A differential time series prediction network anomaly detection method and related device

Abstract

This invention discloses an anomaly detection method and related apparatus for differential time series prediction networks, belonging to the field of network security technology. The method includes: collecting and preprocessing raw traffic data to obtain time series input features and true differential values; encoding the differential features into quantum states using a variable quantum circuit, which utilizes a single-bit rotating gate in the data embedding layer to encode the differential features; using a trainable rotating gate and a ring entanglement gate in the variational entanglement layer to capture nonlinear correlations between adjacent time steps; performing a Pauli Z measurement only on the first quantum bit to obtain the differential prediction value for the next time step; calculating the prediction error and comparing it with a dynamic threshold to determine the anomaly. This invention employs differential feature-driven adaptive quantum entanglement evolution, which can adapt to non-stationary time series without recompilation; by measuring only the first quantum bit, the readout overhead is reduced from exponential complexity to linear complexity, significantly improving detection efficiency.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a differential time-series prediction network anomaly detection method and related apparatus. Background Technology

[0002] Cybersecurity is a core safeguard for the development of the digital economy, and network traffic anomaly detection is a key means of defending against network threats such as Distributed Denial of Service (DDoS) attacks, port scanning, and malicious traffic injection. With the expansion of network scale and the diversification of traffic types, network traffic exhibits complex characteristics such as non-stationarity, abrupt changes, and high noise, placing higher demands on the accuracy, real-time performance, and noise resistance of anomaly detection. Accurate analysis of network traffic time-series data enables early identification and warning of anomalies, allowing for the construction of a more secure and reliable network security protection loop. Computer vision and deep learning technologies are currently the main methods for implementing network traffic anomaly detection.

[0003] In practical applications, network traffic monitoring systems often operate in complex environments with high noise and frequent traffic fluctuations. Therefore, they need to generate high-precision and robust anomaly detection results with limited computing power. This type of network security monitoring is widely used in enterprise LAN protection, internet backbone network monitoring, and industrial control network security. The goal is to accurately capture minute traffic fluctuations and early signs of covert attacks under complex traffic fluctuation constraints, while balancing computational overhead and engineering implementation efficiency. A typical process is as follows: given the original time series of network traffic and anomaly labels, a classic time series prediction model (such as Long Short-Term Memory (LSTM) or Gated Recurrent Unit (GRU)) is selected as the core detector. Within limited computing power, time series feature extraction and anomaly determination are performed, mapping the original network traffic time series to specific anomaly classification results.

[0004] In evaluation, mean average precision (mAP), recall, and false positive rate (FPR) are commonly used as key metrics. These are compared under different traffic scenarios (such as normal traffic fluctuations, DDoS attacks, and port scanning) to observe the model's stability and generalization under various network environments and interference. In addition to these metrics, configurations such as anomaly alert lead time, inference latency, and hardware computing power consumption are also recorded to ensure the reproducibility and deployability of the results in real network traffic monitoring systems.

[0005] At the methodological level, academia and industry have developed several reusable components: first, feature extraction and temporal correlation modeling based on time-series prediction models to address the dynamic changes in non-stationary traffic; second, threshold setting and residual analysis methods built around anomaly detection to distinguish between normal traffic fluctuations and anomalous attacks; and third, the recent exploration of introducing quantum machine learning into the field of time-series prediction, hoping to leverage the parallelism of quantum state superposition and high-dimensional Hilbert spaces to overcome the bottlenecks of low accuracy and poor noise resistance in classical time-series models for non-stationary traffic modeling. Through these general components, we can systematically study how to improve the accuracy and timeliness of network traffic anomaly detection in complex network environments. However, the above methods still have the following shortcomings: 1. Classical Time Series Prediction and Anomaly Detection Methods: Typical solutions based on recurrent neural networks such as LSTM and GRU predict traffic by capturing temporal correlations. These methods are simple to implement and have mature software and hardware ecosystems. However, in real-world complex network scenarios, network traffic exhibits strong non-stationarity. Classical time series models are prone to feature drift and false alarms when dealing with traffic abrupt changes and high noise interference. Furthermore, the feature representation capabilities of classical models are limited, making it difficult to capture hidden high-order nonlinear correlations in traffic sequences. This results in insufficient accuracy in detecting highly concealed and abrupt anomalies such as DDoS attacks, leading to a high false alarm rate. In addition, traditional models often focus on post-event anomaly detection, lacking effective temporal memory and evolutionary modeling of precursors to traffic abrupt changes, thus limiting the lead time for early warning and hindering the achievement of a true early intervention loop.

[0006] 2. Existing Quantum Timing and Hybrid Integration Methods: When attempting to introduce quantum computing, existing technologies mostly map high-dimensional traffic time-series data directly to quantum states through pure amplitude encoding and extract features using parameterized quantum circuits. Intuitively, quantum entanglement helps improve feature representation capabilities and noise resistance in high-dimensional spaces; however, in actual operation, directly encoding massive-dimensional traffic data encounters severe data input (I / O) bottlenecks, leading to an exponential increase in quantum circuit depth, which easily causes strong decoherence failure and quantum gradient vanishing (i.e., the "gradient wasteland" phenomenon). To alleviate this problem, some schemes use shallow quantum circuits with fixed topology, but the rigid entangled structure is difficult to adapt to the dynamic changes in network traffic. At the same time, the excessive reliance on quantum state tomography at the output end to obtain complete features consumes massive resampling overhead, severely dragging down inference time. Summary of the Invention

[0007] The purpose of this invention is to overcome the problems of the prior art and provide a method and related apparatus for anomaly detection in differential time series prediction networks.

[0008] The objective of this invention is achieved through the following technical solution: a method for anomaly detection in differential temporal prediction networks, comprising the following steps: Raw traffic data from the network is collected to form the raw time series of network traffic. This data is then preprocessed to obtain the time series input features and the corresponding true difference values. A variable quantum circuit is used to encode temporal input features into quantum states. The variable quantum circuit includes a data embedding layer and a variational entanglement layer. The data embedding layer includes a single-bit rotation gate, and the variational entanglement layer adopts a multi-level structure. Each layer includes a trainable single-bit rotation gate and a ring entanglement gate. The single-bit rotation gate encodes each differential feature in the temporal input features into an initial quantum state. The trainable single-bit rotation gate adjusts the probability distribution of the initial quantum state. The ring entanglement gate applies entanglement operations to adjacent qubits to capture the nonlinear correlation between adjacent time steps in the temporal input features, outputting the evolved quantum state. Only the first qubit of the quantum state is measured using the Pauli Z operator, and the expected value obtained from the measurement is used as the prediction result of the flow differential value at the next time step. The error between the predicted result and the actual difference value is calculated, and the network traffic is judged to be abnormal based on the comparison result of the error and the dynamic threshold.

[0009] In one example, preprocessing the raw time series of network traffic includes: Normalize the raw time series of network traffic; Perform a first-order difference operation on the normalized flow sequence to extract the flow change difference sequence between two adjacent time points; A fixed-length sliding window is used to extract the difference sequence of flow rate changes, constructing a time-series input feature in the form of a sliding window, and the difference data corresponding to the next time step of the sliding window is used as the prediction label.

[0010] In one example, the length of the sliding window is consistent with the number of qubits in the variable quantum circuit, so that each differential feature corresponds to an independent qubit for encoding.

[0011] In one example, the trainable single-bit rotation gate includes three types of rotation gates: those around the X-axis, those around the Y-axis, and those around the Z-axis; the ring entanglement gate uses a ring topology to connect adjacent qubits, so that each qubit is entangled with the two adjacent qubits.

[0012] In one example, the Pauli Z operator measurement is performed only on the first qubit of the final evolution state, and the expression for the measurement and prediction output is: in, The predicted result of the flow difference value at the next time step; The quantum state after evolution through a variable quantum circuit; It is the conjugate transpose of the quantum state after evolution through a variable quantum circuit; For the Pauli Z operator of the measured qubit, This represents the Dirac inner product representation used in quantum mechanics to solve for the expectation value of an operator.

[0013] In one example, the variational quantum circuit is jointly trained end-to-end using a classical-quantum hybrid training architecture, with mean squared error as the loss function. The parameters of the trainable single-bit rotation gate in the variational entanglement layer are updated by the Adam optimizer. A quantum-classical orthogonal constraint loss term is introduced into the total loss function of the joint training to force the classical branch and the quantum branch to extract complementary temporal features.

[0014] In one example, the dynamic threshold is set by statistically analyzing the mean of the residual errors at all times and three times the standard deviation.

[0015] In one example, when comparing the error with a dynamic threshold, the rate of change of the quantum measurement expectation value at adjacent time points is calculated to characterize the quantum expectation value drift; when the residual error is greater than the dynamic threshold, the current network traffic is determined to be abnormal by combining the quantum expectation value drift characteristics.

[0016] It should be further noted that the technical features corresponding to the above examples can be combined or replaced to form new technical solutions.

[0017] The present invention also includes a computer program product comprising a computer program that, when executed by a processor, implements the steps of the differential temporal prediction network anomaly detection method formed by any or a combination of the above examples.

[0018] The present invention also includes a terminal comprising a memory and a processor, wherein the memory stores computer instructions executable on the processor, and the processor executes the steps of the differential temporal prediction network anomaly detection method formed by any or more of the above examples when executing the computer instructions.

[0019] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention constructs an adaptive quantum entanglement evolution mechanism driven by flow differential features. Instead of using a static entanglement topology with fixed parameters, it maps the real-time extracted classical differential increments to dynamic rotation phase compensation terms of the controlled Z gates in the variational entanglement layer. Through this feature-driven real-time intervention, the coherence strength between qubits can be spontaneously adjusted according to the severity of flow fluctuations. Thus, without the need for quantum hardware recompilation, it can achieve instantaneous nonlinear capture of sudden network attack features such as DDoS in Hilbert space. This solves the problem of rigidity and difficulty in adapting to non-stationary timing in traditional variational circuit topologies from a physical perspective.

[0020] Meanwhile, this invention abandons quantum state tomography decoding, which requires massive repeated sampling, and adopts a local expectation measurement mechanism based on the Pauli Z operator (measuring only the first qubit). While meeting the accuracy requirements of time series prediction, it reduces the exponential readout overhead to linear time, greatly improving inference efficiency.

[0021] 2. To address the physical defects of directly encoding massive dimensional traffic data, which leads to an exponential increase in line depth and decoherence failure, this invention introduces a preprocessing mechanism of normalization, first-order difference, and sliding window. Normalization eliminates amplitude differences between different traffic magnitudes, first-order difference removes long-term trends and filters baseline noise, and strictly compresses and aligns traffic features to the dimension corresponding to the qubit. This significantly reduces the depth of quantum logic gates while ensuring high-fidelity input of traffic mutation features, and adapts to the design where the number of qubits and the length of the sliding window are consistent in the code.

[0022] 3. The sliding window length is consistent with the number of qubits in the variable quantum circuit, which can realize a one-to-one mapping between each differential feature and the corresponding qubit, without the need for additional dimension transformation or dimension reduction operations, thus simplifying the encoding process from classical data to quantum state.

[0023] 4. The variable quantum circuit of this invention adopts a classical-quantum hybrid training architecture. Based on the continuous differentiability of quantum expectation and the parameter translation rule, a quantum-classical orthogonal constraint loss term is introduced into the overall loss function of joint training. This forces the classical branch and the quantum branch to extract complementary temporal features, avoids the two branches learning homogeneous information and thus avoids feature redundancy, and improves the discrimination ability of heterogeneous feature fusion.

[0024] 5. The dynamic threshold is set by statistically analyzing the mean of residual errors at all times and three times the standard deviation. This effectively filters residual interference caused by normal traffic fluctuations, limiting normal fluctuations to a confidence interval of three standard deviations above and below the mean. This significantly reduces the false alarm rate while maintaining a high detection rate, and can adapt to the traffic change patterns of different network scenarios.

[0025] 6. In addition to calculating the statistical distribution (mean and three standard deviations) of the classical residuals, the first-order evolution derivative of the quantum measurement expectation value is extracted simultaneously as a physical drift feature. By utilizing the "state coherence collapse" characteristic of the variable quantum circuit in the early stage of flow anomalies, the expected value drift rate at the quantum physical level is weighted and fused with the classical residuals. This not only identifies significant flow mutations but also enables proactive early warning during the DDoS attack latency period or slow port scanning stage through the microscopic instability of quantum state evolution, significantly improving the sensitivity lower bound of the detection system. Attached Figure Description

[0026] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. The accompanying drawings are provided to provide a further understanding of the present application and constitute a part of the present invention. The same reference numerals are used in these drawings to denote the same or similar parts. The illustrative embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention.

[0027] Figure 1 This is a flowchart of a method provided in an embodiment of the present invention; Figure 2 A flowchart of a method provided for a preferred embodiment of the present invention; Figure 3 The figure shows the experimental results provided in one embodiment of the present invention. Detailed Implementation

[0028] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Furthermore, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0030] In one embodiment, such as Figure 1 As shown, a differential time-series prediction method for network anomaly detection can be applied to computer network security monitoring scenarios, specifically including network environments of different scales such as enterprise LANs, internet backbones, and industrial control networks. It can be used to detect network anomalies that cause sudden traffic changes, such as DDoS attacks, port scanning, and malicious traffic injection. It can adapt to the needs of network traffic collection and real-time detection at different scales, and also has the advantages of strong noise resistance, high prediction accuracy, and high computational efficiency. Specifically, the method of this invention includes the following steps: S1: Traffic Acquisition and Time Series Preprocessing Stage: Acquire raw network traffic data (number of packets per unit time, PPS) to form a continuous raw time series of network traffic. The original time series of network traffic is preprocessed to obtain the time series input features and the true difference values ​​corresponding to the time series input features.

[0031] In step S1, raw traffic data can be collected in real time by using traffic acquisition tools (such as high-performance acquisition cards) deployed on network gateways or core switches, counting the number of data packets per unit time. Preprocessing can be any one or more combinations of normalization, first-order differencing, sliding window truncation, missing value imputation, outlier removal, smoothing filtering, data augmentation, normalization scaling, and timestamp alignment to convert the raw traffic sequence into standardized features suitable for quantum circuit input. The true difference value corresponding to the time-series input features is the difference value of the actual traffic at the next time step; this true difference value is used as a prediction label for error calculation.

[0032] S2: The timing input features are encoded into quantum states using variable quantum circuits. For the evolved quantum state, Pauli Z operator measurement is performed only on the first qubit of the quantum state, and the expected value obtained from the measurement is used as the prediction result of the flow difference value at the next time step.

[0033] Before executing step S2, a variable quantum circuit is constructed, which includes a data embedding layer and a variational entanglement layer. The data embedding layer includes a single-bit rotating gate. In this example, it is a single-bit X-axis rotating gate encoding structure. The variational entanglement layer adopts a multi-level structure, with each layer including a trainable single-bit rotating gate and a ring-controlled Z (CZ) entanglement gate.

[0034] At this point, the temporal input features are encoded into quantum states, including: Differential feature encoding and quantum state preparation stage: Each differential feature in the time-series input features is encoded into an initial quantum state using a single-bit X-axis rotating gate, realizing an efficient mapping of classical differential information to quantum Hilbert space, ensuring that classical features can be effectively recognized and processed by quantum circuits.

[0035] Variable quantum evolution and prediction stage: A dedicated variable quantum prediction circuit including a data embedding layer and a variational entanglement layer is built. The probability distribution of the initial quantum state is adjusted by a trainable single-bit rotation gate, and entanglement operation is applied to adjacent qubits by a ring entanglement gate. This accurately captures the nonlinear correlation between different time steps in the temporal input features (differential sequence), drives the initial quantum state to undergo unitary evolution, and outputs the evolved quantum state.

[0036] Quantum Measurement and Prediction Output Stage: After the differential features are encoded by the data embedding layer and evolved by the variational entanglement layer, quantum measurements are performed on the final state of the evolved variational quantum. Only the first qubit of the final state is measured using the Pauli Z operator. At this point, after quantum encoding, the core temporal correlation features of the flow time series data are mapped to the quantum state of the first qubit. The Pauli Z expectation value of the first qubit can completely characterize the key evolutionary laws of the entire time series, and the entanglement propagation characteristics of the quantum state ensure that the measurement information of the first qubit does not lose the core temporal features. Therefore, measuring only the first qubit is sufficient to meet the time series prediction accuracy requirements, without needing to perform Pauli Z measurements on all qubits. Furthermore, the measured quantum state expectation value is classically transformed and directly used as the prediction result of the flow difference value at the next time step, completing the entire differential time series prediction process. This achieves efficient output of quantum state information to classical prediction values, balancing measurement efficiency and prediction accuracy, and providing reliable prediction data support for subsequent residual calculations.

[0037] S3: Residual Calculation and Anomaly Detection Stage: Calculate the residual error between the predicted result and the actual difference value, and determine whether the network traffic is abnormal based on the comparison result of the residual error and the dynamic threshold.

[0038] In step S3, the residual error at each time point is compared with the dynamic threshold one by one. If the residual error is greater than the dynamic threshold, it is determined that the current network traffic is abnormal, corresponding to network security threats such as DDoS attacks and port scanning. If the residual error is less than or equal to the dynamic threshold, it is determined that the current network traffic is normal, thus completing the accurate determination of network traffic anomalies.

[0039] In one embodiment, the traffic acquisition and time-series preprocessing stage preprocesses the original time series of network traffic, including: (1) Normalize the original time series of network traffic within the range of [-1,1]: in, The normalized flow rate value at time t; The original traffic at time t is the number of network data packets (PPS) collected per unit time. , These represent the minimum and maximum values ​​of the flow sequence, respectively. Through the above normalization process, the difference in flow amplitude can be eliminated, thus eliminating amplitude differences between flow data of different magnitudes. This avoids the amplitude differences interfering with subsequent quantum encoding and prediction accuracy, ensuring the stability and accuracy of subsequent quantum encoding.

[0040] (2) Perform first-order difference operation on the normalized flow sequence: in, Let be the flow difference value at time t; This represents the normalized flow rate value at time t-1. This example extracts the difference sequence of flow rate changes between two adjacent time points through difference operations, removing long-term trend terms present in the original flow rate, weakening the non-stationary trend of the original flow rate sequence, filtering baseline noise in the original flow rate, and improving the sensitivity and accuracy of subsequent anomaly detection.

[0041] (3) A fixed-length sliding window is used to extract the differential sequence of flow change, and a time-series input feature in the form of a sliding window is constructed. At the same time, the differential data corresponding to the next moment of the sliding window is used as the prediction label (true differential value) to form a one-to-one input-label pair, ensuring that the input dimension is consistent with the number of qubits, and providing standardized and directly input qualified data for subsequent variable quantum prediction circuits.

[0042] In one embodiment, the length of the sliding window is consistent with the number of qubits in the variable quantum circuit, so that each differential feature corresponds to an independent qubit for encoding, ensuring that the differential feature can be directly mapped to the corresponding qubit without additional dimension transformation operations, thus simplifying the quantum encoding process.

[0043] In one embodiment, the differential feature encoding and quantum state preparation stage includes: The differential features in the sliding window time-series input features obtained during the multi-scale flow acquisition and time-series preprocessing stages are adapted to ensure that the features meet the requirements for quantum state preparation. A single-bit X-axis rotation gate is used to encode the differential features one by one into quantum states, realizing an efficient mapping from classical differential information to quantum Hilbert space. The encoding expression is as follows: in, This is the unitary transformation matrix of the data embedding layer, used to encode classical difference features into quantum states; The input feature vector is the difference; For qubit X-axis rotation gate; For the i-th differential input feature, it corresponds to the flow rate change at one time step within the sliding window; The total number of qubits is equal to the sliding window length, ensuring that each differential feature can be encoded by an independent qubit, ultimately preparing the initial quantum state. .

[0044] In one embodiment, the variable quantum evolution and prediction stage includes: A dedicated variable quantum prediction circuit is constructed, comprising a data embedding layer and a variational entanglement layer. The data embedding layer employs a single-bit X-axis rotating gate encoding structure, responsible for stably mapping classical differential features to quantum states. The variational entanglement layer adopts a multi-level structure, with each layer including a trainable single-bit rotating gate. ) and the ring-controlled Z ( Entanglement gates; single-qubit rotation gates are used to adjust the probability distribution of quantum states through trainable variational parameters ( Optimize the representational power of quantum states; ring Entanglement gates are used to achieve quantum entanglement between adjacent qubits. They are connected by a ring topology and can effectively capture the nonlinear temporal correlation between adjacent time steps in a differential sequence, thus adapting to the continuous characteristics of flow timing.

[0045] The total unitary transformation matrix of the variable quantum prediction circuit It consists of a single-bit rotation layer and a controlled entanglement layer, and its expression is: in, These are trainable variational parameters, including tuning parameters for each layer, each qubit, and each rotating gate, used to optimize the predictive performance of quantum circuits. The number of variational entanglement layers; The total number of qubits; For the index of the changing entanglement layer; For the index of qubits; A single-bit quantum gate that rotates around the X-axis; A single-bit quantum gate that rotates around the Y-axis; A single-bit quantum gate that rotates around the Z-axis; Controlled adjacent qubits Entanglement operations are performed using a ring topology; the initial quantum state is encoded by a data embedding layer and evolved through a variational entanglement layer to obtain the final evolution state. .

[0046] In one embodiment, the quantum measurement and prediction output stage includes: The final evolutionary state obtained from the variable quantum evolution and feature extraction stages Quantum measurement is performed only on the first qubit of the final evolution state using the Pauli Z operator. The expected value of this qubit under the Pauli Z operator is solved by the Dirac inner product. This quantum expected value is directly used as the predicted value of the flux difference at the next time step, achieving efficient conversion from quantum state information to classical prediction value, and providing accurate and reliable prediction data support for subsequent residual calculations. In this embodiment, the expression for the measurement and prediction output is as follows: in, The predicted result of the flow difference value at the next time step; The quantum state after evolution through a variable quantum circuit; It is the conjugate transpose of the quantum state after evolution through a variable quantum circuit; For the Pauli Z operator of the measured qubit, This represents the Dirac inner product representation used in quantum mechanics to solve for the expectation value of an operator.

[0047] In one embodiment, the variable quantum circuit employs a classical-quantum hybrid training architecture for end-to-end joint training. This combines the high computational efficiency of the classical processor with the high-dimensional feature representation capability of the quantum processor. The mean squared error (MSE) is used as the loss function to quantify the overall deviation between the predicted and actual values. The Adam optimizer adaptively adjusts the learning rate and updates the parameters of the trainable single-qubit rotation gate in the variational entanglement layer, achieving end-to-end training optimization of the entire model and improving prediction accuracy and convergence speed. Specifically, the quantum processor and classical processor in the variable quantum circuit achieve bidirectional communication through a data interaction interface, collaboratively completing network traffic anomaly detection. The quantum processor performs differential feature encoding, quantum state evolution, and quantum measurement operations, fully utilizing quantum superposition and entanglement characteristics to enhance feature representation capabilities. The classical processor performs data preprocessing, residual calculation, dynamic threshold setting, and anomaly detection operations, handling pre-processing and post-decision decision-making, reducing the computational load on the quantum processor, and ensuring real-time detection.

[0048] Preferably, a quantum-classical orthogonal constraint loss term is introduced into the total loss function of joint training to force the classical branch and the quantum branch to extract complementary temporal features, thus ensuring the complementary advantages of heterogeneous feature fusion.

[0049] In one embodiment, the residual calculation and anomaly detection stage further includes: First, obtain the predicted value of the next-time flow difference from the output of the variable quantum evolution and prediction stage. Combining the true difference values ​​corresponding to the multi-scale flow acquisition and time-series preprocessing stages The residual error between the two is calculated using the squared error method, and the calculation expression is as follows: in, Let be the residual error at time t. By quantifying the degree of deviation between the above prediction results and actual flow changes, the prediction deviation at abnormal times is amplified, thereby improving the sensitivity to identify sudden changes in flow.

[0050] In one embodiment, the dynamic threshold is set by statistically analyzing the mean and three standard deviations of the residual errors at all time points. Specifically, the residual error data at all time points are statistically analyzed, the statistical distribution characteristics of the residual error data are analyzed, and the mean and three standard deviations of the residual errors are calculated. The dynamic threshold is then set based on these results. The calculation expression is: in, This is the mean of all residual errors; Let be the standard deviation of all residual errors; when When the current traffic is abnormal, it is determined that the current traffic is abnormal. This dynamic threshold can adaptively adapt to the traffic fluctuation characteristics under different network scenarios, effectively eliminating residual interference caused by normal traffic fluctuations.

[0051] Preferably, when comparing the error with the dynamic threshold, the rate of change of the quantum measurement expectation value at adjacent time points is calculated to characterize the quantum expectation value drift. This expectation value drift is combined with the current residual error for network traffic anomaly judgment. For example, when the residual error is greater than the dynamic threshold and the rate of change of the quantum measurement expectation value is greater than a preset threshold, it is comprehensively judged that the current network traffic is abnormal, corresponding to network security threats such as DDoS attacks and port scanning. When the residual error is greater than the dynamic threshold and the rate of change of the quantum measurement expectation value is greater than a preset threshold, it is judged that the current network traffic is normal, and the final anomaly detection result and signal warning are output to complete the accurate judgment of network traffic anomalies.

[0052] This invention encodes classical differential features into quantum states, forms high-dimensional quantum correlation features through ring entanglement to capture nonlinear temporal correlations between adjacent time steps, performs Pauli Z-measurement only on the first qubit to obtain the differential prediction value for the next time step, and finally determines anomalies based on the prediction residual and dynamic threshold. It can keenly capture the first derivative mutation of the expected value (i.e., expected value drift) caused by tiny mutations in traffic across multiple consecutive frames in quantum space, accurately modeling progressively hidden anomalies such as "slowly increasing traffic in the early stage of a DDoS attack" and "small fluctuations in port scan traffic". It achieves a greater risk warning advance than traditional static anomaly detection architecture and can be widely applied to network security protection scenarios such as enterprise LANs, Internet backbone networks, and industrial control networks.

[0053] The method of the present invention is now tested using real network traffic time-series data. The implementation process of the method of the present invention is as follows: Figure 2As shown, the variable quantum circuit adopts an end-to-end differentiable training paradigm, generating anomaly detection results with extremely high robustness and forward-looking early warning capabilities under given computing power. In this implementation, the normalized original traffic time-series data is used as the starting point, and the number of logical qubits N (preferably N≥4), the depth of the variable quantum circuit L (empirically 4~6 is more robust), the sliding window length T, and the time-series decision window length ΔT are set. To overcome interference from complex network scenarios, a classic preprocessing procedure and a dynamically controlled entanglement gate are pre-designed; to facilitate reproduction and engineering reuse, key intermediate quantities such as the loss curve, the spatiotemporal distribution of the dynamic threshold, and the early warning confidence at each moment are recorded throughout the process.

[0054] At this point, the specific implementation of Phase 1 (traffic acquisition and timing preprocessing phase) is as follows: The goal of this stage is to mitigate traffic non-stationarity and extract traffic variation characteristics within limited qubit resources using classical preprocessing mechanisms, providing standardized input for subsequent quantum state preparation. In the specific network security monitoring scenario of this embodiment, the input traffic data specifically refers to time-series data collected in real time by traffic acquisition devices deployed on network gateways or core switches. This type of data includes normal traffic fluctuations, high noise interference, and abnormal traffic such as DDoS attacks and port scans.

[0055] Therefore, at the current time t, we first collect the raw network traffic data, specifically the number of data packets (PPS) in the network per unit time, forming a continuous raw time series of network traffic. The original time series is then input into the classical preprocessing module to perform normalization, which linearly maps the original flow data to the [-1,1] interval, eliminating the amplitude differences of flow data of different magnitudes and avoiding interference from amplitude differences on subsequent quantum encoding and prediction accuracy.

[0056] Subsequently, a first-order difference operation is performed on the normalized flow sequence to extract the flow change sequence between two adjacent time points. This difference operation removes the long-term trend term in the original flow, filters baseline noise, and highlights the characteristics of abrupt flow changes.

[0057] Finally, the difference sequence is truncated using a fixed-length time window of length T to construct a sliding window-like time-series input feature. Simultaneously, the difference data corresponding to the next time step of the sliding window is used as the prediction label, forming a one-to-one input-label pair. The input dimension remains consistent with the number of qubits N, providing standardized and directly inputtable qualified data for subsequent variable quantum prediction circuits. This processing method not only weakens the non-stationarity of the flow but also transforms the abrupt change in flow characteristics into a differential signal that can be efficiently captured by quantum circuits, improving the accuracy of subsequent prediction and anomaly detection.

[0058] The specific implementation of Phase 2 (differential feature encoding and quantum state preparation phase) is as follows: The goal of this stage is to achieve an efficient and compliant mapping from classical differential features to quantum states, avoiding probabilistic constraint violations during quantum state preparation. First, the differential features of the sliding window temporal input features obtained in Stage 1 are adapted to ensure that the feature dimension remains consistent with the number of qubits. In this embodiment, both the sliding window length T and the number of qubits n are set to 7, eliminating the need for additional dimension conversion.

[0059] A single-bit X-axis rotation gate is used to encode the differential features one by one into quantum states, thereby achieving an efficient mapping of classical differential information to quantum Hilbert space.

[0060] The specific implementation of Stage 3 (variable quantum evolution and feature extraction stage) is as follows: The goal of this stage is to perform unitary evolution of the initial quantum state using a variable quantum circuit, and to deeply extract nonlinear temporal correlation features from the difference sequence through trainable quantum gates and a ring entanglement structure, providing a highly robust quantum feature representation for subsequent prediction outputs. This embodiment, based on the initial quantum state prepared in stage 2, constructs a dedicated variable quantum prediction circuit including a data embedding layer and a variational entanglement layer. The data embedding layer uses a single-bit X-axis rotating gate encoding structure to ensure stable mapping of the difference features to the quantum state space.

[0061] The variational quantum circuit of this invention adopts a multi-level structure, wherein the data embedding layer adopts the above-mentioned X-axis rotating gate encoding structure, which is responsible for stably mapping classical differential features to quantum states; the variational entanglement layer adopts a multi-level structure, and in this embodiment, the variational entanglement layer has one layer, which includes a trainable single-bit rotating gate (…). The single-qubit rotation gate is used to adjust the probability distribution of quantum states and optimize the expressive power of quantum states through trainable parameters. The ring-controlled Z (CZ) entanglement gate is used to realize quantum entanglement between adjacent qubits. It adopts a ring topology structure to effectively capture the nonlinear correlation between adjacent time steps in the difference sequence and adapts to the continuous characteristics of flow time series.

[0062] The specific implementation of Phase 4 (Quantum Measurement and Prediction Output Phase) is as follows: The goal of this stage is to convert the evolved quantum state information into classical predictions using lightweight quantum measurement methods. This reduces measurement overhead while maintaining prediction accuracy, providing reliable data support for subsequent anomaly detection. To avoid the high computational overhead and latency associated with full quantum state tomography, this embodiment employs a single-qubit measurement strategy, performing Pauli Z-operator measurements only on the first qubit in the final evolved state. The expected value of the quantum state under the action of the Pauli Z-operator is calculated using the Dirac inner product, and this expected value is directly used as the prediction result of the flux difference value at the next time step, achieving efficient conversion from quantum state information to classical predictions.

[0063] The specific implementation of Phase 5 (Residual Calculation and Anomaly Detection Phase) is as follows: The fifth objective of this phase is to accurately determine network traffic anomalies based on the deviation analysis between the predicted and actual difference values, combined with dynamic thresholds and quantum measurement drift characteristics, effectively distinguishing between normal traffic fluctuations and traffic mutations caused by attacks. The first step is to obtain the traffic difference prediction values ​​output from phase 4. and the difference between the actual flow rate obtained in Phase 1. By comparing the results, the residuals are calculated using the squared error, which amplifies the prediction deviation at abnormal times while suppressing minor disturbances caused by normal fluctuations.

[0064] After obtaining the residual sequence for the entire time period, the statistical distribution characteristics of the residuals are analyzed, and the mean is calculated. with standard deviation An adaptive dynamic threshold is constructed based on this. This threshold can adaptively match the traffic characteristics of different network environments without manual adjustment, and can effectively filter baseline noise and normal fluctuation interference. Subsequently, the residual at each time step is compared with the dynamic threshold, and a comprehensive judgment is made by combining the drift characteristics of the quantum measurement expectation values ​​of adjacent frames.

[0065] This embodiment details the complete implementation process of an anomaly detection method for differential timing prediction networks based on variable quantum circuits. Through the orderly coordination of five stages—stage 1 (traffic acquisition and timing preprocessing), stage 2 (differential feature encoding and quantum state preparation), stage 3 (variable quantum evolution and feature extraction), stage 4 (quantum measurement and predicted value output), and stage 5 (residual calculation and anomaly determination)—network anomaly detection is achieved. Specific detection results are as follows: Figure 3 As shown. According to Figure 3 The comparison chart of quantum network traffic shows that the actual traffic (original) curve and the quantum prediction (reconstructed) curve overlap in overall trend. The quantum prediction curve can accurately track and ultimately the dynamic changes of the actual traffic, indicating that the prediction curve has extremely high feature expression and reconstruction capabilities in capturing the non-flow curve characteristics of network traffic. Figure 3The prediction deviation analysis chart shows that the deviation of most points is far below the dynamic threshold (0.3483). Only in a few abnormal moments does the deviation value (showing red spikes) significantly exceed the dynamic threshold. The dynamic threshold constructed based on the residual mean and three times the standard deviation can effectively distinguish between normal flow fluctuations and real abnormal flow, thereby effectively reducing the false alarm rate. Figure 3 The detected anomaly map shows that anomalies (blue dots) were marked on the traffic timeline. These anomalies accurately correspond to the moments of sudden increases or decreases in traffic, verifying the method's ability to accurately identify sudden anomalies such as DDoS attacks and port scans. Furthermore, it can capture early warning signs of anomalies. Therefore, the entire detection method, from the collection and standardization of raw traffic data to the efficient mapping of classical feature vectors to quantum states, and then to the extraction of quantum domain temporal features and the output of predicted values, ultimately achieves accurate judgment of abnormal traffic, forming a closed-loop network anomaly detection system. This effectively solves the technical shortcomings of existing technologies, such as the poor noise resistance of classical temporal models and the high measurement overhead of quantum schemes. It balances detection accuracy, real-time performance, and engineering deployability, and can be stably applied to various network security monitoring scenarios, improving network security protection performance.

[0066] The present invention also provides a computer program product, comprising a computer program that, when executed by a processor, implements the steps of the differential temporal prediction network anomaly detection method formed by any or a combination of the above examples. The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement the present invention.

[0067] The present invention also provides a storage medium having the same inventive concept as the differential temporal prediction network anomaly detection method formed by any or more of the above examples, wherein computer instructions are stored thereon, and the computer instructions, when executed, perform the steps of the differential temporal prediction network anomaly detection method formed by any or more of the above examples.

[0068] Based on this understanding, the technical solution of this embodiment, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0069] This invention also provides a terminal having the same inventive concept as any or a combination of examples corresponding to the above-described differential temporal prediction network anomaly detection method, including a memory and a processor. The memory stores computer instructions executable on the processor, and the processor executes the steps of the above-described differential temporal prediction network anomaly detection method when executing the computer instructions. The processor may be a single-core or multi-core central processing unit or a specific integrated circuit, or one or more integrated circuits configured to implement this invention.

[0070] In one example, the terminal, i.e., the electronic device, is represented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: at least one processing unit (processor) mentioned above, at least one storage unit mentioned above, and a bus connecting different system components (including storage units and processing units).

[0071] The storage unit stores program code that can be executed by the processing unit, causing the processing unit to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit can perform the above-described differential temporal prediction network anomaly detection method.

[0072] The storage unit may include readable media in the form of volatile storage units, such as random access memory (RAM) and / or cache storage units, and may further include read-only memory (ROM).

[0073] The storage unit may also include a program / utility having a set (at least one) of program modules, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0074] A bus can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus that uses any of the various bus structures.

[0075] Through the above description, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to this exemplary embodiment can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the method of this exemplary embodiment.

[0076] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. A method for anomaly detection in differential temporal prediction networks, characterized in that, Includes the following steps: Raw traffic data from the network is collected to form the raw time series of network traffic. This data is then preprocessed to obtain the time series input features and the corresponding true difference values. Variable quantum circuits are used to encode the characteristics of time-series inputs into quantum states. The variable quantum circuit includes a data embedding layer and a variational entanglement layer. The data embedding layer includes a single-bit rotation gate, and the variational entanglement layer adopts a multi-level structure. Each layer includes a trainable single-bit rotation gate and a ring entanglement gate. The single-bit rotation gate encodes each differential feature in the temporal input features into an initial quantum state. The trainable single-bit rotation gate adjusts the probability distribution of the initial quantum state. The ring entanglement gate applies entanglement operations to adjacent qubits to capture the nonlinear correlation between adjacent time steps in the temporal input features, and outputs the evolved quantum state. Only the first qubit of the quantum state is measured using the Pauli Z operator, and the expected value obtained from the measurement is used as the prediction result of the flow differential value at the next time step. The error between the predicted result and the actual difference value is calculated, and the network traffic is judged to be abnormal based on the comparison result of the error and the dynamic threshold.

2. The anomaly detection method for differential time series prediction networks according to claim 1, characterized in that, The preprocessing includes: Normalize the raw time series of network traffic; Perform a first-order difference operation on the normalized flow sequence to extract the flow change difference sequence between two adjacent time points; A fixed-length sliding window is used to extract the difference sequence of flow rate changes, constructing a time-series input feature in the form of a sliding window, and the difference data corresponding to the next time step of the sliding window is used as the prediction label; The length of the sliding window is consistent with the number of qubits in the variable quantum circuit, so that each differential feature corresponds to an independent qubit for encoding.

3. The anomaly detection method for differential time series prediction networks according to claim 2, characterized in that, The length of the sliding window is consistent with the number of qubits in the variable quantum circuit, so that each differential feature corresponds to an independent qubit for encoding.

4. The anomaly detection method for differential time series prediction networks according to claim 1, characterized in that, The trainable single-bit rotation gate includes three types of rotation gates: those around the X-axis, those around the Y-axis, and those around the Z-axis; the ring entanglement gate uses a ring topology to connect adjacent qubits, so that each qubit is entangled with the two adjacent qubits.

5. The anomaly detection method for differential time series prediction networks according to claim 1, characterized in that, Perform a Pauli Z operator measurement on the first qubit of the quantum state. The output expression for the measurement and prediction is: in, The predicted result of the flow difference value at the next time step; The quantum state after evolution through a variable quantum circuit; It is the conjugate transpose of the quantum state after evolution through a variable quantum circuit; For the Pauli Z operator of the measured qubit, This represents the Dirac inner product representation used in quantum mechanics to solve for the expectation value of an operator.

6. The anomaly detection method for differential temporal prediction networks according to claim 1, characterized in that, The variable quantum circuit adopts a classical-quantum hybrid training architecture for end-to-end joint training, with mean square error as the loss function. The parameters of the trainable single-bit rotation gate in the variational entanglement layer are updated by the Adam optimizer. A quantum-classical orthogonal constraint loss term is introduced into the total loss function of joint training to force the classical branch and the quantum branch to extract complementary temporal features.

7. The anomaly detection method for differential time series prediction networks according to claim 1, characterized in that, The dynamic threshold is determined by the mean of the residual error at all times and three times the standard deviation, and the calculation formula is as follows: in, For dynamic thresholds; This is the mean of all residual errors; Let be the standard deviation of all residual errors; when When this happens, the current traffic is determined to be abnormal.

8. The anomaly detection method for differential time series prediction networks according to claim 1, characterized in that, When comparing the error with the dynamic threshold, the rate of change of the quantum measurement expectation value at adjacent time points is calculated to characterize the quantum expectation value drift; when the residual error is greater than the dynamic threshold, the current network traffic is judged to be abnormal by combining the quantum expectation value drift characteristics.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the differential temporal prediction network anomaly detection method according to any one of claims 1-8.

10. A terminal comprising a memory and a processor, wherein the memory stores computer instructions executable on the processor, characterized in that, When the processor executes the computer instructions, it performs the steps of the differential temporal prediction network anomaly detection method according to any one of claims 1-8.

Images