A dynamic prototype network-based continuous single-classification anomaly traffic detection method
Patent Information
- Application Number
- CN202611316388.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-28
- Publication Date
- 2026-10-27
AI Technical Summary
[0005]（1）静态训练模式：大多数方法采用离线一次性训练，模型参数和结构在部署后固定不变，无法适应网络流量分布的动态变化，即概念漂移问题
[0048]1、本发明仅使用正常流量数据训练，无需标注的攻击样本，天然适合零日攻击检测。
Smart Images
Figure CN122994057A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of interdisciplinary technology of network security and artificial intelligence, and specifically to a method for continuous single-classification abnormal traffic detection based on dynamic prototype networks. Background Technology
[0002] With the rapid development of network technology and the deepening of digital transformation, cybersecurity threats are becoming increasingly complex and diversified. Network attack methods are constantly evolving, with new attack methods such as zero-day attacks and advanced persistent threats (APTs) emerging one after another, posing a severe challenge to network security defense systems. Anomaly traffic detection, as a key component of network security defense, aims to identify suspicious behaviors in network traffic that deviate from normal patterns and is one of the core technologies of intrusion detection systems (IDS).
[0003] Existing anomaly traffic detection technologies are mainly divided into three categories: rule-based matching methods, supervised learning methods, and unsupervised / single-classification learning methods. Rule-based matching methods rely on expert knowledge to build rule bases, which are effective against known attacks but cannot detect unknown attacks. Supervised learning methods require a large number of labeled attack samples for training, resulting in high labeling costs and an inability to cover zero-day attacks. Single-classification learning methods use only normal traffic data to train the model, identifying anomalies by detecting traffic deviating from normal patterns, making them naturally suitable for zero-day attack detection scenarios.
[0004] However, existing single-class abnormal traffic detection methods have the following technical problems:
[0005] (1) Static training mode: Most methods adopt offline one-time training. The model parameters and structure remain unchanged after deployment, which cannot adapt to the dynamic changes in network traffic distribution, i.e. concept drift problem.
[0006] (2) Catastrophic forgetting: When the model needs to adapt to new traffic patterns, fine-tuning on new data can lead to forgetting of old patterns and degradation of detection performance.
[0007] (3) Limitations of feature representation: Most methods only focus on one of the statistical features or time-series features of traffic, lack joint modeling of the spatiotemporal features of traffic, and have limited feature representation capabilities.
[0008] (4) Fixed threshold: The anomaly detection threshold is usually fixed based on the training set and cannot be adaptively adjusted according to changes in the operating environment, resulting in fluctuations in false alarm rate and false negative rate.
[0009] In recent years, the interdisciplinary research of continuous learning and novelty detection has provided new ideas for solving the above problems. ACORN-IDS proposed a continuous novelty detection framework, which achieves continuous optimization of feature embedding through clustered pseudo-labels and metric learning. However, this scheme uses a fixed PCA reconstruction module for anomaly scoring, which has limited expressive power; the quality of pseudo-labels is greatly affected by the K-Means clustering algorithm; and it lacks a joint modeling mechanism for the spatiotemporal features of traffic. Summary of the Invention
[0010] To address the aforementioned problems in existing technologies, this invention proposes a continuous single-classification anomaly traffic detection method based on a dynamic prototype network. This invention uses only normal traffic data for training, eliminating the need for labeled attack samples. It can continuously adapt to dynamic changes in network traffic distribution, effectively detecting zero-day attacks and unknown threats, and boasts advantages such as high detection accuracy, low forgetting rate, and low inference overhead.
[0011] The technical solution adopted in this invention is as follows:
[0012] A continuous single-classification anomaly traffic detection method based on a dynamic prototype network includes the following steps:
[0013] Step 1: Obtain network traffic data by capturing data packets, preprocess the network traffic data, and extract multi-dimensional spatiotemporal feature vectors;
[0014] Step 2: Construct a spatiotemporal joint encoder based on an attention mechanism. The spatiotemporal joint encoder maps the multidimensional spatiotemporal feature vectors to a low-dimensional feature space to obtain the traffic feature embedding vectors.
[0015] Step 3: Construct a dynamic prototype memory to store and continuously update representative prototypes of normal traffic; continuously train the spatiotemporal joint encoder using the triplet contrast learning objective.
[0016] Step 4: Based on the dynamic prototype memory, calculate the normalized distance between the traffic sample to be tested and the nearest neighbor prototype to obtain the anomaly score of the traffic sample to be tested, and combine it with the adaptive threshold mechanism based on Bayesian optimization to determine whether the traffic sample to be tested is abnormal traffic.
[0017] Furthermore, in step 1, the specific method for extracting the multidimensional spatiotemporal feature vector is as follows:
[0018] The data packets are parsed using a five-tuple of source IP, destination IP, source port, destination port, and protocol type to extract traffic metadata features;
[0019] Network traffic data is segmented according to a preset time window, and statistical characteristics within each time window are calculated, including the average number of packets, the average number of bytes, the average and variance of packet arrival intervals, and the flow duration.
[0020] Extract the side-channel features of the traffic, including the Fourier transform coefficients of the packet length sequence and the autocorrelation coefficient of the packet arrival time interval;
[0021] The traffic metadata features, statistical features, and side-channel features are concatenated into a multi-dimensional spatiotemporal feature vector with a single time window.
[0022] Furthermore, the input to the spatiotemporal co-encoder is a temporal feature sequence formed by stacking multidimensional spatiotemporal feature vectors from multiple consecutive windows; the spatiotemporal co-encoder includes:
[0023] The temporal attention module is used to perform self-attention calculation on temporal feature sequences to capture the temporal dependencies of traffic patterns;
[0024] The spatial attention module is used to perform cross-attention calculations on traffic metadata features, statistical features, and side-channel features within a single window to capture the correlation between network entity attributes and traffic behavior patterns.
[0025] The feature fusion layer is used to weight and fuse the outputs of the temporal attention module and the spatial attention module, and then map them to a low-dimensional feature space through a multi-layer fully connected network to obtain the traffic feature embedding vector.
[0026] Furthermore, in step 3, the specific method for storing and continuously updating representative prototypes of normal traffic through a dynamic prototype memory is as follows:
[0027] Initialization phase: Run the K-Means clustering algorithm on normal traffic data to obtain K cluster centers as initial prototypes, which are stored in the dynamic prototype memory;
[0028] Update phase: For a newly arrived normal traffic sample, calculate the distance between its traffic feature embedding vector and all current prototypes. If the nearest distance exceeds the preset update threshold, add the sample as a new prototype to the memory. If the nearest distance is less than the preset merging threshold, merge the sample into the nearest prototype and update the prototype to the weighted average of the two. If the nearest distance is between the merging threshold and the update threshold, do not modify the prototype, but only update the matching frequency and the most recent update timestamp of the corresponding prototype.
[0029] Elimination phase: When the number of prototypes in the dynamic prototype memory exceeds the preset capacity limit, remove the prototype with the oldest recent update timestamp and the lowest matching frequency.
[0030] Furthermore, in step 3, the specific method for continuously training the spatiotemporal joint encoder using the triplet contrast quantity learning objective is as follows:
[0031] For each training sample, it is used as the anchor sample, the prototype corresponding to its cluster pseudo-label is selected as the positive sample, and the prototypes of other clusters are randomly selected as the negative samples to construct a triplet consisting of the anchor sample, the positive sample, and the negative sample.
[0032] Construct the total loss function The spatiotemporal joint encoder is continuously trained; the total loss function is... for:
[0033]
[0034] in, and These are the weighting coefficients. To reconstruct the loss function, The triplet loss function is calculated as follows:
[0035]
[0036] In the formula, For Euclidean distance, For preset boundary values, For anchor samples, As a positive sample, For negative samples, This indicates taking the maximum value.
[0037] Furthermore, in step 4, the Bayesian-optimized adaptive threshold mechanism includes:
[0038] In the initial stage, based on the abnormal score distribution of the normal traffic validation set, the optimal initial threshold is searched through Bayesian optimization so that the false positive rate on normal traffic does not exceed the preset target false positive rate.
[0039] During the deployment phase, a sliding window is maintained to record the abnormal scores of the most recent samples that were judged as normal traffic. When the change in the mean or standard deviation of the abnormal scores within the window exceeds the change threshold, the threshold is updated.
[0040] The threshold update uses a Bayesian optimization method to search for a new optimal threshold in the neighborhood of the current threshold, so that the abnormal score distribution of normal samples within the sliding window remains stable.
[0041] Furthermore, in step 3, when continuously training the spatiotemporal joint encoder, a progressive normality modeling strategy based on course learning is adopted, specifically as follows:
[0042] The normal traffic training samples are sorted from low to high according to the abnormal scores, and the training samples with the lowest scores are used for initial training.
[0043] As the number of training rounds increases, higher-scoring normal samples are introduced, enabling the spatiotemporal joint encoder to gradually learn more complex normal patterns.
[0044] A linearly increasing function is used to schedule the difficulty of the courses, controlling the upper limit of the sample difficulty introduced in each training stage.
[0045] Furthermore, the spatiotemporal joint encoder also includes a reconstruction decoder, which is used to reconstruct the low-dimensional feature embedding vector back to the original feature space and calculate the reconstruction error as an auxiliary anomaly scoring index.
[0046] In step 4, the anomaly score is a weighted fusion of normalized distance and reconstruction error.
[0047] Compared with the prior art, the beneficial effects achieved by this invention are as follows:
[0048] 1. This invention uses only normal traffic data for training and does not require labeled attack samples, making it naturally suitable for zero-day attack detection.
[0049] 2. This invention, through a dynamic prototype memory and a continuous learning mechanism, can adapt to the dynamic changes in network traffic distribution and has near-zero forgetting characteristics.
[0050] 3. The spatiotemporal joint encoder of the present invention can simultaneously capture the temporal pattern and spatial correlation of traffic, and has strong feature representation capability.
[0051] 4. The adaptive threshold mechanism of the present invention can dynamically adjust the detection threshold according to environmental changes, and maintain stable detection performance.
[0052] 5. The inference overhead of this invention is small, making it suitable for real-time deployment. Attached Figure Description
[0053] Figure 1 This is the overall flowchart of the present invention.
[0054] Figure 2 This is a schematic diagram of the principle of a spatiotemporal joint encoder based on an attention mechanism.
[0055] Figure 3 This is a flowchart for the management of the dynamic prototype memory. Detailed Implementation
[0056] The present invention will now be described in detail with reference to the accompanying drawings.
[0057] A continuous single-classification anomaly traffic detection method based on dynamic prototype networks, such as Figure 1 As shown, it includes the following steps:
[0058] Step 1: Obtain network traffic data by capturing data packets, preprocess the network traffic data, and extract multi-dimensional spatiotemporal feature vectors. Specifically:
[0059] (1) Data packet parsing: Extract the five-tuple information (source IP address, destination IP address, source port, destination port, transport layer protocol type) for each network data packet, as well as metadata such as packet length, packet arrival timestamp, and TCP flags.
[0060] (2) Traffic segmentation: Data packets are grouped according to five-tuples to form unidirectional flows. Each flow is segmented according to a preset time window (default 30 seconds) to obtain traffic segments.
[0061] (3) Statistical feature calculation: For each traffic segment, calculate the following statistical features: number of packets, total number of bytes, average packet length, standard deviation of packet length, average packet arrival rate, mean of packet arrival interval, standard deviation of packet arrival interval, flow duration, uplink / downlink packet ratio, SYN flag count, FIN flag count, RST flag count, a total of 12 statistical features.
[0062] (4) Side channel feature extraction: Perform Fast Fourier Transform (FFT) on the packet length sequence of each traffic segment, and take the amplitude of the first 8 frequency components as frequency domain features; calculate the first 4 autocorrelation coefficients of the packet arrival time interval sequence as time series features, for a total of 12-dimensional side channel features.
[0063] (5) Feature splicing: The 12-dimensional statistical features, 12-dimensional side channel features and 5-dimensional metadata features (subnet prefix encoding of source IP, subnet prefix encoding of destination IP, source port range encoding, destination port range encoding, protocol type encoding) are spliced into a 29-dimensional multidimensional spatiotemporal feature vector.
[0064] Step 2: Construct a spatiotemporal joint encoder based on an attention mechanism. This encoder maps the multidimensional spatiotemporal feature vectors to a low-dimensional feature space, obtaining the traffic feature embedding vectors. For example... Figure 2 As shown, the detailed structure of the spatiotemporal co-encoder is as follows:
[0065] (1) Input layer: Receives a time-series feature sequence with size [8,29], which contains multi-dimensional spatiotemporal features of 8 consecutive time windows.
[0066] (2) Temporal Attention Module: The temporal feature sequence is linearly mapped to obtain three sequence vectors: Query, Key, and Value. The self-attention weights are then calculated. ,in The dimension for the Key. This module captures the dependencies between feature dimensions.
[0067] (3) Spatial Attention Module: The module uses metadata features (first 5 dimensions) as the Query and statistical and side-channel features (last 24 dimensions) as the Key and Value to calculate cross-attention weights. This module captures the correlation between network entity attributes and traffic behavior patterns.
[0068] (4) Feature fusion layer: The outputs of temporal attention and spatial attention are concatenated and mapped to the 16-dimensional feature embedding space through two fully connected networks, and the LeakyReLU activation function and LayerNorm normalization are used.
[0069] (5) Encoder output: Obtain a 16-dimensional flow feature embedding vector .
[0070] (6) Reconstructed Decoder: Consists of two fully connected network layers, embedding features into the vector The original 29-dimensional feature space is reconstructed, and the reconstruction error is calculated using the mean squared error as an auxiliary anomaly scoring index.
[0071] Step 3: Construct a dynamic prototype memory to store and continuously update representative prototypes of normal traffic; use triplet contrast quantity learning objectives to continuously train the spatiotemporal joint encoder.
[0072] Among them, such as Figure 3 As shown, the detailed implementation of the dynamic prototype memory is as follows:
[0073] (1) Initialization: Run the K-Means clustering algorithm (K=32) on the initial normal traffic training set to obtain 32 cluster centers as the initial prototype. Each prototype is associated with a matching frequency counter. and the most recent update timestamp .
[0074] (2) Clustering pseudo-label generation: For each training sample Calculate the distance between the sample and all prototypes, and use the index of the nearest prototype as the pseudo-label for clustering the sample. .
[0075] (3) Prototype update: When a new sample Upon arrival, calculate the nearest prototype distance. The following rules apply:
[0076] like (This is a preset update threshold, which defaults to 1.5 times the average distance between current prototypes), then a new prototype is created. ;
[0077] like (A preset merging threshold is set to 0.3 times the average distance between current prototypes by default), then the most recent prototype is updated. , .
[0078] like If the prototype vector is not modified, only the matching frequency of the corresponding prototype is incremented by 1 and the most recent update timestamp is refreshed.
[0079] (4) Elimination: When the number of prototypes exceeds the capacity limit. When the default value is 128, calculate the overall score for each prototype. Remove the prototype with the lowest rating.
[0080] The detailed implementation of continuous training of the spatiotemporal joint encoder is as follows:
[0081] (1) Training data organization: For the normal traffic samples of the current task, cluster pseudo-labels are generated through dynamic prototype memory.
[0082] (2) Triple construction: For each training sample (Anchor sample), whose positive sample is the corresponding prototype. Negative samples are other randomly selected prototypes. To form a triple .
[0083] (3) Loss function calculation:
[0084] Reconstruction loss: ;
[0085] Triple loss: , The default value is 1.0;
[0086] Total loss: .
[0087] in, The original input feature vector, The reconstructed feature vector, This is a preset boundary value (controlling the minimum margin between positive and negative samples, default 1.0). The weights for reconstructing the loss (default 0.3). The weight for the triplet loss (default 0.7).
[0088] (4) Optimizer: Adam optimizer is used with a learning rate of 0.001 and weight decay. .
[0089] (5) Training rounds: 10 epochs for each new task, with a batch size of 256.
[0090] (6) Training Stop Judgment: After each epoch, check the following three stopping conditions. Training stops if any one of them is met: Convergence Stop: When the training loss changes within T consecutive epochs (default T=3). Less than the convergence threshold (default When the mean of the outlier scores on the validation set reaches a certain threshold, the model is considered convergent; when it reaches a stable stop, the model is considered to have reached convergence. and standard deviation The score distribution is considered stable when the relative deviation from the initial reference value is less than 1% for T consecutive epochs; a forced stop is initiated when the training epochs reach the preset maximum number of epochs. When the time comes, force a stop.
[0091] (7) Course learning strategy: Before training begins, the initial model is used to calculate the anomaly score of all training samples as a difficulty index, and the samples are sorted from low to high scores. The training process is divided into three stages: Stage 1 (epoch 1 to...) The lowest 30% of samples; Phase 2 (epoch) +1 to The lowest 60% of samples; Phase 3 (epoch) All samples. Difficulty scheduling uses a linearly increasing function, with the upper limit of sample difficulty at each stage increasing linearly with the training progress.
[0092] (8) Post-training processing: After training stops, the anomaly score distribution is calculated on the validation set using the final model, and the initial detection threshold is determined by Bayesian optimization. The final model and initial thresholds are then deployed to the detection phase.
[0093] Step 4: Based on the dynamic prototype memory, calculate the normalized distance between the traffic sample to be tested and the nearest neighbor prototype to obtain the anomaly score of the traffic sample to be tested, and combine it with the adaptive threshold mechanism based on Bayesian optimization to determine whether the traffic sample to be tested is abnormal traffic.
[0094] The detailed implementation of the adaptive threshold mechanism is as follows:
[0095] (1) Initial threshold search: Calculate the anomaly score of all samples on the normal traffic validation set, and use Bayesian optimization (Gaussian process surrogate model, hoping to improve the acquisition function) to search for the optimal threshold within the score range. This makes the false positive rate (Default 0.01).
[0096] (2) Runtime monitoring: Maintain a sliding window (Size N=1000), records the abnormal scores of the most recently judged normal samples.
[0097] (3) Change detection: Calculate the mean of the abnormal scores within the window. and standard deviation , compared with the initial reference value and Comparison. If ( (Default is 2.0) or This triggers a threshold update.
[0098] (4) Threshold update: at the current threshold neighborhood The system uses Bayesian optimization to search for a new optimal threshold.
[0099] During the deployment phase, the reasoning process for anomaly detection is as follows:
[0100] (1) Sample of flow rate to be measured Feature embeddings are obtained through a spatiotemporal joint encoder. .
[0101] (2) Calculate the distance score: Normalization is performed using the maximum prototype spacing.
[0102] (3) Calculate the reconstruction score: ,in This is the standard deviation of the reconstruction error of the training set.
[0103] (4) Integration score: , The default value is 0.6.
[0104] (5) Anomaly detection: If If the current adaptive threshold is reached, it is determined to be abnormal traffic and an alarm is triggered; otherwise, it is determined to be normal traffic and the sample is used for updating the dynamic prototype memory.
[0105] This invention designs a dynamic prototype memory to store representative prototype representations of normal traffic, supporting the dynamic addition, updating and elimination of prototypes. It breaks through the limitations of traditional methods that rely on fixed reconstruction modules, uses prototype distance metric as the core basis for anomaly judgment, and supplements it with reconstruction error as a secondary scoring dimension, which significantly improves the expressive power and adaptability of normality modeling.
[0106] This invention constructs a joint encoder that includes a temporal attention module and a spatial attention module. Temporal attention captures long-term temporal dependencies in traffic patterns, while spatial attention mines the intrinsic relationship between network entity attributes and traffic behavior, thereby enabling deep representation learning of traffic features.
[0107] This invention employs an adaptive threshold mechanism based on Bayesian optimization. A Bayesian-optimized online threshold update strategy is designed, which dynamically adjusts the detection threshold by monitoring changes in the distribution of abnormal scores in normal traffic, thus solving the problem of fluctuating false alarm and false negative rates caused by fixed thresholds in traditional methods.
[0108] This invention employs a progressive normality modeling approach based on curriculum learning. By introducing a curriculum learning strategy, training samples are organized progressively according to the difficulty of normality modeling, prioritizing the learning of typical normality patterns and then gradually learning complex normality patterns, thereby improving the model's learning performance on complex normality traffic distributions.
[0109] In summary, this invention, through the above technical solution, achieves continuous single-class abnormal traffic detection based on a dynamic prototype network. It uses only normal traffic data for training, requires no labeled attack samples, and can continuously adapt to dynamic changes in network traffic distribution, effectively detecting zero-day attacks and unknown threats.
Claims
1. A method for continuous single-class anomaly traffic detection based on dynamic prototype networks, characterized in that, Includes the following steps: Step 1: Obtain network traffic data by capturing data packets, preprocess the network traffic data, and extract multi-dimensional spatiotemporal feature vectors; Step 2: Construct a spatiotemporal joint encoder based on an attention mechanism. The spatiotemporal joint encoder maps the multidimensional spatiotemporal feature vectors to a low-dimensional feature space to obtain the traffic feature embedding vectors. Step 3: Construct a dynamic prototype memory to store and continuously update representative prototypes of normal traffic; continuously train the spatiotemporal joint encoder using the triplet contrast learning objective. Step 4: Based on the dynamic prototype memory, calculate the normalized distance between the traffic sample to be tested and the nearest neighbor prototype to obtain the anomaly score of the traffic sample to be tested, and combine it with the adaptive threshold mechanism based on Bayesian optimization to determine whether the traffic sample to be tested is abnormal traffic.
2. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 1, characterized in that, In step 1, the specific method for extracting multidimensional spatiotemporal feature vectors is as follows: The data packets are parsed using a five-tuple of source IP, destination IP, source port, destination port, and protocol type to extract traffic metadata features; Network traffic data is segmented according to a preset time window, and statistical characteristics within each time window are calculated, including the average number of packets, the average number of bytes, the average and variance of packet arrival intervals, and the flow duration. Extract the side-channel features of the traffic, including the Fourier transform coefficients of the packet length sequence and the autocorrelation coefficient of the packet arrival time interval; The traffic metadata features, statistical features, and side-channel features are concatenated into a multi-dimensional spatiotemporal feature vector with a single time window.
3. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 2, characterized in that, The input to the spatiotemporal joint encoder is a temporal feature sequence formed by stacking multidimensional spatiotemporal feature vectors from multiple consecutive windows; The spatiotemporal co-encoder includes: The temporal attention module is used to perform self-attention calculation on temporal feature sequences to capture the temporal dependencies of traffic patterns; The spatial attention module is used to perform cross-attention calculations on traffic metadata features, statistical features, and side-channel features within a single window to capture the correlation between network entity attributes and traffic behavior patterns. The feature fusion layer is used to weight and fuse the outputs of the temporal attention module and the spatial attention module, and then map them to a low-dimensional feature space through a multi-layer fully connected network to obtain the traffic feature embedding vector.
4. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 1, characterized in that, In step 3, the specific method for storing and continuously updating representative prototypes of normal traffic through a dynamic prototype memory is as follows: Initialization phase: Run the K-Means clustering algorithm on normal traffic data to obtain K cluster centers as initial prototypes, which are stored in the dynamic prototype memory; Update phase: For a newly arrived normal traffic sample, calculate the distance between its traffic feature embedding vector and all current prototypes. If the nearest distance exceeds the preset update threshold, add the sample as a new prototype to the memory. If the nearest distance is less than the preset merging threshold, merge the sample into the nearest prototype and update the prototype to the weighted average of the two. If the nearest distance is between the merging threshold and the update threshold, do not modify the prototype, but only update the matching frequency and the most recent update timestamp of the corresponding prototype. Elimination phase: When the number of prototypes in the dynamic prototype memory exceeds the preset capacity limit, remove the prototype with the oldest recent update timestamp and the lowest matching frequency.
5. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 1, characterized in that, In step 3, the specific method for continuously training the spatiotemporal joint encoder using the triplet contrast quantity learning objective is as follows: For each training sample, it is used as the anchor sample, the prototype corresponding to its cluster pseudo-label is selected as the positive sample, and the prototypes of other clusters are randomly selected as the negative samples to construct a triplet consisting of the anchor sample, the positive sample, and the negative sample. Construct the total loss function The spatiotemporal joint encoder is continuously trained; the total loss function is... for: in, and These are the weighting coefficients. To reconstruct the loss function, The triplet loss function is calculated as follows: In the formula, For Euclidean distance, For preset boundary values, For anchor samples, As a positive sample, For negative samples, This indicates taking the maximum value.
6. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 1, characterized in that, In step 4, the Bayesian-optimized adaptive thresholding mechanism includes: In the initial stage, based on the abnormal score distribution of the normal traffic validation set, the optimal initial threshold is searched through Bayesian optimization so that the false positive rate on normal traffic does not exceed the preset target false positive rate. During the deployment phase, a sliding window is maintained to record the abnormal scores of the most recent samples that were judged as normal traffic. When the change in the mean or standard deviation of the abnormal scores within the window exceeds the change threshold, the threshold is updated. The threshold update uses a Bayesian optimization method to search for a new optimal threshold in the neighborhood of the current threshold, so that the abnormal score distribution of normal samples within the sliding window remains stable.
7. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 1, characterized in that, In step 3, during the continuous training of the spatiotemporal joint encoder, a progressive normality modeling strategy based on course learning is adopted, specifically as follows: The normal traffic training samples are sorted from low to high according to the abnormal scores, and the training samples with the lowest scores are used for initial training. As the number of training rounds increases, higher-scoring normal samples are introduced, enabling the spatiotemporal joint encoder to gradually learn more complex normal patterns. A linearly increasing function is used to schedule the difficulty of the courses, controlling the upper limit of the sample difficulty introduced in each training stage.
8. The method for continuous single-class anomaly traffic detection based on dynamic prototype networks according to claim 3, characterized in that, The spatiotemporal joint encoder also includes a reconstruction decoder, which is used to reconstruct the low-dimensional feature embedding vector back to the original feature space and calculate the reconstruction error as an auxiliary anomaly scoring index. In step 4, the anomaly score is a weighted fusion of normalized distance and reconstruction error.