Abnormal traffic flow detection method and device fusing long-term behavior and local burst characteristics

Abstract

The application discloses an abnormal traffic detection method and equipment fusing long-term behavior and local burst characteristics, relates to the technical field of network security and intelligent traffic analysis, and constructs a double-branch structure of long-term behavior modeling and short-time local window modeling to capture macro evolution rules and micro burst mutation modes of network traffic respectively, then introduces a gate adaptive fusion mechanism to dynamically balance the importance of the two types of characteristics, and finally uses the fused comprehensive representation for abnormal traffic detection and threshold determination.

Description

Technical Field

[0001] This invention relates to the fields of network security and intelligent traffic analysis technology, specifically to an abnormal traffic detection method and device that integrates long-term behavior and local burst characteristics. Background Technology

[0002] As the types of network applications continue to increase and communication content becomes increasingly encrypted, traditional network traffic identification methods based on port numbers, protocol fields, or manual rules are gradually becoming insufficient to meet the needs of refined identification in complex network environments.

[0003] Schemes based on Deep Message Parsing (DPI) and Deep Flow Detection (DFI) offer strong interpretability, but DPI struggles to function effectively in encrypted scenarios, its rule base relies on manual maintenance, and it cannot capture temporal dynamic features. Traditional machine learning schemes based on statistical features are simple to implement and fast inference, but feature engineering depends on human experience, has weak ability to represent fine-grained behavior in encrypted traffic, struggles to model temporal dependencies, and exhibits poor generalization. Deep learning methods based on Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) offer strong local feature extraction but limited receptive fields, while RNNs can model temporal dependencies but suffer from long-term limitations. The problem of sequence information decay cannot be fundamentally resolved by fusion schemes due to the inherent contradiction between long sequence modeling and real-time processing. Long sequence modeling schemes based on Temporal Convolutional Networks (TCNs) and Structured State Space Models (SSMs) improve efficiency, but TCNs have fixed receptive fields that struggle to adapt to dynamic behavioral patterns, while SSMs lack sensitivity to high-frequency burst features. Transformer-based sequence modeling schemes achieve global context modeling through self-attention, resulting in leading recognition accuracy, but computational complexity increases quadratically with sequence length, leading to high inference latency in long conversation scenarios and the potential for local burst features to be overlooked. Furthermore, some fusion schemes (such as CNN+RNN concatenation and multimodal splicing) attempt to accommodate multiple features, but suffer from issues such as a lack of parallel interaction in the serial process and a fixed fusion method that cannot adaptively adjust contribution ratios.

[0004] Most existing network traffic detection methods focus on modeling only a single type of feature. Some methods rely on global statistical features or long-term time-series information, but are insensitive to local anomaly patterns; others focus on local window features, but struggle to characterize long-term behavioral evolution patterns. In summary, existing technologies cannot simultaneously address both long-term dependency modeling and short-term burst detection, resulting in insufficient ability to characterize complex anomaly traffic. Summary of the Invention

[0005] Based on the problems raised in the background technology, the purpose of this invention is to provide an abnormal traffic detection method that integrates long-term behavior and local burst features. This solves the problem that the existing technology can only identify abnormal traffic based on a single feature pattern, and cannot simultaneously take into account both long-term traffic behavior changes and local burst abnormal features, resulting in low detection accuracy.

[0006] This invention is achieved through the following technical solution:

[0007] The first aspect of this invention provides an abnormal traffic detection method that integrates long-term behavior and local burst characteristics, comprising the following steps:

[0008] Acquire and parse raw network traffic data;

[0009] Extract packet-level temporal features from the parsed raw network traffic data to construct a sequence of traffic temporal feature vectors;

[0010] The traffic flow time-series feature vector sequence is input into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation;

[0011] The long-term behavioral representation and the local sudden behavioral representation are subjected to gated adaptive fusion to obtain a fused feature representation;

[0012] The fused feature representation is used to detect abnormal traffic, obtain the abnormal probability, and a threshold is determined on the abnormal probability to generate abnormal traffic detection results.

[0013] In the above technical solution, a dual-branch structure of long-term behavior modeling and short-term local window modeling is constructed to capture the macro-evolution law and micro-burst mutation mode of network traffic, respectively. Then, a gating adaptive fusion mechanism is introduced to dynamically balance the importance of the two types of features. Finally, the integrated representation after fusion is used to detect abnormal traffic and determine the threshold.

[0014] In one optional embodiment, extracting packet-level temporal features from the parsed raw network traffic data includes:

[0015] Based on the 5-tuple information, the parsed raw network traffic data is divided into sessions to obtain a traffic session set;

[0016] In the traffic session set, the packets in each traffic session are sorted in ascending order according to the timestamp to form an ordered packet sequence;

[0017] Extract the packet-level time-series features of the ordered message sequence, normalize the packet-level time-series features, and construct a traffic time-series feature vector sequence from the normalized packet-level time-series features.

[0018] In one alternative embodiment, the long-term behavior modeling branch includes:

[0019] A reset gate is used to filter historical state information related to the current anomaly detection when generating candidate hidden states; wherein, the candidate hidden states are used to characterize the potential behavioral change trend under the combined effect of the current input features and the historical states after gating.

[0020] An update gate is used to control the fusion ratio of historical state information and new state information in the current hidden state; wherein, the current hidden state is used to form a continuous progressive behavior representation of network traffic over a long time scale.

[0021] In an optional embodiment, the sequence of traffic time-series feature vectors is input into the long-term behavior modeling branch, including:

[0022] The sequence of time-series traffic feature vectors is used to construct an input difference, and an abnormality-sensitive statistical factor is obtained to characterize the intensity of abnormal disturbances in traffic behavior within the current local window.

[0023] The reset gate is used to perform gating and filtering on the traffic time-series feature vector sequence, and candidate hidden states are obtained;

[0024] The candidate hidden state, the input difference, and the anomaly-sensitive statistical factor are input together into the update gate for fusion and update to obtain the current hidden state;

[0025] The hidden states at all time steps are averaged to obtain the long-term behavioral representation.

[0026] In one optional embodiment, the short-term local window modeling branch includes:

[0027] Local window construction is used to create local sliding windows;

[0028] Local attention computation is used to aggregate contextual information and generate local context within a local sliding window using an attention mechanism.

[0029] Average pooling layers are used to fuse the local context of each time step into a global representation.

[0030] In an optional embodiment, the traffic time-series feature vector sequence is input into the short-time local window modeling branch, including:

[0031] A local sliding window of length w is constructed based on the traffic time-series feature vector sequence, and each sliding window includes w traffic time-series feature vectors;

[0032] For each traffic time-series feature vector within each sliding window, it is mapped to query, key, and value vectors respectively through a learnable weight matrix;

[0033] Local attention is calculated on the query, key, and value vectors, and a local context is generated based on the local attention calculation.

[0034] By fusing the local context of each time step, short-term burst behavior features are generated.

[0035] In one optional embodiment, gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation includes:

[0036] The long-term behavioral representation and the local sudden behavioral representation are vector-concatenated;

[0037] A gating function is used to calculate the fusion weights on the spliced ​​vectors. The long-term behavioral representation and the local burst behavioral representation are then fused using the fusion weights to obtain a fused feature representation.

[0038] A second aspect of the present invention provides an abnormal traffic detection system that integrates long-term behavior and local burst characteristics, comprising:

[0039] The data acquisition module is used to acquire and parse raw network traffic data;

[0040] The feature sequence module is used to extract packet-level temporal features from the parsed raw network traffic data to construct a traffic temporal feature vector sequence.

[0041] The dual-branch detection module is used to input the traffic time-series feature vector sequence into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation.

[0042] The fusion module is used to perform gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation to obtain a fused feature representation;

[0043] An abnormal traffic detection module is used to detect abnormal traffic using the fused feature representation, obtain an abnormal probability, determine a threshold for the abnormal probability, and generate an abnormal traffic detection result.

[0044] A third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements an abnormal traffic detection method that integrates long-term behavior and local burst characteristics.

[0045] A fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an abnormal traffic detection method that integrates long-term behavior and local burst characteristics.

[0046] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0047] 1. By performing time-series analysis and feature construction on the original network traffic, the behavioral evolution characteristics of traffic over a long time scale and the local burst characteristics within a short time range are jointly represented, so that the long-term potential change patterns and local abnormal disturbance patterns of abnormal traffic can be expressed differently in a unified model, thereby improving the feature richness and inter-class distinguishability between normal and abnormal traffic.

[0048] 2. The abnormal traffic detection model, which is based on the long-term behavior modeling branch, the local burst feature extraction branch, and the adaptive fusion mechanism, can achieve high-precision detection and identification of abnormal traffic by relying solely on network traffic time series data, without having to rely on complex manual rules and expert prior knowledge. This improves the universality, robustness and generalization ability of the abnormal traffic detection model.

[0049] 3. By constructing a dual-branch, adaptive fusion anomaly traffic detection model, the accuracy of anomaly traffic detection can be improved based solely on network traffic data without relying on manual rules. It can simultaneously utilize the behavioral evolution information of network traffic over a long time scale and local burst information within a short time range, thereby reducing the threshold for the actual deployment and application of anomaly traffic detection. Attached Figure Description

[0050] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings:

[0051] Figure 1 This is a flowchart illustrating the abnormal traffic detection method that integrates long-term behavior and local burst characteristics provided in Embodiment 1 of the present invention.

[0052] Figure 2 This is a schematic diagram of the dual-branch data processing flow provided in Embodiment 1 of the present invention;

[0053] Figure 3 This is a schematic diagram of the gated adaptive fusion process provided in Embodiment 1 of the present invention;

[0054] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0056] Example 1

[0057] Figure 1 This is a flowchart illustrating the abnormal traffic detection method that integrates long-term behavior and local burst characteristics provided in Embodiment 1 of the present invention. Figure 1 As shown, the abnormal traffic detection method that integrates long-term behavior and local burst characteristics includes the following steps:

[0058] Acquire and parse raw network traffic data;

[0059] Extract packet-level temporal features from the parsed raw network traffic data to construct a sequence of traffic temporal feature vectors;

[0060] The traffic flow time-series feature vector sequence is input into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation;

[0061] The long-term behavioral representation and the local sudden behavioral representation are subjected to gated adaptive fusion to obtain a fused feature representation;

[0062] The fused feature representation is used to detect abnormal traffic, obtain the abnormal probability, and a threshold is determined on the abnormal probability to generate abnormal traffic detection results.

[0063] It should be noted that by constructing a dual-branch structure of long-term behavioral modeling and short-term local window modeling, the macro-evolutionary laws and micro-burst mutation patterns of network traffic are captured respectively. Then, a gating adaptive fusion mechanism is introduced to dynamically balance the importance of the two types of features. Finally, the integrated representation after fusion is used for abnormal traffic detection and threshold determination.

[0064] Acquire and parse raw network traffic data, including:

[0065] The raw network traffic data to be detected is obtained. In this embodiment, the raw network traffic data comes from network packet capture devices, switch mirror ports, traffic probes, security gateways, or historical packet capture files; preferably, it is a pcap file or a pcapng file.

[0066] Furthermore, the parsing of raw network traffic data can be accomplished using packet capture and parsing libraries in Python. The parsed basic fields are then organized into structured samples that can be read by the TensorFlow 2.10 data pipeline.

[0067] For each packet in the raw network traffic data, protocol parsing is performed. First, packet field information is extracted, including: timestamp t. i Source IP address src i Destination IP address dst i Source port sport i Destination port dport i Transport layer protocol type proto i Message length len i TCP flag i , payload length i The extracted i-th message is represented as: .

[0068] It should be noted that the extracted timestamp is used to support packet sorting and time interval calculation; the extracted source IP address, destination IP address, source port, destination port and transport layer protocol are used to support traffic session segmentation; and the extracted packet length, TCP flags and payload length are used to support subsequent packet-level timing feature construction and abnormal behavior pattern characterization.

[0069] Then, the extracted messages are arranged in chronological order to form a message set: .

[0070] Furthermore, corrupted, duplicate, and missing field messages encountered during the parsing process are filtered, corrected, or marked to improve the quality of subsequent modeling data.

[0071] In one optional embodiment, extracting packet-level temporal features from the parsed raw network traffic data includes:

[0072] Based on the 5-tuple information, the parsed raw network traffic data is divided into sessions to obtain a traffic session set;

[0073] In the traffic session set, the packets in each traffic session are sorted in ascending order according to the timestamp to form an ordered packet sequence;

[0074] Extract the packet-level time-series features of the ordered message sequence, normalize the packet-level time-series features, and construct a traffic time-series feature vector sequence from the normalized packet-level time-series features.

[0075] The purpose of this step is to extract feature data for subsequent abnormal traffic detection models.

[0076] Specifically, the parsed raw network traffic data is first segmented into sessions based on the 5-tuple information, which includes: source IP address, destination IP address, source port, destination port, and protocol type. After session segmentation, a traffic session set is obtained. ,in, Indicates the first Each traffic session.

[0077] Secondly, within the traffic session set, the packets in each traffic session are sorted in ascending order according to their timestamps to form an ordered packet sequence: Where L represents the actual number of packets in the current traffic session, and to accommodate the fixed-length input requirements of deep learning models, this embodiment sets the preset input sequence length to T. When, the first T messages are preferred; when When aligning lengths, zero padding is used.

[0078] Extracting packet-level temporal features from an ordered message sequence. In this embodiment, the packet-level temporal features include: packet length len. t Message direction dir t Arrival interval time (iat) t TCP flag encoding t , payload length t Cumulative bytes (cbytes) t The six types of features, namely, the packet-level time series features at the nth time step, are: .

[0079] Among them, the arrival interval time is iat t for , where time t The time represents the timestamp of the t-th message. t−1 Represents the timestamp of the (t-1)th message; cumulative byte count. cbytes t for ; Message direction dir t for .

[0080] The packet-level time-series features are normalized to eliminate the influence of different units on model training. The normalized packet-level time-series features are then used to construct a sequence of traffic time-series feature vectors. , where d represents the dimension of the feature vector at a single time step.

[0081] Furthermore, the normalized traffic time-series feature vector sequence can be further converted into a tensor format supported by TensorFlow 2.10 for use in subsequent model training and inference.

[0082] In one alternative embodiment, the long-term behavior modeling branch includes:

[0083] A reset gate is used to filter historical state information related to the current anomaly detection when generating candidate hidden states; wherein, the candidate hidden states are used to characterize the potential behavioral change trend under the combined effect of the current input features and the historical states after gating.

[0084] An update gate is used to control the fusion ratio of historical state information and new state information in the current hidden state; wherein, the current hidden state is used to form a continuous progressive behavior representation of network traffic over a long time scale.

[0085] The purpose of constructing the long-term behavior modeling branch in this step is to obtain the behavioral evolution of network traffic over a long time scale. Based on this, the behavioral evolution process of network traffic over a long time scale is modeled, thereby obtaining the long-term behavior modeling branch.

[0086] The core of the long-term behavior modeling branch lies in the construction of gating and the recursive state update of the enhanced gating. Specifically, the long-term behavior modeling branch in this embodiment includes an update gate and a reset gate.

[0087] The reset gate is used to filter historical state information related to the current anomaly detection when generating candidate hidden states. Reset gate 𝑟 𝑡 The structure is as follows:

[0088] ;

[0089] in, and These are trainable parameters.

[0090] The aforementioned reset gate filtering suppresses interference from historical information that is irrelevant to the current anomaly detection.

[0091] The candidate hidden state is used to characterize the potential behavioral change trend under the combined effect of the current input features and the historical states after gating. The candidate hidden state is represented as follows:

[0092] ;

[0093] in, and Here are the trainable parameters, and tanh(⋅) represents the hyperbolic tangent activation function.

[0094] The update gate controls the fusion ratio of historical state information and new state information in the current hidden state. (Update gate 𝑧) 𝑡 The structure is as follows:

[0095] ;

[0096] in, This represents the contextual features of the local branch output. Indicates the input difference. Indicates an abnormally sensitive statistical factor. and For trainable parameters, This represents the Sigmoid activation function.

[0097] The current hidden state represents the continuous and iterative behavior of network traffic over a long time scale. In this embodiment, it is obtained by weighted fusion of historical hidden states and candidate hidden states. The current hidden state is represented as follows:

[0098] ;

[0099] Here, ⊙ represents element-wise multiplication.

[0100] Furthermore, the gated recursive state update process can be completed through operations such as tf.keras.layers.Dense, tf.sigmoid, tf.tanh, and tf.matmul in TensorFlow 2.10; the relevant trainable parameters can be defined and updated through tf.Variable or equivalent parameter mechanisms in deep learning frameworks.

[0101] In an optional embodiment, the sequence of traffic time-series feature vectors is input into the long-term behavior modeling branch, including:

[0102] The sequence of time-series traffic feature vectors is used to construct an input difference, and an abnormality-sensitive statistical factor is obtained to characterize the intensity of abnormal disturbances in traffic behavior within the current local window.

[0103] The reset gate is used to perform gating and filtering on the traffic time-series feature vector sequence, and candidate hidden states are obtained;

[0104] The candidate hidden state, the input difference, and the anomaly-sensitive statistical factor are input together into the update gate for fusion and update to obtain the current hidden state;

[0105] The hidden states at all time steps are averaged to obtain the long-term behavioral representation.

[0106] like Figure 2 As shown, the flow time series feature vector sequence is constructed as the input difference. That is, the flow time series features are used as input features, and the change magnitude between two flow time series features at adjacent time steps is calculated. The input difference is represented as follows:

[0107] ;

[0108] An anomaly-sensitive statistical factor is used to characterize the intensity of anomalies in traffic behavior within the current local window. It, along with the traffic temporal feature vector sequence and the candidate hidden states obtained from the reset gate, are fed into the update gate and applied to the update of the current hidden state. The anomaly-sensitive statistical factor is [value missing]. 𝑡 It is expressed as follows:

[0109] ;

[0110] in, Indicates the frequency of direction switching. Indicates the volatility of the time interval. and These are adjustable weighting coefficients.

[0111] Traffic time-series features are input to the reset gate, which performs gating filtering to remove historical information irrelevant to anomaly detection, thereby generating candidate hidden states. Then, the candidate hidden states, input differences, and anomaly-sensitive statistical factors are input to the update gate, which performs weighted fusion of historical and candidate hidden states to form a continuous recursive behavioral representation of network traffic over a long time scale, and finally generates the current hidden state at the current time step.

[0112] Finally, average pooling is performed on the hidden states of all time steps in the traffic temporal feature vector sequence to obtain the long-term behavior representation, which is expressed as follows:

[0113] .

[0114] Furthermore, the average pooling operation can be performed using tf.reduce_mean in TensorFlow 2.10.

[0115] In one optional embodiment, the short-term local window modeling branch includes:

[0116] Local window construction is used to create local sliding windows;

[0117] Local attention computation is used to aggregate contextual information and generate local context within a local sliding window using an attention mechanism.

[0118] Average pooling layers are used to fuse the local context of each time step into a global representation.

[0119] In an optional embodiment, the traffic time-series feature vector sequence is input into the short-time local window modeling branch, including:

[0120] A local sliding window of length w is constructed based on the traffic time-series feature vector sequence, and each sliding window includes w traffic time-series feature vectors;

[0121] For each traffic time-series feature vector within each sliding window, it is mapped to query, key, and value vectors respectively through a learnable weight matrix;

[0122] Local attention is calculated on the query, key, and value vectors, and a local context is generated based on the local attention calculation.

[0123] By fusing the local context of each time step, short-term burst behavior features are generated.

[0124] like Figure 2 As shown, for each time step w, a local sliding window of length w is constructed. The local sliding window is constructed as follows:

[0125] ;

[0126] Perform linear mapping on the feature vectors within the local window to generate the query vector, key vector, and value vector respectively:

[0127] ;

[0128] in, , , This is a learnable weight matrix.

[0129] Local attention is calculated on the query, key, and value vectors to obtain the local attention weights:

[0130] ;

[0131] Generate local context based on the local attention weights calculated from local attention:

[0132] .

[0133] Furthermore, local attention computation can be implemented based on functions such as tf.keras.layers.Dense, tf.matmul, tf.transpose, and tf.nn.softmax in TensorFlow 2.10.

[0134] Average pooling is performed on the local context features at all time steps to obtain short-term burst behavior features:

[0135] .

[0136] Furthermore, pooling operations can be performed using tf.reduce_mean.

[0137] In one optional embodiment, gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation includes:

[0138] The long-term behavioral representation and the local sudden behavioral representation are vector-concatenated;

[0139] A gating function is used to calculate the fusion weights on the spliced ​​vectors. The long-term behavioral representation and the local burst behavioral representation are then fused using the fusion weights to obtain a fused feature representation.

[0140] like Figure 3 As shown, the long-term behavioral representation output by the long-term behavioral modeling branch is 𝑔 (A) The short-term burst behavior representation of the short-term local window modeling branch output. (B) Simultaneously, the input gated adaptive fusion module performs vector concatenation, and the concatenated vector is: [𝑔 (A) ; (B) ].

[0141] The fusion weight φ is calculated using a gating function on the concatenated vectors. The calculation process is as follows:

[0142] ;

[0143] In the above formula, W f and b f These are trainable parameters.

[0144] The long-term behavioral representation and the local sudden behavioral representation are fused by fusion weights:

[0145] ;

[0146] Furthermore, the adaptive fusion process can be implemented based on functions such as tf.concat, tf.keras.layers.Dense, and tf.sigmoid in TensorFlow 2.10.

[0147] Furthermore, abnormal traffic detection is performed using fused feature representations, including:

[0148] The fused feature representation is input into the anomaly detection output head, which outputs the anomaly probability. :

[0149] ;

[0150] Among them, W o and b o These are the trainable parameters for the output layer. This indicates the probability that the traffic session is abnormal.

[0151] Set a detection threshold of 1. If the probability of an anomaly is greater than or equal to the detection threshold, the traffic is considered abnormal; otherwise, it is considered normal traffic.

[0152] ;

[0153] in, This indicates abnormal traffic, while the opposite indicates normal traffic.

[0154] The training phase uses the binary cross-entropy loss function, which is expressed as:

[0155] ;

[0156] Where 𝑦 represents the true label of the sample.

[0157] Furthermore, the loss function can be implemented based on tf.keras.losses.BinaryCrossentropy in TensorFlow 2.10.

[0158] In an optional embodiment, this embodiment also provides a method for updating the training set parameters of the abnormal traffic detection model, the process of which is as follows:

[0159] First, the constructed traffic time-series feature vector sequence and corresponding label data are imported into the TensorFlow 2.10 data pipeline. The sample set can be constructed using tf.data.Dataset.from_tensor_slices, and the shuffle, batch, and prefetch operations are performed sequentially to improve training efficiency.

[0160] During the training phase, the tf.keras.optimizers.Adam built into the TensorFlow 2.10 framework is preferred as the model optimizer, with a learning rate of 0.0003. The recommended default values ​​for beta_1 and beta_2 are 0.9 and 0.999, respectively. The parameters of the long-term behavior modeling branch, the short-term local window modeling branch, the adaptive fusion module, and the anomaly detection output module are jointly updated by minimizing the aforementioned binary cross-entropy loss function.

[0161] Furthermore, model training can be achieved using GradientTape or model.fit; the number of training epochs can be controlled according to the preset value of Epochs.

[0162] Once the abnormal traffic detection model is trained, the time-series feature vector sequence of the traffic to be detected is input into the trained model, the corresponding abnormal probability is output, and the abnormality is determined according to the preset threshold.

[0163] Furthermore, the detection results can be compared with the real labels to construct a confusion matrix, and performance metrics such as accuracy, recall, precision, and F1 score can be calculated to evaluate the model's detection performance.

[0164] Finally, use the `tf.keras.models.save_model` function in TensorFlow 2.10 or the Keras interface to save the trained abnormal traffic detection model so that it can be directly loaded later to complete online or offline abnormal traffic detection tasks.

[0165] The overall process of this method is as follows: First, obtain the pcap file from the network traffic collection device, parse the packets in the pcap file and extract fields such as timestamp, 5-tuple information, packet length, direction, arrival interval, TCP flags and payload length; then, divide the packets into sessions according to the 5-tuple and construct a fixed-length traffic time-series feature vector sequence; subsequently, send the sequence to the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain long-term behavior representation and short-term burst behavior representation; then generate the fused feature representation 𝑔 through the gating adaptive fusion module; finally, output the anomaly probability through the anomaly detection output header and determine whether the traffic session is abnormal traffic according to the preset threshold.

[0166] Through the above implementation methods, the present invention can achieve joint characterization of long-term behavior change patterns and local sudden disturbance patterns of abnormal traffic under the condition of being driven solely by network traffic data, thereby improving the accuracy, robustness and deployment adaptability of abnormal traffic detection.

[0167] Example 2

[0168] Embodiment 2 of the present invention provides an abnormal traffic detection system that integrates long-term behavior and local burst characteristics, based on Embodiment 1. The system includes:

[0169] The data acquisition module is used to acquire and parse raw network traffic data;

[0170] The feature sequence module is used to extract packet-level temporal features from the parsed raw network traffic data to construct a traffic temporal feature vector sequence.

[0171] The dual-branch detection module is used to input the traffic time-series feature vector sequence into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation.

[0172] The fusion module is used to perform gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation to obtain a fused feature representation;

[0173] An abnormal traffic detection module is used to detect abnormal traffic using the fused feature representation, obtain an abnormal probability, determine a threshold for the abnormal probability, and generate an abnormal traffic detection result.

[0174] Example 3

[0175] Figure 4 This is a schematic diagram of the structure of an electronic device provided in Embodiment 3 of the present invention, as shown below. Figure 4 As shown, the electronic device includes a processor 21, a memory 22, an input device 23, and an output device 24; the number of processors 21 in the computer device can be one or more. Figure 4 Taking a processor 21 as an example; the processor 21, memory 22, input device 23, and output device 24 in an electronic device can be connected via a bus or other means. Figure 4 Taking the example of a connection between China and Israel via a bus.

[0176] The memory 22, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules. The processor 21 executes various functional applications and data processing of the electronic device by running the software programs, instructions, and modules stored in the memory 22, thereby implementing the abnormal traffic detection method of Embodiment 1 that integrates long-term behavior and local burst characteristics.

[0177] The memory 22 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created based on terminal usage. Furthermore, the memory 22 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory, or other non-volatile solid-state storage device. In some instances, the memory 22 may further include memory remotely located relative to the processor 21, which can be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0178] Input device 23 can be used to receive user input such as ID and password. Output device 24 is used to output the network configuration page.

[0179] Example 4

[0180] Embodiment 4 of the present invention also provides a computer-readable storage medium, wherein the computer-executable instructions, when executed by a computer processor, are used to implement the abnormal traffic detection method that integrates long-term behavior and local burst characteristics as provided in Embodiment 1.

[0181] The storage medium containing computer-executable instructions provided in the embodiments of the present invention is not limited to the method operation provided in Embodiment 1, but can also perform related operations in the abnormal traffic detection method that integrates long-term behavior and local burst characteristics provided in any embodiment of the present invention.

[0182] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An abnormal flow detection method that integrates long-term behavior and local sudden characteristics, characterized in that, Includes the following steps: Acquire and parse raw network traffic data; Extract packet-level temporal features from the parsed raw network traffic data to construct a sequence of traffic temporal feature vectors; The traffic flow time-series feature vector sequence is input into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation; The long-term behavioral representation and the local sudden behavioral representation are subjected to gated adaptive fusion to obtain a fused feature representation; The fused feature representation is used to detect abnormal traffic, obtain the abnormal probability, and a threshold is determined on the abnormal probability to generate abnormal traffic detection results.

2. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 1, characterized in that, Extract packet-level temporal features from the parsed raw network traffic data, including: Based on the 5-tuple information, the parsed raw network traffic data is divided into sessions to obtain a traffic session set; In the traffic session set, the packets in each traffic session are sorted in ascending order according to the timestamp to form an ordered packet sequence; Extract the packet-level time-series features of the ordered message sequence, normalize the packet-level time-series features, and construct a traffic time-series feature vector sequence from the normalized packet-level time-series features.

3. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 1, characterized in that, The long-term behavior modeling branch includes: A reset gate is used to filter historical state information related to the current anomaly detection when generating candidate hidden states; wherein, the candidate hidden states are used to characterize the potential behavioral change trend under the combined effect of the current input features and the historical states after gating. An update gate is used to control the fusion ratio of historical state information and new state information in the current hidden state; wherein, the current hidden state is used to form a continuous progressive behavior representation of network traffic over a long time scale.

4. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 3, characterized in that, The sequence of time-series traffic feature vectors is input into the long-term behavior modeling branch, including: The sequence of time-series traffic feature vectors is used to construct an input difference, and an abnormality-sensitive statistical factor is obtained to characterize the intensity of abnormal disturbances in traffic behavior within the current local window. The reset gate is used to perform gating and filtering on the traffic time-series feature vector sequence, and candidate hidden states are obtained. The candidate hidden state, the input difference, and the anomaly-sensitive statistical factor are input together into the update gate for fusion and update to obtain the current hidden state; The hidden states at all time steps are averaged to obtain the long-term behavioral representation.

5. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 1, characterized in that, The short-time local window modeling branch includes: Local window construction is used to create local sliding windows; Local attention computation is used to aggregate contextual information and generate local context within a local sliding window using an attention mechanism. Average pooling layers are used to fuse the local context of each time step into a global representation.

6. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 5, characterized in that, The sequence of traffic time-series feature vectors is input into the short-time local window modeling branch, including: A local sliding window of length w is constructed based on the traffic time-series feature vector sequence, and each sliding window includes w traffic time-series feature vectors; For each traffic time-series feature vector within each sliding window, it is mapped to query, key, and value vectors respectively through a learnable weight matrix; Local attention is calculated on the query, key, and value vectors, and a local context is generated based on the local attention calculation. By fusing the local context of each time step, short-term burst behavior features are generated.

7. The abnormal flow detection method integrating long-term behavior and local burst characteristics according to claim 1, characterized in that, Gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation includes: The long-term behavioral representation and the local sudden behavioral representation are vector-concatenated; A gating function is used to calculate the fusion weights on the spliced ​​vectors. The long-term behavioral representation and the local burst behavioral representation are then fused using the fusion weights to obtain a fused feature representation.

8. An abnormal flow detection system integrating long-term behavior and local burst characteristics, used to implement the abnormal flow detection method integrating long-term behavior and local burst characteristics as described in any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to acquire and parse raw network traffic data; The feature sequence module is used to extract packet-level temporal features from the parsed raw network traffic data to construct a traffic temporal feature vector sequence. The dual-branch detection module is used to input the traffic time-series feature vector sequence into the long-term behavior modeling branch and the short-term local window modeling branch respectively to obtain the long-term behavior representation and the local burst behavior representation. The fusion module is used to perform gated adaptive fusion of the long-term behavioral representation and the local burst behavioral representation to obtain a fused feature representation; An abnormal traffic detection module is used to detect abnormal traffic using the fused feature representation, obtain an abnormal probability, determine a threshold for the abnormal probability, and generate an abnormal traffic detection result.

9. An electronic device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the abnormal traffic detection method according to any one of claims 1 to 7, which integrates long-term behavior and local burst characteristics.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the abnormal traffic detection method that integrates long-term behavior and local burst characteristics as described in any one of claims 1 to 7.

Images