Network traffic prediction and anomaly detection method based on LSTM-ATT

Abstract

The application discloses a network traffic prediction and anomaly detection method based on LSTM-ATT, and belongs to the technical field of network traffic prediction and anomaly detection, and the method comprises the following steps: S1, collecting a green algorithm data set, and after feature extraction, preprocessing and data set division, establishing a training set, a verification set and a test set; S2, training the LSTM-ATT model according to the training set, the verification set and the test set, and obtaining an optimal network traffic detection model; S3, inputting a to-be-detected data set into the optimal network traffic detection model, and outputting a traffic prediction value and an anomaly classification result. Experimental results show that the model traffic prediction MAE is as low as 3.7%, the large flow detection accuracy is 94.2%, the burst detection accuracy is 92.5%, the reasoning delay is only 6.7 mu s, the comprehensive performance is significantly better than that of a baseline model, and the problems that a traditional model is difficult to balance prediction and multi-class anomaly detection and is low in calculation efficiency are solved.

Description

Technical Field

[0001] This invention belongs to the field of network traffic prediction and anomaly detection technology, specifically relating to a network traffic prediction and anomaly detection method based on LSTM-ATT. Background Technology

[0002] With the rapid development of 5G, cloud computing, and IoT technologies, network traffic is experiencing explosive growth, and its characteristics are becoming increasingly complex. Besides sudden traffic spikes caused by network attacks and equipment failures, large flows resulting from scenarios such as large file transfers and distributed computing are frequently occurring, and these two types together constitute the main types of network anomalies. Large flows are characterized by "long duration and high bandwidth consumption," easily leading to link congestion and resource overload, forming a complementary anomaly pattern to the "large instantaneous increase" characteristic of sudden traffic spikes. Accurate traffic prediction, real-time burst detection, and large flow detection can provide comprehensive decision support for dynamic allocation of network resources, congestion control, and security early warning, and are key technological supports for intelligent network management.

[0003] With the deployment requirements of green computing power and edge computing, traditional complex models face the challenge of balancing computational efficiency and accuracy. Detection methods based on empirical rules have poor adaptability, and a single deep learning model struggles to simultaneously optimize prediction and multiple detection tasks. There is an urgent need to design lightweight, multi-objective optimization intelligent models that are suitable for application scenarios involving real-world network traffic datasets such as those using green computing power.

[0004] In the field of time series forecasting, LSTM, with its gated structure, effectively solves the gradient vanishing problem and has become the mainstream method for traffic time series modeling. However, a single LSTM is difficult to automatically focus on critical time steps of anomalies, and its ability to distinguish between large flows and bursts of traffic is limited. Attention mechanisms can dynamically allocate feature weights, but traditional attention ignores temporal location information and cannot fully capture the "persistent and long-term dependent" characteristics of large flows. Existing research still has the following shortcomings: most methods only target a single anomaly type and lack joint detection of both bursts and large flows; the criteria for determining large flows are vague, and there is a lack of quantitative standards adapted to real datasets; complex models have high computational costs, and it is difficult to balance lightweight design with high accuracy. Summary of the Invention

[0005] To address the aforementioned shortcomings in existing technologies, the LSTM-ATT-based network traffic prediction and anomaly detection method provided by this invention solves the problems of traditional models struggling to balance prediction and detection of multiple anomalies, as well as low computational efficiency.

[0006] To achieve the above-mentioned objectives, the technical solution adopted by this invention is: a network traffic prediction and anomaly detection method based on LSTM-ATT, comprising the following steps:

[0007] S1. Collect the Green Computing dataset, and after feature extraction, preprocessing and dataset partitioning, establish training set, validation set and test set;

[0008] S2. Input the training set into the LSTM-ATT model. During the training process, the hyperparameters of the model are tuned based on the validation set, and the target detection model is tested based on the test set to obtain the optimal network traffic detection model.

[0009] S3. Input the dataset to be detected into the optimal network traffic detection model, and output the traffic prediction value and anomaly classification result.

[0010] Furthermore: In S1, the features generated by the feature extraction method include:

[0011] Original characteristics, including traffic share and node load;

[0012] Sudden-related characteristics, including sudden slope and load overload;

[0013] Large-scale flow-related characteristics include flow maintenance and cumulative increase;

[0014] Preprocessing methods include:

[0015] Sequence slicing: The input sequence is constructed using the sliding window method, with the window size set to 5;

[0016] Normalization: Min-Max normalization maps the eigenvalues ​​to the range [0,1].

[0017] The specific method for dividing the dataset is as follows: the dataset is divided into training set, validation set and test set in a 7:1.5:1.5 ratio.

[0018] Furthermore: In S2, the LSTM-ATT model consists of a lightweight LSTM encoder, a position-biased attention layer, and a multi-task output layer connected in sequence. The specific workflow of the LSTM-ATT model is as follows:

[0019] A1. Input the input dataset into the lightweight LSTM encoder, extract temporal features through the lightweight LSTM encoder, and generate hidden states;

[0020] A2. The hidden state input position is biased to the attention layer, and the hidden state is weighted and fused.

[0021] A3. The fused feature input multi-task output layer outputs traffic prediction values ​​and anomaly classification results.

[0022] Furthermore: In A1, the lightweight LSTM encoder adopts a unidirectional single-layer LSTM structure, adding only one Dropout layer after the LSTM output; the input of the lightweight LSTM encoder is a 5×6-dimensional temporal feature sequence, and the output is a 5×64-dimensional hidden state matrix.

[0023] Furthermore, in A2, the position-biased attention layer introduces sine and cosine positional encoding, which is added to the hidden state to obtain an enhanced feature sequence that fuses temporal positional information.

[0024]

[0025]

[0026] In the formula, For even-numbered dimension position encoding values, For odd-numbered dimension position encoding values, For time step position, For feature dimension, For the hidden layer dimension, ;

[0027] The position-biased attention layer employs a position-biased enhanced single-head attention mechanism, the specific workflow of which is as follows:

[0028] The enhanced feature sequence with fused temporal location information is input into the location-biased attention layer to generate a query matrix, a key matrix, and a value matrix. Single-head attention is used to calculate the attention score of the enhanced feature sequence. The attention score is normalized by Softmax to obtain the normalized attention weight matrix. A trainable location bias matrix is ​​introduced to correct the attention weight distribution. The value matrix is ​​weighted and summed according to the normalized attention weight matrix to obtain the output of the single-head attention, which is used as the fused feature output of the location-biased attention layer.

[0029] Specifically, the weights are adjusted using a trainable position bias matrix, the attention score of the input sequence is calculated, and thus the output of the single-head attention is obtained. Adapt to traffic timing characteristics;

[0030]

[0031] In the formula, For querying the matrix, The key matrix, For value matrices, It is the transpose symbol. for Matrix dimension This is the trainable position bias matrix.

[0032] Furthermore: In A3, the multi-task output layer includes a traffic prediction branch and an anomaly classification branch;

[0033] In the traffic prediction branch, the fully connected layer uses a linear activation function to output continuous traffic percentage prediction values;

[0034] In the anomaly classification branch, the fully connected layer uses the Softmax activation function to output the three classification probabilities;

[0035] Multi-task output layer sets weighted hybrid loss function Used to balance regression and classification tasks:

[0036]

[0037] In the formula, This is the mean squared error loss for traffic flow forecasting. For three-class cross-entropy loss, These are the weighting coefficients;

[0038]

[0039]

[0040] In the formula, Let i be the actual traffic percentage of the i-th sample. The model predicts the proportion of traffic for the i-th sample. This represents the total number of samples in the current batch. Let be the true label of the i-th sample in the k-th class. In a three-class classification scenario, the true label is 1 for the normal / sudden / major class and 0 for the rest. The model predicts the probability of the i-th sample in the k-th class.

[0041] Furthermore: In S2, the specific training configuration for the LSTM-ATT model is as follows:

[0042] Optimizer: AdamW optimizer, learning rate 5e-4, weight decay 5e-5;

[0043] Batch size: 32, balancing gradient stability and training efficiency;

[0044] Early stop mechanism: Patience value 10, training stops if the loss on the validation set does not decrease for 10 consecutive rounds;

[0045] Maximum number of training rounds: 100, actual number of training rounds: approximately 50.

[0046] Furthermore: In S3, the anomaly classification results include large flow rates, burst flow rates, and normal flow rates;

[0047] Large flow is defined as: the cumulative increase of the flow percentage over three consecutive time steps is greater than or equal to 60%, and the final flow percentage is greater than or equal to 60%; burst flow is defined as: the increase of the flow percentage within a single time step exceeds 50%, and does not meet the criteria for large flow; normal flow is flow that does not meet the criteria for large flow or burst flow.

[0048] The beneficial effects of this invention are as follows:

[0049] (1) This invention provides a network traffic prediction and anomaly detection method based on LSTM-ATT. Addressing the problems of traditional models struggling to balance prediction and multi-class anomaly detection, and low computational efficiency, this invention constructs explicit large-flow determination rules, designs a lightweight LSTM encoder, and achieves collaborative optimization of prediction and detection through position-biased attention and multi-task loss functions. Compared with existing methods, its improvements are: 1) Lightweight temporal encoding: Adopting a single-layer unidirectional LSTM structure, significantly reducing computational load while maintaining temporal modeling capabilities. 2) Position-biased attention layer: Introducing learnable position biases to enhance the perception of long-term continuous anomalies. 3) Multi-task hybrid loss: Jointly optimizing regression prediction and three-class classification detection to simultaneously improve accuracy and generalization. 4) Standardized large-flow determination: Proposing a two-dimensional quantization rule to make large-flow detection more interpretable and operable.

[0050] (2) Experimental results show that the model's traffic prediction MAE is as low as 3.7%, the large flow detection accuracy reaches 94.2%, the burst detection accuracy reaches 92.5%, and the inference latency is only 6.7μs. Its overall performance is significantly better than baseline models such as Transformer and PhaseFormer. Ablation experiments verified the effectiveness of the location bias and hybrid loss function, which brought performance improvements of 8.3% and 10.1% respectively to large flow detection. This model provides an efficient and accurate solution for intelligent network traffic analysis and has significant application value in scenarios such as green computing and edge computing. Its lightweight design concept can also be extended to other time-series prediction and anomaly detection fields. Attached Figure Description

[0051] Figure 1 This is a flowchart of the network traffic prediction and anomaly detection method based on LSTM-ATT of the present invention.

[0052] Figure 2 This is a schematic diagram of the LTM-ATT model of the present invention.

[0053] Figure 3 This is a flow time series curve and a large flow labeling diagram.

[0054] Figure 4 This is a comparison chart of detection accuracy under different flow rates.

[0055] Figure 5 This is a comparison chart of F1 scores for high-flow detection. Detailed Implementation

[0056] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0057] Example 1:

[0058] like Figure 1 As shown, in one embodiment of the present invention, the network traffic prediction and anomaly detection method based on LSTM-ATT includes the following steps:

[0059] S1. Collect the Green Computing dataset, and after feature extraction, preprocessing and dataset partitioning, establish training set, validation set and test set;

[0060] S2. Input the training set into the LSTM-ATT model. During the training process, the hyperparameters of the model are tuned based on the validation set, and the target detection model is tested based on the test set to obtain the optimal network traffic detection model.

[0061] S3. Input the dataset to be detected into the optimal network traffic detection model, and output the traffic prediction value and anomaly classification result.

[0062] In S1, this invention selects the Green Computing Dataset, which is collected from the server cluster task scheduling system of the Green Computing Power Scheduling Platform. It contains 27,804 valid task records, including real-time traffic data of core network links, and covers continuous operation data of multiple servers on the Green Computing Platform. It comprehensively records the task submission, resource allocation, and operational status information of the Green Computing servers in actual business scenarios, serving as a real-world business dataset for validating traffic prediction and anomaly detection models. The dataset covers normal traffic fluctuations, sudden traffic spikes, and high-flow scenarios, possessing the temporal characteristics and anomaly patterns of real network traffic.

[0063] This embodiment also defines a two-dimensional large flow determination rule based on actual network engineering scenarios (meeting either condition is considered a large flow):

[0064] This embodiment, based on a real-world network engineering scenario, clearly defines different traffic patterns:

[0065] High-volume flow is defined as a cumulative increase of more than or equal to 60% in the proportion of flow over three consecutive time steps, with the final flow proportion being more than or equal to 60%. This definition includes both the characteristics of "continuous flow growth" and "final high load," which can effectively distinguish between instantaneous bursts and sustained high-load high-volume flow patterns.

[0066] A burst of traffic is defined as a traffic increase of more than 50% within a single time step, and which does not meet the above criteria for determining large traffic.

[0067] Normal flow is defined as: a flow state that does not meet the above-mentioned abnormal conditions of large flow and sudden flow.

[0068] In S1, the features generated by the feature extraction method include:

[0069] Original features: flow ratio and node load;

[0070] Burst-related characteristics: burst slope (first-order difference of traffic percentage), load exceedance (marked as 1 when node load ≥ 80%).

[0071] Large flow-related characteristics: flow_sustain (count of consecutive time steps with flow percentage ≥ 60%), cumulative growth (cumulative growth of flow percentage over 3 consecutive steps).

[0072] Preprocessing methods include:

[0073] Sequence slicing: The input sequence is constructed using the sliding window method, with the window size set to 5 (i.e., using the previous 5 time steps to predict the state at the next time step), consistent with the model's time series expansion structure;

[0074] Normalization: Min-Max normalization maps the eigenvalues ​​to the range [0,1].

[0075] The specific method for splitting the dataset is as follows: the dataset is divided into training set, validation set and test set in a 7:1.5:1.5 ratio to avoid data leakage.

[0076] In S2, the LSTM-ATT model consists of a lightweight LSTM encoder, a position-biased attention layer, and a multi-task output layer connected in sequence. The model structure is as follows: Figure 2 As shown, the input sequence is processed by LSTM units at 5 time steps to generate hidden states a1~a5, and then weighted and fused by a position-biased attention layer to achieve focus on key time points.

[0077] The workflow of the LSTM-ATT model is as follows:

[0078] A1. Input the input dataset into the lightweight LSTM encoder, extract temporal features through the lightweight LSTM encoder, and generate hidden states;

[0079] A2. The hidden state input position is biased to the attention layer, and the hidden state is weighted and fused.

[0080] A3. The fused feature input multi-task output layer outputs traffic prediction values ​​and anomaly classification results.

[0081] In A1, the lightweight LSTM encoder adopts a unidirectional single-layer LSTM structure, abandoning deep / bidirectional designs. It only uses historical traffic information for modeling, which conforms to the traffic temporal evolution law and avoids future information leakage. Only one Dropout layer (dropout rate of 0.3) is added after the LSTM output, without additional BatchNorm or other computation modules, thus improving inference efficiency. The input of the lightweight LSTM encoder is a 5×6-dimensional temporal feature sequence, and the output is a 5×64-dimensional hidden state matrix. Random noise is filtered through a gating mechanism to capture the nonlinear dynamic features of traffic.

[0082] In A2, to address the shortcomings of traditional attention mechanisms that ignore temporal position, a lightweight position-biased attention layer is designed. This layer introduces sine and cosine positional encoding, which is then added to the hidden state to obtain an enhanced feature sequence that incorporates temporal positional information.

[0083]

[0084]

[0085] In the formula, For even-numbered dimension position encoding values, For odd-numbered dimension position encoding values, For time step position, For feature dimension, For the hidden layer dimension, ;

[0086] In this embodiment, the output of the lightweight LSTM encoder is 3D hidden state matrix, The time step length is the same as the dimension of the position encoding result and the dimension of the hidden state. After the two are added element by element, the traffic temporal features extracted by LSTM are preserved, and a clear position identifier is injected into the features of each time step. This solves the defect of traditional attention mechanisms that cannot perceive the temporal order, and provides complete temporal context information for subsequent position bias attention calculation, thereby enhancing the temporal perception capability.

[0087] The position-biased attention layer employs a position-biased enhanced single-head attention mechanism, the specific workflow of which is as follows:

[0088] The enhanced feature sequence with fused temporal location information is input into the location bias attention layer to generate a query matrix, a key matrix, and a value matrix. Single-head attention is used to calculate the attention score of the enhanced feature sequence. The attention score is normalized by Softmax to obtain the normalized attention weight matrix. A trainable location bias matrix is ​​introduced to correct the attention weight distribution. The value matrix is ​​weighted and summed according to the normalized attention weight matrix to obtain the output of single-head attention, highlighting the features of abnormal key time steps. The output of single-head attention is used as the fused feature output of the location bias attention layer.

[0089] Specifically, the weights are adjusted using a trainable position bias matrix, the attention score of the input sequence is calculated, and thus the output of the single-head attention is obtained. Adapt to traffic timing characteristics;

[0090]

[0091] In the formula, For querying the matrix, The key matrix, For value matrices, It is the transpose symbol. for Matrix dimension This is the trainable position bias matrix.

[0092] The number of parameters for single-head attention is reduced by 87.5% compared to 8-head attention, significantly improving computational efficiency.

[0093] In A3, the multi-task output layer includes a traffic prediction branch and an anomaly classification branch;

[0094] In the traffic prediction branch, the fully connected layer uses a linear activation function to output continuous traffic percentage prediction values. ;

[0095] In the anomaly classification branch, the fully connected layer uses the Softmax activation function to output the three classification probabilities. (Normal / Sudden / Mass Flow);

[0096] Multi-task output layer sets weighted hybrid loss function Used to balance regression and classification tasks:

[0097]

[0098] In the formula, This is the mean squared error loss for traffic flow forecasting. For three-class cross-entropy loss, As the weighting coefficient, in this embodiment (Determined through validation set optimization) to achieve synergistic optimization of prediction accuracy and detection performance.

[0099]

[0100]

[0101] In the formula, Let be the actual traffic percentage of the i-th sample (the label of the regression task). The model predicts the percentage of traffic for the i-th sample (output of the regression task). This represents the total number of samples in the current batch (batch size). Let be the true label (one-hot vector) of the i-th sample in the k-th class. In a three-class classification scenario, the position of the true class is 1 in the normal / burst / major flood categories, and 0 in the rest. The model predicts the probability of the i-th sample in the k-th class.

[0102] In S2, the specific training configuration for the LSTM-ATT model is as follows:

[0103] Optimizer: AdamW optimizer, learning rate 5e-4, weight decay 5e-5;

[0104] Batch size: 32, balancing gradient stability and training efficiency;

[0105] Early stop mechanism: Patience value 10, training stops if the loss on the validation set does not decrease for 10 consecutive rounds;

[0106] Maximum training rounds: 100, actual training rounds: approximately 50 (triggered by early stop mechanism).

[0107] In S3, the abnormal classification results include large flow, burst flow, and normal flow;

[0108] Large flow is defined as: the cumulative increase of the flow percentage over three consecutive time steps is greater than or equal to 60%, and the final flow percentage is greater than or equal to 60%; burst flow is defined as: the increase of the flow percentage within a single time step exceeds 50%, and does not meet the criteria for large flow; normal flow is flow that does not meet the criteria for large flow or burst flow.

[0109] Example 2:

[0110] This embodiment provides specific experimental data for Embodiment 1 to verify the effectiveness of the LTM-ATT model designed in this invention.

[0111] I. Experimental Setup:

[0112] Step 1: Dataset and Preprocessing;

[0113] The experiment used the Green Computing dataset, which contains 27,804 task scheduling records. Preprocessing workflow:

[0114] The time series is constructed based on submittedAt, with a time window of 5.

[0115] Extract 6-dimensional traffic characteristics: traffic share, node load, burst slope, load overload, traffic maintenance, and cumulative growth;

[0116] Construct three-category tags: 0 = Normal traffic, 1 = Sudden traffic, 2 = High traffic;

[0117] The dataset is divided into training, validation, and test sets in a ratio of 7:1.5:1.5.

[0118] Step 2: Calculate the evaluation indicators;

[0119] A comprehensive evaluation indicator system was designed for the three tasks:

[0120] Traffic flow forecasting metrics: Calculation of mean absolute error The smaller the value, the higher the prediction accuracy.

[0121]

[0122] In the formula, To test the actual flow value of sample j, The model predicts the flow value for test sample j. The total number of test samples;

[0123] Classification metric: Overall Accuracy. Overall accuracy reflects the model's overall ability to classify traffic in three categories (normal traffic, burst traffic, and large flow). The calculation formula is:

[0124]

[0125] In the formula, (True cases) represent the number of mass flow samples that were correctly detected. (True negative examples) represent the number of correctly identified non-massive flow samples (normal / burst flow). (False positives) represent the number of normal / burst samples that were misclassified as a pandemic. (False negatives) represent the number of missed samples in the large-volume stream;

[0126] The higher the accuracy, the more stable the model is in identifying various types of traffic and the stronger its comprehensive discrimination ability.

[0127] Classification metric: Popularity F1 score (F1-Score), the popularity F1 score is the accuracy. With recall rate The harmonic mean, specifically used to evaluate the model's detection performance for the critical category of large flows, is the core metric of this study. The calculation formula is as follows:

[0128]

[0129]

[0130]

[0131] The higher the score, the more accurate the model is in identifying the main flow, the fewer the missed detections, and the fewer the false positives.

[0132] Efficiency metric: Single-sample inference latency (Latency) Single-sample inference latency refers to the average time required for the model to process one flow sequence, measured in microseconds. Testing method: Under the same hardware environment, perform 1000 consecutive inferences on the test set and take the average value. The lower the latency, the faster the model runs and the lower the computational overhead, making it more suitable for deployment in edge and real-time traffic detection scenarios.

[0133] Step 3: Baseline Model;

[0134] Four mainstream time series models were selected as baselines to ensure experimental fairness:

[0135] Transformer: Standard 2-layer 8-head Transformer model, pure attention architecture;

[0136] TSMixer: A lightweight time series prediction model based on MLP;

[0137] PhaseFormer: A Transformer variant that incorporates phase information;

[0138] MixLinear: A lightweight time series model based on linear mixing.

[0139] All baseline models used the same data preprocessing methods and training configurations, and the hyperparameters were optimized to the best performance using the validation set.

[0140] II. Experimental Results and Analysis:

[0141] Step 1: Traffic Timeline & Large Flow Labeling.

[0142] This experiment aims to visually present the temporal variation characteristics of traffic in the Green Computing dataset, and to verify the rationality of the large flow judgment rule proposed in this paper and the accuracy of the annotation results, so as to provide reliable data basis and visualization support for subsequent anomaly detection models.

[0143] Two hundred consecutive time steps were extracted from the preprocessed green computing data time series as visualization samples, preserving the original flow fluctuations and distribution characteristics. Based on the proposed high-flow determination rule, the sequence was labeled point-by-point, and samples meeting both flow intensity and persistence conditions were marked as high-flow. By plotting flow time series curves and overlaying the labeling results, the distribution pattern, persistence characteristics, and abrupt change patterns of high-flow were visually displayed, thus verifying that the labeling rule can effectively distinguish between ordinary flow, burst flow, and high-flow patterns.

[0144] like Figure 3 As shown, the actual time-series changes in green computing traffic and the results of large flow annotation are presented. The curves exhibit obvious fluctuations, including stable segments, sudden spikes, and sustained high-proportion segments. The annotation results show that large flows are concentrated in continuous intervals where the traffic proportion remains high for a long period, rather than instantaneous peaks, which is highly consistent with the real characteristics of large flows being "high bandwidth and long-term sustainability." The visualization results demonstrate that the green computing dataset possesses typical data center traffic patterns, and that the large flow annotation rules designed in this paper are reasonable and interpretable, providing reliable supervision signals for multi-classification models.

[0145] Step 2: Comparison of detection accuracy under different large flow ratios.

[0146] This experiment aims to evaluate the detection performance of each model in a complex scenario where the proportion of high flow gradually increases, and to verify the robustness and generalization ability of the proposed LSTM-ATT model in the face of flow distribution shift.

[0147] To simulate network environments ranging from normal to high congestion, five test sets were constructed with peak traffic percentages of 10%, 20%, 30%, 40%, and 50%, maintaining consistent feature structures and sequence lengths. All comparison models were inferred under the same training and testing environment, with overall accuracy as the evaluation metric. The performance trends of each model under different traffic distributions were recorded. Multiple comparisons revealed the differences in model stability under extreme traffic conditions.

[0148] like Figure 4As shown, with the increase in the proportion of large flows, the detection accuracy of various models all exhibit a decreasing trend to varying degrees. Among them, the baseline models such as Transformer and TSMixer show significant decreases, indicating their sensitivity to changes in flow distribution. In contrast, the LSTM-ATT curve shows the most gradual decrease, maintaining high accuracy even under the stringent condition of 50% large flow proportion. Experimental results demonstrate that the proposed model, through position-biased attention and lightweight temporal structure, can better adapt to changes in flow distribution and possesses stronger robustness.

[0149] Step 3: Large Flow Detection F1 Score Comparison.

[0150] Flow detection is the core task of this paper, and its false negatives and false negatives directly affect network scheduling efficiency. This experiment uses the F1 score as the core indicator to specifically compare the comprehensive performance of various models on the flow recognition task, highlighting the advantages of LSTM-ATT in terms of precision and recall.

[0151] On the standard test set, performance statistics were performed separately for major streaming categories, calculating the precision, recall, and F1 score for each model. The F1 score, as a comprehensive indicator, reflects the model's ability to reduce false positives and false negatives in a balanced manner. Through horizontal comparison, the ability of different models to capture major streaming categories in minority classes under imbalanced classification scenarios was evaluated.

[0152] like Figure 5 The results show that LSTM-ATT achieves the highest F1 score on the large flow detection task, significantly outperforming all baseline models. This is because the model effectively captures the continuous high-load features of large flows through temporal encoding and attention mechanisms, while also enhancing the learning of abnormal patterns through multi-task loss. In contrast, other models, lacking a targeted temporal awareness structure, struggle to accurately distinguish large flows in complex traffic contexts, resulting in higher false negative and false positive rates.

[0153] In summary, this invention addresses the problems of traditional models struggling to balance prediction and multi-class anomaly detection, as well as their low computational efficiency. Based on the Green Computing dataset, this paper proposes a lightweight LSTM-Attention hybrid architecture. This model achieves lightweight temporal modeling through a unidirectional single-layer LSTM, introduces position-biased single-head attention to enhance anomaly perception, designs a hybrid loss function to jointly optimize the three tasks, and defines explicit quantization conditions for high-volume detection.

[0154] Experimental results show that the model achieves a low MAE of 3.7% in traffic prediction, a large flow detection accuracy of 94.2%, a burst detection accuracy of 92.5%, and an inference latency of only 6.7 μs. Its overall performance significantly outperforms baseline models such as Transformer and PhaseFormer. Ablation experiments validate the effectiveness of the location bias and hybrid loss function, which bring performance improvements of 8.3% and 10.1% respectively to large flow detection. This model provides an efficient and accurate solution for intelligent network traffic analysis, with significant application value in scenarios such as green computing and edge computing. Its lightweight design can also be extended to other time-series prediction and anomaly detection fields.

[0155] In the description of this invention, the above are merely preferred embodiments and are not intended to limit the scope of protection of this invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A network traffic prediction and anomaly detection method based on LSTM-ATT, characterized in that, Includes the following steps: S1. Collect the Green Computing dataset, and after feature extraction, preprocessing and dataset partitioning, establish training set, validation set and test set; S2. Input the training set into the LSTM-ATT model. During the training process, the hyperparameters of the model are tuned based on the validation set, and the target detection model is tested based on the test set to obtain the optimal network traffic detection model. S3. Input the dataset to be detected into the optimal network traffic detection model, and output the traffic prediction value and anomaly classification result.

2. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 1, characterized in that, In S1, the features generated by the feature extraction method include: Original characteristics, including traffic share and node load; Sudden-related characteristics, including sudden slope and load overload; Large-scale flow-related characteristics include flow maintenance and cumulative increase; Preprocessing methods include: Sequence slicing: The input sequence is constructed using the sliding window method, with the window size set to 5; Normalization: Min-Max normalization maps the eigenvalues ​​to the range [0,1]. The specific method for dividing the dataset is as follows: the dataset is divided into training set, validation set and test set in a 7:1.5:1.5 ratio.

3. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 1, characterized in that, In S2, the LSTM-ATT model consists of a lightweight LSTM encoder, a position-biased attention layer, and a multi-task output layer connected in sequence. The specific workflow of the LSTM-ATT model is as follows: A1. Input the input dataset into the lightweight LSTM encoder, extract temporal features through the lightweight LSTM encoder, and generate hidden states; A2. The hidden state input position is biased to the attention layer, and the hidden state is weighted and fused. A3. The fused feature input multi-task output layer outputs traffic prediction values ​​and anomaly classification results.

4. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 3, characterized in that, In A1, the lightweight LSTM encoder adopts a unidirectional single-layer LSTM structure, adding only one Dropout layer after the LSTM output; the input of the lightweight LSTM encoder is a 5×6-dimensional temporal feature sequence, and the output is a 5×64-dimensional hidden state matrix.

5. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 3, characterized in that, In A2, the position-biased attention layer introduces sine and cosine position encoding, which is added to the hidden state to obtain an enhanced feature sequence that fuses temporal positional information. In the formula, For even-numbered dimension position encoding values, For odd-numbered dimension position encoding values, For time step position, For feature dimension, For the hidden layer dimension, ; The position-biased attention layer employs a position-biased enhanced single-head attention mechanism, the specific workflow of which is as follows: The enhanced feature sequence with fused temporal location information is input into the location-biased attention layer to generate a query matrix, a key matrix, and a value matrix. Single-head attention is used to calculate the attention score of the enhanced feature sequence. The attention score is normalized by Softmax to obtain the normalized attention weight matrix. A trainable location bias matrix is ​​introduced to correct the attention weight distribution. The value matrix is ​​weighted and summed according to the normalized attention weight matrix to obtain the output of the single-head attention, which is used as the fused feature output of the location-biased attention layer. Specifically, the weights are adjusted using a trainable position bias matrix, the attention score of the input sequence is calculated, and thus the output of the single-head attention is obtained. Adapt to traffic timing characteristics; In the formula, For querying the matrix, The key matrix, For value matrices, It is the transpose symbol. for Matrix dimension This is the trainable position bias matrix.

6. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 3, characterized in that, In A3, the multi-task output layer includes a traffic prediction branch and an anomaly classification branch; In the traffic prediction branch, the fully connected layer uses a linear activation function to output continuous traffic percentage prediction values; In the anomaly classification branch, the fully connected layer uses the Softmax activation function to output the three classification probabilities; Multi-task output layer sets weighted hybrid loss function Used to balance regression and classification tasks: In the formula, This is the mean squared error loss for traffic flow forecasting. For three-class cross-entropy loss, These are the weighting coefficients; In the formula, Let i be the actual traffic percentage of the i-th sample. The model predicts the proportion of traffic for the i-th sample. This represents the total number of samples in the current batch. Let be the true label of the i-th sample in the k-th class. In a three-class classification scenario, the true label is 1 for the normal / sudden / major class and 0 for the rest. The model predicts the probability of the i-th sample in the k-th class.

7. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 1, characterized in that, In S2, the specific training configuration for the LSTM-ATT model is as follows: Optimizer: AdamW optimizer, learning rate 5e-4, weight decay 5e-5; Batch size: 32, balancing gradient stability and training efficiency; Early stop mechanism: Patience value 10, training stops if the loss on the validation set does not decrease for 10 consecutive rounds; Maximum number of training rounds: 100, actual number of training rounds: approximately 50.

8. The network traffic prediction and anomaly detection method based on LSTM-ATT according to claim 1, characterized in that, In S3, the abnormal classification results include large flow, burst flow, and normal flow; Large flow is defined as: the cumulative increase of the flow percentage over three consecutive time steps is greater than or equal to 60%, and the final flow percentage is greater than or equal to 60%; burst flow is defined as: the increase of the flow percentage within a single time step exceeds 50%, and does not meet the criteria for large flow; normal flow is flow that does not meet the criteria for large flow or burst flow.

Images