Network anomaly traffic detection system and method based on federated contrastive learning

Abstract

The application relates to the technical field of network security, and discloses a network abnormal traffic detection system and method based on federal contrast learning, which comprises the following steps: obtaining a set of traffic positive and negative sample pairs and constructing a communication interaction graph, obtaining an active directed communication interaction graph through hierarchical management updating, extracting node topology features to splice a multi-dimensional node feature vector, outputting a node-level graph topology feature vector after normalization and truncation processing, combining a flow-level feature vector extracted from the set of traffic positive and negative sample pairs to locally deploy a shared encoder network, calculating local model parameters, uploading and performing federal average aggregation, constructing a global anomaly detection model, calculating a traffic anomaly score to determine network traffic anomaly, outputting an anomaly determination result, performing cross-node correlation analysis and updating the global anomaly detection model, splicing communication interaction graphs of all nodes to form a global network topology graph, and finally generating a traffic anomaly detection processing report, so that data privacy is ensured and cross-node anomaly detection efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network anomaly traffic detection system and method based on federated contrastive learning. Background Technology

[0002] As cyberattacks become increasingly sophisticated, traditional anomaly detection methods based on rule matching or centralized machine learning face severe challenges. On the one hand, network traffic data from various industries are silos due to privacy regulations and data ownership restrictions, making it impossible to centrally train high-performance models. On the other hand, existing methods have low detection accuracy and insufficient generalization ability against unknown attacks and encrypted traffic. Federated learning can achieve multi-party collaborative training while protecting data privacy, and contrastive learning can effectively extract discriminative features from high-dimensional traffic data. Combining the two can resolve the contradiction between data privacy and model performance, and improve the ability to identify complex anomaly traffic, providing an efficient and secure anomaly detection solution for distributed network environments.

[0003] Chinese patent CN118802291B discloses a method and apparatus for detecting network traffic anomalies. The method includes: acquiring target network traffic data of a network device to be detected; inputting the target network traffic data into a feature extraction module of a detection model to obtain multi-domain mixed features of the target network traffic data; inputting the multi-domain mixed features of the target network traffic data into a traffic anomaly detection network of the detection model to obtain a traffic anomaly detection result for the network device to be detected; wherein the detection model is trained based on unlabeled first sample network traffic data, multi-domain statistical features of the first sample network traffic data, and traffic anomaly labels of labeled second sample network traffic data and the second sample network traffic data; the number of first sample network traffic data is greater than the number of second sample network traffic data. This technical solution enables accurate acquisition of network traffic anomaly detection results even when there are few labeled samples.

[0004] Although existing network traffic anomaly detection methods and devices have improved the automation level of network operation and maintenance to some extent, they still have problems such as privacy leakage of traffic data of distributed network nodes, poor generalization of detection models, and difficulty in cross-node collaborative anomaly detection. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention aims to provide a network anomaly traffic detection system and method based on federated contrastive learning. Through federated average aggregation and Gaussian perturbation encryption mechanisms, it achieves localized training and encrypted parameter uploading of distributed network node traffic data, preventing traffic data leakage and ensuring node privacy and security. Utilizing shared encoder networks and bimodal fusion features, it extracts joint representations at the flow level and graph topology level, enhancing the generalization of the detection model and avoiding model degradation caused by single-node data distribution bias. Based on a global anomaly detection model and cross-node correlation analysis, it performs temporal alignment and connectivity path localization for alarms from each node, solving the problem of high difficulty in cross-node collaborative anomaly detection, reducing the difficulty of identifying multi-node linked anomalies, and reconstructing the key connectivity paths and impact range of attacks.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] Network anomaly traffic detection methods based on federated contrastive learning include:

[0008] Collect network traffic data and aggregate it to form flow-level data. Perform data augmentation on the same network flow to generate positive samples and obtain negative samples to construct a set of positive and negative traffic samples.

[0009] A communication interaction graph is constructed, and an active directed communication interaction graph is obtained through hierarchical management and updates. Node topological features are extracted and spliced ​​to form a multi-dimensional node feature vector. After normalization and truncation, the node-level graph topological feature vector is output.

[0010] Extract flow-level feature vectors from positive and negative traffic sample pairs, combine them with node-level graph topology feature vectors to deploy a shared encoder network locally, calculate local model parameters, encrypt and upload them, perform federated average aggregation, construct a global anomaly detection model, calculate traffic anomaly scores to determine network traffic anomalies, and output anomaly determination results.

[0011] Based on the anomaly determination results, cross-node correlation analysis is performed, the global anomaly detection model is updated, and the communication interaction graphs of each node are stitched together to form a global network topology graph, ultimately generating a traffic anomaly detection and processing report.

[0012] Specifically, the steps for constructing a communication interaction graph include:

[0013] Extract quintuples from the stream-level data, using the source IP and destination IP as unique identifiers for the host nodes. Traverse all quintuples of all stream records within the current time-series window, remove duplicates, and extract all host nodes to form an initial node set.

[0014] Consistent hashing is performed on the node identifiers in the initial node set to generate a node ID set, and the source node ID and destination node ID are extracted as the unique primary key of the directed edge;

[0015] Aggregate multiple port-level flows under the same primary key, calculate directed edge attributes, remove invalid edge records, and filter self-loop edges with the same source node ID and destination node ID to generate a set of directed edge attributes.

[0016] Based on the set of directed edge attributes, a communication interaction graph is constructed with host identifiers as nodes and network flows as directed edges.

[0017] Specifically, the steps for outputting the node-level graph topological feature vectors include:

[0018] An incremental sliding window mechanism is used to hierarchically manage and update the nodes in the communication interaction graph, resulting in an updated communication interaction graph.

[0019] The directed edge attributes of the current sliding window are smoothed by an exponentially weighted moving average to obtain the updated directed edge attributes.

[0020] Based on the updated directed edge attributes, all active nodes and their corresponding directed edges are filtered from the updated communication interaction graph to generate an active directed communication interaction graph.

[0021] Node topological features are extracted from the active directed communication interaction graph, and multi-dimensional node feature vectors are formed by orderly splicing. After min-max normalization, the node-level graph topological feature vectors are output.

[0022] Specifically, the steps for deploying a shared encoder network include:

[0023] Flow-level feature vectors are extracted from positive and negative traffic sample pairs. The host identifiers of source IP and destination IP are extracted using the quintuple as an index. The node-level graph topology feature vectors of the corresponding source host node and destination host node are matched respectively.

[0024] The node-level graph topology feature vectors of the stream-level feature vector, the source host node, and the destination host node are sequentially concatenated to form a dual-modal fused feature vector;

[0025] Matching and concatenation are performed on the homogeneous network streams of positive samples and the heterogeneous network streams of negative samples respectively to generate positive sample fusion feature pairs and negative sample fusion feature pairs. These are then merged into a dual-modal fusion feature positive and negative sample pair set and divided into a training set and a validation set.

[0026] A shared encoder network is deployed locally, and the contrastive loss is calculated as the training objective. The Adam optimizer is used to update the local model parameters of the shared encoder network in combination with the training set.

[0027] All normal traffic samples in the training set are selected and input into the shared encoder network to obtain a low-dimensional representation vector set. The mean is calculated for each dimension to generate a local normal representation vector.

[0028] Specifically, the steps for performing federated average aggregation include:

[0029] The local model parameters are flattened and concatenated into a one-dimensional parameter vector according to the network hierarchy, and then combined with the local normal representation vector to form a one-dimensional vector to be encrypted.

[0030] Calculate the standard deviation of Gaussian noise, generate Gaussian noise using the standard deviation as a parameter, perform Gaussian perturbation encryption to obtain an encrypted one-dimensional vector, and restore the encryption parameters of the shared encoder network by reverse splitting.

[0031] Calculate the sample weight coefficients for local nodes;

[0032] The encrypted one-dimensional vector, sample weight coefficients, and encryption parameters are uploaded to the central server for federated average aggregation.

[0033] The encryption parameters of each layer of the shared encoder network are weighted and summed with the sample weight coefficients to obtain the aggregate parameters layer by layer.

[0034] The global normal representation baseline vector is obtained by weighting and aggregating the encrypted one-dimensional vector dimension by dimension.

[0035] Specifically, the steps for constructing a global anomaly detection model include:

[0036] Construct a global anomaly detection model, including an input layer, a feature extraction layer, an anomaly score calculation layer, and an output layer;

[0037] The input layer is used to receive the dual-modal fusion feature vector, aggregation parameters and global normal representation baseline vector of the traffic to be detected, and uses the aggregation parameters and global normal representation baseline vector as global model parameters.

[0038] The feature extraction layer is used to load the aggregation parameters as weights of the shared encoder network, encoding the bimodal fusion feature vector into a low-dimensional representation vector.

[0039] The anomaly scoring layer calculates the cosine distance between the low-dimensional representation vector and the global normal representation baseline vector, mapping it to a traffic anomaly score. ;

[0040] Output layer, used for outputting traffic anomaly scores. .

[0041] Specifically, the steps for outputting the anomaly determination result include:

[0042] The central server distributes global model parameters to each node, and each node loads the global anomaly detection model and collects network traffic loading data in real time.

[0043] Flow-level features are extracted and concatenated with graph node-level topological features to form a real-time dual-modal fusion feature vector, which is then input into a global anomaly detection model to obtain a flow anomaly score. ;

[0044] Set anomaly scoring threshold , Perform network traffic anomaly detection;

[0045] like If so, it is considered a normal state; if If so, it is determined to be a warning state, and the abnormal label is marked as a warning;

[0046] like If the condition is abnormal, the cosine similarity between the low-dimensional representation vector and the preset baseline vectors for various attack representations is calculated.

[0047] Select the one with the highest cosine similarity and greater than The attack type is used as the anomaly type, the anomaly type is used as the anomaly label, and the traffic anomaly score is used as the anomaly confidence level.

[0048] The final output is the anomaly determination result.

[0049] Specifically, the steps for updating the global anomaly detection model include:

[0050] After receiving the anomaly determination results, the central server sets up a composite index to perform cross-node correlation analysis on alarms from each node, and outputs cross-node anomaly alarm event clusters after time-series alignment.

[0051] Calculate the confidence calibration factor for each cross-node abnormal alarm event cluster, and calculate the calibration confidence by combining the abnormal confidence with weighted average;

[0052] Abnormal samples with calibration confidence greater than a preset calibration threshold are selected, and dual-modal fusion feature vectors, low-dimensional representation vectors, and abnormal types are extracted to form an incremental training dataset.

[0053] The parameters of the third fully connected layer and the anomaly scoring calculation layer of the shared encoder network are incrementally updated based on the incremental training dataset.

[0054] The corresponding attack representation baseline vector is updated using an exponential moving average method to generate updated global model parameters and global attack representation baseline vector, thereby updating the global anomaly detection model.

[0055] Specifically, the steps for generating a traffic anomaly detection and processing report include:

[0056] Based on the host identifier, merge the active directed communication interaction graphs uploaded by each node, recalculate the weighted betweenness centrality and second-order neighbor structure overlap of each node, and form a global network topology graph.

[0057] On the global network topology graph, alarm nodes within cross-node abnormal alarm event clusters are mapped as abnormal nodes. Using abnormal nodes as seeds, a breadth-first search is performed along directed edges to identify the connected paths between abnormal nodes.

[0058] Calculate the traffic anomaly score for each abnormal node on the connected path;

[0059] When the traffic anomaly score shows a propagation trend of first rising and then falling or increasing step by step, the corresponding connectivity path is determined to be a critical connectivity path.

[0060] The role of each node in the attack propagation is assessed based on weighted betweenness centrality, and the key connectivity paths and scope of impact of the attack are reconstructed by combining connectivity paths.

[0061] A summary report on traffic anomaly detection and handling is generated.

[0062] A network anomaly traffic detection system based on federated contrastive learning includes: a flow-level sample construction module, a feature extraction module, a federated anomaly detection module, and a global correlation update module.

[0063] The flow-level sample construction module is used to collect network traffic data, aggregate it to form flow-level data, perform data augmentation on the same network flow to generate positive samples and obtain negative samples, and construct a set of positive and negative traffic sample pairs.

[0064] The feature extraction module is used to construct a communication interaction graph, obtain an active directed communication interaction graph through hierarchical management and update, extract node topological features and splice them to form a multi-dimensional node feature vector, and output a node-level graph topological feature vector after normalization and truncation.

[0065] The federated anomaly detection module is used to extract flow-level feature vectors from the set of positive and negative traffic sample pairs, combine them with node-level graph topology feature vectors to deploy a shared encoder network locally, calculate local model parameters, encrypt and upload them and perform federated average aggregation, construct a global anomaly detection model, calculate traffic anomaly scores to determine network traffic anomalies, and output anomaly determination results.

[0066] The global association update module is used to perform cross-node association analysis based on the anomaly judgment results, update the global anomaly detection model, and then stitch together the communication interaction graphs of each node to form a global network topology graph, and finally generate a traffic anomaly detection and processing report.

[0067] The beneficial effects of this invention are:

[0068] 1. In this invention, each node only flattens and concatenates the local model parameters of the shared encoder network into a one-dimensional parameter vector according to the network hierarchy, and concatenates it end-to-end with the local normal representation vector. The encrypted one-dimensional vector is obtained by Gaussian perturbation encryption. The central server only receives the encrypted one-dimensional vector and sample weight coefficients. The original stream-level data and graph topology features are stored locally, thus avoiding the risk of data privacy leakage from the root. The central server performs federated average aggregation, calculates the aggregation parameters by weighted summation layer by layer, and generates a global normal representation baseline vector by weighted aggregation dimension by dimension. The global model parameters are then distributed to each node, so that each node has a unified detection benchmark without sharing the original data, realizing cross-node collaborative anomaly detection.

[0069] 2. This invention utilizes cross-node alarm correlation analysis and combines a three-dimensional confidence calibration factor to screen high-confidence anomaly samples to construct an incremental training dataset. Through incremental fine-tuning and exponential moving average updates of the attack characterization baseline, it achieves dynamic updates to the global anomaly detection model. By splicing together the active directed communication interaction graphs of each node to generate a global network topology graph, it identifies key connectivity paths of attacks based on the traffic anomaly scores and propagation trends of each anomaly node. Combined with weighted betweenness centrality, it determines the role of attack propagation, reconstructs the attack's diffusion path and impact range, and improves the overall collaborative protection effectiveness of the distributed network. Attached Figure Description

[0070] Figure 1 This is a schematic diagram of a network anomaly traffic detection method based on federated contrastive learning.

[0071] Figure 2 This is a flowchart illustrating the process of outputting node-level graph topological feature vectors in this invention.

[0072] Figure 3 This is a flowchart of the process of performing federated average aggregation in this invention;

[0073] Figure 4 This is a flowchart of the output of the anomaly determination result in this invention;

[0074] Figure 5 This is a structural diagram of a network anomaly traffic detection system based on federated contrastive learning. Detailed Implementation

[0075] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0076] Example 1

[0077] refer to Figures 1 to 4As shown in the figure, this embodiment introduces a network anomaly traffic detection method based on federated contrastive learning, including the following steps:

[0078] Step 1: Collect network traffic data in the local detection area through each distributed network node. Aggregate the data at the flow level according to the five-tuple and time window to form flow-level data. Extract feature vectors such as packet length, arrival interval, and flag statistics from the flow-level data. Perform data augmentation on the same network flow to generate positive samples. At the same time, collect feature vectors of other network flows from the local cache as negative samples. After feature normalization and labeling, construct a standardized set of positive and negative traffic sample pairs. The five-tuple consists of source IP, destination IP, source port, destination port, and transport layer protocol. Data augmentation includes random masking, feature jittering, and time window pruning.

[0079] Step 2: Based on flow-level data, a communication interaction graph is constructed with host identifiers as nodes and network flows as directed edges. Directed edge attributes include traffic duration, total number of packets, total number of bytes, average packet length, and retransmission rate. An incremental sliding window mechanism is used to hierarchically manage and update nodes in the communication interaction graph, resulting in newly added nodes, retained nodes, and silent nodes. The directed edge attributes are smoothed using an exponentially weighted moving average. The active directed communication interaction graph of the current sliding window is extracted from the updated graph to eliminate instantaneous jitter. Node topology features are extracted from the active directed communication interaction graph and concatenated to form a multi-dimensional node feature vector that integrates traffic intensity and topological roles. This vector is then normalized and truncated based on historical baselines. A continuous silent window dimension is added to silent nodes, outputting a standardized node-level graph topology feature vector to support network anomaly detection and behavior analysis. Node topology features include byte-weighted in-degree, weighted betweenness centrality, quantiles and variances of directed edge attributes, weighted average similarity of first-order neighbors, structural overlap of second-order neighbors, and isomorphic role matching degree.

[0080] Step 3: Extract flow-level feature vectors from the set of positive and negative traffic samples, and deploy a shared encoder network locally by combining node-level graph topology feature vectors. Calculate local model parameters by comparing the loss function to maximize positive sample similarity and minimize negative sample similarity. Each node uploads its local model parameters, encrypted with Gaussian perturbation using differential privacy technology, to the central server. The central server performs federated average aggregation to construct a cross-node fusion global anomaly detection model and distributes the global model parameters to each node for synchronization. After loading the global anomaly detection model, each node collects network traffic loading data in real time and simultaneously extracts flow-level features and graph node-level topology features. It calculates traffic anomaly scores to determine network traffic anomalies and outputs anomaly determination results including anomaly labels, anomaly confidence, and anomaly type.

[0081] Step 4: Based on the anomaly judgment results returned by the nodes, perform cross-node correlation analysis on the alarms of each node, select high-confidence anomaly samples as incremental training datasets, update the global model parameters of the global anomaly detection model, integrate the anomaly detection results and model performance indicators of each node, and form a global network topology map by splicing the communication interaction graph of each node based on the host identifier. Analyze the spatiotemporal distribution characteristics of abnormal traffic, the key connectivity paths of the attack and the scope of impact, and generate a traffic anomaly detection and processing report.

[0082] Specifically, the steps for outputting standardized node-level graph topological feature vectors include:

[0083] Extract quintuples from the stream-level data. Using the source IP and destination IP in the quintuple as unique identifiers for the host nodes, traverse all quintuples of all stream records within the current time-series window, deduplicating and extracting all host nodes within the current time-series window to form an initial node set. Perform consistent hashing on the node identifiers in the initial node set to generate a fixed-length node ID set, including the source node ID and destination node ID. The fixed length is set according to the local storage resources of the distributed nodes and is a 32-bit hexadecimal string.

[0084] Extract the source node ID and destination node ID from the node ID set. Using the source node ID and destination node ID as the unique primary key of the directed edge, aggregate multiple port-level flows under the same primary key, and calculate the directed edge attributes, including traffic duration, total number of packets, total number of bytes, average packet length, and retransmission rate. The specific calculation process includes: selecting the union of the time intervals of multiple network flows, calculating the total duration of the merged coverage as the traffic duration of the directed edge corresponding to the primary key; and aggregating all network flows under the same directed edge. The packet count and byte count of each flow are summed to obtain the total packet count and total byte count of the directed edge. The sum of the total byte counts of all network flows under the same directed edge is divided by the sum of the total packet counts to obtain the average packet length of the directed edge. The total packet count of each network flow is multiplied by the retransmission rate of that network flow to obtain the retransmission packet count of that network flow. The retransmission packet counts of all network flows are summed to obtain the total retransmission packet count. The total retransmission packet count is then divided by the sum of the total packet counts of all network flows within the directed edge to obtain the retransmission rate of the directed edge.

[0085] Invalid edge records with a traffic duration of 0 and a total number of packets of 0 are removed, and self-loop edges with the same source node ID and destination node ID are filtered out to avoid interfering with the topology statistics results. Finally, a set of directed edge attributes containing traffic duration, total number of packets, total number of bytes, average packet length, and retransmission rate is generated.

[0086] Based on the set of directed edge attributes, a communication interaction graph is constructed using host identifiers as nodes and network flows as directed edges. An incremental sliding window mechanism is used to hierarchically manage and update the nodes in the communication interaction graph, resulting in an updated communication interaction graph. The specific process includes: marking nodes that exist in the current sliding window but not in the historical communication interaction graph output by the previous sliding window as new nodes, adding them to the current communication interaction graph, and keeping them in an active state by default; marking nodes that exist in the historical communication interaction graph of the previous sliding window and still generate valid communication traffic in the current sliding window as retained nodes, keeping their node IDs associated with the historical topology unchanged and maintaining their active state; marking nodes that exist in the historical communication interaction graph of the previous sliding window but have no valid communication traffic in the current sliding window as silent nodes, retaining their historical topology connections but not including them in the active topology calculation of the current sliding window, while incrementing the consecutive silent window count of silent nodes; if a silent node generates traffic again, its count is reset to zero and it is converted into a retained node.

[0087] The directed edge attributes of the current sliding window are smoothed by an exponentially weighted moving average to obtain the updated directed edge attributes. The specific calculation logic includes: the updated directed edge attributes are obtained by weighted summation of two terms. The first term is the measured attribute value of the directed edge in the current sliding window multiplied by the smoothing coefficient, and the second term is the complement value obtained by multiplying the historical attribute value of the directed edge in the previous sliding window by 1 and subtracting the smoothing coefficient. The measured attribute value is obtained by aggregating the flow-level data of the same primary key in the current sliding window. The smoothing coefficient is determined according to the fluctuation characteristics of network traffic and the sensitivity requirements of the detection scenario, and the value range is 0.6~0.8. The larger the smoothing coefficient, the stronger the influence of the traffic data of the current sliding window on the result, thereby weakening the interference of sudden traffic fluctuations in a single sliding window on the graph structure attributes.

[0088] Directed edges that exist in the current sliding window but not in the historical communication interaction graph are directly inserted into the communication interaction graph. Through the above process, an updated communication interaction graph is obtained. Based on the updated directed edge attributes, all active nodes and corresponding directed edges are selected from the updated communication interaction graph to generate the active directed communication interaction graph of the current sliding window, thus eliminating topology noise caused by instantaneous traffic fluctuations.

[0089] Extracting node topological features from an active directed communication interaction graph, including byte-weighted in-degree, weighted betweenness centrality, quantiles and variances of directed edge attributes, weighted average similarity of first-order neighbors, structural overlap of second-order neighbors, and isomorphic role matching degree. The specific calculation process for each node topological feature includes:

[0090] For each node, traverse all incoming edges pointing to that node, and sum the total byte count attribute value of each incoming edge to obtain the weighted in-degree of that node, which is used to characterize the total scale of downlink traffic received by the current host. The total byte count attribute value is the total number of data bytes transmitted by all network flows within the current time window for a single incoming edge, used to quantify the data transmission scale of a single communication link. For each node, traverse all outgoing edges originating from that node, and sum the total byte count attribute value of each outgoing edge to obtain the weighted out-degree of that node, which is used to characterize the total scale of uplink traffic sent by the current host. The weighted betweenness centrality is calculated using the total byte count as the edge weight, and the calculation process includes: traversing active directed communication interactions. For all node pairs in the graph, the shortest weighted path between all node pairs is counted, and the number of times each shortest weighted path passes through the target node is calculated. The ratio of the number of shortest paths passing through the target node to the total number of shortest paths for all node pairs in the network is used as the weighted betweenness centrality of the target node, which is used to characterize the importance of the target node as a transit hub in the overall network communication. The total number of shortest paths for all node pairs in the network is determined based on the reachable node pair size of the active directed communication interaction graph, that is, the sum of the shortest path counts for all source and destination node pairs with connected paths. The path cost of the shortest weighted path is the reciprocal of the total number of bytes of the directed edges; the larger the number of bytes, the lower the path cost and the higher the communication reachability.

[0091] The quantiles and variances of directed edge attributes are statistically analyzed, including: for five attribute dimensions—traffic duration, total number of packets, total number of bytes, average packet length, and retransmission rate—the 25th quantile, median, 75th quantile, and variance of the corresponding values ​​for all incoming edges are calculated. The same statistical analysis is performed on outgoing edges, resulting in a total of 40 distribution feature dimensions, characterizing the dispersion of traffic distribution among node communication objects. These 40 distribution feature dimensions consist of five attribute dimensions, distinguishing between incoming and outgoing edges. For each attribute category, the 25th quantile, median, 75th quantile, and variance are uniformly calculated. Four distribution statistics are calculated using a combination of 5×2×4 to obtain a complete 40-dimensional distribution feature. The calculation logic for quantiles is as follows: sort the corresponding values ​​of all directed edges in ascending order, the value at the 25th percentile is the 25th quantile, the value at the 50th percentile is the median, and the value at the 75th percentile is the 75th quantile. The calculation logic for variance is as follows: calculate the average value of all directed edge values, square the difference between the value of each directed edge and the average value, add all the squared results together, and divide by the total number of directed edges to obtain the variance.

[0092] The calculation process for the weighted average similarity of first-order neighbors, the structural overlap of second-order neighbors, and the isomorphic role matching degree is as follows: The weighted average similarity of first-order neighbors is calculated by concatenating the vector after normalizing the weighted in-degree and weighted betweenness centrality as the intrinsic topological vector of the node. For each first-order neighbor node of the target node, the cosine similarity is calculated based on the intrinsic topological vector of the target node and the intrinsic topological vector of the first-order neighbor node to obtain the similarity value. The total number of bytes of all directed edges of the target node's neighbors is normalized to obtain the weight ratio of each directed edge of the neighbors, that is, the total number of bytes of a single directed edge divided by the sum of the total number of bytes of all directed edges of the neighbors. The similarity value of each first-order neighbor node is multiplied by the weight ratio of the corresponding directed edge of the neighbors to obtain the weighted similarity component. All weighted similarity components are summed to obtain the weighted average similarity of the first-order neighbors of the target node.

[0093] The calculation logic of cosine similarity is as follows: Multiply the values ​​of the corresponding dimensions of the intrinsic topological vector and the intrinsic topological vector of the first-order neighbor node one by one, and add all the multiplication results as the numerator; calculate the sum of the squares of all dimensions of the intrinsic topological vector and the intrinsic topological vector of the first-order neighbor node respectively, take the square root of the two sums respectively, and multiply them together as the denominator; divide the numerator by the denominator to obtain the cosine similarity between the intrinsic topological vector and the intrinsic topological vector of the first-order neighbor node, with a value range of -1 to 1. The closer the value is to 1, the more similar the topological features of the target node and the first-order neighbor node are.

[0094] The calculation process for the overlap of second-order neighbor structures includes: for each target node, obtaining its first-order neighbor set and second-order neighbor set through breadth-first search, where the second-order neighbor set represents the neighbors of its neighbors, excluding the target node itself; calculating the intersection ratio of the first-order neighbor set and the second-order neighbor set, i.e., the number of common nodes in the two sets divided by the total number of nodes in the second-order neighbor set, to obtain the local clustering coefficient; and calculating the weighted sum of the local clustering coefficient and the average similarity of second-order neighbors to obtain the second-order neighbor structure overlap; where the average similarity of second-order neighbors is the sum of the similarities of all second-order neighbors. The average cosine similarity between the intrinsic topological vector of a node and the intrinsic topological vector of the target node is calculated in the same way as the cosine similarity defined in the first-order neighbor weighted average similarity, that is, using the intrinsic topological vector as a feature for cosine similarity calculation. According to the prior statistical law of network topology, the structural overlap has a higher priority in representing the role of a node than the cross-order feature similarity. Therefore, the weight of the local clustering coefficient is set to 0.6 and the weight of the second-order neighbor average similarity is set to 0.4 to comprehensively represent the degree of overlap of the local topology and the consistency of roles.

[0095] The calculation process of isomorphic role matching degree includes: equal frequency bucketing based on the 3-dimensional features composed of weighted in-degree and weighted betweenness centrality; structural bucketing of all nodes in the current sliding window; and statistical analysis of the proportion of neighbors in the bucket where the target node is located to obtain the isomorphic role matching degree, which is the number of neighboring nodes that are in the same bucket as the target node divided by the total number of neighboring nodes, representing the degree of convergence of the topological role of the node in the whole network.

[0096] By sequentially splicing together all the above-mentioned dimensional features, a multi-dimensional node feature vector is formed that integrates traffic intensity and topological role. The splicing order is weighted in-degree, weighted betweenness centrality, quantiles and variances of directed edge attributes, weighted average similarity of first-order neighbors, structural overlap of second-order neighbors, and isomorphic role matching degree, ensuring that the feature dimension order and length of all nodes are consistent.

[0097] Based on the historical baseline, the multi-dimensional node feature vectors are subjected to min-max normalization. If the value of a certain dimension exceeds the historical baseline, it is truncated and marked as an abnormal amplitude. For silent nodes, in addition to supplementing the dimension of continuous silent windows, the other topological feature dimensions are set to 0 and the historical marking is retained, and the standardized node-level graph topological feature vector is output. Among them, the historical baseline is determined by collecting the feature vectors of multiple continuous sliding windows under normal network operation, and calculating the minimum and maximum values ​​of each dimension as the normalization benchmark.

[0098] Specifically, the steps for outputting the anomaly determination result, which includes the anomaly label, anomaly confidence level, and anomaly type, include:

[0099] Extract flow-level feature vectors from the positive and negative traffic sample pairs. Using the five-tuple of each network flow as an index, extract the host identifiers of the source IP and destination IP corresponding to the network flow. Match the node-level graph topology feature vectors of the corresponding source host node and destination host node under the same time window.

[0100] The flow-level feature vector of a single network flow is used as the first part, the node-level graph topology feature vector of the source host node is used as the second part, and the node-level graph topology feature vector of the destination host node is used as the third part. The two parts are concatenated in the order of the first part, the second part, and the third part to form a dual-modal fusion feature vector.

[0101] For the two homogeneous network flows generated by data augmentation from the positive samples in the positive and negative sample pairs set, perform the matching and splicing operations described above to generate positive sample fusion feature pairs; similarly, perform the matching and splicing operations described above to generate negative sample fusion feature pairs; merge the positive sample fusion feature pairs and the negative sample fusion feature pairs to form a set of bimodal fusion feature positive and negative sample pairs.

[0102] A locally deployed shared encoder network consists of three fully connected layers, two batch normalization layers, and ReLU activation functions stacked alternately. The first fully connected layer has the same input dimension as the bimodal fusion feature vector and an output dimension of 256. The second fully connected layer has a progressively decreasing dimension and an output dimension of 128. The third fully connected layer outputs a low-dimensional representation vector with a dimension of 64. This low-dimensional representation vector is a unified representation of the bimodal fusion feature vector after encoding and compression, serving as a standardized input carrier for subsequent sample similarity calculations and normal traffic benchmark construction. The weights of the two branches of the shared encoder network are completely shared, and the representation results obtained by inputting the same bimodal fusion feature vector into any branch are completely consistent.

[0103] The contrastive loss is used as the training objective. The calculation logic includes: for each set of positive and negative sample pairs in the dual-modal fusion feature set, the two dual-modal fusion feature vectors of the positive sample pair are input into the two branches of the shared encoder network, respectively, and two low-dimensional representation vectors are output; the cosine similarity of the two low-dimensional representation vectors is calculated as the numerator; the cosine similarity of the low-dimensional representation vectors corresponding to the positive sample pair and all negative sample pairs in the same batch is summed as the denominator; the contrastive loss of each set of samples is obtained by calculating the negative logarithm of the ratio of the numerator to the denominator; finally, the average of the contrastive losses of all samples in the batch is taken as the total batch loss; the training objective is to maximize the positive sample similarity and minimize the negative sample similarity.

[0104] The dual-modal fusion feature positive and negative sample pairs were divided into training and validation sets in a 7:3 ratio. Using contrastive loss, the Adam optimizer was employed to iteratively update the local model parameters of the shared encoder network. The initial learning rate of the Adam optimizer was set to... The weight decay coefficient is set to The first-order moment estimation coefficient is set to 0.9, and the second-order moment estimation coefficient is set to 0.999. An early stopping mechanism is implemented based on the decrease in the comparative loss of the validation set; if the comparative loss of the validation set decreases by less than 0.999 for 15 consecutive rounds... Training is terminated at the specified time, and the local model parameters after convergence are saved, including the weight matrix and bias terms of each fully connected layer. All normal traffic samples are selected from the training set and input into the trained shared encoder network to obtain the corresponding low-dimensional representation vector set. The mean is calculated for each dimension to generate the local normal representation vector.

[0105] The local model parameters of the shared encoder network are flattened and spliced ​​into a one-dimensional parameter vector according to the network hierarchy. The local normal representation vector is used as an extended parameter and spliced ​​together to form a one-dimensional vector to be encrypted. The total dimension and the range of values ​​of each dimension of the one-dimensional vector to be encrypted are statistically analyzed.

[0106] A differential privacy budget is set according to privacy protection requirements. The failure probability is obtained based on the relaxation conditions corresponding to the differential privacy budget. Specifically, based on the relaxation definition of differential privacy, the failure probability is not an independently set parameter, but a derived quantity constrained by the differential privacy budget, parameter sensitivity, and noise standard deviation. In actual implementation, the value of the differential privacy budget is first set according to security requirements. Then, based on the monotonic relationship between the tail probability of the standard normal distribution and the differential privacy budget, the corresponding failure probability value is derived through numerical calculation. This value is used to measure the maximum risk probability of the algorithm output leaking individual information under the current privacy protection configuration. The parameter sensitivity is determined according to the upper limit of parameter variation corresponding to single-sample training, and the standard deviation of Gaussian noise is calculated. The calculation logic includes: multiplying the parameter sensitivity by 2 times the natural logarithm under the square root to obtain the noise scaling factor, and calculating the ratio of the noise scaling factor to the differential privacy budget to obtain the standard deviation. Here, 2 times the natural logarithm is the ratio of 1.25 (2 times the natural logarithm) to the failure probability.

[0107] For each value in the one-dimensional vector to be encrypted, Gaussian noise is generated using the standard deviation of the Gaussian noise as a parameter. Specifically, for each element position in the one-dimensional vector to be encrypted, a random noise value is independently sampled from a Gaussian distribution with a mean of zero and a standard deviation equal to the previously calculated value. The sampling process is performed sequentially according to the element order, and the sampling results for each element position are independent of each other. The noise value sampled at each element position is directly added to the original value at that element position to obtain the encrypted new value for that element position. The encrypted new values ​​calculated for all element positions are arranged in their original order to form a complete encrypted vector. Gaussian noise is used; Gaussian perturbation encryption is performed based on Gaussian noise to obtain an encrypted one-dimensional vector. The encrypted one-dimensional vector is then reverse-split and restored according to the dimensions of the original network layers to obtain the encryption parameters of the shared encoder network; the proportion of the number of local samples to the total number of samples of all participating nodes in this round is calculated to obtain the sample weight coefficient of the local node, which is used for the weighted calculation of subsequent federated aggregation; the number of local samples is determined based on the total number of sample pairs in the set of positive and negative sample pairs of dual-modal fusion features, and the total number of samples of all participating nodes in this round is determined based on the sum of the number of local samples reported by all participating nodes in this round of training collected by the central server;

[0108] The encrypted one-dimensional vector, sample weight coefficients, and encryption parameters of the shared encoder network are uploaded to the central server. The central server then performs federated average aggregation. The federated average aggregation process includes: weighting and summing the encryption parameters of each layer of the shared encoder network in combination with the sample weight coefficients of each local node. The calculation logic is as follows: multiply the encryption parameters of the first layer of each node by the sum of the corresponding sample weight coefficients, and then divide by the sum of the sample weight coefficients of each local node to obtain the aggregation parameters of the shared encoder network layer by layer; using the same weighted summation logic as the calculation of the aggregation parameters, the encrypted one-dimensional vector uploaded by each local node is weighted and aggregated dimension by dimension to obtain the global normal representation baseline vector, which serves as the representation benchmark for normal traffic in the global scope.

[0109] Based on the aggregation parameters and the global normal representation baseline vector, a cross-node fusion global anomaly detection model is constructed, including an input layer, a feature extraction layer, an anomaly score calculation layer, and an output layer.

[0110] The input layer is used to receive the dual-modal fusion feature vector, aggregation parameters and global normal representation baseline vector of the traffic to be detected, and uses the aggregation parameters and global normal representation baseline vector as global model parameters.

[0111] The feature extraction layer is used to load aggregation parameters as weights of the shared encoder network, and encodes the bimodal fusion feature vector of the traffic to be detected in the input layer into a low-dimensional representation vector.

[0112] The anomaly scoring layer calculates the cosine distance between the low-dimensional representation vector and the global normal representation baseline vector, and maps it to a traffic anomaly score between 0 and 1. ;

[0113] Output layer, used for outputting traffic anomaly scores. ;

[0114] The central server distributes global model parameters to all participating nodes for synchronization. After loading the global anomaly detection model, each node collects network traffic loading data in real time, synchronously extracts the flow-level features of each network flow and concatenates them with the graph node-level topology features to form a real-time dual-modal fusion feature vector, which is then input into the global anomaly detection model to obtain a traffic anomaly score. ;

[0115] Anomaly scoring thresholds are set based on the quantile statistics of anomaly scores from global normal samples. , To determine network traffic anomalies; among them, This is the 95th percentile value of the quantile statistics. This represents the 99th percentile value of the quantile statistics.

[0116] like If the network traffic is normal, no alarm will be triggered; otherwise... If the network traffic is in a warning state, an abnormal label is set as a warning and recorded in the local log; if If the network traffic is deemed abnormal, its low-dimensional representation vector is compared with the preset baseline vectors representing various attacks, and the cosine similarity is calculated for each vector. The vector with the highest cosine similarity and a cosine similarity greater than 1 is selected. The attack type is used as the anomaly type and the anomaly label. The anomaly confidence score is directly taken as the traffic anomaly score, which represents the degree to which the current network traffic deviates from the global normal representation baseline vector. Among them, the representation baseline vector of each type of attack is calculated and preset by calculating the mean of each dimension of the low-dimensional representation vector obtained by network encoding of the labeled attack traffic samples through the shared encoder. The anomaly types are determined according to the typical attack scenarios of network traffic anomaly detection and business security protection requirements, including port scanning attacks, distributed denial-of-service attacks, unauthorized access attacks, and data leakage attacks.

[0117] The final output includes the anomaly label, anomaly confidence level, and anomaly type.

[0118] For example, for a certain real-time network traffic to be detected, a bimodal fusion feature vector with a total dimension of 112 is extracted. The 112-dimensional bimodal fusion feature vector, together with the aggregation parameters and the 64-dimensional global normal representation baseline vector, is input into the input layer of the global anomaly detection model. The 112-dimensional bimodal fusion feature vector includes a 48-dimensional flow-level feature vector, a 32-dimensional node-level graph topology feature vector of the source host node, and a 32-dimensional node-level graph topology feature vector of the destination host node.

[0119] The feature extraction layer receives a 112-dimensional bimodal fusion feature vector, loads a shared encoder network initialized with aggregation parameters, and sequentially passes through a first fully connected layer with an input dimension of 112 and an output dimension of 256, a first batch normalization layer and a ReLU activation function, a second fully connected layer with an input dimension of 256 and an output dimension of 128, a second batch normalization layer and a ReLU activation function, and a third fully connected layer with an input dimension of 128 and an output dimension of 64, finally outputting a 64-dimensional low-dimensional representation vector;

[0120] The 64-dimensional low-dimensional representation vector is input into the anomaly scoring calculation layer, and the cosine distance between it and the 64-dimensional global normal representation baseline vector is calculated to be 1.44. Since the original range of the cosine distance is [0,2], while the flow anomaly score needs to be constrained to the interval [0,1], a linear mapping is used to divide the cosine distance by 2, thus obtaining the flow anomaly score after mapping. The output layer outputs a traffic anomaly score. ;

[0121] Traffic anomaly scoring With the abnormal scoring threshold , The comparison shows that since 0.72 is greater than 0.6, the network traffic is determined to be in an abnormal state. The cosine similarity between the 64-dimensional low-dimensional representation vector and the baseline vectors of various attack representations is calculated one by one. The cosine similarity corresponding to the distributed denial-of-service attack is 0.78. 0.78 is the largest cosine similarity among the four abnormal types and is greater than 0.6. Therefore, the abnormal type is determined to be a distributed denial-of-service attack. The abnormal label is marked as a distributed denial-of-service attack and the abnormal confidence value is set to 0.72. The final output includes the corresponding abnormal label, abnormal confidence value and abnormal type.

[0122] Specifically, the steps for generating a traffic anomaly detection and processing report include:

[0123] The central server receives the anomaly judgment results returned by each node. Using the source IP, destination IP, and anomaly occurrence timestamp in the five-tuple as a joint index, it performs cross-node correlation analysis on alarms from each node, grouping anomaly alarms belonging to the same communication pair or within the same time window. It aligns the timestamps of cross-node anomaly alarms, using the earliest alarm trigger time as the reference point, and merges alarms within a preset time tolerance window into the same associated event cluster, outputting the time-aligned cross-node anomaly alarm event cluster to resolve timing deviations caused by clock asynchrony among nodes. The preset time tolerance window is determined based on the clock synchronization accuracy of all nodes in the network and the upper limit of cross-node network transmission latency, and is set to ±5 seconds.

[0124] For each cross-node abnormal alarm event cluster, three-dimensional confidence calibration factors are calculated, including cross-node consistency factor, spatiotemporal contagion factor, and abnormal amplitude coordination factor. The calculation process for the cross-node consistency factor is as follows: count the abnormal types of all alarm records within the cross-node abnormal alarm event cluster, select the abnormal type with the highest frequency as the judgment type, and divide the frequency of the judgment type by the total number of alarm records to obtain the judgment consistency ratio, with a value range of 0 to 1. The calculation process for the spatiotemporal contagion factor is as follows: extract the subgraph composed of all alarm nodes within the cross-node abnormal alarm event cluster on the global network topology graph, count the number of nodes of the largest connected component from the subgraph, and calculate the ratio of the number of nodes of the largest connected component to the total number of alarm nodes to obtain the spatiotemporal contagion factor, with a value range of 0 to 1. The calculation process for the abnormal amplitude coordination factor is as follows: calculate the coefficient of variation of the traffic abnormality score of all nodes within the cross-node abnormal alarm event cluster, take the reciprocal of the coefficient of variation to obtain the abnormal amplitude coordination factor, and normalize it to the interval of 0 to 1; where the coefficient of variation is the ratio of the standard deviation to the arithmetic mean of the traffic abnormality score.

[0125] The weighted product of the anomaly confidence and the confidence calibration factor is used as the calibration confidence. The calibration threshold is set according to the 99th percentile of the calibration confidence statistics of historical normal traffic samples, with a value of 0.85. Cross-node anomaly alarm event clusters with calibration confidence greater than the calibration threshold are marked as high-confidence anomaly samples. The bimodal fusion feature vector, low-dimensional representation vector and anomaly type of the anomaly samples are extracted to form an incremental training dataset.

[0126] The incremental training dataset is used as the fine-tuning training set. The parameters of the first two fully connected layers of the shared encoder network in the feature extraction layer are frozen, and only the parameters of the third fully connected layer and the anomaly scoring calculation layer of the shared encoder network are incrementally updated. Cosine similarity loss is used as the fine-tuning loss function to maximize the similarity between the low-dimensional representation vector of the newly added anomaly sample and the corresponding attack representation baseline vector. The Adam optimizer is used for mini-batch iterative training. In this embodiment, the mini-batch size is set to 16 according to the sample size of the incremental training dataset and the GPU memory capacity of the central server. The attack representation baseline vector corresponding to the anomaly type is updated synchronously. The low-dimensional representation vector of the newly added anomaly sample is fused into the original attack representation baseline vector with a smoothing coefficient using an exponential moving average method to ensure that the attack baseline dynamically adapts as the threat evolves. After fine-tuning, the updated global model parameters and global attack representation baseline vector are generated to update the global anomaly detection model.

[0127] The central server uses the host identifier as a globally unique index to merge the active directed communication interaction graphs uploaded by each node. When the same directed edge appears simultaneously in the active directed communication interaction graphs of multiple nodes, a weighted average is performed using the total number of bytes of the directed edge in each node as the weight, and the resulting graph is merged to generate global directed edge attributes. For directed edges that appear only in the active directed communication interaction graph of a single node, they are directly inserted into the global communication interaction graph and marked as edge node associated edges. After merging, the weighted betweenness centrality and second-order neighbor structure overlap of each node are recalculated from a global perspective to form a global network topology graph that reflects the overall network communication situation.

[0128] On the global network topology, all alarm nodes involved in cross-node abnormal alarm event clusters are mapped as abnormal nodes. Using abnormal nodes as seeds, a breadth-first search is performed along the directed edge direction to identify the connection paths between abnormal nodes. For each connection path, the traffic anomaly score of each abnormal node on the connection path is calculated. If the traffic anomaly score along the connection path shows a propagation trend of first rising and then falling or increasing hop by hop, then the connection path is determined to be a critical connection path for potential attacks. The role of each node in attack propagation is evaluated based on weighted betweenness centrality, including: when the weighted betweenness centrality of a node is above the upper quartile of the weighted betweenness centrality of all nodes globally, the corresponding node is determined to be a high betweenness centrality node and marked as an attack relay hub; when the weighted betweenness centrality of a node is below the lower quartile and its weighted out-degree or weighted in-degree is abnormally increased, the corresponding node is determined to be a low betweenness centrality node and marked as a controlled terminal or initial intrusion point.

[0129] By combining the roles of connectivity paths and nodes in attack propagation, the key connectivity paths and scope of impact of the attack spreading laterally from the initial intrusion point to the target node are reconstructed.

[0130] The central server summarizes all the above analysis results and generates a traffic anomaly detection and processing report, including but not limited to the performance indicators of the global anomaly detection model, anomaly types, hop-by-hop topology diagrams of the critical connectivity paths of the attack, marking the initial intrusion point, relay nodes and target nodes of lateral spread, statistical distribution of each anomaly type and the number of affected hosts.

[0131] Example 2

[0132] Please see Figure 5 Another embodiment of the present invention provides a network anomaly traffic detection system based on federated contrastive learning, comprising: a flow-level sample construction module, a feature extraction module, a federated anomaly detection module, and a global correlation update module;

[0133] The flow-level sample construction module is used to collect network traffic data, aggregate it into flow-level data, and extract feature vectors. It performs data augmentation on the same network flow to generate positive samples. At the same time, it collects feature vectors from other network flows as negative samples, and generates a set of positive and negative traffic sample pairs after feature normalization and labeling.

[0134] The feature extraction module is used to construct a communication interaction graph based on stream-level data. It adopts an incremental sliding window mechanism for hierarchical management and updates, performs exponential weighted moving average smoothing on directed edge attributes, extracts the active directed communication interaction graph of the current sliding window, extracts node topology features and splices them to form a multi-dimensional node feature vector, performs normalization and truncation processing based on historical baselines, and outputs node-level graph topology feature vectors.

[0135] The federated anomaly detection module extracts flow-level feature vectors from positive and negative traffic sample pairs, combines them with node-level graph topology feature vectors, deploys a shared encoder network locally, calculates local model parameters using a comparative loss function, encrypts them with Gaussian perturbation, uploads them to the central server, performs federated averaging and aggregation, constructs a global anomaly detection model, and distributes the global model parameters to each node. After each node loads the global anomaly detection model, it collects network traffic loading data in real time, extracts flow-level features and graph node-level topology features, calculates traffic anomaly scores to determine network traffic anomalies, and outputs the anomaly determination results.

[0136] The global correlation update module is used to perform cross-node correlation analysis on alarms of each node based on the anomaly judgment results, select high-confidence anomaly samples as incremental training datasets, update the global anomaly detection model, integrate anomaly detection results and model performance indicators, stitch together the communication interaction graphs of each node to form a global network topology graph, analyze the spatiotemporal distribution characteristics of abnormal traffic, the key connectivity paths of attacks and the scope of impact, and generate a traffic anomaly detection and processing report.

[0137] Working principle and effects:

[0138] By collecting network traffic data locally on each distributed node, performing flow-level aggregation, and extracting feature vectors, data augmentation is performed on the same network flow to generate positive samples, while feature vectors from other network flows are selected as negative samples. After feature normalization and labeling, a set of positive and negative traffic sample pairs is generated. The original traffic data is stored on the local node throughout the process, avoiding the risk of privacy leakage caused by cross-domain data transmission from the source. At the same time, data augmentation increases sample diversity, breaks through the training limitations of a single sample distribution, and provides standardized sample support for the subsequent training of the global anomaly detection model.

[0139] A communication interaction graph is constructed based on flow-level data. An incremental sliding window mechanism is used to complete the hierarchical management and update of nodes. An exponentially weighted moving average smoothing is performed on the directed edge attributes. The active directed communication interaction graph of the current sliding window is extracted to eliminate instantaneous jitter. The node topology features are extracted and spliced ​​to form a multi-dimensional node feature vector that integrates traffic intensity and topology role. Normalization and truncation are performed based on historical baselines to output a standardized node-level graph topology feature vector. This compensates for the lack of global topology information in single flow-level features, realizes multi-dimensional representation of network communication behavior, and provides reliable feature basis for anomaly detection.

[0140] Flow-level feature vectors are extracted from positive and negative traffic sample pairs and combined with node-level graph topology feature vectors. A shared encoder network is deployed locally, and local model parameters are calculated based on the contrastive loss function. After Gaussian perturbation encryption, the parameters are uploaded to the central server for federated averaging and aggregation to build a global anomaly detection model, which is then distributed to each node for synchronous loading. Network traffic loading data is collected in real time, and flow-level features and graph node-level topology features are extracted synchronously to calculate traffic anomaly scores. Network traffic anomaly judgment is performed, and the anomaly judgment results are output. Based on federated learning, multi-node traffic distribution knowledge is integrated while protecting node data privacy, solving the problem of poor generalization of single-node training models and realizing collaborative modeling of distributed nodes.

[0141] Based on the anomaly detection results, cross-node correlation analysis is performed on alarms from each node. High-confidence anomaly samples are selected as incremental training datasets to update the global anomaly detection model. The anomaly detection results of each node are integrated with the model performance indicators, and the communication interaction graphs of each node are stitched together to form a global network topology graph. The spatiotemporal distribution characteristics of abnormal traffic, the key connectivity paths of attacks, and the scope of impact are analyzed, and finally, a traffic anomaly detection and processing report is generated. This approach overcomes the limitations of single-node detection and solves the problem of the difficulty of cross-node collaborative anomaly detection. At the same time, the global anomaly detection model is adaptively optimized through incremental training, which improves the generalization ability, privacy security, and overall situational awareness of network anomaly traffic detection in multi-node collaborative scenarios.

[0142] Overall, a four-layer architecture—flow-level sample construction, graph topology feature extraction, federated anomaly detection, and global correlation update—has been constructed to build an intelligent monitoring and risk warning system for abnormal network traffic in a distributed scenario. This system achieves privacy-preserving collaborative modeling, multi-dimensional feature fusion detection, and global anomaly judgment. From the three dimensions of data privacy protection, improved model generalization ability, and cross-node collaborative detection, it solves the problems of easy leakage of traffic data privacy, poor generalization of single-node detection models, and difficulty in cross-node collaborative anomaly detection in traditional distributed network detection.

[0143] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A network anomaly traffic detection method based on federated contrastive learning, characterized in that, include: Collect network traffic data and aggregate it to form flow-level data. Perform data augmentation on the same network flow to generate positive samples and obtain negative samples to construct a set of positive and negative traffic samples. A communication interaction graph is constructed, and an active directed communication interaction graph is obtained through hierarchical management and updates. Node topological features are extracted and spliced ​​to form a multi-dimensional node feature vector. After normalization and truncation, the node-level graph topological feature vector is output. Extract flow-level feature vectors from positive and negative traffic sample pairs, combine them with node-level graph topology feature vectors to deploy a shared encoder network locally, calculate local model parameters, encrypt and upload them, perform federated average aggregation, construct a global anomaly detection model, calculate traffic anomaly scores to determine network traffic anomalies, and output anomaly determination results. Based on the anomaly determination results, cross-node correlation analysis is performed, the global anomaly detection model is updated, and the communication interaction graphs of each node are stitched together to form a global network topology graph, ultimately generating a traffic anomaly detection and processing report.

2. The network anomaly traffic detection method based on federated contrastive learning according to claim 1, characterized in that, The specific steps for constructing a communication interaction graph include: Extract quintuples from the stream-level data, using the source IP and destination IP as unique identifiers for the host nodes. Traverse all quintuples of all stream records within the current time-series window, remove duplicates, and extract all host nodes to form an initial node set. Consistent hashing is performed on the node identifiers in the initial node set to generate a node ID set, and the source node ID and destination node ID are extracted as the unique primary key of the directed edge; Aggregate multiple port-level flows under the same primary key, calculate directed edge attributes, remove invalid edge records, and filter self-loop edges with the same source node ID and destination node ID to generate a set of directed edge attributes. Based on the set of directed edge attributes, a communication interaction graph is constructed with host identifiers as nodes and network flows as directed edges.

3. The network anomaly traffic detection method based on federated contrastive learning according to claim 2, characterized in that, The specific steps for outputting the node-level graph topological feature vectors include: An incremental sliding window mechanism is used to hierarchically manage and update the nodes in the communication interaction graph, resulting in an updated communication interaction graph. The directed edge attributes of the current sliding window are smoothed by an exponentially weighted moving average to obtain the updated directed edge attributes. Based on the updated directed edge attributes, all active nodes and their corresponding directed edges are filtered from the updated communication interaction graph to generate an active directed communication interaction graph. Node topological features are extracted from the active directed communication interaction graph, and multi-dimensional node feature vectors are formed by orderly splicing. After min-max normalization, the node-level graph topological feature vectors are output.

4. The network anomaly traffic detection method based on federated contrastive learning according to claim 3, characterized in that, The specific steps for deploying a shared encoder network include: Flow-level feature vectors are extracted from positive and negative traffic sample pairs. The host identifiers of source IP and destination IP are extracted using the quintuple as an index. The node-level graph topology feature vectors of the corresponding source host node and destination host node are matched respectively. The node-level graph topology feature vectors of the stream-level feature vector, the source host node, and the destination host node are sequentially concatenated to form a dual-modal fused feature vector; Matching and concatenation are performed on the homogeneous network streams of positive samples and the heterogeneous network streams of negative samples respectively to generate positive sample fusion feature pairs and negative sample fusion feature pairs. These are then merged into a dual-modal fusion feature positive and negative sample pair set and divided into a training set and a validation set. A shared encoder network is deployed locally, and the contrastive loss is calculated as the training objective. The Adam optimizer is used to update the local model parameters of the shared encoder network in combination with the training set. All normal traffic samples in the training set are selected and input into the shared encoder network to obtain a low-dimensional representation vector set. The mean is calculated for each dimension to generate a local normal representation vector.

5. The network anomaly traffic detection method based on federated contrastive learning according to claim 4, characterized in that, The specific steps for performing federated average aggregation include: The local model parameters are flattened and concatenated into a one-dimensional parameter vector according to the network hierarchy, and then combined with the local normal representation vector to form a one-dimensional vector to be encrypted. Calculate the standard deviation of Gaussian noise, generate Gaussian noise using the standard deviation as a parameter, perform Gaussian perturbation encryption to obtain an encrypted one-dimensional vector, and restore the encryption parameters of the shared encoder network by reverse splitting. Calculate the sample weight coefficients for local nodes; The encrypted one-dimensional vector, sample weight coefficients, and encryption parameters are uploaded to the central server for federated average aggregation. The encryption parameters of each layer of the shared encoder network are weighted and summed with the sample weight coefficients to obtain the aggregate parameters layer by layer. The global normal representation baseline vector is obtained by weighting and aggregating the encrypted one-dimensional vector dimension by dimension.

6. The network anomaly traffic detection method based on federated contrastive learning according to claim 5, characterized in that, The specific steps for constructing a global anomaly detection model include: Construct a global anomaly detection model, including an input layer, a feature extraction layer, an anomaly score calculation layer, and an output layer; The input layer is used to receive the dual-modal fusion feature vector, aggregation parameters and global normal representation baseline vector of the traffic to be detected, and uses the aggregation parameters and global normal representation baseline vector as global model parameters. The feature extraction layer is used to load the aggregation parameters as weights of the shared encoder network, encoding the bimodal fusion feature vector into a low-dimensional representation vector. The anomaly scoring layer calculates the cosine distance between the low-dimensional representation vector and the global normal representation baseline vector, mapping it to a traffic anomaly score. ; Output layer, used for outputting traffic anomaly scores. .

7. The network anomaly traffic detection method based on federated contrastive learning according to claim 6, characterized in that, The specific steps for outputting the anomaly determination result include: The central server distributes global model parameters to each node, and each node loads the global anomaly detection model and collects network traffic loading data in real time. Flow-level features are extracted and concatenated with graph node-level topological features to form a real-time dual-modal fusion feature vector, which is then input into a global anomaly detection model to obtain a flow anomaly score. ; Set anomaly scoring threshold , Perform network traffic anomaly detection; like If so, it is considered a normal state; if If so, it is determined to be a warning state, and the abnormal label is marked as a warning; like If the condition is abnormal, the cosine similarity between the low-dimensional representation vector and the preset baseline vectors for various attack representations is calculated. Select the one with the highest cosine similarity and greater than The attack type is used as the anomaly type, the anomaly type is used as the anomaly label, and the traffic anomaly score is used as the anomaly confidence level. The final output is the anomaly determination result.

8. The network anomaly traffic detection method based on federated contrastive learning according to claim 7, characterized in that, The specific steps for updating the global anomaly detection model include: After receiving the anomaly determination results, the central server sets up a composite index to perform cross-node correlation analysis on alarms from each node, and outputs cross-node anomaly alarm event clusters after time-series alignment. Calculate the confidence calibration factor for each cross-node abnormal alarm event cluster, and calculate the calibration confidence by combining the abnormal confidence with weighted average; Abnormal samples with calibration confidence greater than a preset calibration threshold are selected, and dual-modal fusion feature vectors, low-dimensional representation vectors, and abnormal types are extracted to form an incremental training dataset. The parameters of the third fully connected layer and the anomaly scoring calculation layer of the shared encoder network are incrementally updated based on the incremental training dataset. The corresponding attack representation baseline vector is updated using an exponential moving average method to generate updated global model parameters and global attack representation baseline vector, thereby updating the global anomaly detection model.

9. The network anomaly traffic detection method based on federated contrastive learning according to claim 8, characterized in that, The specific steps for generating a traffic anomaly detection and handling report include: Based on the host identifier, merge the active directed communication interaction graphs uploaded by each node, recalculate the weighted betweenness centrality and second-order neighbor structure overlap of each node, and form a global network topology graph. On the global network topology graph, alarm nodes within cross-node abnormal alarm event clusters are mapped as abnormal nodes. Using abnormal nodes as seeds, a breadth-first search is performed along directed edges to identify the connected paths between abnormal nodes. Calculate the traffic anomaly score for each abnormal node on the connected path; When the traffic anomaly score shows a propagation trend of first rising and then falling or increasing step by step, the corresponding connectivity path is determined to be a critical connectivity path. The role of each node in the attack propagation is assessed based on weighted betweenness centrality, and the key connectivity paths and scope of impact of the attack are reconstructed by combining connectivity paths. A summary report on traffic anomaly detection and handling is generated.

10. A network anomaly traffic detection system based on federated contrastive learning, used to implement the network anomaly traffic detection method based on federated contrastive learning as described in any one of claims 1-9, characterized in that, include: The module includes a stream-level sample construction module, a feature extraction module, a federated anomaly detection module, and a global correlation update module. The flow-level sample construction module is used to collect network traffic data, aggregate it to form flow-level data, perform data augmentation on the same network flow to generate positive samples and obtain negative samples, and construct a set of positive and negative traffic sample pairs. The feature extraction module is used to construct a communication interaction graph, obtain an active directed communication interaction graph through hierarchical management and update, extract node topological features and splice them to form a multi-dimensional node feature vector, and output a node-level graph topological feature vector after normalization and truncation. The federated anomaly detection module is used to extract flow-level feature vectors from the set of positive and negative traffic sample pairs, combine them with node-level graph topology feature vectors to deploy a shared encoder network locally, calculate local model parameters, encrypt and upload them and perform federated average aggregation, construct a global anomaly detection model, calculate traffic anomaly scores to determine network traffic anomalies, and output anomaly determination results. The global association update module is used to perform cross-node association analysis based on the anomaly judgment results, update the global anomaly detection model, and then stitch together the communication interaction graphs of each node to form a global network topology graph, and finally generate a traffic anomaly detection and processing report.

Images