A network traffic anomaly behavior detection method

Abstract

The application discloses a network traffic abnormal behavior detection method, and belongs to the technical field of network security and artificial intelligence. The application constructs three kinds of nested alignment multi-scale dynamic space-time interaction graphs of short, medium and long, extracts deep semantic features of encrypted traffic through self-supervised contrast learning and fuses them to the graph edge features; the spatial and time sequence features are respectively extracted through the multi-head graph attention network and the multi-scale dilated time sequence convolution, and the node multi-scale fusion features are obtained through the channel attention fusion; the improved self-attention model with relative position coding is used to predict the features, and the abnormality is determined in combination with the node-level adaptive dynamic threshold; the model is lightened through the structured pruning and 8-bit quantization, the edge cloud collaborative update is realized based on the heterogeneous degree perception asynchronous federal algorithm; and finally, the interpretable analysis report is generated through the large model in the security field. The application significantly improves the detection accuracy of hidden encryption attacks, reduces the false positive rate, and supports edge deployment and data privacy protection.

Description

Technical Field

[0001] This invention relates to the field of network security and artificial intelligence, and in particular to a network traffic anomaly behavior detection method based on multi-scale spatiotemporal graph neural networks, heterogeneous federated learning and lightweight adaptive methods. It can be applied to multiple scenarios such as edge gateways, enterprise intranets, industrial control systems and cloud security centers to achieve a closed-loop protection of encrypted traffic anomaly identification, advanced persistent threat detection and interpretable security operation. Background Technology

[0002] With the widespread adoption of cloud computing, the Internet of Things (IoT), and the Industrial Internet, global network traffic is growing exponentially, while cyberattack methods are continuously evolving towards greater concealment, distribution, and encryption. New types of attacks, such as Advanced Persistent Threats (APTs), slow port scanning, distributed low-speed denial-of-service attacks, and encrypted tunnel data theft, often evade detection by disguising legitimate traffic and employing long-term, low-speed behavior, posing a serious challenge to traditional network security defense systems. Currently, over 80% of network traffic is transmitted using encryption protocols such as TLS / SSL and QUIC, further increasing the difficulty of identifying abnormal behavior.

[0003] Existing network traffic anomaly detection technologies mainly suffer from the following six types of technical defects:

[0004] First, detection methods based on statistical rules and single-time-series deep learning treat traffic as a one-dimensional aggregated time-series signal. Relying on manually set fixed thresholds and single-time-granularity features, they cannot adapt to the dynamic characteristics of network traffic fluctuations throughout the day and night and changes in business cycles. They are prone to generating a large number of false alarms during business peaks and are difficult to capture both second-level sudden attacks and hour-level gradual anomalies simultaneously. They also have a high false negative rate for covert attacks such as slow scanning and low-frequency data leakage. Furthermore, such methods completely sever the topological interaction relationship between network entities and cannot identify distributed collaborative attack behaviors.

[0005] Second, although the detection methods based on graph neural networks introduce topological interaction information, most of them adopt static graph modeling, ignoring the dynamic evolution of network communication relationships over time. Even when a spatiotemporal graph architecture is adopted, a single time step temporal aggregation mechanism is generally used, which fails to achieve feature complementarity across multiple time scales and is not capable of handling both short-term bursts and long-term gradual anomalies.

[0006] Third, there are obvious technical bottlenecks in the field of encrypted traffic detection: the use of man-in-the-middle decryption poses serious legal compliance risks and privacy leaks, and is difficult to adapt to end-to-end encryption protocols such as TLS 1.3; detection methods based on shallow statistical features can only use surface information such as packet length and flow duration, and cannot mine the deep behavioral semantics of encrypted payloads, resulting in extremely low accuracy in identifying malicious communications disguised as normal encrypted traffic.

[0007] Fourth, there is a conflict between model deployment and data privacy: high-precision detection models typically have a large number of parameters and high computational complexity, and can only be deployed on cloud servers, resulting in high detection latency and the risk of leakage of raw traffic data; while edge gateways, industrial controllers and other end-side devices have limited computing power and cannot support complex detection models. At the same time, traffic data across enterprises and branches involves sensitive business information, and cannot be centrally aggregated for training, resulting in poor generalization ability of single-node models and difficulty in dealing with cross-domain collaborative attacks.

[0008] Fifth, the anomaly detection threshold has insufficient adaptive capability: existing solutions mostly use a global fixed threshold or a simple moving average threshold, without differentiating the behavior baseline of different nodes, and lack effective threshold boundary constraints. They are easily affected by extreme traffic events, resulting in threshold drift, and it is difficult to maintain a stable low false alarm rate in dynamic network environments.

[0009] Sixth, the interpretability of detection results is lacking: mainstream deep learning detection models only output anomaly probability scores, which cannot explain the basis for anomaly judgment, the stage of the attack, and the handling strategy. Security operations personnel need to spend a lot of time manually tracing and analyzing the source, resulting in alarm fatigue and making it difficult to support an efficient security operation closed loop.

[0010] In summary, existing technologies generally suffer from multiple technical problems, such as limited spatiotemporal feature scale, weak encrypted traffic detection capabilities, high model deployment thresholds, poor threshold adaptability, insufficient privacy protection, and weak interpretability. There is an urgent need to propose a full-link network traffic abnormal behavior detection scheme that balances detection accuracy, deployment flexibility, environmental adaptability, and privacy security. Summary of the Invention

[0011] The purpose of this invention is to address the shortcomings of existing technologies by providing a method for detecting abnormal network traffic behavior. This method solves the technical problems of insufficient fusion of multi-scale spatiotemporal features, low accuracy of encrypted traffic detection, high model computing power threshold making edge deployment difficult, high false alarm rate of fixed thresholds, significant privacy risks due to data silos, and insufficient interpretability of detection results. The invention achieves high-precision, lightweight, highly adaptive, and privacy-secure closed-loop detection of abnormal network traffic.

[0012] To achieve the above objectives, the present invention adopts the following technical solution: a method for detecting abnormal network traffic behavior, comprising the following steps:

[0013] S1. Construction of Multi-Scale Dynamic Spatiotemporal Interaction Graph and Traffic Preprocessing: Raw network traffic data packets are collected through network interface mirroring, and flow records are generated by aggregating them according to three nested and aligned time granularities: short, medium, and long. Dynamic traffic interaction graphs of the corresponding scales are constructed respectively. Simultaneously, the side-channel sequence features of encrypted traffic are extracted, and data cleaning and normalization are completed.

[0014] S2. Semantic feature extraction of encrypted traffic based on self-supervised contrastive learning: For the message length sequence, time interval sequence and direction sequence of encrypted traffic, a self-supervised pre-training framework combining masked message prediction and contrastive learning is adopted to extract deep semantic feature vectors that do not need to be decrypted, and then integrate them into the edge feature matrix of the corresponding scale dynamic graph.

[0015] S3. Multi-scale spatiotemporal graph neural network joint feature extraction: For dynamic interaction graphs at three scales, spatial topological interaction features are extracted through a multi-head graph attention network, and multi-span temporal dependency features are extracted through a multi-scale dilated temporal convolutional network to generate node-level spatiotemporal feature vectors at each scale; then, multi-scale features are adaptively weighted and fused through a channel attention mechanism to output the final node multi-scale spatiotemporal fusion feature vector.

[0016] S4. Improved Self-Attention Prediction and Adaptive Dynamic Threshold Anomaly Detection: For the historical fusion feature sequence of each node, an improved multi-head self-attention prediction model with relative position encoding and local attention window is introduced as input to generate the predicted feature vector of the next window; the cosine deviation between the predicted feature and the true feature is calculated as the anomaly score, and node-level adaptive dynamic threshold combining exponential weighted moving average and statistical distribution is used for anomaly detection, outputting the abnormal node and the corresponding abnormal subgraph structure.

[0017] S5. Collaborative update of lightweight federated model with heterogeneity awareness: Each edge detection node trains its local model based on local traffic data, and performs joint lightweight processing of structured pruning and 8-bit integer quantization on the trained model; the cloud server receives the quantized model parameters uploaded by the edge nodes, updates the global model based on the asynchronous federated aggregation algorithm with node data heterogeneity awareness, and distributes it to each edge node to complete the iteration.

[0018] S6. Structured Anomaly Interpretability Analysis and Incremental Update: For nodes identified as anomalies, extract the anomaly subgraph structure, key temporal features, and encrypted semantic features, convert them into standardized structured prompt word templates, input them into a large language model fine-tuned in the security domain, and generate an interpretable analysis report containing attack intent inference, ATT&CK tactical phase mapping, and emergency response suggestions; at the same time, high-confidence normal samples are included in the incremental training set, and federated incremental fine-tuning is triggered at fixed intervals.

[0019] Furthermore, in step S1, the three time granularities are divided using a nested alignment method: short-cycle granularity corresponds to a 10-second window, medium-cycle granularity corresponds to a 30-second window, and long-cycle granularity corresponds to a 60-second window; each long-cycle window contains two consecutive medium-cycle windows and six consecutive short-cycle windows, and the starting points of all sub-windows are strictly aligned; the dynamic traffic interaction graph uses IP addresses as nodes and inter-IP communication relationships as directed edges. Node features include 12-dimensional attributes such as inflow and outflow statistics, connectivity, and port entropy, while edge features include 8-dimensional statistical attributes such as flow quantity, packet rate, byte rate, and TCP flag distribution; data cleaning removes incomplete flows, invalid zero-value samples, and duplicate statistical items, and min-max normalization is used to map all features to the [0,1] interval.

[0020] Furthermore, the specific process of self-supervised contrastive learning in step S2 is as follows: Extract the length, time interval, and direction of the first 100 messages from a single encrypted stream into a three-dimensional sequence; construct positive sample pairs using random masks and time jitter; and use different stream sequences as negative samples. A feature extraction network is constructed using a one-dimensional causal convolution and a Transformer encoder to build a joint loss function.

[0021]

[0022] in The mean squared error loss for masked message prediction. For the contrast loss based on InfoNCE, , , where is the weight coefficient; after training, the global pooling output of the Transformer encoder is extracted as the deep semantic vector of the encrypted traffic, and concatenated to the original feature vector of the corresponding edge.

[0023] Furthermore, the computational flow of the multi-scale spatiotemporal graph neural network in step S3 is as follows:

[0024] 1) Spatial Feature Extraction: For each scale snapshot image, a 4-head graph attention network is used to aggregate neighbor nodes and edge features. The attention coefficient is calculated using the following formula:

[0025]

[0026] After softmax normalization, the neighbor features are weighted and aggregated to output the node spatial embedding vector.

[0027] 2) Temporal feature extraction: For each node, a spatially embedded temporal sequence is used. A three-way parallel dilated temporal convolutional network with dilation rates of 1, 2 and 4 is used to capture the temporal dependencies of short, medium and long periods respectively. The three outputs are concatenated to obtain single-scale spatiotemporal features.

[0028] 3) Multi-scale fusion: The spatiotemporal features of short, medium and long scales are concatenated in the channel dimension, input into the channel attention module, and channel weights are calculated through global average pooling and two fully connected layers. After weighting each channel, the final 256-dimensional node fusion feature vector is obtained.

[0029] Furthermore, in step S4, the improved multi-head self-attention prediction model introduces relative temporal position encoding, and the attention score is calculated using the following formula:

[0030]

[0031] in The relative position offset parameter is used; a local attention window constraint is applied, and each time step only interacts with the six time steps before and after it; the anomaly deviation is calculated using 1 minus cosine similarity.

[0032]

[0033] Node-level adaptive dynamic thresholds are updated using an exponentially weighted moving average combined with statistical distribution.

[0034]

[0035] in , The mean and standard deviation of the historical deviation buffer for node v are set, α is the smoothing coefficient, and β is the sensitivity coefficient; at the same time, the upper and lower limits of the threshold are set to ±50% of the initial threshold to avoid threshold drift caused by extreme traffic.

[0036] Furthermore, in step S5, the lightweight processing adopts a joint scheme of structured pruning and 8-bit integer quantization: structured pruning removes channels with weight L1 norm less than a threshold, with a pruning ratio of 35%; 8-bit quantization uses symmetric quantization to convert weights and activation values ​​from 32-bit floating-point numbers to 8-bit integers; the heterogeneous federated aggregation algorithm is as follows: the cloud calculates the Wasserstein distance between the local dataset of each edge node and the global benchmark dataset as a heterogeneity index, dynamically adjusts the proximal term penalty coefficient of local training, and the higher the heterogeneity, the larger the penalty coefficient; during asynchronous aggregation, the contribution weight is calculated based on the node data volume, local loss and heterogeneity, and the global model parameters are updated.

[0037] Furthermore, the structured prompt word template in step S6 includes four parts: system role setting, network environment context, structured description of anomaly subgraph, and statistical summary of key features; the security domain large language model is obtained by fine-tuning the open-source base model using LoRA technology based on the MITREATT&CK knowledge base, CVE vulnerability database, and real alarm analysis data; incremental updates use a small learning rate to fine-tune the top-level parameters of the model, and federated incremental training is triggered once every 10,000 high-confidence normal samples to avoid catastrophic forgetting.

[0038] Compared with the prior art, the present invention has the following significant advantages:

[0039] 1. Improved detection accuracy and broader anomaly coverage. This invention constructs a nested, aligned, multi-scale dynamic spatiotemporal interaction graph, integrating spatial topology information and multi-span temporal features. It also introduces self-supervised encrypted traffic semantic extraction, enabling it to identify both plaintext burst attacks such as SYN floods and port scans, and accurately detect hidden anomalies such as encrypted C2 communication and slow lateral movement. Compared to single temporal detection methods, the overall detection accuracy is improved by over 18%, the recall rate for slow encrypted attacks is improved by over 25%, and the false negative rate is reduced by over 20%.

[0040] 2. The model is highly lightweight and supports edge-cloud collaborative deployment. Through joint optimization of structured pruning and 8-bit quantization, the model size is compressed by more than 75%, inference speed is improved by 2-3 times, and the accuracy loss after pruning and quantization is less than 1%. Inference latency of less than 10ms per sample can be achieved on ordinary ARM architecture edge gateways without uploading raw traffic to the cloud, balancing real-time detection and data privacy. Combined with a heterogeneous federated learning mechanism, edge nodes can collaboratively optimize the model without aggregating raw data, effectively breaking down data silos.

[0041] 3. Strong threshold adaptability and significantly reduced false alarm rate. Employing a node-level adaptive dynamic threshold mechanism, combining statistical distribution characteristics with exponentially weighted smooth updates, and setting threshold boundary constraints, this approach can adapt to differences in the behavioral baselines of different nodes, dynamically adjust judgment criteria according to network service cycles, and avoid threshold distortion caused by extreme traffic. Compared to a globally fixed threshold method, the false alarm rate is reduced by more than 45% during peak business hours, and detection stability is significantly improved.

[0042] 4. Improved interpretability and significantly enhanced operational efficiency. By transforming graph structure features into standardized inputs that are understandable to large models through structured prompt word engineering, interpretable analysis reports that comply with security operation standards are automatically generated, clearly identifying attack intent, tactical phases, and handling recommendations. This reduces threat response time from hours to minutes, effectively alleviating alert fatigue among security operations personnel.

[0043] 5. Strong incremental learning capability and good environment adaptability. It supports federated incremental fine-tuning of high-confidence samples, and the model can continuously learn the normal traffic patterns of the target network. It has low cross-scenario migration cost and can quickly adapt to various deployment environments such as enterprise intranets, industrial control networks, and IoT gateways, making it extremely valuable for engineering implementation. Attached Figure Description

[0044] Figure 1 This is a flowchart illustrating the overall process framework of the network traffic abnormal behavior detection method described in this invention.

[0045] Figure 2 This is a diagram of the architecture for constructing and extracting multi-scale dynamic spatiotemporal interaction graphs as described in this invention.

[0046] Figure 3 This is a schematic diagram of the self-supervised encrypted traffic semantic extraction framework described in this invention;

[0047] Figure 4 This is a flowchart of the adaptive dynamic threshold determination process described in this invention. Detailed Implementation

[0048] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0049] I. Construction of Multi-Scale Dynamic Spatiotemporal Interaction Graph and Traffic Preprocessing

[0050] This step forms the data foundation for the entire detection method. Its core is to convert the original discrete data packets into a multi-granular, structured dynamic graph sequence while retaining the side-channel information of the encrypted traffic, providing standardized input for subsequent feature extraction.

[0051] First, raw network traffic packets are collected via switch port mirroring or NIC promiscuous mode, supporting both the DPDK high-speed packet capture engine and eBPF kernel-level capture methods, adapting to different deployment scenarios from edge gateways to core switches. The collected raw packets are then merged into flows based on a five-tuple (source IP, destination IP, source port, destination port, protocol). Flow timeout is set to 60 seconds; after timeout, the current flow is automatically terminated and a new flow record is generated.

[0052] This invention employs a nested, aligned three-scale time window mechanism to address the issue that a single time granularity cannot simultaneously handle both sudden and gradual anomalies. The three time granularities are: a short-period window of 10 seconds, a medium-period window of 30 seconds, and a long-period window of 60 seconds. For a 60-second detection period with any starting time, a nested partitioning method is used: the long-period scale directly uses the complete 60-second window; the medium-period scale divides the 60 seconds into two consecutive sub-windows of 30 seconds each; and the short-period scale divides the 60 seconds into six consecutive 10-second sub-windows. The starting points of all sub-windows are strictly aligned to ensure temporal consistency in subsequent multi-scale feature fusion.

[0053] For each time window at each scale, a dynamic traffic interaction graph with corresponding granularity is constructed. , where s∈{1,2,3} corresponds to the short, medium, and long scales, respectively. Node set The set is the union of all source and destination IPs appearing within the window. To control the graph size, a Bloom filter is used to filter out background radiation IPs that appear only once, retaining active communication nodes. Edge set For directed communication edges between nodes, a directed edge is generated if there is at least one flow record from IPU to IPv within the window. .

[0054] Node features The system comprises 12 dimensions, covering two types of statistical attributes: inflow and outflow. Outflow characteristics include the number of outflow flows, total number of outflow packets, total number of outflow bytes, number of destination IPs, number of destination ports, and outflow port entropy. Inflow characteristics include the number of inflow flows, total number of inflow packets, total number of inflow bytes, number of source IPs, number of source ports, and inflow port entropy. Port entropy is calculated using the information entropy formula, reflecting the dispersion of port access by nodes. High entropy values ​​typically correspond to port scanning behavior.

[0055] Edge features The original dimension is 8 dimensions, including the number of streams, total number of packets, total number of bytes, average packet length, average stream duration, percentage of SYN packets, percentage of ACK packets, and percentage of RST packets. After the subsequent extraction of encrypted semantic features, the 64-dimensional encrypted semantic vector is concatenated into the edge features, resulting in a final edge feature dimension of 72 dimensions.

[0056] The data preprocessing stage involves three operations: First, data cleaning, which removes invalid samples with all zero features, incomplete streams with discontinuous timestamps, and redundant stream records with repeated statistics. A small number of missing features are filled by linear interpolation of the mean of the preceding and following times. Second, normalization, which uses min-max normalization to map all numerical features to the [0,1] interval to eliminate dimensional differences. Extreme values ​​that exceed the training set range are directly truncated to 0 or 1 to avoid interference from outliers. Third, overlapping sampling, which sets the sliding window step size to 1 / 2 of the window size, meaning that adjacent windows have 50% time overlap, improving sample richness and robustness to temporal boundaries.

[0057] II. Semantic Feature Extraction of Encrypted Traffic Based on Self-Supervised Comparative Learning

[0058] This step addresses the industry pain point of the inability to deeply analyze encrypted traffic. It employs a self-supervised learning framework to extract deep semantic fingerprints from side-channel information, enabling the identification of malicious behavior patterns in encrypted traffic without decryption, thus completely avoiding compliance and privacy risks.

[0059] First, encrypted traffic identification and sequence construction are performed: the protocol identification module filters out encrypted protocol streams such as TLS1.2 / 1.3 and QUIC, and extracts the three-dimensional sequence features of the first 100 packets of each encrypted stream.

[0060] ,in Let be the length of the i-th message. The time interval between the previous message, ∈{0,1} represents the message direction (0 for uplink, 1 for downlink). If the number of messages is less than 100, zero vectors are used to pad the message.

[0061] A self-supervised pre-training design employs a dual-task joint learning framework to simultaneously enhance the model's local contextual understanding and global discriminative abilities.

[0062] 1. Masked Message Prediction Task: Borrowing from the BERT masked language model, 15% of the message features in a random masking sequence are replaced with a special mask vector. The model needs to predict the original length and time interval of the masked message based on contextual information. The loss function uses mean squared error.

[0063]

[0064] This task forces the model to learn the temporal dependencies and protocol state machine characteristics within encrypted traffic.

[0065] 2. Contrastive Learning Task: Positive and negative sample pairs are constructed using the SimCLR framework. Positive samples are generated from the original sequence by randomly discarding 5% of non-critical messages and adding ±5% time jitter noise; sequences from other streams within the same batch are used as negative samples. The InfoNCE loss function is used.

[0066]

[0067] in , The feature vectors of positive sample pairs ( ) represents the cosine similarity, and τ is the temperature coefficient with a value of 0.07; [ [This represents the mathematical expectation.] [ ] is an indicator function.

[0068] The feature extraction network employs a hybrid architecture of one-dimensional causal convolution and a Transformer encoder: the first layer consists of two one-dimensional causal convolutional layers with a kernel size of 3, used to extract local burst patterns in the message; followed by two Transformer encoder layers with four multi-head attention heads and a hidden layer dimension of 64, used to capture long-range periodic and globally dependent features. Causal convolution ensures temporal causality and avoids future information leakage.

[0069] The total weight of the joint loss function is set to The system was trained using the Adam optimizer with an initial learning rate of 1e-4 and 30 training epochs. After training, the global average pooling output of the last layer of the Transformer encoder was extracted to obtain a 64-dimensional encrypted traffic deep semantic vector. This vector was then concatenated with the original 8-dimensional edge features to obtain a 72-dimensional fused edge feature, which was then input into the subsequent spatiotemporal graph neural network.

[0070] III. Joint Feature Extraction from Multi-Scale Spatiotemporal Graph Neural Networks

[0071] This step, through spatial-temporal two-level feature extraction and multi-scale attention fusion, comprehensively captures the network topology evolution patterns across different time spans, and is the core module for improving detection accuracy.

[0072] 1. Spatial Dimension: Feature Extraction from Multi-Head Image Attention Network

[0073] For each snapshot at short, medium, and long scales, a shared-weight 4-head graph attention network (GAT) is used for spatial feature aggregation. GAT adaptively allocates neighbor weights through an attention mechanism, which can distinguish the topological differences between normal high-traffic servers and malicious scanning sources, and is more adaptable to the heterogeneity of network traffic graphs than traditional graph convolution.

[0074] The specific calculation process is as follows: First, a linear transformation is performed on the initial node features and edge features, mapping the node features from 12 dimensions to 64 dimensions, and the edge features from 72 dimensions to 64 dimensions. For the directed edge euv (u points to v), the attention coefficient is calculated:

[0075]

[0076] in , For learnable linear transformation matrices, For attention vectors, This indicates a feature concatenation operation. For nodes... All incoming neighbors are subjected to softmax normalization to obtain the final attention weights:

[0077]

[0078] The updated feature of node v is the weighted sum of the features of all its incoming neighbors:

[0079]

[0080] Simultaneously, the feature aggregation along the edge direction is calculated using the same method. The features of the incoming and outgoing edges are concatenated and then subjected to dimensionality reduction through a linear layer to obtain the final node space embedding. The results of the 4-head attention are concatenated to output a 64-dimensional node space embedding vector.

[0081] By stacking multiple layers of GAT, nodes can aggregate 2-3 hop neighbor information, effectively identifying multi-hop topology anomalies such as lateral movement and botnets. This invention employs a 2-layer GAT structure, balancing feature extraction capabilities with computational efficiency.

[0082] 2. Temporal Dimension: Multi-scale dilated temporal convolutional networks

[0083] For each node, its spatial embedding vector within a continuous time window is collected to form a time series. A multi-scale dilated temporal convolutional network (TCN) is used to extract temporal dependencies, solving the problems of low parallelism and vanishing gradients in long sequences of traditional LSTM.

[0084] This invention designs three parallel dilated convolution branches with dilation rates of 1, 2, and 4, respectively, to capture temporal patterns across time spans of 1, 2, and 4 steps. Each branch contains two residual dilated convolutional layers with a kernel size of 3, and employs causal convolution constraints to ensure temporal causality. The residual connection formula is as follows:

[0085]

[0086] The outputs of the three branches are concatenated along the channel dimension and reduced to 64 dimensions by a 1×1 convolution to obtain the spatiotemporal feature vector of the node at this scale.

[0087] The short, medium, and long scales output 64-dimensional, 128-dimensional, and 256-dimensional spatiotemporal feature vectors, respectively. The larger the scale, the higher the feature dimension, matching the information complexity of different granularities.

[0088] 3. Multi-scale feature channel attention fusion

[0089] The spatiotemporal features at three scales are concatenated along the channel dimension to obtain an initial 448-dimensional concatenated feature. To adaptively enhance high-discrimination feature channels and suppress redundant noise, a channel attention mechanism is introduced for weighted fusion.

[0090] The calculation process is as follows:

[0091] 1. Global Average Pooling: Global average pooling is performed on the 448-dimensional concatenated features to obtain a 1×448 channel global description vector, which aggregates the overall activation level of each channel.

[0092] 2. Weight Mapping: Channel weights are generated through two fully connected layers. The first layer reduces the dimensionality by a ratio of 16:1, reducing the 448 dimensions to 28 dimensions, and uses ReLU activation. The second layer restores the 448 dimensions and uses Sigmoid activation to output weight coefficients between 0 and 1.

[0093] 3. Channel-by-channel weighting: Multiply the weight coefficients element by element with the original splicing features to obtain the weighted fusion features.

[0094] 4. Dimensionality reduction output: The 448-dimensional vector is compressed to 256-dimensional vector through a fully connected layer to obtain the final node multi-scale spatiotemporal fusion feature vector.

[0095] Through the channel attention mechanism, the model can automatically adjust the weights of different scales according to the anomaly type: the weight of short-cycle feature channels increases when detecting sudden DDoS attacks, and the weight of long-cycle feature channels increases when detecting slow APT attacks, which significantly improves the model's ability to adapt to different anomaly types.

[0096] IV. Improved Self-Attention Prediction and Adaptive Dynamic Threshold Anomaly Detection

[0097] This step uses a self-supervised prediction paradigm for anomaly detection, which can detect unknown attacks with only normal samples for training. At the same time, it designs a node-level adaptive dynamic threshold, which greatly reduces the false alarm rate in dynamic environments.

[0098] 1. Improved multi-head self-attention prediction model

[0099] For each node, take the fused feature sequence of the most recent 12 time windows. As input, predict the feature vector for the next window. The prediction model employs an improved multi-head self-attention architecture, introducing two key optimizations:

[0100] First, relative temporal position encoding. Based on standard sinusoidal position encoding, a learnable relative position bias term is introduced. The attention score is calculated using the following formula:

[0101]

[0102] in To determine the relative distance based on time steps The scalar bias parameters of the index have independent bias tables for different attention heads. Relative positional encoding enables the model to more accurately characterize temporal causality, improving prediction accuracy.

[0103] Second, local attention window constraints. Considering the short-term inertia of network behavior, each time step is restricted to interacting with only the six time steps before and after it, forming a sparse attention pattern. This design reduces computation and forces the model to focus on recent behavioral dynamics, which is consistent with the short-term dependency characteristics of network traffic; long-term patterns are indirectly captured through dilated convolution and relative position bias.

[0104] The multi-head attention output is processed by a feedforward network (two fully connected layers + ReLU activation), and the output at the last time step is mapped through a linear layer to generate a 256-dimensional predicted feature vector. The model is trained using only normal traffic samples, and the optimization objective is to minimize the mean squared error between the predicted features and the true features.

[0105] 2. Calculation of Abnormal Deviation

[0106] In the real-time detection phase, the cosine deviation between the predicted feature vector and the true fused feature vector is calculated as the anomaly score:

[0107]

[0108] The deviation value ranges from [0,2]. A larger value indicates a more severe deviation of the node's behavior from the normal pattern and a higher probability of anomaly. Cosine distance is not sensitive to vector scale and focuses more on the directional differences in behavior patterns, making it more stable than Euclidean distance.

[0109] 3. Node-level adaptive dynamic threshold update

[0110] For each node, maintain a 100-bit first-in-first-out historical deviation buffer, storing only deviation samples deemed normal. Dynamically update the threshold based on the buffer's statistical distribution and exponentially weighted moving average (EWMA). The specific steps are as follows:

[0111] 1. Initial threshold calibration: Before deployment, the deviation of each node is calculated using the historical normal traffic of the target environment, and the 95th percentile value is taken as the initial threshold. Newly emerging nodes are cold-started using a global average threshold.

[0112] 2. Daily dynamic update: The mean of the samples in the buffer of each node is calculated every morning. with standard deviation , to obtain the statistical baseline threshold The sensitivity coefficient β is set to 3, conforming to the 3σ principle and covering 99.7% of normal fluctuations. The threshold is then updated using EWMA smoothing.

[0113]

[0114] The smoothing coefficient α is set to 0.2 to balance the adaptability and stability of the threshold.

[0115] 3. Threshold boundary constraints: Set the upper and lower limits of the dynamic threshold to 0.5 times and 1.5 times the initial threshold, respectively. If the calculation result exceeds the range, the boundary value will be forcibly taken to avoid abnormal threshold drift caused by extreme events such as large-scale business fluctuations and temporary data backups.

[0116] 4. Real-time determination: If the current deviation... If the current window of a node is found to have abnormal behavior, an alarm is triggered and the abnormal subgraph is extracted; otherwise, it is considered normal, the deviation is added to the buffer and the oldest value is removed, so as to realize online threshold update.

[0117] This mechanism achieves node-level differentiated baseline adaptation and can dynamically adjust with the network environment. At the same time, it ensures the stability of the detection standard through boundary constraints, reducing the false alarm rate by more than 45% compared with a global fixed threshold.

[0118] V. Collaborative Update of a Lightweight Federated Model for Heterogeneous Perception

[0119] This step resolves the dual contradiction between the privacy risks of data silos and the limitations of computing power in edge deployments, achieving an edge-cloud collaborative protection system where "data does not leave the domain and models co-evolve."

[0120] 1. Lightweight Model Processing

[0121] After local training is completed at each edge node, a lightweight compression scheme using a combination of structured pruning and 8-bit integer quantization is employed to enable the model to run stably on low-computing-power edge devices.

[0122] Structured pruning: For fully connected layers, GAT channels, and TCN convolutional channels, the L1 norm of each channel weight is calculated, and 35% of redundant channels with a norm less than a threshold are removed. After pruning, five rounds of fine-tuning are performed using a small number of normal samples to restore the data, keeping the accuracy loss within 0.8%.

[0123] 8-bit integer quantization: Symmetric quantization is used to convert all model weights and activation values ​​from FP32 to INT8. The quantization scaling factor and zeros of each tensor are determined using a calibration dataset. The quantization formula is as follows:

[0124]

[0125] in This is the scaling factor. Quantization reduces the model size by 75%, integer operations are much faster than floating-point operations, and memory bandwidth requirements are significantly reduced.

[0126] After joint optimization, the total number of parameters of the single-node detection model is less than 5MB. On the Cortex-A72 architecture edge gateway, the average latency of single-window inference is 8.3 milliseconds, and it can process 120 window samples per second, supporting real-time detection of 10Gbps traffic.

[0127] 2. Heterogeneity-aware asynchronous federated aggregation

[0128] The cloud-based federated server is responsible for aggregating the quantized model parameters uploaded by each edge node and updating the global model. To address the model divergence problem caused by significant differences in network environments among nodes and non-identical data distribution (Non-IID), a heterogeneity-aware asynchronous federated aggregation algorithm is designed:

[0129] 1. Local Training: Each edge node performs local training using local traffic data based on the globally distributed model parameters. A proximate term is added to the loss function to limit the local model from deviating too far from the global model.

[0130]

[0131] in Let k be the local detection loss for node k. This is the penalty coefficient for the proximal term.

[0132] 2. Heterogeneity Assessment: A lightweight global benchmark dataset is maintained in the cloud. When edge nodes upload models, the Wasserstein distance between the local dataset and the benchmark dataset is calculated simultaneously. As a measure of data heterogeneity, the Wasserstein distance can accurately measure the geometric differences in high-dimensional distributions and is more stable than the KL divergence.

[0133] 3. Adaptive proximal term: penalty coefficient Dynamically adjusted based on heterogeneity: Nodes with higher heterogeneity have stronger penalties for proximal terms to prevent them from skewing the global model; nodes with low heterogeneity have more local optimization space.

[0134] 4. Asynchronous Weighted Aggregation: The cloud uses an asynchronous aggregation mechanism, receiving model updates from node k. At that time, based on the amount of node data Local verification loss With heterogeneity Calculate contribution weights:

[0135]

[0136] in This represents the set of nodes currently participating in the aggregation. The global model is updated as follows:

[0137]

[0138] This mechanism effectively overcomes the model drift problem of the traditional FedAvg algorithm under heterogeneous data, improves the global model convergence speed by more than 30%, and significantly enhances the cross-scene generalization ability.

[0139] VI. Interpretability Analysis and Incremental Update Closed Loop

[0140] This step achieves a complete closed loop from anomaly detection to operational handling, while continuously improving model performance through incremental learning.

[0141] 1. Interpretability analysis of structured large models

[0142] When a node triggers an anomaly alarm, the system automatically extracts three types of key information: the anomaly subgraph structure (including the communication relationship and edge features of the anomaly node and its one-hop neighbors), the node temporal feature summary (the anomaly score trend and key feature fluctuations in the past 24 hours), and the encryption semantic feature decoding (the behavior pattern matching result of the encrypted stream).

[0143] The image-to-text conversion module structures the above information into standardized prompt word templates, including four fixed modules: system role, environment context, exception details, and task instructions, ensuring the standardization and accuracy of the large model's output. The security domain's large language model adopts a 7B parameter open-source base model, fine-tuned using LoRA technology on the MITREATT&CK knowledge base, CVE vulnerability descriptions, and real alert analysis report datasets. It can be privately deployed on a local server to prevent data leakage.

[0144] The analysis report output by the large model includes three parts: first, attack intent inference, which determines the anomaly type by combining topological behavior and temporal characteristics; second, ATT&CK tactical phase mapping, which marks the corresponding tactical numbers and technical points; and third, tiered emergency response recommendations, providing actionable steps from isolation and blocking to source tracing and evidence collection. This mechanism reduces threat response time from an average of 2 hours to less than 5 minutes, significantly improving security operation efficiency.

[0145] 2. Incremental Model Update

[0146] For high-confidence samples that are judged as normal and whose abnormal scores are below the threshold of 70%, they are automatically included in the local incremental training set. Every 10,000 samples, each edge node triggers an incremental fine-tuning synchronously, using a small initial learning rate of 1 / 10, updating only the top-level parameters of the model to avoid catastrophic forgetting of the underlying feature extraction network.

[0147] After incremental fine-tuning is completed, the node uploads the updated model parameters to the cloud, triggering the next round of federated aggregation, thus enabling continuous iterative evolution of the entire network model. As runtime increases, the model's adaptability to the target network environment gradually improves, and detection accuracy is continuously optimized.

[0148] VII. Comparative Experiments and Effect Verification

[0149] To verify the technical effectiveness of this invention, tests were conducted using the CICIDS2017 public dataset and a self-built encrypted traffic hybrid dataset to compare the detection performance of four existing methods with that of this invention. The comparison methods include: A (traditional entropy fixed threshold method), B (single-scale LSTM autoencoder method), C (static GCN graph detection method), D (ordinary spatiotemporal graph detection method), and E (the method of this invention).

[0150] The evaluation metrics used were accuracy, precision, recall, F1 score, and false alarm rate. The experimental results are shown in the table below:

[0151] sheet

[0152] Method A 77.9% 64.8% 51.9% 0.57 12.7% Method B 89.2% 83.5% 80.7% 0.82 4.9% Method C 85.4% 79.1% 76.3% 0.77 6.8% Method D 91.7% 88.2% 86.5% 0.87 3.5% Method E 96.4% 93.8% 92.1% 0.93 1.9%

[0153] The experimental results show that the method of this invention is significantly better than the comparative method in all indicators. The F1 value reaches 0.93, which is 6.9% higher than the ordinary spatiotemporal graph detection method, and the false alarm rate is reduced to 1.9%, which verifies the synergistic improvement effect of multi-scale feature fusion, encrypted semantic extraction and adaptive threshold.

[0154] Specific tests on slow encrypted C2 communication show that the recall rate of this invention reaches 89.3%, while that of the single-scale LSTM method is only 62.7%, which fully demonstrates the advantages of multi-scale spatiotemporal architecture and self-supervised encrypted semantic extraction in detecting covert encryption attacks.

[0155] In terms of deployment performance, the lightweight model size is 4.2MB, and the single-window inference latency on the Cortex-A72 edge processor is 8.3 milliseconds, which fully meets the real-time detection requirements of the edge gateway. In federated learning mode, after collaborative training of 5 heterogeneous nodes, the global model generalization accuracy is improved by an average of 9.4% compared with a single node, which verifies the practical value of edge-cloud collaboration.

[0156] In summary, this invention systematically solves multiple defects of existing technologies through the collaborative innovation of multi-scale spatiotemporal graph fusion, self-supervised encrypted semantic extraction, lightweight heterogeneous federated learning, and adaptive dynamic threshold. It achieves significant breakthroughs in detection accuracy, deployment flexibility, and environmental adaptability, and possesses outstanding inventiveness, novelty, and practical value.

[0157] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting abnormal network traffic behavior, characterized in that: Includes the following steps: S1. Construction of Multi-Scale Dynamic Spatiotemporal Interaction Graph and Traffic Preprocessing: Collect raw network traffic data packets, aggregate them into flow records according to three nested and aligned time granularities (short, medium, and long), and construct dynamic traffic interaction graphs at the corresponding scales; simultaneously extract side-channel sequence features of encrypted traffic, and complete data cleaning and normalization processing. S2. Semantic feature extraction of encrypted traffic based on self-supervised contrastive learning: For the message length, time interval and direction sequence of encrypted traffic, a self-supervised pre-training framework combining masked message prediction and contrastive learning is adopted to extract deep semantic feature vectors that do not need to be decrypted and integrate them into the edge feature matrix of the corresponding scale dynamic graph. S3. Multi-scale spatiotemporal graph neural network joint feature extraction: For dynamic interaction graphs at three scales, spatial topological interaction features are extracted through a multi-head graph attention network, and multi-span temporal dependency features are extracted through a multi-scale dilated temporal convolutional network to generate node-level spatiotemporal feature vectors at each scale; then, multi-scale features are adaptively weighted and fused through a channel attention mechanism to output node multi-scale spatiotemporal fusion feature vectors. S4. Improved Self-Attention Prediction and Adaptive Dynamic Threshold Anomaly Detection: For the historical fusion feature sequence of each node, an improved multi-head self-attention prediction model incorporating relative position encoding and local attention windows is input to generate the predicted feature vector for the next window; calculation The cosine deviation between the predicted feature and the true feature is used as the anomaly score. Anomaly determination is performed using a node-level adaptive dynamic threshold that combines exponential weighted moving average and statistical distribution. The result is anomaly nodes and their corresponding anomaly subgraph structures. S5. Collaborative update of lightweight federated model for heterogeneous perception: Each edge detection node trains its local model based on local traffic data, and performs joint lightweight processing of structured pruning and 8-bit integer quantization on the trained model. The cloud receives the quantized model parameters uploaded by the edge nodes, updates the global model based on the asynchronous federated aggregation algorithm that is aware of the heterogeneity of node data, and distributes it to each edge node to complete the iteration. S6. Structured anomaly interpretability analysis and incremental update: For nodes identified as anomalies, extract the anomaly subgraph structure, key temporal features and encrypted semantic features, convert them into standardized structured prompt word templates, input them into a large language model fine-tuned in the security domain to generate an interpretable analysis report; at the same time, high-confidence normal samples are included in the incremental training set, and federated incremental fine-tuning is triggered at fixed intervals.

2. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: In step S1, the three time granularities are divided using a nested alignment method: short-cycle granularity corresponds to a 10-second window, medium-cycle granularity corresponds to a 30-second window, and long-cycle granularity corresponds to a 60-second window. Each long-cycle window contains two consecutive medium-cycle windows and six consecutive short-cycle windows, and the starting points of all sub-windows are strictly aligned. The dynamic traffic interaction graph uses IP addresses as nodes and inter-IP communication relationships as directed edges. Node features include 12-dimensional attributes such as inflow and outflow statistics, connectivity, and port entropy. Edge features include 8-dimensional statistical attributes such as flow quantity, packet rate, byte rate, and TCP flag distribution. Data cleaning removes incomplete flows, invalid zero-value samples, and duplicate statistical items. Min-max normalization is used to map all features to the [0,1] interval.

3. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: In step S2, the self-supervised pre-training uses a dual-task joint loss function: in The mean squared error loss for masked message prediction. For the contrast loss based on InfoNCE, , These are the weighting coefficients; After training, the global pooling output of the Transformer encoder is extracted as the deep semantic vector of the encrypted traffic and concatenated to the original feature vector of the corresponding edge.

4. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: The specific calculation process for step S3 is as follows: 1) Spatial feature extraction: For snapshot images at each scale, a 4-head graph attention network is used to aggregate neighbor nodes and edge features. After softmax normalization, the features are weighted and aggregated to obtain the node spatial embedding vector. 2) Temporal feature extraction: For each node, a spatially embedded temporal sequence is used. A three-way parallel dilated temporal convolutional network with dilation rates of 1, 2 and 4 is used to capture the temporal dependencies of short, medium and long periods respectively. The three outputs are concatenated to obtain single-scale spatiotemporal features. 3) Multi-scale fusion: The spatiotemporal features of the three scales are spliced ​​together in the channel dimension, and the channel weights are adaptively calculated by the channel attention module and weighted channel by channel, finally outputting a 256-dimensional node fusion feature vector.

5. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: The improved multi-head self-attention prediction model described in step S4 introduces relative temporal position encoding, and the attention score is calculated using the following formula: in The relative position bias parameter is used; at the same time, a local attention window constraint is applied, and each time step only interacts with the 6 time steps before and after it; the abnormal deviation is calculated using 1 minus cosine similarity, with a value range of [0,2].

6. The method for detecting abnormal network traffic behavior according to claim 5, characterized in that: The update formula for the node-level adaptive dynamic threshold in step S4 is: in , The mean and standard deviation of the historical deviation buffer for node v are given, α is the smoothing coefficient, and β is the sensitivity coefficient. At the same time, the upper and lower limits of the dynamic threshold are set to 0.5 times and 1.5 times the initial threshold, respectively, to constrain the threshold drift range.

7. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: The joint lightweighting process described in step S5 is as follows: structured pruning is used to remove channels with weights whose L1 norm is less than a threshold, with a pruning ratio of 35%; then, symmetric quantization is used to convert the model weights and activation values ​​from 32-bit floating-point numbers to 8-bit integers; after pruning and quantization, a small number of normal samples are used for fine-tuning and recovery, with the accuracy loss controlled within 1%.

8. The method for detecting abnormal network traffic behavior according to claim 7, characterized in that: The heterogeneity-aware asynchronous federated aggregation algorithm described in step S5 is as follows: the cloud calculates the Wasserstein distance between the local dataset of each edge node and the global benchmark dataset as a heterogeneity index, and dynamically adjusts the penalty coefficient of the proximal term in the local training. The higher the heterogeneity, the larger the penalty coefficient. During asynchronous aggregation, contribution weights are calculated based on node data volume, local loss, and heterogeneity, and the global model parameters are updated in a weighted manner.

9. The method for detecting abnormal network traffic behavior according to claim 1, characterized in that: The structured prompt word template mentioned in step S6 includes four parts: system role settings, network environment context, anomaly subgraph structured description, and key feature statistical summary; the security domain big language model is obtained by fine-tuning the open-source base model using LoRA technology based on the MITREATT&CK knowledge base, CVE vulnerability database, and real alarm analysis data; the generated interpretable analysis report includes attack intent inference, ATT&CK tactical phase mapping, and graded emergency response suggestions.

10. The method for detecting abnormal network traffic behavior according to claim 9, characterized in that, In step S6, samples with abnormal scores below 70% of the threshold are selected as high-confidence normal samples. Incremental fine-tuning is triggered once every 10,000 samples. Incremental fine-tuning uses a small learning rate of 1 / 10 of the initial learning rate and only updates the top-level parameters of the model. After fine-tuning is completed, the data is uploaded to the cloud to trigger federated aggregation update.

Images