Traffic anomaly detection method and system based on quantum genetic algorithm feature selection

Abstract

The present application relates to the technical field of information security, and particularly relates to a traffic anomaly detection method and system based on quantum genetic algorithm feature selection, which comprises the following steps: calculating initial importance scores of each feature based on a feature importance measurement method; constructing a quantum population and collapsing quantum chromosomes into binary feature mask vectors through observation operation; performing hierarchical fitness evaluation on the quantum population, calculating pre-evaluation values of all individuals based on mutual information, selecting individuals with high pre-evaluation values as elite candidates, training a classifier to calculate accurate fitness values; when the population diversity is lower than a preset threshold, sampling elite fragments from a historical elite fragment memory bank and implementing directional assignment on non-elite individuals, otherwise performing quantum rotation gate update, and iterating until convergence to output an optimal feature subset; training an anomaly detection classifier based on the optimal feature subset, extracting corresponding features from real-time network traffic and inputting the features into the anomaly detection classifier for anomaly determination.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a traffic anomaly detection method and system based on feature selection using a quantum genetic algorithm. Background Technology

[0002] Network traffic anomaly detection is a core technology in network security defense systems. It aims to identify abnormal traffic that deviates from normal behavior patterns, such as distributed denial-of-service attacks, port scanning, worm propagation, and data breaches, through real-time monitoring and analysis of network data flows. With the continuous growth of network bandwidth and the advancement of attack methods, machine learning-based traffic anomaly detection methods have gradually become the mainstream approach due to their ability to automatically learn deep statistical patterns in traffic data. Machine learning-based network traffic anomaly detection typically requires extracting a large number of statistical features from raw network traffic to accurately distinguish between normal and attack traffic. These features cover packet header fields (such as protocol type, source and destination port numbers), statistics within a time window (such as the number of packets, bytes, and connections per unit time), connection behavior characteristics (such as connection duration, round-trip latency, and retransmission rate), and payload content characteristics. In practical systems, to achieve comprehensive detection coverage, raw feature sets with tens to hundreds of dimensions are often constructed.

[0003] However, high-dimensional feature sets contain a large number of redundant features and noisy features irrelevant to anomaly detection. Directly using all features for model training leads to a sharp increase in computational complexity with increasing feature dimensionality, making it difficult to meet the real-time detection requirements of high-throughput networks. Furthermore, redundant and noisy features interfere with the correct learning of the classifier's decision boundaries, reducing the model's generalization ability to unknown samples. Feature selection is an effective way to solve these problems. It achieves dimensionality reduction and efficiency by selecting the optimal subset of features from the original high-dimensional feature set that is most relevant to the classification task and has minimal redundancy.

[0004] Quantum Genetic Algorithm (QGA), a product of the combination of quantum theory and evolutionary algorithms, exhibits advantages such as good population diversity, strong global search capability, and fast convergence speed, and has been attempted to be applied to feature selection in recent years. However, existing methods still have the following limitations in traffic anomaly detection scenarios: First, the fitness evaluation cost is too high. Each generation of the quantum genetic algorithm requires constructing feature subsets for all individuals in the population and training a classifier to calculate the fitness value. When the feature dimension is high and the population size is large, the cumulative number of training times is high, and the computational cost severely restricts the population size and the number of iterations, resulting in insufficient search depth and difficulty in finding high-quality feature subsets in high-dimensional space. Second, the population diversity degrades in the later stages and is prone to getting trapped in local optima. During the search process, the probability amplitude of each qubit in the population gradually tends to concentrate, and diversity is lost rapidly. Existing methods use random reset of probability amplitude to perturb and try to escape local optima, but this method lacks directional guidance and may destroy the good feature combinations that have been explored, further slowing down the convergence process.

[0005] The information disclosed in this background section is intended only to enhance the understanding of the general background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] This invention provides a method and system for detecting traffic anomalies based on feature selection using a quantum genetic algorithm, thereby effectively solving the problems in the background art. To achieve the above objectives, the technical solution adopted by this invention is: a flow anomaly detection method based on feature selection using a quantum genetic algorithm, comprising the following steps: Obtain the original feature matrix of network traffic, and calculate the initial importance score of each feature based on the feature importance measurement method; The probability amplitude of the qubit is initialized according to the initial importance score, a quantum population is constructed, and the quantum chromosome is collapsed into a binary feature mask vector through observation operation; A hierarchical fitness assessment is performed on the quantum population. Based on mutual information, a pre-assessment value is calculated for all individuals. Individuals with the highest pre-assessment value are selected as elite candidates, and a classifier is trained to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation based on the similarity between their feature mask vector and the feature mask vector of the elite candidate individuals. Based on the population diversity metric, determine whether to trigger a directional perturbation. When the population diversity is lower than the preset threshold, sample elite fragments from the historical elite fragment memory bank and assign directional values ​​to non-elite individuals. Otherwise, perform quantum rotation gate update. Iterate until convergence and output the optimal feature subset. An anomaly detection classifier is trained based on the optimal feature subset, and corresponding features are extracted from real-time network traffic and input into the anomaly detection classifier for anomaly determination.

[0007] Furthermore, the original feature matrix is ​​constructed as follows: The captured network packets are parsed according to protocols, and the packets are aggregated into network flows according to the network flow quintuple. Multidimensional statistical features are calculated for each network flow. The multidimensional statistical features include data packet quantity statistics, data packet length statistics, time correlation features, connection behavior features, and traffic load content features; The original feature matrix is ​​obtained by normalizing the multidimensional statistical features.

[0008] Furthermore, the initial importance score is calculated as follows: A random forest classifier is trained on all normalized features. The average decrease in Gini coefficient contributed by each feature in the random forest classifier when used as a split node is taken as the initial importance score of the feature. The initial importance score is then scaled and mapped to a preset range.

[0009] Furthermore, the calculation of the precise fitness value employs a bi-objective optimization rule: Using recall and false positive rate as evaluation metrics, when the current optimal recall rate is lower than the preset recall rate convergence threshold, the exact fitness value is calculated with recall rate as the primary optimization objective. When the current optimal recall rate is not lower than the recall rate convergence threshold, the exact fitness value is calculated by minimizing the false positive rate while maintaining a high recall rate.

[0010] Furthermore, the construction method of the historical elite fragment memory bank is as follows: After each generation completes the fitness evaluation, the frequency of each feature in the feature mask vector in the elite candidate set is statistically analyzed. Features with a frequency higher than a preset frequency threshold are extracted to form elite segments. These elite segments are then stored in the historical elite segment memory bank, and their cumulative occurrence count is recorded.

[0011] Furthermore, the implementation method of the directional assignment is as follows: Elite fragments are sampled from the historical elite fragment memory bank with a weight proportional to the cumulative occurrence of the fragments, and targeted values ​​are assigned to non-elite individuals in the current population at a predetermined proportion. The qubit probability amplitude of the feature bits corresponding to the elite segments is set to a high selection probability, and a small random rotation is applied to the feature bits corresponding to the non-elite segments.

[0012] Furthermore, the quantum rotating gate is updated in the following way: To maintain the record of the globally optimal individual, the probability amplitude of each qubit is deflected by a basis rotation angle in the direction of the corresponding probability amplitude of the globally optimal individual. The rotation direction of the base rotation angle is determined based on the phase angle difference between the current probability amplitude and the probability amplitude of the globally optimal individual; A quantum NOT gate operation is performed on a subset of qubits with a preset mutation probability, thereby exchanging the probability amplitude values ​​of the qubits.

[0013] The present invention also includes a flow anomaly detection system based on feature selection using a quantum genetic algorithm, employing the method described above, the system comprising: The feature extraction and importance measurement module is used to obtain the original feature matrix of network traffic and calculate the initial importance score of each feature based on the feature importance measurement method. The quantum population initialization module is used to initialize the probability amplitude of the qubits according to the initial importance score, construct the quantum population, and collapse the quantum chromosome into a binary feature mask vector through observation operations. The hierarchical fitness evaluation module is used to perform hierarchical fitness evaluation on the quantum population. Based on mutual information, it calculates the pre-evaluation value of all individuals, selects the individuals with the highest pre-evaluation value as elite candidates, and trains a classifier to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation of the similarity between their feature mask vector and the feature mask vector of elite candidate individuals. The quantum evolution module is used to determine whether to trigger a directional perturbation based on the population diversity metric. When the population diversity is lower than a preset threshold, it samples elite fragments from the historical elite fragment memory bank and assigns directional values ​​to non-elite individuals. Otherwise, it performs a quantum rotation gate update and outputs the optimal feature subset after iteration until convergence. The anomaly detection module is used to train an anomaly detection classifier based on the optimal feature subset, extract corresponding features from real-time network traffic, and input them into the anomaly detection classifier for anomaly determination.

[0014] The present invention also includes a computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described above.

[0015] The present invention also includes a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method as described above.

[0016] The beneficial effects of this invention are as follows: Through the synergy of three mechanisms—prior-guided initialization, hierarchical fitness evaluation, and directional memory perturbation—high-quality network traffic feature selection is achieved with controlled computational overhead. In the initialization phase, the initial value of the qubit probability amplitude is directly guided by the feature importance measurement results, ensuring that features with higher importance have a higher probability of being selected in the initial population. The population search direction receives effective guidance from prior information at the beginning, accelerating the convergence process. During the evolutionary process, a pre-evaluation strategy based on mutual information is used to quickly rank all individuals. Precise fitness evaluation is performed only on the top-ranked elite candidates. The fitness values ​​of other individuals are estimated by weighted interpolation based on the similarity to the feature selection of elite individuals. This keeps the number of individuals requiring precise evaluation in each generation far smaller than the population size, significantly reducing computational overhead without significantly sacrificing evaluation accuracy. When the population diversity metric falls below a preset threshold, superior feature combinations are sampled from the historical elite fragment memory bank. Directional perturbation is applied to non-elite individuals, limiting the search perturbation direction to the range of verified effective feature combinations. This guides the population out of local optima while protecting the explored superior feature structures. Under the same computational budget constraint, this invention can support a larger population size and more iterations than conventional full-scale accurate evaluation schemes, thereby obtaining a feature subset with better classification performance and improving the accuracy of subsequent network traffic anomaly detection. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of the flow anomaly detection method based on feature selection using quantum genetic algorithm in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the flow anomaly detection system based on feature selection using a quantum genetic algorithm in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of the steps in the flow anomaly detection method based on feature selection using quantum genetic algorithm in Embodiment 2 of the present invention; Figure 4 This is a schematic diagram of the overall scheme framework of the flow anomaly detection method based on feature selection using quantum genetic algorithm in Embodiment 2 of the present invention; Figure 5 This is a functional block diagram of the flow anomaly detection system based on feature selection using a quantum genetic algorithm in Embodiment 2 of the present invention; Figure 6 This is a system framework diagram of the flow anomaly detection system based on feature selection using quantum genetic algorithm in Embodiment 2 of the present invention; Figure 7 This is a schematic diagram of the computer device in Embodiment 3 of the present invention. Detailed Implementation

[0019] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0020] Example 1: like Figure 1 As shown: A flow anomaly detection method based on feature selection using a quantum genetic algorithm, comprising the following steps: Obtain the original feature matrix of network traffic, and calculate the initial importance score of each feature based on the feature importance measurement method; The probability amplitude of the qubit is initialized based on the initial importance score, a quantum population is constructed, and the quantum chromosome is collapsed into a binary feature mask vector through observation operations; A hierarchical fitness assessment is performed on the quantum population. Based on mutual information, the pre-evaluation value of all individuals is calculated. Individuals with the highest pre-evaluation value are selected as elite candidates and a classifier is trained to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation based on the similarity between their feature mask vector and the feature mask vector of elite candidate individuals. Based on the population diversity metric, determine whether to trigger a directional perturbation. When the population diversity is lower than the preset threshold, sample elite fragments from the historical elite fragment memory bank and assign directional values ​​to non-elite individuals. Otherwise, perform quantum rotation gate update. Iterate until convergence and output the optimal feature subset. An anomaly detection classifier is trained based on the optimal feature subset. Corresponding features are extracted from real-time network traffic and input into the anomaly detection classifier for anomaly determination.

[0021] By synergistically employing three mechanisms—prior-guided initialization, hierarchical fitness evaluation, and directed memory perturbation—high-quality network traffic feature selection is achieved with controlled computational overhead. In the initialization phase, the initial value of the qubit probability amplitude is directly guided by the feature importance metric, ensuring that features with higher importance have a higher probability of being selected in the initial population. This provides effective prior information guidance for the population search direction from the outset, accelerating the convergence process. During evolution, a mutual information-based pre-evaluation strategy is used to quickly rank all individuals. Precise fitness evaluation is performed only on the top-ranked elite candidates. The fitness values ​​of other individuals are estimated through weighted interpolation based on the similarity of their feature selection to that of elite individuals. This keeps the number of individuals requiring precise evaluation in each generation far smaller than the population size, significantly reducing computational overhead without significantly sacrificing evaluation accuracy. When the population diversity metric falls below a preset threshold, superior feature combinations are sampled from the historical elite fragment memory bank. Directed perturbation is applied to non-elite individuals, limiting the search perturbation direction to the range of validated feature combinations. This guides the population out of local optima while protecting the explored superior feature structures. Under the same computational budget constraint, this invention can support a larger population size and more iterations than conventional full-scale accurate evaluation schemes, thereby obtaining a feature subset with better classification performance and improving the accuracy of subsequent network traffic anomaly detection.

[0022] In this embodiment, the original feature matrix is ​​constructed as follows: The captured network packets are parsed according to protocols, and the packets are aggregated into network flows according to the network flow quintuple. Multidimensional statistical features are calculated for each network flow. Multidimensional statistical features include data packet quantity statistics, data packet length statistics, time-related features, connection behavior features, and traffic payload content features; The original feature matrix is ​​obtained by normalizing the multidimensional statistical features.

[0023] The initial importance score is calculated as follows: A random forest classifier is trained on all normalized features. The average decrease in Gini coefficient contributed by each feature in the random forest classifier when used as a split node is taken as the initial importance score of the feature. The initial importance score is then scaled and mapped to a preset range.

[0024] As a preferred embodiment of the above, the calculation of the precise fitness value adopts a bi-objective optimization rule: Using recall and false positive rate as evaluation metrics, when the current optimal recall rate is lower than the preset recall rate convergence threshold, the exact fitness value is calculated with recall rate as the primary optimization objective. When the current optimal recall rate is not lower than the recall rate convergence threshold, the exact fitness value is calculated by minimizing the false positive rate while maintaining a high recall rate.

[0025] The construction method of the historical elite fragment memory bank is as follows: After each generation completes the fitness evaluation, the frequency of each feature in the feature mask vector in the elite candidate set is statistically analyzed. Features with a frequency higher than a preset frequency threshold are extracted to form elite segments. These elite segments are stored in a historical elite segment memory bank, and their cumulative occurrence count is recorded.

[0026] In this embodiment, the implementation method of directional assignment is as follows: Elite fragments are sampled from the historical elite fragment memory bank with a weight proportional to the cumulative occurrence of the fragments, and targeted values ​​are assigned to non-elite individuals in the current population at a predetermined proportion. Set the qubit probability amplitude of the feature bits corresponding to the elite segments to a high selection probability, and apply a small random rotation to the feature bits corresponding to the non-elite segments.

[0027] As a preferred embodiment of the above, the quantum rotating gate is updated as follows: To maintain the record of the globally optimal individual, the probability amplitude of each qubit is deflected by a basis rotation angle in the direction of the corresponding probability amplitude of the globally optimal individual. The rotation direction of the base rotation angle is determined based on the phase angle difference between the current probability amplitude and the probability amplitude of the globally optimal individual; A quantum NOT gate operation is performed on a subset of qubits with a preset mutation probability, swapping the probability amplitude values ​​of the qubits.

[0028] like Figure 2 As shown, this embodiment also includes a traffic anomaly detection system based on feature selection using a quantum genetic algorithm. Using the method described above, the system includes: The feature extraction and importance measurement module is used to obtain the original feature matrix of network traffic and calculate the initial importance score of each feature based on the feature importance measurement method. The quantum population initialization module is used to initialize the probability amplitude of qubits according to the initial importance score, construct the quantum population, and collapse the quantum chromosome into a binary feature mask vector through observation operations; The hierarchical fitness evaluation module is used to perform hierarchical fitness evaluation on the quantum population. It calculates the pre-evaluation value of all individuals based on mutual information, selects the individuals with the highest pre-evaluation value as elite candidates and trains a classifier to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation based on the similarity between their feature mask vector and the feature mask vector of elite candidate individuals. The quantum evolution module is used to determine whether to trigger a directional perturbation based on the population diversity metric. When the population diversity is lower than a preset threshold, it samples elite fragments from the historical elite fragment memory bank and assigns directional values ​​to non-elite individuals. Otherwise, it performs a quantum rotation gate update and outputs the optimal feature subset after iteration until convergence. The anomaly detection module is used to train an anomaly detection classifier based on the optimal feature subset, extract corresponding features from real-time network traffic and input them into the anomaly detection classifier for anomaly determination.

[0029] Example 2: like Figure 3 As shown, this embodiment includes a traffic anomaly detection method based on feature selection using a quantum genetic algorithm, comprising the following steps: Step 1: Traffic Feature Extraction and Initial Importance Measurement A packet capture engine is deployed at key network nodes to acquire raw network traffic packets in real time. The captured packets are parsed according to protocols, and packets belonging to the same flow are aggregated into network flows based on network flow quintuples. Multidimensional statistical features are calculated, including packet count, packet length statistics, flow duration, packet arrival interval, packets per second and bytes per second, and payload characteristics, forming a raw high-dimensional numerical feature vector. The feature matrices of all samples are normalized to eliminate dimensional differences. A random forest classifier is then trained on all normalized features. The average decrease in the Gini coefficient contributed by each feature when it acts as a splitting node in all decision trees is calculated and used as the initial importance score for that feature. This score is scaled to the [0,1] interval and used as prior information for quantum population initialization.

[0030] Step 2: Quantum Population Initialization and Observation Feature selection is modeled as a binary combinatorial optimization problem. A subset of candidate features is represented using qubit probability amplitude encoding. Each quantum chromosome consists of qubits with the same dimension as the original features. Each qubit encodes the probability of a feature being selected or not selected using a pair of probability amplitudes. During initial population generation, the initial probability amplitude of each qubit is set according to the feature importance score obtained in step 1, increasing the initial selection probability of important features. Simultaneously, a small random perturbation is added to maintain a certain level of diversity. After generating quantum chromosomes to form the initial population at a preset population size, an observation operation is performed on each chromosome. This involves generating a random number for each qubit to determine whether the feature bit is 1 or 0, collapsing the quantum chromosome into a defined binary feature mask vector, forming the mask matrix of the initial population.

[0031] Step 3: Stratified fitness assessment A coarse-grained pre-evaluation is first performed on all individuals in the population: based on mutual information, the mutual information between each feature and the class label, as well as between features, is calculated. For each individual's feature mask, a pre-evaluation value is calculated—the sum of the mutual information between the selected features and the label minus the product of the sum of the mutual information between features and the redundancy penalty coefficient. The pre-evaluation values ​​are ranked from highest to lowest, and the top-ranked individuals are selected as elite candidates. Only these elite candidates are actually trained with a random forest classifier. Their recall and false positive rates on the validation set are calculated, and the precise fitness value is calculated according to the bi-objective optimization rule, updating the global optimal record. Non-elite individuals are not actually trained with a classifier; their fitness is estimated through weighted interpolation of the cosine similarity between the mask vector and the elite individual mask vectors. Through this hierarchical strategy, the number of classifiers actually trained in each generation is controlled within the elite candidate size, significantly reducing computational overhead.

[0032] Step 4: Elite Fragment Memory Bank Update and Diversity Assessment After each generation completes fitness evaluation, the frequency of each feature in the selected mask within the elite candidate set is statistically analyzed. Features with frequencies exceeding a preset threshold are extracted to form elite segments, which are stored in a historical elite segment memory bank, and their cumulative occurrence count is recorded. Simultaneously, the average entropy of the probability amplitudes of all qubits in the population is calculated as a diversity measure—the entropy value is calculated for each qubit based on its probability amplitude, and then averaged across the entire population. A value closer to 1 indicates a more dispersed population, while a value closer to 0 indicates a tendency towards homogeneity. The average entropy is compared with a preset diversity degradation threshold to determine whether diversity degradation has occurred in the population.

[0033] Step 5: Quantum Evolution Operation If the average entropy of the population is lower than the diversity degradation threshold, a directional perturbation is performed: elite fragments are obtained by weighted sampling based on the cumulative occurrence frequency from the historical elite fragment memory bank, and a directional assignment is applied to a certain proportion of non-elite individuals in the current population—features within the fragment are forcibly set to a high selection probability, while features outside the fragment are only subjected to a small random rotation. If the average entropy is not lower than the threshold, a conventional quantum rotation gate update is performed, causing the probability amplitude of each qubit to deflect towards the globally optimal individual by a basic angle, and a NOT gate operation is performed on some qubits with a preset low mutation probability to exchange their probability amplitudes, introducing a new search direction.

[0034] Step 6: Iteration Termination and Output of Optimal Feature Subset The updated population is re-observed to obtain a new generation of binary mask matrix, and the next generation loop begins. The iteration terminates when the preset maximum number of iterations is reached or the global optimal fitness has not improved over multiple consecutive generations. The optimal binary mask vector is extracted from the global optimal record, and the feature bits with a value of 1 form the optimal feature subset and are output.

[0035] Step 7: Anomaly Detection Model Training and Online Detection Based on the optimal feature subset of the output, corresponding feature columns are extracted from the normalized training feature matrix to construct a dimensionality-reduced training set. This set is then used to train the final random forest anomaly detection classifier. Hyperparameters are optimized through cross-validation and grid search, and the model and optimal feature subset are saved. During online detection, real-time captured traffic is parsed and merged according to the protocol, and only the feature dimension specified by the optimal subset is calculated to form a dimensionality-reduced real-time feature vector. This vector is input into the classifier, which outputs a category label to determine whether the traffic is normal or abnormal. An alarm is triggered when an anomaly occurs.

[0036] like Figure 4 As shown, the specific steps and algorithm are as follows: 1. Traffic feature extraction and initial importance measurement 1.1 Raw Flow Feature Extraction The process involves acquiring raw network traffic data, performing protocol parsing and flow merging on the captured packets, and aggregating the packets into network flows based on the network flow quintuple. The network flow quintuple is defined as follows: ,in Indicates the source IP address. Indicates the destination IP address. Indicates the source port. Indicates the destination port. This indicates the protocol type. A sequence of data packets belonging to the same quintuple constitutes a network flow, and multidimensional statistical characteristics are calculated for this flow. These statistical characteristics include the following categories: data packet quantity statistics, including the total number of forward packets, the total number of backward packets, and the total number of packets; data packet length statistics, including the mean, standard deviation, maximum, and minimum data packet lengths; time-related characteristics, including the flow duration and the mean and standard deviation of packet arrival intervals; connection behavior characteristics, including the number of packets per second, the number of bytes per second, and the ratio of forward to backward packets; and traffic payload content characteristics, including payload byte length, payload byte entropy, and the frequency of specific protocol keywords.

[0037] The sum of all the above features constitutes the original high-dimensional numerical feature vector. ,in This represents the original feature dimension. For features containing... The dataset of traffic samples, the original feature matrix is ​​denoted as The corresponding category label vector is Where 0 represents normal traffic and 1 represents abnormal traffic. For the original feature matrix... Perform maximum and minimum value normalization to map each feature value to an interval. This eliminates the dimensional differences between different features. The normalized initial feature matrix. As input for feature selection in subsequent quantum genetic algorithms.

[0038] 1.2 Initial Feature Importance Measurement To ensure the quantum population has an information-guided search direction at the beginning of its evolution and avoid the inefficient search caused by completely random initialization, a random forest classifier is first trained on all normalized features before feature selection. The decrease in its output Gini coefficient is used as a measure of the initial importance of each feature. This importance score will then serve as prior information input for the probability amplitude of each qubit during subsequent quantum population initialization. Let the trained random forest contain... A decision tree, for features Its importance score Defined as the average decrease in the Gini coefficient for this feature's contribution across all decision trees, expressed as: ; in For the first In a decision tree, features The set of internal nodes of a split node For nodes The decrease in Gini coefficient before and after splitting. Importance scores of all features are scaled and mapped to intervals. ,Right now ,in This represents the maximum value among all feature importance scores. This is the scaled importance score. It is directly used as prior information input for the probability amplitude of each qubit during quantum population initialization.

[0039] 2. Quantum bit probabilistic amplitude encoding and population construction 2.1 Binary Combination Optimization Modeling for Feature Selection First, the feature selection problem is modeled as a binary combinatorial optimization problem, and a binary feature mask vector is defined. ,in Indicates the first One feature was selected and included in the candidate feature subset. This indicates that the feature has been removed. Let... Given a search space consisting of all possible feature mask vectors, the objective of the feature selection problem is to... Find the optimal mask vector from possible combinations that maximizes the preset fitness function. : ; Where fitness function The core evaluation metrics for assessing the quality of feature subsets are anomaly detection recall and false positive rate, with specific expressions provided in the subsequent section on hierarchical fitness evaluation strategies. Search space size. It exhibits exponential growth and employs a quantum genetic algorithm for efficient approximate search to select the optimal feature subset with the greatest discriminative power for anomaly detection from the high-dimensional original feature set.

[0040] 2.2 Quantum Bit Probabilistic Amplitude Encoding and Population Initialization A quantum bit probability amplitude encoding mechanism is used to represent the candidate feature subset. The original high-dimensional feature dimension is... Assume each quantum chromosome is composed of It consists of 100 qubits, each qubit With a pair of probability amplitudes Encoding, definition Indicates the first One feature was not selected ( The probability of ), This indicates that the feature has been selected. The probability of ) satisfies the normalization condition: ; Then the first quantum chromosome It can be represented as: ; That is, each quantum chromosome is... real numbers (i.e.) The probability amplitude was encoded to represent the probability distribution over the entire search space. Let the preset population size be... ,generate During the initial population generation, the values ​​of each qubit... The initial values ​​are set based on the feature importance scores output by the random forest in the initial feature importance metric. For the ... The first chromosome Each qubit is defined with an initial probability amplitude. for: ; in To conform to a mean of 0 and a variance of , Small random perturbations of a normally distributed system; and Cut off within the preset range To ensure numerical stability, This initialization strategy increases the probability of selecting features with higher importance in the initial population, giving the population a search direction guided by prior information from the very beginning.

[0041] 2.3 Quantum Chromosome Observation Operation Each quantum chromosome collapses into a defined binary feature mask vector through observation. The observation rule is: for the ... The first chromosome One qubit, generating random numbers ,like but ,otherwise .in This represents a continuous, uniform distribution. A binary mask vector is obtained after observing each chromosome. This is used as input for subsequent hierarchical fitness evaluation, and the mask vectors form a binary mask matrix. The observation operation is random; the same quantum chromosome may collapse into different binary mask vectors in different generations or multiple observations. After updating the probability amplitude in each generation, the observation is re-executed to generate a new generation of mask matrix, thus mapping the update of the probability amplitude space to the search of the feature subset space.

[0042] 3. Hierarchical fitness assessment and elite fragment-guided quantum evolutionary search 3.1 Strategies for Hierarchical Fitness Assessment To reduce the training overhead of each generation of classifiers, a hierarchical fitness evaluation strategy is designed, dividing fitness evaluation into two levels: coarse-grained pre-evaluation and fine-grained precise evaluation. First, a global optimal record is established to store the optimal quantum chromosome discovered up to the current evolutionary generation. and its corresponding binary mask vector and precise fitness value .

[0043] Coarse-grained pre-evaluation is based on the mRMR (minimum redundancy maximum correlation) criterion, using the normalized initial feature matrix. and the corresponding category label vector Calculate the mutual information between each feature and the label, as well as between features themselves. In each generation, perform a cross-referencing of all features in the population. Each chromosome, based on its feature mask vector, has a pre-evaluation value calculated, which is composed of the mutual information between features and class labels minus the mutual information between features, represented as: ; in For the first Features and category labels Mutual information between them; Features With features Mutual information between them; This represents the redundancy penalty coefficient. Mutual information is calculated by discretizing the normalized feature values ​​and then using a nonparametric estimation method. The physical meaning of coarse-grained pre-evaluation is that the stronger the correlation between features and labels and the lower the redundancy between features, the more likely the subset is to perform well in subsequent accurate evaluation.

[0044] Fine-grained, precise assessment sorts the pre-assessed values ​​from highest to lowest and selects the top-ranked values. Individuals were selected as elite candidates, among whom This is the proportionality coefficient. This is a preset maximum number of training iterations per generation. The random forest classifier is only trained on elite candidate individuals, based on their feature masks. Extract the corresponding dimensionality-reduced subsets from the normalized training set, divide them into training subsets and validation subsets, train the random forest classifier, and then calculate its anomaly detection recall rate on the validation subset. and false positive rate To reduce false negatives, a bi-objective optimization rule is designed to calculate the accurate fitness value. The recall rate convergence threshold is defined as follows: if the current globally optimal recall rate is... Therefore, recall is the primary optimization objective, and precision fitness is: ; in Preset weights to ensure recall is prioritized. If To minimize the false positive rate while maintaining a high recall rate: ; in The weights are preset. After calculating the exact fitness, the global best record is updated, and the individual with the highest exact fitness is the current global best individual. If the current individual's... Greater than Then replace with that individual. , and .

[0045] For non-elite individuals not selected as elite candidates, their fitness values ​​are masked. Mask of Elite Individuals Cosine similarity weighted interpolation estimation. Let the elite candidate set be... Non-elite individuals fitness Represented as: ; Among similarity For cosine similarity, To prevent division by zero for extremely small constants, the above hierarchical strategy controls the actual number of classifiers trained in each generation. Within this range, computational overhead is significantly reduced.

[0046] 3.2 Construction of a Historical Elite Fragment Memory Bank To implement directional perturbations when population diversity degrades, after fitness assessment in each generation, high-frequency feature combinations are extracted from the historical elite set to construct a historical elite fragment memory bank. Features are defined. In the Elite Gathering The frequency of occurrence of is: ; Extracting frequency of occurrence Features constitute elite fragments ,in This is the frequency threshold. The segment... Stored in the memory bank of historical elites And record the cumulative number of times it appears.

[0047] 3.3 Quantification and Directional Perturbation of Population Diversity To quantify the diversity of a population, the average entropy of the probability amplitude of the population's qubits is defined as a measure of diversity. For the... Generations, average entropy The calculation is as follows: ; The range of average entropy values ​​is: A value closer to 1 indicates a more dispersed probability amplitude distribution and higher diversity in the population; a value closer to 0 indicates a more homogeneous population. A threshold for population diversity is set. ,when At that time, the directional perturbation mechanism is triggered: (1) From the memory bank of historical elites The sampling method uses a weight proportional to the cumulative occurrence frequency of the segment to obtain an elite segment. ; (2) The proportion selected from the current population is For non-elite individuals, targeted value assignment is performed on their corresponding feature bits: if the feature Then set ,Right now , Force the feature to be selected with a high probability; if the feature Then for Apply a small random rotation, rotation angle : ; in The variance is the random rotation angle.

[0048] 3.4 Quantum Rotation Gate Update and Mutation Operations For algebras that do not trigger the diversity degradation condition, perform the regular quantum rotation gate update and mutation operations: (1) Quantum rotation gate update. The probability amplitude of each qubit on each chromosome is directed towards the current global best individual. The corresponding probability amplitude direction deflection. Rotation angle ,in Based on the rotation angle; This is the rotation direction function. The value is determined based on the phase angle difference between the current probability amplitude and the global optimal probability amplitude: if the current phase angle Less than the global optimal phase angle ,but ,otherwise The update rules are as follows: ; (2) Quantum NOT gate mutation. The mutation probability is predetermined. Perform a NOT gate operation on a subset of qubits, i.e., swap them. and The value is equivalent to , This introduces entirely new search directions with a low probability.

[0049] 3.5 Algorithm Flow The complete process of the overall algorithm is as follows: Input: Normalized feature matrix Category tags Population size Maximum iteration algebra ; Output: Optimal feature mask vector Optimal feature subset ; (1) Population initialization. Generation quantum chromosome , No. chromosome no. The probability amplitude of each qubit is set to , ,in , This represents the initial feature importance score. A binary mask vector is obtained from observations of each chromosome. Each mask vector forms a binary mask matrix. Initialize the globally optimal record. , , Historical Elite Fragment Memory Bank ; (2) Cyclic evolution. : (2.1) Stratified fitness assessment. Pre-assessment values ​​are calculated for all individuals. Select the top-ranked candidates with the highest pre-evaluation values. Each individual is designated as an elite candidate. A random forest classifier is trained on these elite candidates, and their recall and false positive rates on the validation set are calculated. The exact fitness is then calculated according to the bi-objective optimization rule. : ; Fitness of non-elite individuals The optimal value is estimated using cosine similarity weighted interpolation between its mask and the mask of elite individuals. After evaluation, the global optimal record is updated to record the current global optimal individual. (2.2) Updating the historical elite fragment memory bank. Statistically analyze the frequency of occurrence of each characteristic within the historical elite set. ,extract Features constitute elite fragments Stored in memory bank And record the cumulative number of times it appears; (2.3) Monitoring population diversity and calculating the average population entropy Determine whether the conditions for diversity degradation are met. ; (2.4.1) If Execute targeted perturbations. From Mid-sample elite fragment The ratio is Targeted value assignment for non-elite individuals: If Then set ;like Then for Apply small random rotation : ; (2.4.2) If Perform a quantum rotation gate update, shifting the probability amplitude towards the current globally optimal individual. Direction deflection, rotation angle : ; and with probability Perform a quantum NOT gate mutation; (2.5) Perform observations on the updated population to obtain the next-generation binary mask matrix. Enter the next cycle; (3) Reaching the maximum number of iterations Or precise fitness in continuous Terminate if no improvement is achieved within the generation, and output the globally optimal mask vector. To obtain the optimal feature subset .

[0050] 4. Anomaly Detection Model Training and Online Anomaly Detection 4.1 Anomaly Detection Model Training The optimal feature subset is obtained by feature selection based on quantum genetic algorithm. ,in The globally optimal mask vector The One portion, To determine the optimal subset size. From the normalized training set. Extract The corresponding feature columns yield the dimensionality-reduced training feature matrix. .

[0051] The training set after dimensionality reduction Train the final anomaly detection classifier Random forest is used as the classifier. Random forest is composed of... The system consists of several decision trees, each of which is trained using a bootstrap sampling method with replacement, drawing data from the original training set. A subset of samples is used as the training set for the tree; at each node split, samples are taken from the entire set. Randomly selected from the features A candidate feature is selected, and the feature with the largest decrease in Gini coefficient is selected as the split node. The process is recursively grown until the preset maximum depth or the lower limit of the number of leaf node samples is reached.

[0052] The hyperparameters of the random forest are optimized through cross-validation, and these hyperparameters include, but are not limited to, the number of decision trees. Maximum depth of a single decision tree Minimum number of samples required for internal node re-splitting Minimum number of samples for leaf nodes The optimal hyperparameter combination was determined using recall and false positive rates on the validation set as evaluation metrics, and grid search was employed to achieve optimal performance on the validation set. The optimal recall and false positive rates meet the preset business requirements. After training, the model parameters and the corresponding optimal feature subset are saved. It is used for loading during the online testing phase.

[0053] 4.2 Online Anomaly Detection During the online detection phase, the optimal feature subset saved during the training phase is loaded first. and a trained random forest classifier .

[0054] For real-time captured network traffic packets, protocol parsing and flow merging are performed. Packets are aggregated into network flows according to the network flow quintuple. Within a fixed time window, various statistical characteristics are calculated, including packet quantity statistics, packet length statistics, time-related features, connection behavior features, and payload content features. However, only the optimal subset of features is extracted during online detection. The specified feature dimension, that is, for each real-time network stream, only its [feature dimension] is calculated. The feature values ​​corresponding to the index are used to obtain the dimensionality-reduced real-time feature vector. .

[0055] Real-time feature vectors Input a pre-trained random forest classifier The classifier outputs the category label for each traffic entry: ; in This indicates normal traffic. This indicates abnormal traffic. When... When a security alert is triggered, the traffic is marked as abnormal and an alert message is generated; If the current flow is considered normal, it is allowed to proceed and the process moves to the next flow detection stage.

[0056] like Figure 5 As shown in the figure, this embodiment also discloses a traffic anomaly detection system based on quantum genetic algorithm feature selection, which mainly consists of four subsystems: a data acquisition and initialization subsystem, a quantum genetic algorithm feature selection subsystem, a traffic anomaly detection subsystem, and a system control subsystem. The data acquisition and initialization subsystem is responsible for capturing raw network traffic, performing protocol parsing, flow recursion, and multi-dimensional statistical feature extraction to construct an original high-dimensional numerical feature set, and calculating the initial importance score of each feature based on the Gini coefficient reduction of the random forest. The quantum genetic algorithm feature selection subsystem is the core subsystem. It constructs a population based on the quantum bit probability amplitude encoding mechanism, and through hierarchical fitness evaluation and elite fragment-guided quantum evolutionary search, selects the optimal feature subset with the strongest discriminative power for anomaly detection from the high-dimensional original feature set. The traffic anomaly detection subsystem trains the final anomaly detection classifier on the dimensionality-reduced optimal feature subset and performs anomaly judgment on real-time network traffic. The system control subsystem is responsible for management and control functions such as system parameter configuration and alarm management.

[0057] like Figure 6 As shown, the flow anomaly detection system based on quantum genetic algorithm feature selection specifically includes: 1. Data Acquisition and Initialization Subsystem (1) Traffic acquisition module This module acquires raw network traffic packets in real time through a packet capture engine deployed at key network nodes (such as mirror ports of core switches or gateway devices). The module performs high-speed packet acquisition based on a packet capture driver, supporting the parsing of standard link-layer and network-layer protocols. Captured packets are timestamped before being sent to subsequent processing stages. The module features packet buffering and retransmission mechanisms to ensure the integrity of data acquisition in high-throughput network environments.

[0058] (2) Preprocessing module This module receives data packets output by the traffic acquisition module and sequentially performs protocol parsing, flow aggregation, and statistical feature calculation. First, it parses the headers of each protocol layer, extracting the five-tuple information (source IP address, destination IP address, source port, destination port, and protocol type), packet length, and payload content of each data packet. Then, it aggregates the data packets into network flows according to the five-tuples. For each network flow, it calculates multi-dimensional statistical features, including data packet count, data packet length, time-related features, connection behavior features, and traffic payload content features, summarizing them to form an original high-dimensional numerical feature vector. Finally, it performs maximum and minimum value normalization on each feature to eliminate dimensional differences, obtaining a normalized initial feature matrix.

[0059] (3) Initial Importance Measurement Module This module receives the normalized feature matrix output from the preprocessing module and trains a random forest classifier. The decrease in the Gini coefficient output by the random forest is used as a measure of the initial importance of each feature. The random forest contains multiple decision trees. For each feature, its importance score is defined as the average decrease in the Gini coefficient contributed by that feature across all decision trees. The importance scores of all features are scaled and mapped to the interval [0,1]. This scaled importance score is directly used as prior information input for the probability amplitude of each qubit during the subsequent initialization of the quantum genetic algorithm population.

[0060] 2. Quantum Genetic Algorithm Feature Selection Subsystem (1) Quantum population initialization and encoding module This module represents a subset of candidate features based on a qubit probability amplitude encoding mechanism. Each quantum chromosome consists of qubits of the same length as the original feature dimension. Each qubit is encoded with a pair of probability amplitudes, representing the probability of the feature being selected and not selected, respectively, satisfying a normalization condition. The module receives feature importance scores from an initial importance measurement module. During the initial population generation, the module sets the initial values ​​of the probability amplitudes of each qubit based on the importance scores of each feature, ensuring that features with higher importance have a greater probability of being selected in the initial population. This provides the population with a search direction guided by prior information from the very beginning. Simultaneously, the module collapses each quantum chromosome into a defined binary feature mask vector through random observations.

[0061] (2) Stratified fitness assessment module This module evaluates the fitness of all individuals in the population, employing a hierarchical strategy combining coarse-grained pre-evaluation and fine-grained precise evaluation to reduce computational overhead. At the coarse-grained pre-evaluation level, the module calculates the mutual information between each feature and the class label, as well as the mutual information between features, based on the mutual information criterion. It calculates the pre-evaluation value for the feature mask vector corresponding to each chromosome, obtained by subtracting the sum of mutual information between selected features and labels from the sum of mutual information between features. After ranking the pre-evaluation values ​​from high to low, the module selects the top-ranked elite candidate individuals for the fine-grained precise evaluation level. At the fine-grained precise evaluation level, the module only trains a random forest classifier on the elite candidate individuals. Based on their feature masks, it extracts corresponding dimensionality-reduced subsets from the normalized training set, dividing them into training and validation subsets. After training the random forest classifier, it calculates the anomaly detection recall and false positive rate on the validation subset and calculates the precise fitness value according to the bi-objective optimization rule. For non-elite individuals not selected as elite candidates, their fitness value is estimated by weighted interpolation using the cosine similarity between their masks and those of elite individuals. After the module completes the fitness assessment of all individuals, it updates the global best record.

[0062] (3) Historical Elite Fragment Memory Bank Module After each generation completes fitness evaluation, this module extracts high-frequency feature combinations from the elite candidate set, constructing and maintaining a historical elite fragment memory bank. The module counts the frequency of each feature in the current elite set, extracts features with frequencies exceeding a preset threshold to form elite fragments, stores them in the historical elite fragment memory bank, and records their cumulative occurrence count. This memory bank is sampled and used by the population evolution module when subsequent population diversity degrades, providing a repository of historically effective feature combinations for targeted perturbations.

[0063] (4) Population Evolution Module This module is responsible for performing evolutionary operations and diversity management on the quantum population. First, the module calculates the average entropy of the probability amplitudes of the qubits in the population as a diversity metric. When the average entropy falls below a preset diversity degradation threshold, the module triggers a directional perturbation mechanism: it samples from the historical elite fragment memory bank with weights proportional to the cumulative occurrence count of the fragments. After obtaining elite fragments, it assigns directional values ​​to the corresponding feature bits of non-elite individuals in the current population, forcing features within elite fragments to be selected with a high probability, while applying only a small random rotation to non-fragment features. When the average entropy is not lower than the threshold, the module performs conventional quantum rotation gate updates and mutation operations: the probability amplitudes of each qubit deflect towards the direction corresponding to the probability amplitude of the current globally optimal individual, and performs NOT gate operations on some qubits with a preset mutation probability to introduce new search directions. After evolution, the module observes the updated population to obtain a new generation of binary mask matrices.

[0064] 3. Traffic Anomaly Detection Subsystem (1) Anomaly detection model training module This module receives the globally optimal feature mask vector output by the feature selection subsystem of the quantum genetic algorithm, extracts the corresponding feature columns from the normalized training feature matrix, and obtains the dimensionality-reduced training feature matrix. On the dimensionality-reduced training set, the module trains the final anomaly detection classifier, using a random forest as the classifier. The module optimizes the hyperparameters of the random forest through cross-validation, using recall and false positive rates on the validation set as evaluation metrics. The module uses grid search to determine the optimal combination of hyperparameters. After training, the module saves the model parameters and the corresponding optimal feature subset.

[0065] (2) Online anomaly detection module This module loads the optimal feature subset and trained random forest classifier saved during the online detection phase. For each dimension of the statistical features of the captured real-time network traffic packets, only the feature dimensions specified by the optimal feature subset are extracted. That is, for each real-time network flow, only the feature value corresponding to its index in the optimal feature subset is calculated, resulting in a dimensionality-reduced real-time feature vector. This real-time feature vector is then input into the trained random forest classifier, which outputs a category label for each flow, where 0 represents normal flow and 1 represents abnormal flow. When a detection result is abnormal, the module triggers a security alarm, generates a structured alarm record containing the abnormal flow's five-tuple information and a timestamp, and pushes it to the system management subsystem.

[0066] 4. System Control Subsystem (1) System Management Module This module allows system administrators to perform global configuration management, including configuration of data acquisition interfaces, feature extraction parameters, quantum genetic algorithm parameters (population size, maximum number of iterations, diversity threshold, etc.), and classifier hyperparameters. The module also provides a system operation status monitoring panel, displaying key indicators such as resource utilization, data throughput, feature selection information, and detection accuracy in real time, enabling global system control.

[0067] (2) Alarm Management Module This module provides an alarm event management interface, displaying anomaly detection alarm events in list format. Each alarm record includes the five-tuple information of the abnormal traffic, the occurrence time, and characteristic tracing information. Security operations personnel can manually review alarms through the interface, marking them as real attacks, false alarms, or missed detections. The module also supports multiple notification methods for alarm information, such as email and work orders.

[0068] This embodiment has the following beneficial effects: 1. This invention employs a strategy of initializing the probability amplitude of a quantum population using an initial feature importance metric based on the decrease in the Gini coefficient of a random forest. This approach provides information-guided search direction for the population at the initial stage of evolution, avoiding the inefficient search caused by completely random initialization. The invention first trains a random forest classifier on all normalized features, using the decrease in the Gini coefficient as a metric for the initial importance of each feature. This importance score is then directly used to set the initial value of the probability amplitude for each qubit, ensuring that features with higher importance have a greater probability of being selected in the initial population. Thus, the population possesses a search direction guided by prior information from the outset.

[0069] 2. A hierarchical fitness evaluation strategy combining coarse-grained pre-evaluation and fine-grained accurate evaluation significantly reduces the training overhead of each generation of classifiers. This invention calculates and ranks the pre-evaluation value of all individuals in the population based on mutual information. Accurate fitness evaluation is performed only on the top-ranked elite candidates, while the fitness of non-elite individuals is estimated using weighted interpolation based on the cosine similarity between their masks and those of elite individuals. This keeps the number of classifiers actually trained per generation within the elite candidate size, meaning the number of training iterations per generation is far less than the population size. Without significantly sacrificing evaluation accuracy, this effectively reduces computational overhead, allowing for a larger population size and more iterations within the same computational budget.

[0070] 3. The guidance mechanism employing a historical elite fragment memory bank and directional perturbation of population diversity facilitates targeted perturbation when population diversity degrades. After fitness evaluation in each generation, this invention statistically analyzes the frequency of each feature in the elite set, extracts features with frequencies exceeding a threshold to form elite fragments, and stores them in the memory bank. Using the average entropy of the population's qubit probability amplitude as a diversity metric, sampling is performed from the memory bank when population degradation is detected. High-probability directional assignment is applied to the corresponding feature bits of non-elite individuals, while non-fragment feature bits undergo only small-amplitude random rotations. This mechanism confines the perturbation direction to the range of historically effective feature combinations, guiding the population out of local optima while preserving previously discovered superior feature combinations.

[0071] Example 3: Please see Figure 7 The diagram shows a structural schematic of a computer device provided in an embodiment of this application. An embodiment of this application provides a computer device 400, including a processor 410 and a memory 420. The memory 420 stores a computer program executable by the processor 410. When the computer program is executed by the processor 410, it performs the method described above.

[0072] This application embodiment also provides a storage medium 430, on which a computer program is stored, and the computer program is executed by a processor 410 to perform the above method.

[0073] The storage medium 430 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0074] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. "A plurality of" means two or more, unless otherwise explicitly specified.

[0075] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0076] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0077] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0078] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0079] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0080] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0081] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

Claims

1. A flow anomaly detection method based on feature selection using a quantum genetic algorithm, characterized in that, Includes the following steps: Obtain the original feature matrix of network traffic, and calculate the initial importance score of each feature based on the feature importance measurement method; The probability amplitude of the qubit is initialized according to the initial importance score, a quantum population is constructed, and the quantum chromosome is collapsed into a binary feature mask vector through observation operation; A hierarchical fitness assessment is performed on the quantum population. Based on mutual information, a pre-assessment value is calculated for all individuals. Individuals with the highest pre-assessment value are selected as elite candidates, and a classifier is trained to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation based on the similarity between their feature mask vector and the feature mask vector of the elite candidate individuals. Based on the population diversity metric, determine whether to trigger a directional perturbation. When the population diversity is lower than the preset threshold, sample elite fragments from the historical elite fragment memory bank and assign directional values ​​to non-elite individuals. Otherwise, perform quantum rotation gate update. Iterate until convergence and output the optimal feature subset. An anomaly detection classifier is trained based on the optimal feature subset, and corresponding features are extracted from real-time network traffic and input into the anomaly detection classifier for anomaly determination.

2. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 1, characterized in that, The original feature matrix is ​​constructed as follows: The captured network packets are parsed according to protocols, and the packets are aggregated into network flows according to the network flow quintuple. Multidimensional statistical features are calculated for each network flow. The multidimensional statistical features include data packet quantity statistics, data packet length statistics, time correlation features, connection behavior features, and traffic load content features; The original feature matrix is ​​obtained by normalizing the multidimensional statistical features.

3. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 2, characterized in that, The initial importance score is calculated as follows: A random forest classifier is trained on all normalized features. The average decrease in Gini coefficient contributed by each feature in the random forest classifier when used as a split node is taken as the initial importance score of the feature. The initial importance score is then scaled and mapped to a preset range.

4. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 1, characterized in that, The calculation of the precise fitness value adopts a bi-objective optimization rule: Using recall and false positive rate as evaluation metrics, when the current optimal recall rate is lower than the preset recall rate convergence threshold, the exact fitness value is calculated with recall rate as the primary optimization objective. When the current optimal recall rate is not lower than the recall rate convergence threshold, the exact fitness value is calculated by minimizing the false positive rate while maintaining a high recall rate.

5. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 1, characterized in that, The construction method of the historical elite fragment memory bank is as follows: After each generation completes the fitness evaluation, the frequency of each feature in the feature mask vector in the elite candidate set is statistically analyzed. Features with a frequency higher than a preset frequency threshold are extracted to form elite segments. These elite segments are then stored in the historical elite segment memory bank, and their cumulative occurrence count is recorded.

6. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 5, characterized in that, The implementation method of the targeted assignment is as follows: Elite fragments are sampled from the historical elite fragment memory bank with a weight proportional to the cumulative occurrence of the fragments, and targeted values ​​are assigned to non-elite individuals in the current population at a predetermined proportion. The qubit probability amplitude of the feature bits corresponding to the elite segments is set to a high selection probability, and a small random rotation is applied to the feature bits corresponding to the non-elite segments.

7. The flow anomaly detection method based on feature selection using quantum genetic algorithm according to claim 1, characterized in that, The quantum rotating gate is updated in the following way: To maintain the record of the globally optimal individual, the probability amplitude of each qubit is deflected by a basis rotation angle in the direction of the corresponding probability amplitude of the globally optimal individual. The rotation direction of the base rotation angle is determined based on the phase angle difference between the current probability amplitude and the probability amplitude of the globally optimal individual; A quantum NOT gate operation is performed on a subset of qubits with a preset mutation probability, thereby exchanging the probability amplitude values ​​of the qubits.

8. A flow anomaly detection system based on feature selection using a quantum genetic algorithm, characterized in that, The system for performing the method as described in any one of claims 1 to 7 includes: The feature extraction and importance measurement module is used to obtain the original feature matrix of network traffic and calculate the initial importance score of each feature based on the feature importance measurement method. The quantum population initialization module is used to initialize the probability amplitude of the qubits according to the initial importance score, construct the quantum population, and collapse the quantum chromosome into a binary feature mask vector through observation operations. The hierarchical fitness evaluation module is used to perform hierarchical fitness evaluation on the quantum population. Based on mutual information, it calculates the pre-evaluation value of all individuals, selects the individuals with the highest pre-evaluation value as elite candidates, and trains a classifier to calculate the accurate fitness value. The fitness value of non-elite individuals is estimated by weighted interpolation of the similarity between their feature mask vector and the feature mask vector of elite candidate individuals. The quantum evolution module is used to determine whether to trigger a directional perturbation based on the population diversity metric. When the population diversity is lower than a preset threshold, it samples elite fragments from the historical elite fragment memory bank and assigns directional values ​​to non-elite individuals. Otherwise, it performs a quantum rotation gate update and outputs the optimal feature subset after iteration until convergence. The anomaly detection module is used to train an anomaly detection classifier based on the optimal feature subset, extract corresponding features from real-time network traffic, and input them into the anomaly detection classifier for anomaly determination.

9. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images