Network traffic reconstruction and anomaly detection method and system based on multi-modal learning

Abstract

This invention relates to the interdisciplinary field of network measurement and artificial intelligence, and in particular to a method and system for network traffic reconstruction and anomaly detection based on multimodal learning. The invention first constructs and trains a traffic reconstruction model, and then uses the trained model to reconstruct the temporal data of traffic in a routing network. The traffic reconstruction model includes a temporal encoder, a topology encoder, a text encoder, and a fusion reconstruction module. This invention fully utilizes the inherent multimodal characteristics of network traffic, including temporal patterns, topology dependencies, and environmental context, enabling integrity guarantees for routing networks in any complex operating scenario and ensuring anomaly detection performance. Through the cooperative encoding of three modalities, this invention achieves a comprehensive characterization of the network's operating state, solving the problem of insufficient representational ability of single-modal modeling in complex network scenarios.

Description

Technical Field

[0001] This invention relates to the field of network measurement and artificial intelligence, and in particular to a method and system for network traffic reconstruction and anomaly detection based on multimodal learning. Background Technology

[0002] Backbone networks (i.e., routing networks), as the core infrastructure of modern communication systems, bear the burden of large-scale data transmission across geographical regions. Their reliability and stability are crucial for ensuring network service quality and operational security. However, in actual operation, backbone networks frequently face threats from various anomalies, including equipment failures, distributed denial-of-service attacks, routing misconfigurations, and sudden surges in traffic. These anomalies can significantly degrade network performance and even lead to service interruptions. Therefore, accurate and timely detection of anomalies in backbone network traffic is of paramount importance for ensuring network security and achieving intelligent network management.

[0003] Traditional backbone network anomaly detection methods primarily rely on statistical techniques such as principal component analysis and exponentially weighted moving averages. These methods typically assume that normal traffic resides in a low-dimensional subspace, identifying disturbances deviating from this subspace as anomalies. However, based on linear assumptions and hand-designed features, these methods struggle to effectively model the nonlinear dynamics and complex dependencies in modern network traffic.

[0004] In recent years, deep learning methods have been widely applied in the field of anomaly detection. Recurrent neural networks, long short-term memory networks, and transformer architectures can effectively capture temporal dependencies in traffic and perform anomaly detection based on prediction errors. Meanwhile, graph neural networks utilize network topology information to model spatial dependencies between nodes or traffic flows. However, most existing methods rely solely on a single temporal traffic pattern for anomaly identification, neglecting crucial contextual information such as routing dynamics and network environmental conditions. This limitation leads to insufficient detection accuracy and response latency.

[0005] In contrast, multimodal learning achieves more robust anomaly detection by integrating heterogeneous data sources, demonstrating significant advantages in multiple fields such as physical scene understanding, industrial anomaly detection, and intelligent operation and maintenance. However, research on multimodal learning technology is still relatively lacking in the field of backbone network traffic anomaly detection. Applying multimodal learning to backbone network anomaly detection faces the following challenges: (1) Different modalities have different data structures and statistical characteristics, requiring the design of dedicated encoders for effective modeling; (2) There is a lack of effective fusion mechanisms, making it impossible to retain the complementary features of each modality while integrating multimodal information. Summary of the Invention

[0006] To overcome the shortcomings of single-modal methods in network traffic detection, which fail to fully utilize contextual information, and the imperfections of multimodal learning techniques, this invention proposes a network traffic reconstruction method based on multimodal learning. By fusing temporal traffic patterns, routing topology dependencies, and network environment semantic information, network traffic is reconstructed. By comparing the original traffic with the reconstructed traffic, abnormal events in the backbone network can be accurately detected.

[0007] The present invention proposes a network traffic reconstruction method based on multimodal learning. First, a traffic reconstruction model is constructed and trained. Then, the trained traffic reconstruction model is used to reconstruct the time-series traffic data of the routing network. The traffic reconstruction model includes a timing encoder, a topology encoder, a text encoder, and a fusion reconstruction module; The timing encoder divides the input sequence window representing the routing network traffic data into patches, and then encodes the patch embeddings. Then, the patch embeddings and learnable memory data are fused to obtain local memory features. A multi-head attention mechanism is used to process the patch embedding sequence to obtain a global vector representation. Then, local memory features are integrated. With global vector representation Obtain the final timing representation ; The topology encoder generates a global topology embedding based on network physical topology and traffic data. ; The text encoder, based on a predefined prompt template, inputs descriptive text containing network topology information, traffic statistics features, and task instructions into a frozen large language model to generate text semantic embeddings. ; The fusion and reconstruction module includes: a cross-modal fusion unit and a gated reconstruction unit; The cross-modal fusion unit first fuses the global topology embedding. and text semantic embedding Obtain joint features Then, a multi-head attention mechanism is used to fuse joint features. and final timing representation Then, the attention results are compared with the final temporal representation. The enhanced representation is obtained after fusion and layer normalization. ; The gated reconstruction unit is first based on the final timing representation. and enhancement representation Generate candidate reconstructions respectively and And then and Weighted fusion is performed to obtain the final reconstruction. .

[0008] Preferably, the temporal encoder includes a sequentially connected patch generation module, retrieval module, attention capture module, and feature fusion module; The patch generation module divides the input sequence into overlapping patches. Each patch is linearly projected and then a positional code representing the temporal sequence is added to it to obtain the patch embedding. ; The retrieval module embeds patches in a learnable memory. Perform similarity searches and refine the search results to obtain local memory features. The prototype memory is used to store prototype patches. The attention capture module applies multi-head self-attention along the patch dimension to capture the global temporal context, followed by average pooling to obtain the global vector representation. ; The feature fusion module fuses local memory features. With global vector representation Obtain the final timing representation .

[0009] Preferably, the retrieval module uses a two-layer MLP network to refine the retrieval results.

[0010] Preferably, the topology encoder uses a two-layer graph attention network to process the node feature matrix, which represents the OD flow data in the routing network in matrix form; The first layer graph attention network uses multiple attention heads to process the node feature matrix to obtain the attention weights of each OD flow, then weights and fuses all OD flow data from each router, and then concatenates the processing results of each attention head. The second-layer graph attention network performs weighted fusion of the OD flow data output by the first-layer graph attention network for each router, incorporating learnable attention weights; the feature matrix output by the second-layer graph attention network... Global topology embedding is obtained by flattening and linear projection. .

[0011] Preferably, the first-layer graph attention network first performs weighted fusion of OD flow data at the router dimension, and then performs data splicing at the attention head dimension to obtain the output of the first-layer graph attention network to each router; In the first-layer graph attention network, under the k-th attention head, the router... For routers Attention weights The calculation formula is: ; in, Let be the learnable attention weight vector for the k-th attention head; For the first Learnable feature transformation matrix for each attention head; This represents the concatenation of feature dimensions; LeakyReLU is a non-linear activation function. Indicates routers in a routing network The set of first-order neighbor nodes; , and These represent the corresponding routers in the input sequence X. , and The node feature vectors.

[0012] Preferably, the gated reconstruction unit will represent the final timing sequence. and enhancement representation After flattening, the image is linearly projected back to the same shape as the input sequence through a fully connected layer to obtain candidate reconstructions. and ; Gated reconstruction unit based on candidate reconstruction and Generate a weight vector G, and then... and Weighted fusion is performed to obtain the reconstruction result. Then merge candidate reconstructions and reconstruction results Achieve final reconstruction .

[0013] Preferably, the loss function used in the flow reconstruction model training process for: ; ; in, Let F be the f-th OD flow at time step t in the sample, F be the total number of OD flows on the routing network in the sample, and T be the time window length. for The final reconstruction; denoted as , where b is the loss for training sample b; and B is the batch size for training.

[0014] The present invention proposes a method for detecting network traffic anomalies, comprising the following steps: S1. Collect network traffic data within the diagnostic time window and construct the input sequence. ; The total number of OD flows in the routing network; T is the time window length; S2. Use the trained traffic reconstruction model to process the input sequence. Reconstruction is performed to obtain the reconstruction sequence. '; S3. Calculate the reconstruction error at each time step. ; S4, Judgment Is it less than or equal to a preset threshold? ; If yes, then the network traffic at the corresponding time step is considered normal; If not, then the network traffic at the corresponding time step is judged to be abnormal.

[0015] Preferably, the reconstruction error at time step t This is the mean of the reconstructed squared difference of all OD flows in the routing network at this time step. The reconstructed squared difference is the square of the difference between the reconstructed and original flows.

[0016] The present invention proposes a network traffic anomaly detection system, comprising a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor is used to execute the computer program to implement the network traffic anomaly detection method.

[0017] The advantages of this invention are: (1) Relatively single-modal modeling often produces incomplete representations. This invention fully utilizes the inherent multimodal characteristics of network traffic, including temporal patterns, topological dependencies, and environmental context, to ensure the integrity of routing networks in any complex operating scenario and guarantee anomaly detection performance. This invention achieves a comprehensive characterization of network operating states through the cooperative encoding of three modalities: the temporal encoder captures traffic statistical features, the graph attention network reveals anomaly propagation paths in the routing structure, and the text encoder provides semantic clues about the network environment. The three complement each other, solving the problem of insufficient representational ability of single-modal modeling in complex network scenarios.

[0018] (2) The traffic reconstruction model proposed in this invention adopts a three-modal joint modeling method of temporal-topology-semantic. The temporal encoder extracts local and global traffic patterns, the topology encoder captures the dependencies between routers based on graph attention network, and the text encoder generates semantic representation of the network environment using a large language model, thus overcoming the limitation of existing methods that only rely on temporal patterns.

[0019] (3) This invention introduces a cross-modal attention mechanism and a gated fusion network, enabling temporal features to adaptively fuse topological and semantic context information. When sudden traffic changes occur, the attention mechanism can effectively amplify abnormal signals. Combined with a dynamic reconstruction error threshold, it significantly reduces the false alarm rate and false negative rate, and improves the robustness of anomaly detection.

[0020] (4) The network traffic anomaly detection method proposed in this invention determines whether the network is abnormal based on the accuracy of OD flow reconstruction; it comprehensively considers the interdependence between network topology and OD flow detection; and combined with highly reliable flow reconstruction, it achieves accurate detection of traffic anomalies. Attached Figure Description

[0021] Figure 1 Here is a diagram of the flow reconstruction model structure; Figure 2 This is a diagram illustrating the patch division. Figure 3 This is a template for displaying prompts; Figure 4 This is a flowchart of a network traffic anomaly detection method proposed in this invention; Figure 5 The results of MTAD-Net detection on representative OD streams in the Abilene dataset; Figure 6 The results of RWKV-TS detection on the same OD flow; Figure 7 The results of MTAD-Net detection on representative OD flows in the GÉANT dataset; Figure 8 The results of RWKV-TS detection on the same OD stream. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0023] like Figure 1 As shown, this embodiment proposes a traffic reconstruction model, which aims to reconstruct traffic data of the routing network by fusing three complementary modalities: time-series traffic patterns, routing topology dependencies, and network environment semantics, so as to accurately detect backbone network anomalies based on reconstruction errors.

[0024] The input sequence of the traffic reconstruction model MTAD-Net is the traffic data sequence of the routing network, which can be specifically denoted as the input sequence. It consists of the OD flow data of the routing network at each time step in the time window T. The total number of source-destination (OD) flows in the routing network; T is the length of the time window.

[0025] During the training of the traffic reconstruction model, the input sequences used as learning samples can be processed in batches. In this case, the input sequences of the traffic reconstruction model can be denoted as... ,in This is the training batch size, which is the number of training samples used in a single training batch.

[0026] The traffic reconstruction model MTAD-Net contains three parallel encoder branches and a fusion reconstruction module.

[0027] The three encoder branches are as follows: The timing encoder extracts traffic pattern features to obtain the final timing representation. ; A topology encoder uses graph attention networks to capture dependencies between routers and obtain a global topology embedding. ; The text encoder, based on a frozen large language model, generates a semantic representation of the network environment, denoted as text semantic embedding. .

[0028] The timing encoder processes the input sequence The final timing representation is obtained through processing. .

[0029] The temporal encoder includes a sequentially connected patch generation module, a retrieval module, an attention capture module, and a feature fusion module.

[0030] The patch generation module will take the input sequence Divide into overlapping patches, and linearly project each patch onto... The latent space is dimensional, and positional encoding is added to preserve temporal order, thus obtaining the patch embedding. .

[0031] like Figure 2 As shown, during the patch partitioning process, the length of each patch is... Step size is , Get the number of patches for each stream. .

[0032] The retrieval module has a built-in refined network, and it calls the memory and embeds patches accordingly. Perform a similarity search and find the patch embedding in the memory. Most similar front Each entry serves as memory data; memory bank Stores the prototype patch patterns learned during training. m is the total number of entries in the memory. The memory data (i.e., the stored prototype patches) represents the learnable parameters during model training.

[0033] The retrieval module calls the refining network to process the memory data and embeds the processing results with the patch. Fusion to obtain local memory features .

[0034] The refinement network can be implemented using a two-layer MLP network. Thus, the processing procedure of the retrieval module can be expressed as follows: ; Where M represents the memory bank; This represents memory data, that is, data retrieved from the memory bank. Most similar front One entry.

[0035] Similarity retrieval can be performed using the cosine similarity retrieval method.

[0036] The attention capture module applies multi-head self-attention along the patch dimension to capture the global temporal context, followed by average pooling to obtain the global vector representation. The formula is expressed as: ; in, The total number of patches obtained by dividing a single OD stream. Embed for the i-th patch. Embed for the i-th patch The output result after multi-head self-attention computation.

[0037] The feature fusion module fuses local memory features. With global vector representation Obtain the final timing representation ,Right now ; This indicates element-wise addition.

[0038] The topology encoder generates a global topology embedding based on network physical topology and traffic data. .

[0039] The physical topology of a network is represented by the adjacency matrix of the router network. N represents the number of routers, where 0 indicates no communication connection and 1 indicates a communication connection; that is: ; Let i be a binary number representing the connection relationship between routers i and j. =0 indicates that there is no communication connection between routers i and j. =1 indicates that there is a communication connection between routers i and j.

[0040] Traffic data is represented by an adjacency matrix, which describes the node characteristics of each routing node in relation to traffic. Traffic data represents the traffic sent from each router (as a source router) to all destination routers at each time step. At time step t, the traffic data of the router network can be denoted as... : ; ; in, This represents the OD flow data of router i at time step t. This represents the data flow from router i to router j at time step t.

[0041] Input sequence The corresponding traffic data can be represented as a node feature matrix. .

[0042] The topology encoder uses a two-layer graph attention network to process the node feature matrix; the first layer uses multiple attention heads concatenated together, and the attention coefficient of the k-th attention head is calculated using the following formula: ; in, This indicates that under the k-th attention head, the router... For routers Attention weights; Let be the learnable attention weight vector for the k-th attention head; For the first The learnable feature transformation matrix of each attention head is used to linearly map the features of the input nodes; This represents the concatenation of feature dimensions; LeakyReLU is a linear unit with leakage correction, which is a non-linear activation function. Represents the routers in adjacency matrix A The set of first-order neighbor nodes, that is, satisfying router A set; , and These represent the routers corresponding to the input sequence X. , and The node feature vectors.

[0043] Specifically, Indicates that in the input sequence X, the router As a source node, the node feature vector is formed by splicing traffic destined for all destination routers within a complete time window.

[0044] The first layer output is: , ; The output of the second layer is: , ; in, Represents the routers in adjacency matrix A The set of first-order neighbor nodes, and These represent the topology encoder's input to the router. and router The processing result; ELU represents a non-linear activation function; This indicates that the outputs of each attention head in the first layer are spliced ​​together in terms of dimensions; in practice, the first layer is specifically set with 4 attention heads.

[0045] For routers in a second-layer attention network For routers The attention weights are used to measure the importance of router j's features to router i. V is the feature transformation matrix of the second-layer attention network, used to linearly map the node features output from the first layer.

[0046] Flattened linear projection can obtain global topology embedding. ; Indicates dimensional flattening. This indicates a linear projection.

[0047] The text encoder, based on a predefined prompt template, inputs descriptive text containing network topology information, traffic statistics features, and task instructions into a frozen large language model to generate text semantic embeddings. .like Figure 3 As shown, the prompt template can include sections such as "Node Information", "Route Testing Strategy", "Task Description", and "Traffic Characteristics".

[0048] The fusion and reconstruction module includes a cross-modal fusion unit and a gated reconstruction unit.

[0049] The cross-modal fusion unit embeds the global topology output from the topology encoder. and semantic embedding of text output by the text encoder After concatenation, the data is linearly projected onto a common dimension and then expanded to the final temporal representation output by the timing encoder. With consistent dimensions, joint features are obtained. Common dimension refers to global topology embedding. and text semantic embedding The common feature dimension after alignment.

[0050] Cross-modal fusion units are represented in the final timing sequence. For querying, using combined features For the keys and values, a multi-head attention mechanism is executed, and then the attention result is compared with the final temporal representation. The fusion process is followed by layer normalization to obtain the enhanced representation. .

[0051] The calculation process of the cross-modal fusion unit is expressed by the following formula: ; in, This indicates a multi-head attention mechanism. Representation layer normalization.

[0052] The gated reconstruction unit first adopts a fully connected layer based on and Generate candidate reconstructions and , combined and Generate a fusion weight vector G, and then... and Weighted fusion is performed to obtain the reconstruction result. Further integrate candidate reconstruction based on time-series information and reconstruction results based on multimodal information The final reconstruction was achieved. .

[0053] In this way, by fusing time-series information at different depths multiple times during the reconstruction process, the temporal stability of the final reconstruction is ensured, and the reliability of the reconstruction traffic is guaranteed.

[0054] Specifically, After flattening, the image is linearly projected back to the same shape as the input sequence through a fully connected layer, resulting in a reconstruction result based solely on temporal information. . After flattening, the image is linearly projected back to the same shape as the input sequence through a fully connected layer, resulting in a reconstruction that integrates topological and semantic context. ; ; ; ; in, and These are the corresponding values ​​in the weight vector G. and The weighted components, and For learnable linear networks, This is the activation function.

[0055] The flow reconstruction model is trained using the mean squared error loss function. : ; ; in, Let F be the f-th OD flow at time step t in the sample, and F be the total number of OD flows on the routing network in the sample; for The final reconstruction; denoted as , where b is the loss for training sample b; and B is the batch size for training.

[0056] like Figure 4 As shown, the proposed network traffic anomaly detection method based on multimodal learning, as described in this embodiment, includes the following steps: S1. Collect network traffic data within the diagnostic time window and construct the input sequence. ; The total number of OD flows in the routing network; T is the time window length; S2. Use the trained traffic reconstruction model to process the input sequence. Reconstruction is performed to obtain the reconstruction sequence. '; S3. Calculate reconstruction error .

[0057] Specifically, in this step, all OD streams from the input sequence are calculated time-step by time. The original flow and the flow from the reconstructed sequence The squared error of the reconstructed flow is calculated, and its average value is taken as the reconstruction error for the corresponding time step.

[0058] The calculation process is expressed as follows: ; ; ; in, The raw flow of the f-th OD at time step t. Let F be the reconstruction traffic of the f-th OD flow at time step t, where F is the total number of OD flows in the routing network.

[0059] S4. Determine reconstruction error Is it less than or equal to a preset threshold? ; If yes, then at time step t, the network traffic is normal; If not, then the network traffic is abnormal at time step t.

[0060] The above-mentioned network anomaly detection method will be described and verified in conjunction with specific embodiments below.

[0061] In this embodiment, the prompt template and content of the text encoder are as follows: Figure 3 As shown.

[0062] In this embodiment, two real backbone network datasets, Abilene and GÉANT, are used for testing.

[0063] The Abilene dataset contains 12 core routers, 144 OD flows, and 48,384 time steps; The GÉANT dataset contains 23 routers, 529 OD flows, and 10,752 time steps.

[0064] In this embodiment, the first 10,000 time steps were selected from the Abilene and GÉANT datasets, respectively. The anomaly rates of the selected data in the Abilene and GÉANT datasets were 18.9% and 28.9%, respectively. The selected data from both datasets were divided into training and test sets in an 8:2 ratio.

[0065] In this embodiment, the model is first trained to convergence on the Abilene and GÉANT training sets, respectively, and then the model performance is tested on the corresponding test sets.

[0066] In this embodiment, the proposed traffic reconstruction model MTAD-Net is compared with five existing methods (RWKV-TS, OmniAnomaly, TranAD, MAD-GAN, and GDN). Precision, recall, and F1 score are used as evaluation metrics. The performance comparison results are shown in Table 1.

[0067] Experimental results show that on the Abilene dataset, MTAD-Net achieves an F1 score of 0.9012, surpassing the best baseline RWKV-TS (0.8931); on the GÉANT dataset, MTAD-Net achieves an F1 score of 0.7331, also ranking first. Complete performance comparisons of each method on the Abilene and GÉANT datasets are attached. Figure 4 As shown, the method of the present invention achieves the best or second-best performance in terms of precision, recall and F1 score, verifying the effectiveness of the multimodal fusion strategy.

[0068] Table 1: Experimental Results

[0069] Figures 5 to 8The paper presents a qualitative comparison of anomaly detection results between the MTAD-Net method of the present invention and the control method RWKV-TS on representative OD flows. The comparison shows that MTAD-Net can more accurately capture the moment of anomaly occurrence, with significantly fewer false positives and false negatives than the control method RWKV-TS, especially on the GÉANT dataset where flow fluctuations are severe.

[0070] In this embodiment, ablation experiments were also conducted, and three ablation models were constructed as follows: w / o TopoEncoder: Compared to the MTAD-Net model, the topology encoder has been removed; w / o TextEncoder: Compared to the MTAD-Net model, the text encoder has been removed; w / o Cross-Attention: Compared to the MTAD-Net model, the cross-modal attention mechanism has been removed.

[0071] Table 2 presents the ablation experiment results on the Abilene and GÉANT datasets. On the Abilene dataset, removing the topology encoder decreased the F1 score from 0.9012 to 0.8715 (a decrease of approximately 3.0%), removing the text encoder decreased the F1 score to 0.8699 (a decrease of approximately 3.5%), and removing the cross-modal attention mechanism decreased the F1 score to 0.8742 (a decrease of approximately 3.0%). On the GÉANT dataset, removing the topology encoder decreased the F1 score from 0.7331 to 0.6913 (a decrease of approximately 5.7%), removing the text encoder decreased the F1 score to 0.6965 (a decrease of approximately 5.0%), and removing the cross-modal attention mechanism decreased the F1 score to 0.7023 (a decrease of approximately 4.2%). These results indicate that temporal features, topological dependencies, and semantic context, as well as the cross-modal fusion mechanism, all contribute indispensablely to achieving high-precision anomaly detection, with the topology encoder making the most significant contribution in larger-scale GÉANT networks.

[0072] Table 2: Ablation Experiment Statistics

[0073] Experimental results on the Abilene and GÉANT real-world backbone network datasets demonstrate that the proposed method significantly outperforms existing mainstream methods in metrics such as F1 score. Ablation experiments validate the effectiveness of each modal component. This invention provides a high-precision and robust technical solution for backbone network traffic anomaly detection.

[0074] Of course, those skilled in the art will recognize that the present invention is not limited to the details of the exemplary embodiments described above, but also includes the same or similar structures that can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0075] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

[0076] The technologies, shapes, and structures not described in detail in this invention are all known technologies.

Claims

1. A network traffic reconstruction method based on multimodal learning, characterized in that, First, a traffic reconstruction model is built and trained. Then, the trained traffic reconstruction model is used to reconstruct the time-series traffic data of the routing network. The traffic reconstruction model includes a timing encoder, a topology encoder, a text encoder, and a fusion reconstruction module; The timing encoder divides the input sequence window representing the routing network traffic data into patches, and then encodes the patch embeddings. ; Then, the patch embeddings and learnable memory data are fused to obtain local memory features. A multi-head attention mechanism is used to process the patch embedding sequence to obtain a global vector representation. Then, local memory features are integrated. With global vector representation Obtain the final timing representation ; The topology encoder generates a global topology embedding based on network physical topology and traffic data. ; The text encoder, based on a predefined prompt template, inputs descriptive text containing network topology information, traffic statistics features, and task instructions into a frozen large language model to generate text semantic embeddings. ; The fusion and reconstruction module includes: a cross-modal fusion unit and a gated reconstruction unit; The cross-modal fusion unit first fuses the global topology embedding. and text semantic embedding Obtain joint features Then, a multi-head attention mechanism is used to fuse joint features. and final timing representation Then, the attention results are compared with the final temporal representation. The enhanced representation is obtained after fusion and layer normalization. ; The gated reconstruction unit is first based on the final timing representation. and enhancement representation Generate candidate reconstructions respectively and And then and Weighted fusion is performed to obtain the final reconstruction. .

2. The network traffic reconstruction method based on multimodal learning as described in claim 1, characterized in that, The temporal encoder includes a sequentially connected patch generation module, a retrieval module, an attention capture module, and a feature fusion module; The patch generation module divides the input sequence into overlapping patches. Each patch is linearly projected and then a positional code representing the temporal sequence is added to it to obtain the patch embedding. ; The retrieval module embeds patches in a learnable memory. Perform similarity searches and refine the search results to obtain local memory features. The prototype memory is used to store prototype patches. The attention capture module applies multi-head self-attention along the patch dimension to capture the global temporal context, followed by average pooling to obtain the global vector representation. ; The feature fusion module fuses local memory features. With global vector representation Obtain the final timing representation .

3. The network traffic reconstruction method based on multimodal learning as described in claim 2, characterized in that, The retrieval module uses a two-layer MLP network to refine the retrieval results.

4. The network traffic reconstruction method based on multimodal learning as described in claim 1, characterized in that, The topology encoder uses a two-layer graph attention network to process the node feature matrix, which represents the OD flow data in the routing network in matrix form. The first layer graph attention network uses multiple attention heads to process the node feature matrix to obtain the attention weights of each OD flow, then weights and fuses all OD flow data from each router, and then concatenates the processing results of each attention head. The second-layer graph attention network performs weighted fusion of the OD flow data output by the first-layer graph attention network for each router, incorporating learnable attention weights; the feature matrix output by the second-layer graph attention network... Global topology embedding is obtained by flattening and linear projection. .

5. The network traffic reconstruction method based on multimodal learning as described in claim 4, characterized in that, The first-layer graph attention network first performs weighted fusion of OD flow data at the router level, and then performs data splicing at the attention head level to obtain the output of the first-layer graph attention network to each router. In the first-layer graph attention network, under the k-th attention head, the router... For router attention weights The calculation formula is: in, Let be the learnable attention weight vector for the k-th attention head; For the first Learnable feature transformation matrix for each attention head; This represents the concatenation of feature dimensions; LeakyReLU is a non-linear activation function. Indicates routers in a routing network The set of first-order neighbor nodes; , and These represent the corresponding routers in the input sequence X. , and The node feature vectors.

6. The network traffic reconstruction method based on multimodal learning as described in claim 1, characterized in that, The gated reconstruction unit will ultimately represent the timing. and enhancement representation After flattening, the image is linearly projected back to the same shape as the input sequence through a fully connected layer to obtain candidate reconstructions. and ; Gated reconstruction unit based on candidate reconstruction and Generate a weight vector G, and then... and Weighted fusion is performed to obtain the reconstruction result. Then merge candidate reconstructions and reconstruction results Achieve final reconstruction .

7. The network traffic reconstruction method based on multimodal learning as described in claim 1, characterized in that, Loss function used in the training process of the traffic reconstruction model for: in, Let F be the f-th OD flow at time step t in the sample, F be the total number of OD flows on the routing network in the sample, and T be the time window length. for The final reconstruction; denoted as , where b is the loss for training sample b; and B is the batch size for training.

8. A network traffic anomaly detection method employing the network traffic reconstruction method based on multimodal learning as described in any one of claims 1-7, characterized in that, Includes the following steps: S1. Collect network traffic data within the diagnostic time window and construct the input sequence. ; This represents the total number of OD flows in the routing network. T is the length of the time window; S2. Use the trained traffic reconstruction model to process the input sequence. Reconstruction is performed to obtain the reconstruction sequence. '; S3. Calculate the reconstruction error at each time step. ; S4, Judgment Is it less than or equal to a preset threshold? ; If yes, then the network traffic at the corresponding time step is considered normal; If not, then the network traffic at the corresponding time step is judged to be abnormal.

9. The network traffic anomaly detection method as described in claim 8, characterized in that, Reconstruction error at time step t This is the mean of the reconstructed squared difference of all OD flows in the routing network at this time step. The reconstructed squared difference is the square of the difference between the reconstructed and original flows.

10. A network traffic anomaly detection system, characterized in that, It includes a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor is used to execute the computer program to implement the network traffic anomaly detection method as described in claim 8 or 9.

Images