Hierarchical time series deep anomaly detection method and system for concept drift data stream

Abstract

The present application relates to the technical field of abnormal data detection, in particular to a layered time series deep anomaly detection method and system for concept drift data stream. The method comprises: collecting traffic data in parallel through multi-scale time windows; constructing a layered heterogeneous deep network to extract short-term local features and long-term trend features; dynamically fusing multi-dimensional deviation features based on environmental state; evaluating the abnormal detection result of the target traffic data based on the comprehensive evaluation value; and adaptively adjusting the forgetting factor of each level through an error feedback mechanism to realize the dynamic evolution of the model when concept drift occurs. The present application also discloses a corresponding detection system. The present application effectively enhances the collaborative representation ability of the model for sudden anomalies and hidden attacks, significantly shortens the performance convergence time in a drifting environment, reduces the false positive rate, and greatly improves the sensitivity and global robustness of heterogeneous network traffic detection.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection technology, and in particular to a hierarchical temporal deep anomaly detection method and system for concept drift data streams. Background Technology

[0002] With the increasing complexity of network environments and the explosive growth of data traffic, time-series anomaly detection technology has become a key means of ensuring cyberspace security. Early time-series modeling relied heavily on statistical methods, but in recent years, deep learning models, represented by Long Short-Term Memory (LSTM) networks and Transformers based on self-attention mechanisms, have demonstrated significant advantages in processing network traffic sequences due to their powerful nonlinear fitting capabilities. Existing time-series anomaly detection schemes typically employ single-layer or single-scale neural network structures, extracting traffic features through pre-defined sliding windows and combining them with fixed-parameter memory mechanisms to identify attack behaviors that deviate from the normal baseline.

[0003] However, the existing time-series anomaly detection models still face many technical bottlenecks in practical applications: First, single-layer LSTM or Transformer models often use a single time window step, making it difficult to capture both transient short-term sudden anomalies and slowly evolving long-term trend changes in the same time dimension, resulting in limited multi-scale feature representation capabilities; Second, network traffic is highly non-stationary, and when traffic distribution undergoes conceptual drift, existing models often exhibit problems such as model failure, a surge in false alarm rates, and slow recovery of detection accuracy due to the lack of dynamic perception of environmental states and adaptive parameter update mechanisms, making them unable to effectively cope with the challenges brought about by the rapid evolution of attack methods. Summary of the Invention

[0004] To overcome the above shortcomings, this invention provides a hierarchical temporal deep anomaly detection method and system for concept drift data streams. It aims to achieve multi-scale feature collaborative representation through hierarchical heterogeneous deep networks and hierarchical attention mechanisms, and to improve the model's detection sensitivity and dynamic evolution capability against complex network attacks in concept drift environments by using error feedback to adaptively adjust the forgetting factor.

[0005] In a first aspect, the present invention provides a hierarchical temporal depth anomaly detection method for concept drift data streams, comprising: S1. Collect network traffic data streams and extract multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. S2. Construct a multi-level deep neural network, and combine it with a differentiated initial forgetting factor. Input the feature sequences of different scales into the corresponding bottom-level network and high-level network respectively, and extract short-term local features and long-term trend features respectively. S3. Coordinate the output of multi-dimensional abnormal deviation characteristics of each network layer to characterize the degree of deviation of traffic data from the normal benchmark model; S4. When the deviation is greater than the deviation threshold, a hierarchical attention mechanism is introduced to dynamically allocate the feature weights of each level according to the current network environment status and fuse them to generate a comprehensive evaluation value. The anomaly detection result of the target traffic data is evaluated based on the comprehensive evaluation value. S5. When anomalies are detected in the target traffic data, monitor the prediction errors at each level, and adaptively adjust the forgetting factors at different levels based on error feedback to realize the dynamic evolution of the model when concept drift occurs.

[0006] Preferably, in step S1, the multiple time windows of different scales include a microscopic detection window and a macroscopic observation window; the microscopic detection window uses a first sampling rate (high-frequency sampling rate) to capture the original message sequence within a preset first time period, and the macroscopic observation window uses a second sampling rate (sparse sampling rate) to capture traffic statistics within a preset second time period.

[0007] Preferably, the first duration is shorter than the second duration, and the first sampling rate is greater than the second sampling rate.

[0008] Preferably, in step S2, the bottom-level network and the top-level network are configured with different initial forgetting factors to match the different memory requirements of short-term local features and long-term trend features respectively.

[0009] Preferably, the initial forgetting factor of the lower-level network configuration is smaller than the initial forgetting factor of the higher-level network configuration.

[0010] Preferably, the value range of the underlying forgetting factor configured in the underlying network is, for example, [0.5, 0.8], so that the underlying network has a higher weighting of the current input and can quickly respond to micro-sudden changes in traffic data.

[0011] Preferably, the high-level forgetting factor configured in the high-level network has a value range of, for example, [0.9, 0.995], so that the high-level network has a strong ability to retain historical memory and stably characterize the long-term trend evolution of traffic.

[0012] Preferably, in step S2, the bottom layer network uses a temporal convolutional network or a one-dimensional convolutional neural network with a local receptive field to capture short-term dependencies and local mutation patterns in the message sequence to extract the short-term local features; and / or the top layer network uses a recurrent neural network with a long-term memory mechanism or a Transformer network based on a self-attention mechanism to capture long-range dependencies and global evolution patterns in the traffic statistics sequence to extract the long-term trend features.

[0013] Preferably, in step S4, the step of generating the comprehensive evaluation value includes: Map the short-term local features and the long-term trend features to a feature space of a unified dimension; Calculate the deviation of the volatility index of the current input sequence from its historical distribution, and use it as the context vector for attention allocation; The contribution weights of features at each level are calculated using the Softmax function; The features at each level are multiplied by their corresponding contribution weights and summed to generate the integrated evaluation value.

[0014] Preferably, in step S5, the hierarchical prediction error further includes: The instantaneous prediction bias index is used to calculate the point-to-point deviation between the current observation and the model prediction, in order to capture short-term prediction fluctuations caused by sudden anomalies. The distribution similarity index is used to calculate the distance between the data distribution within the current sliding window and the historical baseline distribution using KL divergence, in order to quantify the degree of structural shift in the data distribution. Statistical stability indices are used to monitor whether the average level of a forecast error series changes significantly and persistently using cumulative sum control charts to identify persistent conceptual drift trends. The instantaneous prediction bias index, distribution similarity index, and statistical stability index are used together to quantify the drift intensity in order to guide the adaptive adjustment of the forgetting factor.

[0015] Preferably, in step S5, the step of adaptively adjusting the forgetting factors at different levels includes: The prediction error sequence of each network level within the current sliding window is obtained in real time, and the statistical evolution variables of the error are calculated. The statistical evolution variables are input into a preset nonlinear mapping function to calculate the drift intensity score corresponding to each level; Based on the drift intensity scores at each level, the initial forgetting factor is adjusted using negative feedback: when the drift intensity score increases, the forgetting factor is reduced by a preset step size. After the prediction error is detected to have returned to the preset stable range, the forgetting factor is adjusted back to the initial setting value.

[0016] Secondly, the present invention provides a hierarchical temporal depth anomaly detection system for concept drift data streams, used to implement the hierarchical temporal depth anomaly detection method described above, the system comprising: The traffic window segmentation module is used to collect network traffic data streams and extract multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. The hierarchical temporal deep modeling module is used to construct multi-level deep neural networks. By combining differentiated initial forgetting factors, feature sequences of different scales are input into the corresponding bottom-level and high-level networks to extract short-term local features and long-term trend features respectively. The anomaly feature output module is used to coordinate the output of multi-dimensional anomaly deviation features from each layer of the network, which are used to characterize the degree of deviation between traffic data and the normal baseline model. The hierarchical attention fusion module is used to introduce a hierarchical attention mechanism when the deviation degree is greater than the deviation threshold. It dynamically allocates the feature weights of each level according to the current network environment state and fuses them to generate a comprehensive evaluation value. Based on the comprehensive evaluation value, it evaluates the anomaly detection result of the target traffic data. The hierarchical adaptive drift update module is used to monitor the prediction error of each level when an anomaly is detected in the target traffic data. Based on the error feedback, it adaptively adjusts the forgetting factor of different levels to realize the dynamic evolution of the model when concept drift occurs, so as to improve the accuracy of subsequent anomaly detection.

[0017] Preferably, in the hierarchical attention fusion module, the step of generating the comprehensive evaluation value includes: Map the short-term local features and the long-term trend features to a feature space of a unified dimension; Calculate the deviation of the volatility index of the current input sequence from its historical distribution, and use it as the context vector for attention allocation; The contribution weights of features at each level are calculated using the Softmax function; The features at each level are multiplied by their corresponding contribution weights and summed to generate the integrated evaluation value.

[0018] Preferably, in the hierarchical adaptive drift update module, the step of adaptively adjusting the forgetting factor at different levels includes: The prediction error sequence of each network level within the current sliding window is obtained in real time, and the statistical evolution variables of the error are calculated. The statistical evolution variables are input into a preset nonlinear mapping function to calculate the drift intensity score corresponding to each level; Based on the drift intensity scores at each level, the initial forgetting factor is adjusted using negative feedback: when the drift intensity score increases, the forgetting factor is reduced by a preset step size. After the prediction error is detected to have returned to the preset stable range, the forgetting factor is adjusted back to the initial setting value.

[0019] In summary, the technical solutions conceived by this invention have the following beneficial effects compared with the prior art: (1) By constructing a heterogeneous hierarchical deep network, this invention achieves parallel characterization of micro-message features and macro-traffic trends, making up for the limitations of traditional single-scale models that are difficult to capture short-term sudden anomalies and long-term trend changes at the same time, and significantly enhancing the feature characterization accuracy of complex multi-scale attacks.

[0020] (2) The present invention introduces a hierarchical attention mechanism, which can dynamically allocate the contribution weights of the bottom and top features in real time according to the fluctuations of the network environment. This realizes the leap from static configuration to environmental perception of feature fusion, effectively improves the decision robustness of the system in extreme fluctuation environments and significantly reduces the false alarm rate.

[0021] (3) This invention utilizes error feedback to adaptively adjust the forgetting factor at different levels, giving the model the ability to evolve dynamically while detecting, shortening the performance convergence time of the model after concept drift occurs, and ensuring the long-term reliability of the security monitoring system when the countermeasures change rapidly. Attached Figure Description

[0022] Figure 1 The flowchart of the hierarchical temporal depth anomaly detection method for concept drift data stream provided in the embodiments of the present invention is as follows: Figure 2 This is a structural diagram of a hierarchical temporal depth anomaly detection system for concept drift data streams provided in an embodiment of the present invention. Detailed Implementation

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Example 1 In a first embodiment of the present invention, the present invention provides a hierarchical temporal depth anomaly detection method and system for concept drift data streams, such as... Figure 1 As shown, it includes the following steps: S1. Collect network traffic data streams and extract multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. Preferably, in step S1, the multiple time windows of different scales include a microscopic detection window and a macroscopic observation window. The microscopic detection window uses a high-frequency sampling rate (first sampling rate) to capture the original message sequence within a preset first duration, and the macroscopic observation window uses a sparse sampling rate (second sampling rate) to capture traffic statistics within a preset second duration. Preferably, the first duration is shorter than the second duration, and the first sampling rate is greater than the second sampling rate.

[0025] Specifically, the micro-window can capture protocol characteristics and transient behavior in network traffic, making it suitable for detecting DDoS flood attacks or malformed packet attacks.

[0026] In a preferred embodiment, the window parameters are set as follows: Time setting: For example, setting the first duration The time ranges from 500ms to 2s.

[0027] Sampling strategy: For example, full data packet sampling is used, that is, all IP packets within the time period are captured without data compression.

[0028] Feature extraction: For example, extracting the five-tuple information of the message, the message length sequence, and the message arrival interval time sequence.

[0029] Data tensor quantization: For example, converting the extracted sequence into a tensor with a dimension of 1. The tensor, in which For a preset fixed length, The number of feature channels must include at least three channels: length, time, and flags.

[0030] The macro window can capture traffic patterns and long-term evolution trends, making it suitable for discovering slow scans or covert channels in APT attacks. Optionally, the window parameters can be set as follows: Time setting: For example, setting a second duration. The time is 10 to 60 minutes.

[0031] Sampling strategy: For example, sparse sampling or NetFlow statistical sampling. Take a snapshot of the traffic at fixed intervals.

[0032] Feature extraction: For example, extracting macroscopic statistical features, including but not limited to traffic density, connection entropy value, and duration.

[0033] Data tensor quantization: For example, converting statistical values ​​into sequences of length 1. The tensor represents the statistical projection of each minute over the past hour.

[0034] To ensure the model can detect both short-term and long-term anomalies simultaneously, the system maintains a unified global clock. At each sliding moment, the microscopic window captures... Detailed features, macro window capture Global features.

[0035] With the above implementation, when traffic surges in a short period of time, the convolutional layer of the micro-window will quickly detect the drastic change in packet length distribution, thereby triggering an early warning within 1 second, while the macro-window is responsible for recording the impact of the attack on the overall network situation.

[0036] S2. Construct a multi-level deep neural network, and combine it with a differentiated initial forgetting factor. Input the feature sequences of different scales into the corresponding bottom-level network and high-level network respectively, and extract short-term local features and long-term trend features respectively.

[0037] Preferably, in step S2, the bottom-level network and the top-level network are configured with differentiated initial forgetting factors to match the different memory requirements of short-term local features and long-term trend features. For example, in a preferred embodiment, a smaller bottom-level forgetting factor is configured for the bottom-level network, preferably in the range of [0.5, 0.8], such as 0.5, 0.6, 0.7, or 0.8, so that the bottom-level network has a higher weighting for the current input and can quickly respond to micro-sudden changes in traffic data. In another preferred embodiment, a larger top-level forgetting factor is configured for the top-level network, preferably in the range of [0.9, 0.995], such as 0.9, 0.91, 0.99, or 0.995, so that the top-level network has a stronger ability to retain historical memory and stably characterize the long-term trend evolution of traffic.

[0038] Specifically, during the model initialization phase, heterogeneous memory weight coefficients are injected into network layers of different depths using a preset parameter script. The bottom-level network refers to the feature extraction layer corresponding to the microscopic short-time window; this layer is configured with a low forgetting factor, for example, a value range of [value range missing]. The forgetting factor; the high-level network refers to the feature extraction layer corresponding to the macroscopic long-term window, which is a situational awareness layer configured with a high forgetting factor, for example, with a value range of [value missing]. The situational awareness layer for the forgetting factor. The specific configuration is as follows: In this embodiment, the underlying forgetting factor The preferred configuration is as follows: Value range: set in In this embodiment, the preferred value is 0.65. This value means that when the underlying network updates the hidden state, the weight of the current input data accounts for as much as 35%-50%. When processing network packet sequences, since attackers may change the payload content in a very short time, a small forgetting factor enables neurons to track the micro-jitter of packet features in real time.

[0039] In this embodiment, the high-level forgetting factor The preferred configuration is as follows: Value range: set in In this embodiment, the preferred value is 0.99. This value means that the higher-layer network reserves only about 0.5%-1% of the update space for the current input, while the remaining weights are locked in historical memory. When processing traffic statistics trends that last for several hours, this high threshold setting establishes an extremely robust baseline for normal business operations. Even if the lower layer detects instantaneous traffic peaks, the higher-layer network can still identify that the overall periodicity has not been disrupted, thus playing a role in balancing the overall situation.

[0040] In this embodiment, through the above implementation method, the system constructs a heterogeneous cognitive architecture that combines fast and slow approaches. The lower layer responds quickly to sudden changes in characteristics, while the upper layer stabilizes the global discrimination benchmark. This not only improves the sensitivity to unknown attacks but also greatly suppresses false alarms triggered by environmental fluctuations, achieving a dual optimization of detection accuracy and stability.

[0041] Preferably, in step S2, the bottom layer network uses a temporal convolutional network or a one-dimensional convolutional neural network with a local receptive field to capture short-term dependencies and local mutation patterns in the message sequence to extract the short-term local features; the top layer network uses a recurrent neural network with a long-term memory mechanism or a Transformer network based on a self-attention mechanism to capture long-range dependencies and global evolution patterns in the traffic statistics sequence to extract the long-term trend features.

[0042] Specifically, in the deep modeling process, the lower and higher layer networks can adopt various heterogeneous model combinations based on the feature complexity of the traffic to be processed and the limitations of computing resources, including but not limited to the following combinations: Convolutional-Recurrent Combination (TCN / CNN+RNN / LSTM): The bottom layer utilizes the parallel extraction capability of temporal convolutional networks to process high-frequency message features, while the top layer uses LSTM to model the long-range temporal dependence of its output. It is suitable for attack blocking scenarios with high real-time requirements.

[0043] Convolutional-attention combination (TCN / CNN+Transformer): The bottom layer extracts local spatial features, while the high layer uses the global self-attention mechanism of Transformer to capture cross-temporal correlations between traffic, which is suitable for tracing and analyzing complex APT attacks.

[0044] In a reasonable combination, the length of the microscopic detection window is set. At each time step, 3D original message features (message length, arrival interval, protocol flags) are extracted to form the input tensor. The underlying network uses a two-layer temporal convolutional network: The first layer of the TCN uses a kernel size of k=3, 64 filters, a dilation coefficient of d=1, a stride of 1, and padding to maintain the sequence length. The output is batch normalized and ReLU activated to obtain the feature map. .

[0045] The second TCN layer has a kernel size of k=3, 64 filters, and an expansion coefficient of d=2 (receptive field enlargement). It also undergoes batch normalization and ReLU activation, and the output... .

[0046] Subsequently, global average pooling (along the channel dimension) is performed on the features at each time step, but to preserve temporal information, this is changed to direct flattening or preserving the sequence; in practice, it can be... It is directly used as the input sequence for subsequent LSTM.

[0047] Macro observation window length (Representing the past 60 minutes), extract 4-dimensional statistical features (traffic density, connection entropy, packet rate, byte rate) per minute to form the input tensor. .

[0048] The high-level network uses two stacked LSTM layers: First LSTM layer: hidden layer dimension 256, returns the complete sequence, output .

[0049] The second LSTM layer has a hidden layer dimension of 256 and only returns the output of the last time step. .

[0050] This vector represents the long-term trend characteristic. .

[0051] In the entire combination, the bottom-level TCN quickly captures the short-term dependencies of the message sequence through local convolution, while the high-level LSTM performs long-range modeling on the local feature sequences output by the bottom layer to extract the evolution trend within the entire macro window.

[0052] It should be noted that, regardless of the combination, the bottom-level networks focus on extracting instantaneous local features of the sequence, while the top-level networks focus on extracting the long-term evolution trend of the traffic. The layers are cascaded through hidden states or feature vectors. This embodiment does not impose a unique limitation on the specific algorithm selection for the bottom and top-level networks; any network combination that conforms to the aforementioned hierarchical extraction logic is within the scope of protection of this application.

[0053] This embodiment utilizes the above-described implementation method to leverage the feature extraction advantages of different models through heterogeneous network combinations, taking into account both local detail recognition and global situational awareness. While ensuring architectural flexibility, it achieves accurate characterization of multi-dimensional network attack behaviors.

[0054] S3, coordinates the output of multi-dimensional abnormal deviation characteristics of each network layer, and is used to characterize the degree of deviation of traffic data from the normal benchmark model.

[0055] Specifically, the system first constructs and maintains a normal baseline model. This baseline model is obtained by training on historical normal traffic data or by establishing it through unsupervised learning in the early stages of system operation, and is updated online as the environment changes. The baseline model consists of two parts: a low-level normal pattern baseline (such as packet length distribution and arrival interval statistics) and a high-level normal trend baseline (such as traffic density, long-term mean and covariance matrix of connection entropy).

[0056] In this embodiment, during the real-time detection phase, the underlying network receives the micro-window message sequence and outputs a hidden state feature sequence after multiple convolutional operations. To extract instantaneous deviation features, the system employs a residual calculation method. Specifically, the hidden state output by the underlying network is input into a prediction layer to reconstruct the message features at the current moment or predict the expected value at the next moment, thus obtaining a prediction result. Then, the difference between the actually observed message features and the prediction result is calculated, and the sequence of difference values ​​is statistically aggregated to obtain a quantized instantaneous deviation value. This deviation value reflects sudden disturbances at the message level, such as an abnormal surge in packet size or a drastic change in arrival interval.

[0057] Similarly, the high-level network receives macroscopic statistical sequences, processes them through recurrent networks or attention mechanisms, and outputs the final hidden states. The system also extracts trend deviation features using residuals, specifically: Preferably, the hidden state of the high-level network is input into the decoding layer to predict the next macroscopic statistical value. The difference between the predicted value and the actual observed value is calculated, and the results are aggregated to obtain a trend deviation value. This value reflects anomalies at the macroscopic traffic statistics level, such as an abnormal increase in overall traffic density or a sudden change in connection entropy.

[0058] Ultimately, the system combines the low-level and high-level deviations into a multi-dimensional anomaly deviation vector. This vector contains deviation information at both the micro-level message features and the macro-level statistical features levels, comprehensively reflecting the overall degree of deviation between the current traffic data and the normal baseline model, providing input features for subsequent hierarchical attention fusion. Through the above implementation, a multi-dimensional evaluation system is constructed using the deviation features of the hierarchical output, which can accurately quantify traffic anomalies and reveal potential attack intentions, significantly enhancing the system's ability to identify complex masquerading attacks.

[0059] S4. When the deviation is greater than the deviation threshold, a hierarchical attention mechanism is introduced to dynamically allocate the feature weights of each level according to the current network environment status and fuse them to generate a comprehensive evaluation value. The anomaly detection result of the target traffic data is evaluated based on the comprehensive evaluation value. Preferably, in step S4, the step of generating the comprehensive evaluation value includes: Map the short-term local features and the long-term trend features to a feature space of a unified dimension; Calculate the deviation of the volatility index of the current input sequence from its historical distribution, and use it as the context vector for attention allocation; The contribution weights of features at each level are calculated using the Softmax function; The features at each level are multiplied by their corresponding contribution weights and summed to generate the integrated evaluation value.

[0060] Specifically, when the deviation in S3 exceeds the deviation threshold, it is considered suspicious data traffic. This is achieved through a hierarchical attention mechanism to focus on low-level local features. High-level trend characteristics The integration process is as follows: Since the feature dimensions output by the lower and higher layers of the network may be inconsistent, the system first uses a set of learnable linear transformation matrices. and This process maps heterogeneous features to a feature space of uniform dimension. This step ensures that signals from different levels are mathematically comparable during subsequent weighted calculations.

[0061] The system monitors network traffic status in real time, calculating volatility and distribution deviation. Volatility is used to calculate the second moment of packet size or arrival interval within the current time window, quantifying traffic instability. Distribution deviation is used to calculate the cosine similarity between the current characteristic distribution and a long-term normal baseline distribution. These metrics are concatenated into a context vector, serving as the basis for attention allocation decisions.

[0062] The context vector is input into a two-layer fully connected network, and the softmax function outputs two weights. and And satisfy When a surge in traffic fluctuations is detected, such as in the early stages of a DDoS attack, the system automatically increases [the amount of traffic]. This allows the model to focus on microscopic, instantaneous changes; when network traffic is stable but its distribution shifts slowly, such as in stealth infiltration, the system is adjusted accordingly. The determination relies on a high-level, long-range benchmark. The final fusion characteristics... This fusion feature not only preserves the detailed information of the original traffic, but also incorporates adaptively adjusted weights based on environmental awareness, significantly enhancing the accuracy of subsequent classifiers in identifying various complex attacks.

[0063] Through the above implementation, the system utilizes the dynamic guidance of environmental conditions to identify key features, achieving differentiated fusion of sudden changes and hidden shifts. This significantly enhances the accuracy of feature representation and the flexibility of detection decisions in complex and ever-changing adversarial scenarios.

[0064] S5. When an anomaly is detected in the target traffic data, monitor the prediction error at each level, and adaptively adjust the forgetting factor at different levels based on the error feedback to realize the dynamic evolution of the model when concept drift occurs, so as to improve the accuracy of subsequent anomaly detection.

[0065] Preferably, in step S5, the hierarchical prediction error further includes: The instantaneous prediction bias index is used to calculate the point-to-point deviation between the current observation and the model prediction, in order to capture short-term prediction fluctuations caused by sudden anomalies. The distribution similarity index is used to calculate the distance between the data distribution within the current sliding window and the historical baseline distribution using KL divergence, in order to quantify the degree of structural shift in the data distribution. Statistical stability indices are used to monitor whether the average level of a forecast error series changes significantly and persistently using cumulative sum control charts to identify persistent conceptual drift trends. The instantaneous prediction bias index, distribution similarity index, and statistical stability index are used together to quantify the drift intensity in order to guide the adaptive adjustment of the forgetting factor.

[0066] Specifically, at each time step, the system calculates the Euclidean distance between the predicted tensor output by the model and the actual collected flow tensor. This instantaneous prediction bias metric can capture sudden anomalies in message length or arrival intervals. For example, during a DDoS flood attack, this bias value will show a pulse-like surge, providing the system with an immediate early warning signal.

[0067] The system maintains two feature windows, one representing the historical baseline distribution over a longer period (e.g., 24 hours). Another representation of the real-time data distribution within the current observation window. By calculating the KL divergence between the two... This metric quantifies the structural shift in traffic behavior across the probability space. It effectively identifies covert channels or protocol spoofing attacks where the numerical values ​​are within the normal range, but the underlying behavioral logic has been altered.

[0068] To prevent single-point noise from misleading the model, the system introduces a Cumulative Sum Control Chart (CUSUM) to perform sequence analysis of prediction errors over a period of time. CUSUM determines whether this deviation is statistically significant and persistent by accumulating the deviation between the current error and the historical mean. Only when the cumulative deviation exceeds a set confidence threshold will the system determine that a genuine concept drift has occurred, rather than random network fluctuations.

[0069] The above indicators can be used to calculate hierarchical prediction error through weighted combination, or they can be evaluated independently based on a single indicator. One possible combination method is as follows: ; in, To account for the overall prediction error, The normalized instantaneous prediction bias index A normalized distribution similarity index, As a normalized statistical stability indicator, , and These are the corresponding weights. In another simplified implementation, the system can take the maximum value among the three indicators as the prediction error.

[0070] Through the above implementation method, the system constructs a multi-dimensional monitoring network from single-point disturbance to distributed offset. By coordinating indicators, it accurately distinguishes between instantaneous noise and trend evolution, significantly improving the reliability of drift judgment and providing a scientific decision-making basis for the dynamic updating of the model.

[0071] Preferably, in step S5, the step of adaptively adjusting the forgetting factors at different levels includes: The prediction error sequence of each network level within the current sliding window is obtained in real time, and the statistical evolution variables of the error are calculated. The statistical evolution variables are input into a preset nonlinear mapping function to calculate the drift intensity score corresponding to each level; Based on the drift intensity scores at each level, the initial forgetting factor is adjusted using negative feedback: when the drift intensity score increases, the forgetting factor is reduced by a preset step size. After the prediction error is detected to have returned to the preset stable range, the forgetting factor is adjusted back to the initial setting value.

[0072] Specifically, when anomalies are detected in suspicious traffic data in S4, the system collects the residual between the predicted probability output by the network and the actual traffic label at the end of each sliding window. By calculating the mean offset and dispersion of this error sequence, the original characteristics of the quantization drift are formed.

[0073] The calculated statistical evolution variables are input into a nonlinear mapping function, such as the sigmoid function, to output the drift intensity score for each level. This score reflects the degree of change in the current network environment relative to the model's existing knowledge; the closer the score is to 1, the more severe the concept drift.

[0074] The system is based on the score Initial forgetting factor To perform dynamic reduction, the formula is: ; in, To adjust the gain. For example, when an attacker changes their traffic masquerading method, causing the prediction error to spike, the system quickly reduces... This significantly reduces the weight of historical states, forcing the model to absorb new attack features more readily when updating weights, thus enabling it to quickly forget old patterns and accelerate the learning of new attack patterns.

[0075] The system continuously monitors the error curve. Once the error decreases and stabilizes within a preset stable range, such as when the error fluctuation is less than 5% for three consecutive windows, the model is considered to have completed learning the new distribution. At this point, the system gradually increases the gain in a step-by-step manner. The model is restored to its initial high stability value to prevent excessive oscillations during the plateau period and to return to the steady-state monitoring mode.

[0076] Through the above implementation, the system uses error feedback to quantify drift intensity and dynamically correct memory ratio, realizing on-demand reshaping of model cognition. While effectively responding to the rapid iteration of attack methods, it ensures the long-term reliability of the model in a steady-state environment.

[0077] Example 2 This invention also provides a hierarchical temporal deep anomaly detection system for concept drift data streams, the system structure diagram of which is shown below. Figure 2 As shown, it includes: The traffic window segmentation module is used to collect network traffic data streams and extract multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. The hierarchical temporal deep modeling module is used to construct multi-level deep neural networks. By combining differentiated initial forgetting factors, feature sequences of different scales are input into the corresponding bottom-level and high-level networks to extract short-term local features and long-term trend features respectively. The anomaly feature output module is used to coordinate the output of multi-dimensional anomaly deviation features from each layer of the network, which are used to characterize the degree of deviation between traffic data and the normal baseline model. The hierarchical attention fusion module is used to introduce a hierarchical attention mechanism when the deviation degree is greater than the deviation threshold. It dynamically allocates the feature weights of each level according to the current network environment state and fuses them to generate a comprehensive evaluation value. Based on the comprehensive evaluation value, it evaluates the anomaly detection result of the target traffic data. The hierarchical adaptive drift update module is used to monitor the prediction error of each level when an anomaly is detected in the target traffic data. Based on the error feedback, it adaptively adjusts the forgetting factor of different levels to realize the dynamic evolution of the model when concept drift occurs, so as to improve the accuracy of subsequent anomaly detection.

[0078] This embodiment deploys the system on the core switch side of a large enterprise data center. This scenario faces two typical threats: one is a sudden, explosive UDP flood attack, and the other is a slow, weeks-long APT infiltration and probing attack. In a preferred embodiment, the specific implementation process of the system is as follows: The traffic window segmentation module simultaneously opens a 1-second micro-detection window and a 30-minute macro-observation window. When subjected to a sudden DDoS attack, the micro-window, due to its high-frequency sampling, can completely record the drastic sequence of packet lengths, ranging from 64 bytes to 1500 bytes; while the macro-window, through sparse sampling, continuously monitors the statistical deviation of the server's inbound traffic from its historical average.

[0079] The hierarchical temporal deep modeling module inputs microscopic sequences into the underlying TCN network, leveraging its causal convolutional properties to quickly capture instantaneous attack fingerprints. Simultaneously, macroscopic statistical data is input into the higher-level Transformer network. The system is configured with the underlying layer... The initial forgetting factor enables it to lock onto attacks within seconds; it is configured for high-level... The initial forgetting factor ensures that the micro-scanning behavior, which occurs once every hour, can still be accurately identified even amidst background noise fluctuations.

[0080] During system operation, the hierarchical attention fusion module calculates traffic fluctuation rate in real time. When a DDoS attack causes a surge in traffic variance, the hierarchical attention mechanism detects environmental instability and automatically increases the weight of the underlying features from 0.5 to 0.85. At this point, the overall evaluation value output by the system is mainly driven by micro-features, triggering a high-level alarm within 800ms of the attack occurring.

[0081] Subsequently, the attacker changed the attack payload, causing an increase in model prediction error. The hierarchical adaptive drift update module detected this distribution shift through KL divergence and triggered negative feedback adjustment. The system automatically further reduced the bottom-level forgetting factor from 0.6 to 0.3 for that period, forcing the bottom-level network to quickly clear outdated memories and complete the learning of the new attack payload within three windows, thus restoring detection accuracy.

[0082] By employing the aforementioned hierarchical attention fusion and hierarchical adaptive drift update mechanism, this system demonstrates a significant performance improvement compared to traditional static single-scale detection methods, as shown in Table 1. The table reveals that by adopting the hierarchical attention fusion and hierarchical adaptive drift update mechanism, this system exhibits a significant performance improvement over traditional static single-scale methods: In sudden attack scenarios, the instantaneous weight allocation of the attention mechanism compresses the response latency from 3.5s to 0.8s, increasing the speed by approximately 75%; for covert, slow penetration attacks, heterogeneous modeling achieves a high detection rate of 91%, superior to the 72% of traditional models; and when facing concept drift, the dynamic evolution of the forgetting factor triggered by error feedback shortens the accuracy recovery time from 120min to 15min, demonstrating significant convergence performance, while simultaneously reducing the false alarm rate from 12% to 1.5%, achieving a dual leap in detection sensitivity and global robustness.

[0083] Table 1. Performance comparison of this application with traditional single-scale models.

[0084] Through the above implementation methods, the system achieves collaborative representation of multi-scale attack behaviors; with the hierarchical attention fusion mechanism, the system's decision robustness in extreme fluctuation environments is significantly enhanced; and the hierarchical adaptive drift update mechanism gives the model the ability to evolve while detecting, completely solving the pain point that traditional models are prone to failure when facing rapid changes in attack methods, and ensuring the continuity and high reliability of security protection work.

[0085] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A hierarchical temporal deep anomaly detection method for concept-drift data streams, characterized in that, include: S1 collects network traffic data streams and extracts multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. S2 constructs a multi-level deep neural network, and combines a differentiated initial forgetting factor to input feature sequences of different scales into the corresponding bottom-level network and high-level network respectively, extracting short-term local features and long-term trend features respectively; wherein, the bottom-level network is a feature extraction layer network, and the high-level network is a situational awareness layer network. S3 coordinates with each layer of the network to output multi-dimensional abnormal deviation characteristics, which are used to characterize the degree of deviation between traffic data and the normal benchmark model; S4 When the deviation exceeds the deviation threshold, dynamically allocate and fuse the feature weights of each level according to the current network environment status to generate a comprehensive evaluation value, and evaluate the anomaly detection result of the target traffic data based on the comprehensive evaluation value. S5. When anomalies are detected in the target traffic data, monitor the prediction errors at each level, and adaptively adjust the forgetting factors at different levels based on error feedback to realize the dynamic evolution of the model when concept drift occurs.

2. The hierarchical temporal deep anomaly detection method for concept-drift data streams according to claim 1, wherein, In step S1, the multiple time windows of different scales include a micro-detection window and a macro-observation window. The micro-detection window uses a first sampling rate to capture the original message sequence within a preset first duration, and the macro-observation window uses a second sampling rate to capture traffic statistics within a preset second duration.

3. The hierarchical temporal deep anomaly detection method for concept-drift data streams according to claim 2, wherein, The first duration is shorter than the second duration.

4. The layered temporal deep anomaly detection method for concept-drift data streams according to claim 1, wherein, In step S2, the bottom-level network and the top-level network are configured with different initial forgetting factors to match the different memory requirements of short-term local features and long-term trend features.

5. The hierarchical temporal depth anomaly detection method for concept-drift data streams according to claim 1, characterized in that, The initial forgetting factor of the lower-level network configuration is smaller than the initial forgetting factor of the higher-level network configuration.

6. The hierarchical temporal depth anomaly detection method for concept-drift data streams according to claim 1, characterized in that, In step S2, the underlying network uses a temporal convolutional network or a one-dimensional convolutional neural network to capture short-term temporal dependencies and local mutation patterns in the message sequence in order to extract the short-term local features; and / or The high-level network employs a recurrent neural network with a long-term memory mechanism or a Transformer network based on a self-attention mechanism to capture long-range dependencies and global evolution patterns in the traffic statistics sequence, thereby extracting the long-term trend features.

7. The hierarchical temporal depth anomaly detection method for concept-drift data streams according to claim 1, characterized in that, In step S4, the steps for generating the comprehensive evaluation value include: Map the short-term local features and the long-term trend features to a feature space of a unified dimension; Calculate the deviation of the volatility index of the current input sequence from its historical distribution, and use it as the context vector for attention allocation; The contribution weights of features at each level are calculated using the Softmax function; Multiply each level of feature by its corresponding contribution weight and sum them to generate the integrated evaluation value.

8. The hierarchical temporal depth anomaly detection method for concept-drift data streams according to claim 1, characterized in that, In step S5, the hierarchical prediction error includes: The instantaneous prediction bias index is used to calculate the point-to-point deviation between the current observation and the model prediction. Distribution similarity index is used to calculate the distance between the data distribution within the current sliding window and the historical baseline distribution, in order to quantify the degree of structural shift in the data distribution; and Statistical stability indices are used to monitor whether the average level of a forecast error series changes significantly and persistently using cumulative sum control charts.

9. The hierarchical temporal depth anomaly detection method for concept-drift data streams according to claim 1, characterized in that, In step S5, the steps of adaptively adjusting the forgetting factors at different levels include: The prediction error sequence of each network level within the current sliding window is obtained in real time, and the statistical evolution variables of the error are calculated. The statistical evolution variables are input into a preset nonlinear mapping function to calculate the drift intensity score corresponding to each level; Based on the drift intensity scores at each level, the initial forgetting factor is adjusted using negative feedback. When the drift intensity score increases, the forgetting factor is reduced by a preset step size. After the prediction error is detected to have returned to the preset stable range, the forgetting factor is adjusted back to the initial setting value.

10. A hierarchical temporal deep anomaly detection system for concept-drift data streams, characterized in that, The system includes: The traffic window segmentation module is used to collect network traffic data streams and extract multi-scale feature sequences corresponding to sudden anomalies and slow-changing anomalies using multiple preset time windows of different scales. The hierarchical temporal deep modeling module is used to construct a multi-level deep neural network. By combining a differentiated initial forgetting factor, feature sequences of different scales are input into the corresponding bottom-level network and high-level network respectively to extract short-term local features and long-term trend features. The bottom-level network is a feature extraction layer network and the high-level network is a situational awareness layer network. The anomaly feature output module is used to coordinate the output of multi-dimensional anomaly deviation features from each layer of the network, which are used to characterize the degree of deviation between traffic data and the normal baseline model. The hierarchical attention fusion module is used to introduce a hierarchical attention mechanism when the deviation degree is greater than the deviation threshold. It dynamically allocates the feature weights of each level according to the current network environment state and fuses them to generate a comprehensive evaluation value. Based on the comprehensive evaluation value, it evaluates the anomaly detection result of the target traffic data. as well as The hierarchical adaptive drift update module is used to monitor the prediction error of each level when an anomaly is detected in the target traffic data. Based on the error feedback, it adaptively adjusts the forgetting factor of different levels to realize the dynamic evolution of the model when concept drift occurs.

Images