Anomaly traffic situation awareness method of artificial intelligence application

Abstract

The application discloses an abnormal traffic situation awareness method of artificial intelligence application, and relates to the technical field of network information security.The traffic probe arranged on a network link non-invasively collects the packet arrival timestamp and packet length, does not decrypt the payload, divides burst subsequences according to the arrival time interval and maps the burst subsequences into semantic stage labels, constructs a behavior semantic graph, combines statistical features, and obtains a joint implicit representation vector through a fusion encoder after splicing, projects and decomposes a detection cycle deviation vector into a service drift component and an anti-interference component, only updates the baseline according to the drift component, updates the baseline when the anti-interference component exceeds a threshold, resists baseline pollution, inputs a to-be-detected burst sequence into a mask coding and decoding network pre-trained through self-supervision, obtains an abnormal score according to a reconstruction error, compares the abnormal score with a dynamic threshold, and identifies unknown abnormal traffic.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, specifically to a method for abnormal traffic situation perception in artificial intelligence applications. Background Technology

[0002] With the rapid development of large language models and intelligent agent technology, the service forms of artificial intelligence applications have undergone significant changes. Their typical interaction forms are manifested in complex behavioral patterns such as multi-turn long text dialogues, streaming response output, and autonomous invocation of external tools. At the same time, the widespread adoption of encrypted client greetings by Transport Layer Security Protocol version 1.3 and its extended protocols has made the handshake information of network sessions and application layer payloads encrypted across the entire link. This makes it difficult for traditional deep packet inspection methods that rely on plaintext features to obtain effective discrimination information. As a result, the traffic of artificial intelligence applications exhibits the so-called semantic black box characteristics.

[0003] As an important component of network security protection systems, network intrusion detection systems have long been responsible for identifying abnormal traffic and detecting attack behaviors. Their general workflow includes four stages: traffic collection, feature extraction, model discrimination, and alarm output. In encrypted traffic scenarios, the industry typically uses machine learning classification models based on flow statistical features to replace the traditional load regularization matching method to adapt to network environments that cannot be decrypted. The closest existing technical solution to this invention is an encrypted traffic anomaly detection method based on a combination of flow statistical features and machine learning. This type of solution usually first aggregates data packets into flow records according to five-tuples, then extracts statistical features such as average packet length, packet length variance, flow duration, and uplink / downlink byte ratio from the flow records. The extracted statistical features are then input into a pre-trained classification model to distinguish between normal and abnormal traffic, and a security alarm is triggered for traffic that is determined to be abnormal.

[0004] Some solutions also introduce a sliding window mechanism to periodically retrain the model using newly collected normal traffic samples in order to alleviate the problem of detection performance degradation caused by changes in traffic distribution over time.

[0005] The aforementioned existing technical solutions have the following technical defects: First, the simple stream statistical features relied upon by the existing technologies are from a single source. In the context of complex multi-stage behavioral patterns in artificial intelligence applications, such as long text requests, streaming responses, and toolchain callbacks, simple statistical features are insufficient to bear the semantic information contained in multiple rounds of interaction. This leads to false positives and false negatives in detection models due to insufficient feature representation capabilities in artificial intelligence application scenarios. Second, the network environment and artificial intelligence services themselves are non-stationary. Normal traffic can experience concept drift due to factors such as large model version upgrades and business strategy adjustments. Existing technologies generally treat business concept drift and malicious adversarial avoidance as homogeneous feature deviations and treat them uniformly (which contains technical bias), failing to realize that the two can be understood in the feature latent space. To maintain detection accuracy, existing systems generally employ periodic retraining or online baseline updates through orthogonal subspace separation. However, such strategies lack the ability to distinguish between normal business concept drift and malicious adversarial evasion behaviors. Attackers can gradually adjust the frequency of attack behaviors to make them approach the normal traffic distribution, thereby mixing adversarial probing behaviors into the detection baseline, causing the detection baseline to be gradually contaminated and the detection rate to continuously decline over time. Thirdly, existing supervised detection models rely on known attack feature libraries for training and lack the ability to generalize detection of new AI attack forms that have never appeared before, such as model theft, tool abuse, and long text prompt injection. They can only passively supplement rules after the attack causes losses, making it difficult to proactively discover unknown attacks. Summary of the Invention

[0006] The technical problem this invention aims to solve is: given the widespread adoption of strong encryption protocols such as Transport Layer Security (TLS) version 1.3 and encrypted client greetings, and the semantic black-box nature of AI application traffic, how can we accurately detect abnormal traffic attacks suffered by AI applications without decrypting the traffic payload? Furthermore, how can we overcome the technical problems of existing situational awareness systems, such as the inability to distinguish between normal business concept drift and malicious adversarial evasion leading to gradual contamination of the detection baseline, continuous decay of the detection rate over time, and a lack of generalized detection capabilities for unknown attack patterns?

[0007] To address the aforementioned technical problems, this invention provides a method for detecting abnormal traffic patterns in artificial intelligence applications, comprising: using a traffic probe deployed on the network link between the artificial intelligence application client and the artificial intelligence application server to collect the arrival timestamp, packet length, and 5-tuple information of data packets in a non-intrusive manner, without decrypting the payload of the data packets;

[0008] Based on the comparison results of the arrival time interval of adjacent data packets and the preset burst judgment threshold, the data packet sequence of the same session is divided into multiple burst subsequences. According to the direction, duration and interval pattern of each burst subsequence with adjacent burst subsequences, each burst subsequence is mapped to four semantic stage labels: prompt input, model thinking, action call and observation return. The semantic stage labels are connected in chronological order to construct a behavioral semantic graph representing the multi-round interaction behavior.

[0009] The statistical feature vector of the conversation segment is calculated. The semantic graph embedding features corresponding to the behavioral semantic graph, the burst subsequence embedding features corresponding to the burst subsequence, and the statistical feature vector are concatenated and input into the fusion encoder to obtain the joint implicit representation vector of the conversation segment.

[0010] Calculate the deviation vector between the mean of the joint implicit representation vector in the current detection period and the mean vector of the historical baseline. Project this deviation vector onto the pre-calibrated service drift subspace and adversarial disturbance subspace to obtain the service drift component and the adversarial disturbance component. Calculate the magnitude of the adversarial disturbance component. If the magnitude does not exceed the preset robustness boundary threshold, slide update the historical baseline mean vector based on the service drift component. If the magnitude exceeds the preset robustness boundary threshold, refuse to update the historical baseline mean vector based on the feature deviation vector of the current detection period and generate an adversarial avoidance judgment result.

[0011] The burst sequence of the traffic to be tested is input into a mask encoding and decoding network that has been pre-trained by self-supervised training to obtain the reconstruction result of the traffic to be tested. An anomaly score is calculated based on the original characteristics of the traffic to be tested and the error of the reconstruction result. The anomaly score is compared with a dynamic threshold determined based on the reconstruction error distribution of historical normal traffic. When the anomaly score exceeds the dynamic threshold, the traffic to be tested is determined to be an unknown anomaly traffic.

[0012] Based on the results of the adversarial avoidance assessment and the assessment of unknown abnormal traffic, the risk level and anomaly type label are output.

[0013] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0014] 1. This invention abandons the reliance on plaintext payloads and instead constructs behavioral semantic graphs from side-channel information such as packet length sequences and burst flow timing. Combined with statistical features, it performs joint fusion coding, realizing semantic-level representation of multi-round interaction behavior of artificial intelligence applications without decrypting the traffic payload at all, thus solving the problem of traffic feature failure under encrypted black-box conditions.

[0015] 2. This invention enables the detection model to fully capture the complex semantic structure of AI application interaction behavior through the joint implicit representation of three types of features: semantic, behavioral, and statistical. Compared with existing solutions that rely solely on simple flow statistical features, this invention significantly improves the ability to identify AI-specific attack behaviors such as model theft and tool abuse.

[0016] 3. In the feature latent space, the periodic feature deviation vector is orthogonally projected and decomposed into service drift component and adversarial perturbation component. The baseline is adaptively updated only based on the service drift component. At the same time, a robust boundary threshold is used to actively reject the contamination of the baseline by the adversarial perturbation component. This achieves long-term security and stability of the detection baseline update process and overcomes the technical defect of existing periodic retraining schemes that are easily poisoned by adversarial avoidance behavior.

[0017] 4. This invention is based on masked temporal network and uses only burst sequences of massive normal artificial intelligence traffic for self-supervised pre-training. By reconstructing the loss, it automatically discovers unknown abnormal patterns that deviate from the normal distribution. It can achieve zero-sample generalization detection capability for unknown attacks without the need for manual labeling of zero-day attack samples. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the artificial intelligence application abnormal traffic situation awareness system in an embodiment of the present invention;

[0019] Figure 2 This is a flowchart illustrating the semantic-behavior-statistical three-dimensional joint implicit representation method in an embodiment of the present invention;

[0020] Figure 3 This is a schematic diagram illustrating the principle of the latent space orthogonal decomposition and adaptive baseline robust update mechanism in an embodiment of the present invention. Detailed Implementation

[0021] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0022] The technical solution of the present invention will be further described in detail below with reference to specific embodiments. The following embodiments are only used to illustrate the technical solution of the present invention and are not intended to limit the scope of protection of the present invention.

[0023] The artificial intelligence application abnormal traffic situation awareness system provided in this embodiment includes a traffic side-channel acquisition module, a semantic-behavioral-statistical three-dimensional joint implicit representation module, a latent space orthogonal decomposition adaptive baseline update module, a masked temporal network zero-shot detection module, and a situation awareness display and alarm linkage module. The semantic-behavioral-statistical three-dimensional joint implicit representation module contains a semantic behavior graph reconstruction unit, a statistical feature extraction unit, and a fusion encoding unit. The latent space orthogonal decomposition adaptive baseline update module contains a bias calculation unit, a covariance decomposition unit, a drift and adversarial projection unit, and a baseline sliding update unit. The masked temporal network zero-shot detection module contains a pre-trained mask encoding and decoding network and an anomaly score calculation unit. The above modules are connected in series and work with the situation awareness display and alarm linkage module to complete the end-to-end processing flow from traffic acquisition to situation output.

[0024] I. Detailed Implementation of the Traffic Side Channel Acquisition Module

[0025] The traffic side channel acquisition module is deployed on the network link between the AI ​​application client and the AI ​​application server, specifically on gateway devices or edge security nodes. It uses a kernel-mode program based on eBPF technology to non-intrusively intercept passing network data packets. For each data packet, the acquisition module only records the arrival timestamp, packet length, and a five-tuple of information consisting of the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type. It does not perform any decryption or reading operations on the application layer payload of the data packet, thereby obtaining metadata information with discriminative value while ensuring the privacy of user communication content. The acquisition module segments the data packet sequence of the same session using a fixed-length sliding time window to obtain several session segments. Each session segment contains the packet length sequence and arrival time interval sequence within the time window, and outputs the segmentation results to the semantic-behavioral-statistical three-dimensional joint implicit representation module.

[0026] II. Specific Implementation Methods of the Semantic-Behavioral-Statistical Three-Dimensional Joint Implicit Representation Module

[0027] After receiving the packet length sequence and arrival time interval sequence of the session fragment, the semantic behavior graph reconstruction unit calculates the arrival time interval for each adjacent data packet and then... The data packet and the first The arrival time interval of one data packet is denoted as the time interval value. When this time interval value is less than a preset burst detection threshold, the packet is... Each data packet is assigned to the current burst subsequence;

[0028] When the time interval is not less than the preset burst detection threshold, the first... Each data packet is identified as the starting packet of a new burst subsequence, thereby dividing the session fragment into multiple burst subsequences to characterize the dense pulse characteristics unique to scenarios such as streaming output and long text generation in artificial intelligence applications. The preset burst judgment threshold can be pre-calibrated according to the round-trip latency characteristics of the actual deployment network environment. For example, in a typical local area network deployment scenario, it can be calibrated to an empirical value on the order of several milliseconds. The specific value does not affect the essence of the technical solution of this invention.

[0029] The semantic behavior graph reconstruction unit further maps each burst subsequence to four semantic stage labels based on the direction, duration, and interval pattern with adjacent burst subsequences: prompt input, model thinking, action invocation, and observation return. Specifically, the upward burst subsequence with a long duration is mapped to the prompt input stage, the waiting interval with a large time interval after this stage is mapped to the model thinking stage, the short upward burst subsequence that follows is mapped to the action invocation stage, and the downward burst subsequence that follows is mapped to the observation return stage.

[0030] The four types of stages mentioned above can appear several times in a multi-round interaction process. The semantic behavior graph reconstruction unit connects the divided semantic stage labels into a directed graph structure in chronological order, where nodes represent semantic stages and edges represent the time transition relationship between adjacent stages. Thus, a behavior semantic graph representing the behavior of this multi-round interaction is constructed, and the behavior semantic graph is embedded and encoded to obtain semantic graph embedding features.

[0031] The statistical feature extraction unit calculates the statistical features of the session segment in parallel, including numerical features such as mean packet length, packet length variance, stream duration, and uplink / downlink byte ratio, forming a statistical feature vector.

[0032] The fusion encoding unit concatenates the semantic graph embedding features output by the semantic behavior graph reconstruction unit, the burst subsequence embedding features composed of each burst subsequence, and the statistical feature vector output by the statistical feature extraction unit according to their dimensions. This concatenation is then input into the multi-head self-attention encoder for joint fusion encoding to obtain the joint implicit representation vector of the conversation segment. The above fusion encoding process can be expressed by the following formula:

[0033] ;

[0034] in, Indicates the first The joint implicit representation vector corresponding to each session fragment;

[0035] The semantic graph embedding features representing this segment;

[0036] This represents the burst subsequence embedding features of the segment;

[0037] This represents the statistical feature vector of the segment;

[0038] This represents the operation of concatenating three feature vectors according to their dimensions;

[0039] This indicates the operation of a multi-head self-attention fusion encoder to encode concatenated features. The multi-head self-attention encoder is composed of several layers of self-attention sub-layers and feedforward network sub-layers stacked together. By weighted aggregation of the correlation between different positions in the concatenated features, the output joint implicit representation vector can simultaneously retain semantic structure information, burst temporal information and statistical distribution information, thus overcoming the problem of insufficient expressive power of single-type features.

[0040] III. Detailed Implementation of the Latent Space Orthogonal Decomposition Adaptive Baseline Update Module

[0041] In each detection cycle, the deviation calculation unit collects the joint implicit representation vectors corresponding to all session segments in that cycle, calculates their mean, and subtracts it from the pre-maintained historical baseline mean vector to obtain the feature deviation vector for the current detection cycle.

[0042] The covariance decomposition unit continuously collects feature deviation vector samples from multiple detection cycles, calculates the covariance matrix of this set of samples, and performs eigenvalue decomposition on the covariance matrix. Several eigenvectors with larger eigenvalues ​​are selected to form a low-rank approximate subspace basis. The covariance matrix is ​​calculated as follows:

[0043] ;

[0044] in, Represents the characteristic covariance matrix of the deviation;

[0045] This indicates the number of samples from the historical testing period used for statistical analysis.

[0046] Indicates the first The feature deviation vector corresponding to each detection cycle;

[0047] express The mean vector of the deviation vectors of each detection cycle;

[0048] superscript This represents the vector transpose operation.

[0049] The drift and adversarial projection unit determines the subspace basis vector sets corresponding to the business drift direction and the adversarial disturbance direction from the feature vector set obtained by the covariance decomposition unit, based on the distribution differences between historical normal business drift samples and known adversarial evasion samples (or adversarial samples simulated according to preset rules) in the feature space. These sets constitute the drift projection matrix and the adversarial projection matrix, respectively. Normal business drift samples typically exhibit slow, continuous shifts in the feature space along several relatively fixed directions. In contrast, adversarial evasion samples, due to their attack intent, exhibit shift patterns in the feature space that are systematically different from the normal business evolution direction. The distribution differences between the two constitute the criterion for dividing the two subspace basis vector sets. The drift and adversarial projection unit projects the feature deviation vector of the current detection period onto the aforementioned drift subspace and adversarial subspace, respectively. The projection process can be expressed by the following formula:

[0050] ;

[0051] ;

[0052] in, This represents the feature deviation vector for the current detection period;

[0053] Represents the projection matrix of the business drift subspace;

[0054] Represents the projection matrix of the anti-perturbation subspace;

[0055] This represents the service drift component obtained from the projection;

[0056] This represents the anti-disturbance component obtained from the projection.

[0057] The baseline sliding update unit calculates the magnitude of the adversarial perturbation component as the adversarial decision score, and the decision formula is as follows:

[0058] ;

[0059] in, Indicates the score against the disturbance;

[0060] Represents the L2 norm operation of vectors;

[0061] The meaning is the same as above. When the adversarial perturbation score does not exceed the preset robustness boundary threshold, it is determined that the deviation of the current detection period is mainly due to normal business drift. At this time, the business drift component is weighted according to the preset adaptive learning rate and then superimposed on the historical baseline mean vector to realize baseline sliding update. The update formula is as follows:

[0062] ;

[0063] in, Indicates the first The baseline mean vector used in each detection cycle;

[0064] This indicates that the updated version is available for the first time. Add a baseline mean vector used in one detection cycle;

[0065] This indicates the preset adaptive learning rate, used to control the magnitude of baseline updates;

[0066] The same applies above. When the adversarial disturbance score exceeds the preset robust boundary threshold, it is determined that there may be adversarial evasion behavior within the detection period. At this time, the joint implicit representation features of the period are not included in the baseline update, that is, the above baseline sliding update operation is not performed. The determination result is reported as the adversarial evasion determination result to the situational awareness display and alarm linkage module for verification. The preset robust boundary threshold can be pre-calibrated according to the historical normal business fluctuation range. During the calibration process, the quantile covering most samples of the historical normal business deviation vector projected on the adversarial subspace can be selected as the threshold based on the statistical distribution of the component magnitudes. This ensures that normal business drift is not misjudged, while maximizing the detection capability of subtle adversarial evasion behavior.

[0067] IV. Detailed Implementation of the Zero-Shot Detection Module in Masked Temporal Networks

[0068] The training process of the masked encoding and decoding network belongs to the pre-training stage, which specifically includes: obtaining burst sequence samples of massive normal artificial intelligence application traffic in the daily real business of enterprises, without any manual attack annotation, and directly using them as input data for self-supervised pre-training;

[0069] For each input burst sequence, multiple time step positions are randomly selected according to a preset mask ratio, and the original feature values ​​of the selected time step positions are replaced with preset mask marker vectors to form a masked input sequence.

[0070] The masked input sequence is input into the encoder. The encoder extracts a high-dimensional hidden representation of the sequence based on the context information of the unmasked positions. The hidden representation is then input into the decoder. The decoder outputs a reconstructed prediction value for the masked time step position.

[0071] The reconstruction loss is calculated based on the error between the reconstructed predicted value and the original true feature value at that location. The network parameters of the encoder and decoder are then updated using the backpropagation algorithm. This masking, encoding, decoding, and parameter update process is repeated until the reconstruction loss converges, completing the pre-training of the masking-encoding-decoding network. The formula for calculating the reconstruction loss is as follows:

[0072] ;

[0073] in, Indicates the reconstruction loss;

[0074] This represents the set of time steps where the image is currently masked.

[0075] Represents a set The number of locations included;

[0076] Indicates the first The original true feature vectors of the masked positions;

[0077] Indicates the decoder for the first The reconstructed prediction vector output at each position;

[0078] This represents the square operation of the second norm of a vector.

[0079] During the online detection phase, the anomaly score calculation unit inputs the burst sequence of the traffic to be tested (without masking) into the trained masked encoder-decoder network to obtain the reconstruction result of the sequence, and calculates the average reconstruction error of the entire sequence as the anomaly score of the sequence. The calculation formula is as follows:

[0080] ;

[0081] in, This indicates the anomaly score of the sequence under test;

[0082] This indicates the total number of time steps contained in the sequence under test;

[0083] Indicates the first The original feature vectors at each time step;

[0084] This indicates that the mask encoding / decoding network is for the first... The reconstructed prediction vector output at each time step, the anomaly score calculation unit dynamically calculates the judgment threshold of the anomaly score based on the quantile of the reconstruction error distribution of recent historical normal traffic. If the current anomaly score exceeds the dynamic threshold, the traffic to be tested is determined to be an unknown anomaly, and its corresponding sudden behavior characteristics are fed back to the situational awareness display and alarm linkage module to assist in judging the specific attack type.

[0085] If the dynamic threshold is not exceeded, the traffic to be tested is determined to be normal traffic. Since the mask encoding and decoding network is only self-supervised pre-trained based on normal traffic samples, the statistical regularity of its sudden sequences deviates systematically from normal samples for novel abnormal forms such as model theft, tool abuse, and long text prompt injection. Therefore, it will generate a reconstruction error that is significantly higher than that of normal samples during the reconstruction process, thereby achieving zero-sample generalization detection capability that can discover unknown anomalies without manual annotation of attack samples.

[0086] V. Specific Implementation Methods of the Situation Awareness Display and Alarm Linkage Module

[0087] The situational awareness display and alarm linkage module integrates the adversarial evasion judgment results output by the latent space orthogonal decomposition adaptive baseline update module and the unknown abnormal traffic judgment results output by the masked temporal network zero-shot detection module. It combines the above two types of judgment results to generate risk level and abnormality type labels and output them externally. At the same time, it can trigger security devices such as firewalls and security gateways to take corresponding actions according to preset linkage policies. For example, it can implement actions such as rate limiting, blocking, or manual verification and forwarding for sessions that are judged to have adversarial evasion behavior or unknown abnormal traffic.

[0088] VI. Alternative Implementation Methods

[0089] In the implementation of the semantic-behavioral-statistical three-dimensional joint implicit representation module, in addition to using a multi-head self-attention encoder, the fusion coding unit can also use a hybrid network structure combining convolutional neural networks and long short-term memory networks to complete the fusion coding of the three features. This alternative method reduces the consumption of computing resources while retaining the idea of ​​joint representation of semantic, behavioral and statistical features, and is suitable for application scenarios deployed on edge gateway devices with limited computing power.

[0090] In the implementation of the latent space orthogonal decomposition adaptive baseline update module, in addition to using the orthogonal projection method based on the eigenvalue decomposition of the covariance matrix, the decoupling of the service drift component and the adversarial disturbance component can also be achieved by using a continuous learning regularization method based on parameter importance measurement. By evaluating the sensitivity of the detection model parameters to the discrimination loss of historical normal samples, the update range of the baseline model parameters is constrained, thereby achieving a balance between service drift adaptability and anti-pollution capability at the model parameter space level rather than the feature projection space level, as a supplementary implementation of the decoupling update mechanism of this invention.

[0091] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A method for detecting abnormal traffic patterns in artificial intelligence applications, characterized in that, include: By deploying traffic probes on the network link between the AI ​​application client and the AI ​​application server, the arrival timestamp, packet length, and 5-tuple information of data packets in the network session are collected in a non-intrusive manner without decrypting the payload of the data packets. The data packet sequence of the same session is segmented using a sliding time window of fixed duration to obtain multiple session segments; Based on the comparison results of the arrival time interval of adjacent data packets and the preset burst judgment threshold, the data packet sequence of the same session is divided into multiple burst subsequences. According to the direction, duration and interval pattern of each burst subsequence with adjacent burst subsequences, each burst subsequence is mapped to four semantic stage labels: prompt input, model thinking, action call and observation return. The semantic stage labels are connected in chronological order to construct a behavioral semantic graph representing the multi-round interaction behavior. Calculate the statistical feature vector of the conversation segment, and then concatenate the semantic graph embedding features corresponding to the behavior semantic graph, the burst subsequence embedding features corresponding to the burst subsequence, and the statistical feature vector and input them into the fusion encoder to obtain the joint implicit representation vector of the conversation segment. Calculate the deviation vector between the mean of the joint implicit representation vector and the historical baseline mean vector within the current detection period. Project the deviation vector onto the pre-calibrated service drift subspace and adversarial perturbation subspace to obtain the service drift component and the adversarial perturbation component. Calculate the magnitude of the adversarial perturbation component. If the magnitude does not exceed a preset robustness threshold, perform a sliding update on the historical baseline mean vector based on the service drift component. If the magnitude exceeds the preset robustness threshold, refuse to update the historical baseline mean vector based on the feature deviation vector of the current detection period, and generate an adversarial avoidance judgment result. The burst sequence of the traffic to be tested is input into a mask encoding and decoding network that has been pre-trained by self-supervised training to obtain the reconstruction result of the traffic to be tested. An anomaly score is calculated based on the error between the original characteristics of the traffic to be tested and the reconstruction result. The anomaly score is compared with a dynamic threshold determined based on the reconstruction error distribution of historical normal traffic. When the anomaly score exceeds the dynamic threshold, the traffic to be tested is determined to be unknown anomaly traffic. Based on the results of the anti-avoidance judgment and the judgment results of the unknown abnormal traffic, the risk level and anomaly type label are output.

2. The method according to claim 1, characterized in that, The steps for dividing a sequence of data packets from the same session into multiple burst subsequences include: calculating the... The data packet and the first Subtract the arrival time interval of one data packet. If the arrival time interval is less than a preset burst detection threshold, then... Each data packet is assigned to the current burst subsequence; When the arrival time interval is not less than the preset burst determination threshold, the first... One data packet serves as the starting packet for a new burst subsequence.

3. The method according to claim 1, characterized in that, The step of concatenating the semantic graph embedding features, the burst subsequence embedding features, and the statistical feature vector and inputting them into the fusion encoder, and then using a multi-head self-attention encoder to encode the concatenated feature vector to obtain the joint implicit representation vector of fixed dimensions.

4. The method according to claim 1, characterized in that, The service drift subspace and the anti-disturbance subspace are pre-calibrated in the following manner: Collect feature deviation vector samples from multiple detection periods, calculate the covariance matrix of the feature deviation vector samples, and perform eigenvalue decomposition on the covariance matrix; Based on the distribution differences between historical normal business drift samples and known adversarial avoidance samples in the feature space, the subspace basis vector set corresponding to the business drift direction and the subspace basis vector set corresponding to the adversarial disturbance direction are determined from the feature vectors obtained by the eigenvalue decomposition.

5. The method according to claim 1, characterized in that, The step of sliding update of the historical baseline mean vector based on the business drift component involves weighting the business drift component according to a preset adaptive learning rate and then superimposing it onto the historical baseline mean vector to obtain the baseline mean vector for use in the next detection cycle.

6. The method according to claim 1, characterized in that, The mask encoding / decoding network is pre-trained in the following manner: Obtain burst sequence samples of normal artificial intelligence application traffic, randomly select multiple time step positions in the burst sequence samples according to a preset mask ratio, replace the original feature values ​​of the selected time step positions with a preset mask marker vector, and form a masked input sequence. The masked input sequence is input into the encoder to obtain the hidden representation of the masked input sequence. The hidden representation is then input into the decoder to obtain the reconstructed prediction value at the selected time step. The reconstruction loss is calculated based on the error between the reconstructed predicted value and the original feature value at the selected time step. The network parameters of the encoder and the decoder are updated through backpropagation based on the reconstruction loss until the reconstruction loss converges.

7. The method according to claim 1, characterized in that, The dynamic threshold is determined based on the quantiles of the reconstruction error distribution of recent historical normal traffic.

8. An abnormal traffic situation awareness system for artificial intelligence applications, characterized in that, include: The traffic side channel acquisition module is used to collect the arrival timestamp, packet length, and 5-tuple information of data packets in a network session in a non-intrusive manner through a traffic probe deployed on the network link between the AI ​​application client and the AI ​​application server, without decrypting the payload of the data packets. The semantic-behavioral-statistical three-dimensional joint implicit representation module is connected to the traffic side channel acquisition module. It is used to divide the data packet sequence of the session into multiple burst subsequences according to the arrival timestamp of the acquired data packets, map each burst subsequence to a semantic stage label and construct a behavioral semantic graph, calculate the statistical feature vector of the session fragment, and fuse and encode the semantic graph embedding feature corresponding to the behavioral semantic graph, the burst subsequence embedding feature corresponding to the burst subsequence, and the statistical feature vector to obtain the joint implicit representation vector. The latent space orthogonal decomposition adaptive baseline update module is connected to the semantic-behavior-statistical three-dimensional joint implicit representation module. It is used to calculate the deviation vector between the mean of the joint implicit representation vector and the historical baseline mean vector in the current detection period, decompose the deviation vector into service drift component and adversarial disturbance component, and control the update of the historical baseline mean vector according to the magnitude of the adversarial disturbance component. The zero-shot detection module of the masked temporal network is connected to the semantic-behavioral-statistical three-dimensional joint implicit representation module. It is used to input the burst sequence of the traffic to be tested into the masked encoding and decoding network that has been pre-trained by self-supervised training, calculate the anomaly score based on the reconstruction error, and compare the anomaly score with the dynamic threshold to determine whether it is an unknown anomaly traffic. The situational awareness display and alarm linkage module is connected to the latent space orthogonal decomposition adaptive baseline update module and the masked temporal network zero-shot detection module, respectively. It is used to output risk level and anomaly type label based on the adversarial avoidance judgment result generated during the baseline update process and the judgment result of the unknown abnormal traffic.

9. The system according to claim 8, characterized in that, The traffic side channel acquisition module is implemented based on eBPF technology and is used to collect the arrival timestamp, packet length and 5-tuple information of the data packets in a non-intrusive manner in the operating system kernel mode, without decrypting the payload of the data packets.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the abnormal traffic situation awareness method for artificial intelligence applications as described in any one of claims 1 to 7.

Images