used for overall deviation calculations, and the local judgment result is used by subsequent blocking strategies to distinguish between local anomalies and coordinated anomalies. After message encapsulation, the CPU sends the interactive message to subsequent adjacent edge nodes according to a preset ring topology path. In a ring topology, each edge node is both a sending node and a forwarding node. While the current edge node sends its own messages to the next adjacent edge node, it also receives interactive messages forwarded from the previous adjacent edge node. When a message is received, the central processing unit first checks whether it belongs to the current preset time window and has not yet been cached based on the node identifier and timestamp. If the conditions are met, the message is written into the interactive message set cache and forwarded. After one round of propagation, each edge node can obtain the set of interactive messages from multiple edge nodes in the same node cluster within the same time window. If not all node messages are received within the limited receiving conditions, the edge node can participate in the global calculation in this round using only the set of interactive messages received within the same window. At the same time, it records an incomplete collaboration marker in the local log for the management center to evaluate the link status. For joint outlier calculation, after obtaining the set of interactive messages, the central processing unit first extracts the deviation values ​​of all edge nodes in the set, and calculates the square root of the sum of their squares to obtain the overall deviation. This value increases as the number of outlier deviations among the nodes participating in the collaborative calculation increases, and can reflect the cumulative intensity of outliers in the collaborative domain. The central processing unit extracts the compressed data of any two edge nodes from the set of interactive messages one by one, and calculates the cosine similarity between the two as a value of the degree of closeness. If the compressed data of a pair of nodes are in the same direction, the cosine similarity is positive, indicating that the frequency change trends of the two nodes are similar in this time window; if the cosine similarity is negative, it means that the change directions are opposite or inconsistent. To address the feature mapping extraction requirements for multi-node similarity changes, this implementation method only sums and averages the proximity values ​​that are greater than zero, and then multiplies them by a preset weighting factor to obtain the node proximity. If, within the current time window, the cosine similarity of the compressed data of any two node pairs in the interaction message set is not greater than 0, that is, there are no features with similar changes in the same direction, in order to avoid program errors where the denominator is 0 when calculating the average, the central processing unit will directly assign the summation and averaging result to 0, so that the calculated node proximity is zero. The preset weighting factor is configured to adjust the contribution of similarity changes between nodes to the global judgment. If the probability of low-slow-small attacks in the collaborative domain scenario is greater than the set threshold, the preset weighting factor can be increased by a preset step size, making it easier for weak anomalies of multiple nodes to form a global alarm after the similarity is enhanced. If the variance of node business differences in the scenario exceeds the set threshold, the preset weighting factor should not be too high to avoid amplifying the global anomaly value due to accidental similarity fluctuations between nodes. The central processing unit adds the overall deviation to the node proximity to obtain the joint anomaly value. The joint anomaly value is compared with the preset global threshold. When the joint anomaly value is greater than the preset global threshold, a global judgment result indicating a global anomaly is generated. When the joint anomaly value is not greater than the preset global threshold, a global judgment result indicating a global normality is generated. When the local deviation values ​​of each edge node are between the upper limit of the historical normal range and the dynamic alarm threshold, and the compressed data of these nodes have a high positive cosine similarity within the same time window, then from the perspective of a single node, each node may only show a local anomaly with a deviation value lower than the dynamic alarm threshold. However, in the global calculation stage, the overall deviation value is added to the node proximity value to form a high joint anomaly value, thereby generating a global anomaly judgment result. This can identify situations where attack traffic is distributed to multiple edge entry points. To address the discrepancies in global judgment caused by the order of message arrival, this implementation adopts a unified deduplication rule and a unified node sorting rule for the set of interactive messages within the same time window. For example, the central processing unit first sorts the messages by node identifier, and then calculates the proximity value between any two edge nodes in that order. In this way, even if the order of reception on the message forwarding path is different, as long as the set of interactive messages is the same, the final overall deviation, node proximity, and joint anomaly value will remain consistent. In this embodiment, the implementation corresponds to the processing and benchmark update process after the local and global judgments are completed; the traffic blocking policy is configured as the rate limiting, blocking, or joint rate limiting actions taken by the edge nodes for abnormal connections; the action of freezing the benchmark update of the current time window indicates that the data of the current window is not written to the historical benchmark value and historical fluctuation value; the benchmark pause update instruction is issued by the management center according to the global situation, which is used to require the edge nodes to stop updating the normal reference value under specified conditions; The method also includes: executing traffic blocking policies based on local and global judgment results, combined with packet header information, and reporting logs to a preset management center, including: When the local judgment result indicates a local anomaly and the global judgment result indicates a global normal state, it is judged as a single point attack. Local rate limiting or temporary source address blocking policies are implemented for edge nodes, and the action of freezing the current time window baseline update is triggered. When the global judgment result indicates a global anomaly, regardless of the local judgment result, it is judged as a distributed attack. The global blocking policy is executed synchronously, the cached packet header information is extracted, and joint rate limiting is implemented on connections with the same destination address range or the same port set. When the local judgment result indicates that the local condition is normal and the global judgment result indicates that the global condition is abnormal, it acts as a cooperating node to implement the global blocking strategy. Logs containing node identifiers, timestamps, deviation values, joint outliers, compressed data, and handling results are reported to the management center.

[0024] The method also includes: when both the local and global judgment results indicate normal and no baseline pause update instruction has been received from the management center, updating the historical baseline value and historical fluctuation value based on the frequency component data; updating the historical baseline value and historical fluctuation value based on the frequency component data includes: The moving average update method is adopted, which uses a preset time decay weight to update the current historical reference value based on the amplitude of the frequency component data and the historical reference value of the previous moment; and updates the current historical fluctuation value based on the deviation between the amplitude of the frequency component data and the updated historical reference value, combined with the historical fluctuation value of the previous moment. The system receives baseline correction parameters and policy control instructions generated by the management center based on log data over a preset time span for business cycle statistics. It prioritizes updating historical baseline values ​​and historical fluctuation values ​​using the baseline correction parameters before proceeding to the next time window processing flow.

[0025] After the edge node receives the local and global judgment results, the central processing unit first performs a judgment combination analysis. If the local judgment result indicates a local anomaly and the global judgment result indicates a global normality, it means that the anomaly is mainly concentrated in the current edge node and has not formed a multi-point consistent change in the same collaborative domain. At this point, the CPU determines the situation as a single point of attack. In order to implement targeted local processing, the CPU extracts the packet header information from the local cache of the current time window, focusing on reading the source address, destination address, port information, and the distribution of synchronization flags. If the abnormal characteristics are mainly manifested as a continuous establishment rate of new connections by source addresses with a number lower than the first threshold that is higher than the second threshold, a temporary blocking policy can be implemented for the corresponding source address. If the abnormal characteristics are mainly manifested as an increase in the overall access rate but the source addresses are relatively dispersed, a local rate limiting policy can be implemented for the current edge node. Regardless of the local blocking method used, the central processing unit synchronously triggers the action of freezing the current time window baseline update to avoid writing the frequency component data formed during the single point attack into the historical baseline value and historical fluctuation value. If the global judgment result indicates a global anomaly, it means that multiple edge nodes within the same collaborative domain have formed a significant joint anomaly within the same time window. At this time, regardless of whether the local judgment result of the current edge node is a local anomaly or a local normality, the central processing unit should treat this round of state as a distributed attack scenario. The edge nodes extract the destination address, port set, and connection mode information within the same window from the cached packet header information, and implement joint rate limiting on connections with the same destination address range or the same port set. The joint rate limiting configuration is that multiple edge nodes, based on the same global judgment result, take consistent restrictions on the same destination object or the same port set locally, thereby suppressing the impact of dispersed traffic converging at the backend, rather than the independent action of a single node. When the local judgment result indicates that the local condition is normal and the global judgment result indicates that the global condition is abnormal, although the current edge node has not observed a deviation value sufficient to trigger an alarm independently, there are already multiple related anomalies in its cooperative domain. At this time, the edge node acts as a cooperative node to cooperate in executing the global blocking strategy. Specifically, the central processing unit does not block the cooperative action on the grounds that the local threshold has not been exceeded. Instead, it extracts the connections related to the global anomaly from the cached packet header information and imposes restrictions on traffic to the same destination address range or the same port set. This can prevent distributed attacks from being significantly exposed only on some nodes, while other nodes are allowed to pass because the traffic is below the basic blocking threshold. After the processing is completed, the central processing unit generates log data and reports it to the management center. The log data includes at least the node identifier, timestamp, deviation value, joint outlier, compressed data, and processing result. The node identifier is used by the management center to identify the source of the message. The timestamp is used to align logs from different edge nodes within the same time window. The deviation value reflects the local deviation. The joint outlier reflects the overall degree of anomaly in the collaborative domain. The compressed data can be used by the management center for cross-node similarity backtracking. The processing result indicates the specific policy type adopted by the edge node. After receiving these logs, the management center can perform statistical analysis over a longer business cycle and form subsequent baseline correction parameters and policy control instructions. For updating historical baseline values ​​and historical fluctuation values ​​in the embodiments, this implementation requires that updates are only allowed when three conditions are met simultaneously: first, the local judgment result indicates that the local condition is normal; second, the global judgment result indicates that the global condition is normal; and third, no baseline update suspension instruction has been received from the management center. The current frequency component data is imported into the update mechanism as normal sample data only when the edge node and its cooperative domain are in a normal judgment state and updates are allowed. After the update conditions are met, the central processing unit adopts a moving average update method. Using a preset time decay weight, it weights and sums the amplitude of the current frequency component data with the baseline value in the historical baseline value of the previous moment to obtain the updated historical baseline value. The time decay weight is configured to control the degree of influence of the new data on the old baseline. The value of the time decay weight is positively correlated with the rate of change of the historical baseline value and is dynamically matched based on the frequency of change of the business rhythm. The time decay weight is configured according to the preset long-term operating cycle of the edge nodes, so that the historical benchmark value mainly absorbs continuous normal changes, rather than frequently changing with short-term fluctuations. In the specific weighted summation process, the central processing unit uses the time decay weight as the multiplier factor of the current frequency component data amplitude, and uses the difference between 1 and the time decay weight as the multiplier factor of the corresponding benchmark value in the previous historical benchmark value, so as to ensure that the sum of the weights of the two is always 1. Through this complementary weighted summation method, errors such as numerical divergence or out-of-bounds errors in the long-term iterative accumulation of historical benchmark values ​​can be effectively avoided. After obtaining the updated historical baseline value, the central processing unit (CPU) continues to calculate the squared difference between the amplitude of the current frequency component data and the updated historical baseline value. Using the same time decay weight, it then weights and sums this squared difference with the fluctuation value from the previous historical fluctuation value to obtain the updated historical fluctuation value. Here, the principle of complementary weights is also followed, i.e., the time decay weight is multiplied by the squared difference, and then... Multiply by the fluctuation value in the historical fluctuation value of the previous moment to maintain the stability of the fluctuation characteristic calculation scale; In this way, historical fluctuation values ​​not only reflect a single deviation in the current window, but also gradually accumulate the fluctuation range during normal operation; thus, when calculating the deviation value in the next time window, the normalized deviation of each dimension can be calculated based on the fluctuation reference value that is closer to the actual business rhythm. The management center also performs business cycle statistics based on log data over a preset time span, generating baseline correction parameters and policy control instructions. The baseline correction parameters are used to correct the deviation of historical baseline values ​​and historical fluctuation values ​​caused by changes in business structure during long-term operation. The policy control instructions can include control contents such as threshold fine-tuning, freezing or restoring updates. After receiving this data, the central processing unit first uses the baseline correction parameters to update the historical baseline values ​​and historical fluctuation values, and then enters the collection, statistics, frequency decomposition, local judgment and global judgment process of the next time window. In this way, the edge nodes retain their local continuous learning capabilities and are subject to the periodic correction control of the management center, thereby avoiding baseline deviation caused by long-term single-point learning. Taking the scenario of intelligent network access nodes as an example, if multiple time windows within a certain business cycle are judged to be globally normal, the frequency component data of these windows will be gradually written into the historical baseline value and historical fluctuation value of the corresponding time period through a sliding average, so that the system can adapt to the slow changes in normal business volume. Conversely, if distributed port probing occurs within a certain time window and multiple edge nodes exceed the global threshold in the joint outlier value, then each node will perform joint rate limiting and freeze updates. The outlier frequency component data formed in the current time window will not be used as a sample to introduce the historical baseline value. Afterwards, the management center will evaluate whether the business mode has changed stably during this period based on the reported logs over a longer statistical period, and if necessary, make unified corrections to the edge nodes through the baseline correction parameters. In abnormal or link jitter scenarios, if an edge node completes its local determination but fails to obtain a valid global determination result in a timely manner, the node should not directly include the window in the baseline update. In this case, the central processing unit can maintain the historical baseline value and historical fluctuation value of the previous moment unchanged, and wait for the management center to make subsequent corrections or for the next time window to re-participate in the complete collaboration, so as to avoid introducing erroneous learning results when the global state is unclear. This approach can ensure that the historical baseline value and historical fluctuation value are mainly driven by the clear normal window for updating.

[0026] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for real-time monitoring and alarming of network intrusion based on edge computing distributed network, characterized in that, include: Collect the packet header sampling stream between the network interface of the edge node and the central processing unit, cache the packet header information locally, and obtain a statistical sequence by segmenting the data according to a preset time window; The statistical sequence is decomposed into frequencies, and a preset number of frequency component amplitudes are extracted to form frequency component data. Obtain the historical baseline value and historical fluctuation value of the edge node for the preset time window, and calculate the deviation value of the frequency component data relative to the historical baseline value; Obtain a historical average arrival rate benchmark value, calculate the traffic load ratio by comparing the average arrival rate of data packets within the preset time window with the historical average arrival rate benchmark value, calculate a dynamic alarm threshold based on the traffic load ratio and a preset basic alarm threshold, and compare the deviation value with the dynamic alarm threshold to obtain a local judgment result indicating whether the local situation is normal or abnormal. The frequency component data is compressed into compressed data, and an interactive message containing the compressed data, the deviation value, and the local determination result is generated. The interactive message is sent to the pre-configured adjacent edge nodes according to the preset topology, and the set of interactive messages forwarded by the adjacent edge nodes is received. Based on the deviation value of each edge node in the interactive message set and the compressed data, the overall deviation and node proximity are calculated respectively, and the sum is used to obtain a joint anomaly value. The joint anomaly value is compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal.

2. The edge-computing-based distributed network intrusion real-time monitoring and alarm method according to claim 1, wherein, The system collects packet header sampling streams between the edge node network interface and the central processing unit, caches the packet header information locally, and obtains statistical sequences by segmenting them according to a preset time window, including: The kernel layer extension program collects the packet header information of the network interface and caches the source address, destination address and port information of the packet header within the current time window locally on the edge node. The data packet header sampling stream is segmented according to the fixed preset time window; Within each preset time window, the number of arriving packets, the number of newly established connection packets with synchronization flags, the distribution dispersion of destination ports, the variance of packet length, and the ratio of the number of unique source addresses to the total number of packets are counted according to the preset micro-window granularity, thereby generating the statistical sequence.

3. The edge-computing-based distributed network intrusion real-time monitoring and alarm method of claim 2, wherein, The statistical sequence is decomposed into frequencies, and a predetermined number of frequency component amplitudes are extracted to form frequency component data, including: The number of arriving packets and the number of newly established connection data packets with synchronization flags in the statistical sequence are subjected to discrete Fourier transform processing, and the frequency component amplitudes of a first preset number are extracted respectively. Discrete Fourier transform is performed on the distribution dispersion of the destination port, the variance of the data packet length, and the ratio of the number of unique source addresses to the total number of packets in the statistical sequence, and the frequency component amplitudes of the second preset number are extracted respectively. The frequency component data is generated by concatenating the first preset number of frequency component amplitudes with the second preset number of frequency component amplitudes.

4. The edge-computing-based distributed network intrusion real-time monitoring and alarm method of claim 1, wherein, Calculating the deviation of the frequency component data relative to the historical reference value includes: Calculate the normalized distance between the amplitude of each dimension of the frequency component data and the corresponding dimension reference value of the historical reference value, and determine the deviation value based on the normalized distance of each dimension.

5. The edge-computing-based distributed network intrusion real-time monitoring and alarm method of claim 1, wherein, Obtain a historical average arrival rate baseline value, calculate the traffic load ratio (the ratio of the average arrival rate of data packets within the preset time window to the historical average arrival rate baseline value), calculate a dynamic alarm threshold based on the traffic load ratio and a preset basic alarm threshold, and compare the deviation value with the dynamic alarm threshold to obtain a local judgment result indicating whether the local situation is normal or abnormal, including: Obtain the average arrival rate of data packets in the current time window, and calculate the ratio of the average arrival rate of data packets to the historical average arrival rate baseline value to obtain the traffic load ratio; Based on the traffic load ratio, the preset adjustment coefficient, and the preset basic alarm threshold, the dynamic alarm threshold is calculated and generated through a dynamic adjustment algorithm. When the deviation value is greater than the dynamic alarm threshold, a local judgment result indicating a local anomaly is generated; when the deviation value is not greater than the dynamic alarm threshold, a local judgment result indicating a local normality is generated.

6. The method for real-time monitoring and alarming of distributed network intrusion based on edge computing as described in claim 1, characterized in that, The frequency component data is compressed into compressed data, generating an interactive message containing the compressed data, the deviation value, and the local determination result. This interactive message is then sent to pre-configured adjacent edge nodes according to a preset topology. The system also receives a set of interactive messages forwarded by the adjacent edge nodes, including: The preset dimension reduction projection matrix is ​​generated by the management center in advance based on principal component analysis or orthogonal linear transformation training based on historical normal network traffic characteristics. Using the preset dimension reduction projection matrix issued and pre-shared by the management center for mapping high-dimensional features to low-dimensional space, the high-dimensional frequency component data is multiplied by the dimension reduction projection matrix to compress it into low-dimensional compressed data. The node identifier, current timestamp, compressed data, deviation value, and local determination result are encapsulated into an interactive message; According to the preset ring topology path, the interaction message is sent to the subsequent adjacent edge node, and the set of interaction messages forwarded by the preceding adjacent edge node is received, until the set of interaction messages of multiple edge nodes in the same node cluster under the same time window is obtained.

7. The method for real-time monitoring and alarming of distributed network intrusion based on edge computing as described in claim 1, characterized in that, Based on the deviation values ​​of each edge node in the interactive message set and the compressed data, the overall deviation and node proximity are calculated respectively, and the sum is used to obtain a joint anomaly value. The joint anomaly value is compared with a preset global threshold to obtain a global judgment result indicating whether the global situation is normal or abnormal, including: The overall deviation is calculated by aggregating the deviation values ​​of each edge node in the set of interactive messages; the feature direction similarity is calculated by extracting the compressed data of any two edge nodes, and the node proximity is determined by combining the preset weight factor. The overall deviation is added to the node proximity to obtain the joint outlier value; The combined outlier is compared with a preset global threshold. When the combined outlier is greater than the preset global threshold, a global judgment result indicating a global anomaly is generated; when the combined outlier is not greater than the preset global threshold, a global judgment result indicating a global normality is generated.

8. The method for real-time monitoring and alarming of distributed network intrusion based on edge computing as described in claim 1, characterized in that, The method further includes: executing a traffic blocking strategy based on the local determination result and the global determination result, combined with the packet header information, and reporting logs to a preset management center, including: When the local determination result indicates a local anomaly and the global determination result indicates a global normal state, it is determined to be a single-point attack. Local rate limiting or temporary source address blocking strategies are implemented for the edge node, and the action of freezing the current time window baseline update is triggered. When the global judgment result indicates a global anomaly, regardless of the local judgment result, it is determined to be a distributed attack. The global blocking strategy is executed synchronously, the cached packet header information is extracted, and joint rate limiting is implemented on connections with the same destination address range or the same port set. When the local determination result indicates that the local condition is normal and the global determination result indicates that the global condition is abnormal, the node acts as a cooperating node to execute the global blocking strategy. The log, which includes node identifier, timestamp, deviation value, joint anomaly value, compressed data, and processing result, is reported to the management center.

9. The method for real-time monitoring and alarming of distributed network intrusion based on edge computing as described in claim 1, characterized in that, The method further includes: when both the local determination result and the global determination result indicate normal and no baseline pause update instruction has been received from the management center, updating the historical baseline value and the historical fluctuation value according to the frequency component data; updating the historical baseline value and the historical fluctuation value according to the frequency component data includes: The moving average update method is adopted, and a preset time decay weight is used to update the current historical reference value based on the amplitude of the frequency component data and the historical reference value of the previous moment; and the current historical fluctuation value is updated based on the deviation between the amplitude of the frequency component data and the updated historical reference value, combined with the historical fluctuation value of the previous moment. The system receives benchmark correction parameters and policy control instructions generated by the management center based on log data over a preset time span for business cycle statistics. After prioritizing the use of the benchmark correction parameters to update the historical benchmark value and the historical fluctuation value, it proceeds to the next time window processing flow.

Images