A service flow driven network traffic dynamic baseline regulation method

Abstract

The application discloses a kind of service flow driven network traffic dynamic baseline regulation and control methods, belong to network communication technical field, including acquisition flow data, identify service type and extract flow rate sequence and burstiness index;The trend item, periodic term and residual term are obtained by time series decomposition to historical flow rate sequence, with the sum of trend item and periodic term as baseline center value, with residual term standard deviation as fluctuation benchmark;According to service type and burstiness index, determine tolerance factor, amplify baseline interval for high burstiness service, narrow baseline interval for low burstiness service;With tolerance factor scaling residual item confidence interval coefficient to generate dynamic baseline upper and lower limit, trigger alarm when real-time flow out of bounds;Monitor service flow characteristics, temporarily amplify tolerance factor when significant deviation occurs, discard current baseline and reconstruct using recent data when sustained drift occurs;The application realizes the dynamic baseline regulation and control and autonomous evolution of service flow differentiation.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and in particular to a service flow-driven dynamic baseline control method for network traffic. Background Technology

[0002] A network traffic baseline is an important reference for measuring and assessing whether network traffic is in a normal state. It is established by statistically modeling historical traffic data to determine the fluctuation range of normal traffic. When real-time traffic exceeds this range, an anomaly alarm is triggered. Existing dynamic network traffic baseline methods have the following technical problems: Existing dynamic baseline methods typically treat all traffic as homogeneous data for uniform statistical modeling, failing to consider the inherent differential fluctuation characteristics of traffic across different service types. Real-time communication services such as video conferencing and VoIP exhibit high burstiness, with traffic fluctuating dramatically between active and quiet periods, while continuous services like data backup and file transfer exhibit smooth and stable traffic characteristics. Using a uniform statistical model to generate the same dynamic baseline for all service flows leads to frequent misjudgments of normal fluctuations in high-burst services as anomalies, while abnormal growth in continuous services is missed due to an overly lenient baseline. Furthermore, when service upgrades or changes in user behavior patterns cause permanent shifts in traffic distribution, the existing baseline cannot automatically adapt.

[0003] Some methods have already attempted to establish baselines for different services, but the division of service types and the corresponding baseline parameters are all statically configured. When the behavior pattern of the service flow undergoes permanent changes, manual intervention is still required for adjustment.

[0004] In summary, the core technical problem that the existing technology has not yet solved is: how to enable the network traffic baseline to automatically adapt to the differentiated fluctuation characteristics of different service flows, and to achieve baseline auto-evolution without human intervention when the service model undergoes permanent changes. Summary of the Invention

[0005] The purpose of this invention is to provide a service flow-driven dynamic baseline control method for network traffic, in order to solve the technical problems of existing network traffic baseline methods that generate the same dynamic baseline for all service flows using a unified statistical model, resulting in a high false alarm rate for high burst services, serious underreporting of continuous services, and the inability of the baseline to evolve autonomously when the service mode undergoes permanent changes.

[0006] To achieve the above objectives, the present invention provides a service flow-driven network traffic dynamic baseline control method, comprising the following steps: Step 1: Collect network traffic data, identify the service type of each service flow, and extract the traffic rate sequence and burst index of each service flow; Step 2: Perform time-series decomposition on the historical traffic rate sequence of each business flow, breaking down the historical traffic rate sequence into trend, periodic and residual terms. Use the sum of the trend and periodic terms as the baseline center value, and use the statistical distribution characteristics of the residual terms as the initial benchmark for the baseline fluctuation range. Step 3: Based on the business type and burst index of each business flow, determine the tolerance factor for each business flow; for business flows with a burst index higher than the preset threshold, set the tolerance factor to be greater than 1 to expand the baseline normal range of the business flow; for business flows with a burst index lower than the preset threshold, set the tolerance factor to be less than 1 to narrow the baseline normal range of the business flow. Step 4: Scale the confidence interval coefficients of the residual terms using the tolerance factor. Based on the baseline center value, generate the upper and lower bounds of the dynamic baseline for the current time of the business flow. Compare the real-time traffic rate with the upper and lower bounds of the dynamic baseline. Trigger an abnormal alarm when the real-time traffic rate exceeds the upper or lower bound of the dynamic baseline. Step 5: Continuously monitor the multidimensional temporal characteristics of the business flow. When the statistical distribution of the business flow is detected to deviate significantly for the first time, temporarily increase the tolerance factor to expand the normal range of the baseline. When the statistical distribution is detected to drift significantly and continuously, it is determined that the business flow has changed its business mode. The current baseline model is discarded and the data in the most recent time window is used to re-execute the temporal decomposition and initial dynamic baseline modeling to complete the baseline reconstruction.

[0007] Preferably, the formula for calculating the suddenness index in step one is as follows: ; in, For the suddenness index, The peak rate within the current detection window. It is the short-term mean. The standard deviation is the short-term standard deviation.

[0008] Preferably, the time series decomposition in step two uses the STL time series decomposition algorithm to decompose the historical flow rate sequence into: ; in, This is a historical flow rate sequence. For trend items, It is a periodic term. For residuals; baseline center value .

[0009] Preferably, in step three, when determining the tolerance factor for each business flow, the business value weight is also considered. The tolerance factor is adjusted for cost sensitivity, resulting in the final tolerance factor. Calculate using the following formula: ; in, This is the basic tolerance factor determined based on the suddenness index. The cost sensitivity coefficient is 0 < <1, The business value weight has a value range of (0,1). and satisfy × <1.

[0010] Preferably, the formula for generating the upper bound of the dynamic baseline in step four is as follows: ; The formula for generating the lower bound of the dynamic baseline is as follows: ; in, This is the upper bound of the dynamic baseline. As the lower bound of the dynamic baseline, The baseline center value, The standard deviation of the residual term. These are the coefficients for the initial confidence interval.

[0011] Preferably, in step five, the statistical distribution of the business flow is checked for statistically significant and persistent drift, specifically using the sliding window KS test method: Maintain a reference window containing historical feature vectors. and a detection window containing recent real-time feature vectors In each detection cycle and Perform a two-sample KS test to calculate the maximum distance between the empirical cumulative distribution functions of the two windows. ;exist When the preset threshold is exceeded and the preset number of detection cycles are exceeded consecutively, it is determined that the statistical distribution of the business flow has undergone a statistically significant and continuous drift.

[0012] Preferably, the abnormal alarm information in step four includes the service flow identifier, the time of the abnormality, the real-time traffic rate value, the upper limit of the dynamic baseline, and the lower limit of the dynamic baseline.

[0013] Preferably, the multidimensional time-series features continuously monitored in step five include flow rate sequence, burst index, and protocol distribution features.

[0014] Preferably, the method further includes step six: after the baseline operation cycle of steps one to five is completed, the false alarm rate and the missed alarm rate are calculated periodically. When the false alarm rate or the missed alarm rate deviates from the preset target range, the preset threshold and tolerance factor of the burst index in step three are automatically adjusted according to the preset adjustment rule table. The adjustment rule table specifies a one-to-one correspondence between raising the high burst threshold when the false alarm rate is too high and lowering the low burst threshold when the missed alarm rate is too high.

[0015] Therefore, the present invention employs the above-mentioned service flow-driven network traffic dynamic baseline control method, which has the following beneficial effects: (1) By setting a tolerance factor greater than 1 for business flows with a burst index higher than a preset threshold and a tolerance factor less than 1 for business flows with a burst index lower than a preset threshold, the normal baseline range of elastic burst services such as video conferencing and VoIP is amplified, and the false alarm rate is significantly reduced. At the same time, the normal baseline range of continuous services such as data backup and file transfer is narrowed, which can sensitively capture small abnormal growth and improve the accuracy of anomaly detection.

[0016] (2) This invention extracts the burst index of the business flow in real time and adjusts the tolerance factor accordingly, so that the baseline boundary of the same business flow can be dynamically adapted to its fluctuation characteristics in different runtime periods (such as the quiet period and active period of video conferencing), avoiding the static configuration method based on fixed business type division.

[0017] (3) This invention detects the statistical distribution changes of the multidimensional time-series characteristics of the business flow through the sliding window KS test. When a statistically significant and continuous drift is detected, baseline reconstruction is triggered, so that the permanent changes in traffic patterns caused by business upgrades, user growth, or network environment changes can be automatically identified and the baseline model can be updated, thus realizing baseline auto-evolution without human intervention.

[0018] (4) By periodically calculating the false alarm rate and the false alarm rate, the present invention automatically adjusts the burst threshold and tolerance factor value according to the preset adjustment rule table when the error deviates from the preset target range, thereby reducing the operation and maintenance cost of manual parameter adjustment.

[0019] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0020] Figure 1 This is a flowchart of a service flow-driven network traffic dynamic baseline control method according to the present invention. Detailed Implementation

[0021] The following detailed description of embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely illustrates selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0022] Example like Figure 1 As shown, this invention provides a service flow-driven dynamic baseline control method for network traffic. This method can be implemented by deploying traffic acquisition probes at network core switches or border routers. The acquisition method uses port mirroring or the NetFlow / sFlow protocol, and the preferred acquisition granularity is once per minute for traffic rate statistics. The acquisition granularity can be adjusted according to the actual network scale. For example, in a core backbone network where network traffic changes drastically, the acquisition granularity can be adjusted to once every 30 seconds; while in a relatively stable enterprise branch network, the acquisition granularity can be adjusted to once every 5 minutes to reduce system overhead. The complete technical solution of this invention is described in detail below with reference to a specific implementation scenario.

[0023] Step 1: Collect network traffic data, identify the service type of each service flow, and extract the traffic rate sequence and burst index of each service flow.

[0024] After collecting raw traffic data at key network nodes, the collected data packets are parsed by a Deep Packet Inspection (DPI) engine. Combining port number, protocol type, and application layer signature characteristics, the engine identifies the service type of each traffic flow. Service types include at least real-time communication, streaming media, transaction, data synchronization, and general web traffic. For encrypted traffic that cannot be identified by DPI, a machine learning classifier based on traffic behavior features is used for inference and classification. Specifically, classification algorithms such as random forests or gradient boosting trees can be used. Input features include behavioral characteristics such as packet length distribution, packet interval time, connection duration, and uplink / downlink traffic ratio.

[0025] While identifying the service type, this step also extracts the traffic rate sequence for each service flow. Specifically, the average rate of the service flows is statistically analyzed over a fixed time window to form a time series. ,in This represents the number of time windows.

[0026] Based on this, the peak rate within the current detection window is further extracted. and short-term mean The short-term mean is preferably the arithmetic mean of the flow rates over the past five time windows. Burst intensity index. Calculate using the following formula: ; in, The short-term standard deviation and the suddenness index The physical meaning is: when A large value indicates that the traffic flow has a significant rate spike within the current detection window, exhibiting strong burst characteristics; when A smaller value indicates a stable business flow rate with limited fluctuations.

[0027] Step 2: Perform time-series decomposition on the historical traffic rate sequence of each business flow, breaking down the historical traffic rate sequence into trend term, period term, and residual term. Use the sum of the trend term and period term as the baseline center value, and use the statistical distribution characteristics of the residual term as the initial benchmark for the baseline fluctuation range.

[0028] Time series decomposition can be performed using the STL (Seasonal-Trend Decomposition procedure based on Loess) algorithm. The STL algorithm uses historical flow rate sequences... The input, through iterative calculations using inner and outer loops, is decomposed into the following form: ; in, This is a trend indicator, reflecting the long-term trend of business traffic changes; This is a periodic item, reflecting the periodic pattern of business traffic; The residual term reflects the random fluctuation component after removing trends and periods.

[0029] The period length of the periodic item is automatically determined based on the business type. For example, ordinary web-based businesses typically have a clear 24-hour cycle, with weekday traffic higher than weekend traffic; while data backup businesses may have a weekly cycle, with weekend backup volume higher than weekday backup volume. The inner loop of the STL algorithm is preferably set to 10 times, and the outer loop is preferably set to 15 times to ensure the convergence accuracy of the decomposition.

[0030] With trend items and periodic terms The sum of these values ​​is used as the baseline center value: .

[0031] With residual terms Standard deviation As a fundamental measure of baseline fluctuation range, in a preferred embodiment, the initial baseline interval can be represented as: ; in, The initial confidence interval coefficients are set to the default value. =3, corresponding to a confidence level of approximately 99.7%. This initial interval will be further scaled by a tolerance factor in subsequent steps.

[0032] Step 3: Determine the tolerance factor for each business flow based on its business type and burst index. For business flows with a burst index higher than the preset threshold, set the tolerance factor to be greater than 1 to expand the normal baseline range of the business flow. For business flows with a burst index lower than the preset threshold, set the tolerance factor to be less than 1 to narrow the normal baseline range of the business flow.

[0033] Preset thresholds include high thresholds and low threshold In a preferred embodiment, The value is 3.0. The value is 1.2. This refers to the burstiness index of the business flow. When the value is ≥3.0, the business flow is determined to be an elastic burst-type business, and the basic tolerance factor is [not specified]. Take 1.8; when When the value is ≤1.2, the business flow is determined to be a continuous business, and the basic tolerance factor is [not specified]. Take 0.6; when 1.2 < When <3.0, the baseline tolerance factor The threshold is set to 1.0. Experiments have verified that this value achieves low false positive and false negative rates in typical enterprise network environments. The threshold can be adjusted adaptively based on actual traffic characteristics in different network environments.

[0034] In this embodiment, the tolerance factor is set to greater than 1 for bursty services, thus widening the baseline range. This is because services such as Voice over Internet Protocol (VoIP) and video conferencing inherently possess high variance and high burstiness; their traffic fluctuations are normal business behavior rather than anomalies. Widening the baseline range helps reduce the false alarm rate. Conversely, for continuous services such as data backup and file transfer, their normal traffic characteristics are smooth and stable. Small but continuous rate increases often indicate insufficient storage space, abnormal synchronization tasks, or potential network attacks. Therefore, the tolerance factor is set to less than 1 to narrow the baseline range, thereby improving the sensitivity of anomaly detection. This "balanced approach" is one of the core ideas of this embodiment.

[0035] In a preferred embodiment, the determination of the tolerance factor further incorporates a business value weight. Cost-sensitive adjustments are made. Final tolerance factor. Calculate using the following formula: ; in, This is the basic tolerance factor determined based on the suddenness index. The cost sensitivity coefficient is 0 < <1, the preferred value is 0.3. The business value weight has a value range of (0,1). and satisfy × <1 to ensure The value weight is always positive. The business value weight is pre-configured by the network administrator based on the importance of the business. For example, the business value weight of the core transaction system can be configured as 1.0, and that of ordinary file transfer business can be configured as 0.2.

[0036] The technical rationale behind the above correction logic lies in the fact that missing anomalies in high-value services can cause serious economic losses or security consequences, and the cost of missing anomalies far exceeds the cost of false alarms. Therefore, it is preferable to accept a certain increase in false alarms in order to ensure that anomalies are not missed. On the other hand, the cost of false alarms for low-value services is relatively high (a large number of invalid alarms consume maintenance manpower), so the tolerance factor is closer to the base value determined based on the physical characteristics of traffic. This correction mechanism organically integrates the burstiness characteristics at the traffic level with the business importance at the management level, taking into account both the needs of technical indicators and management strategies.

[0037] Step 4: Scale the confidence interval coefficients of the residual terms using the tolerance factor. Based on the baseline center value, generate the upper and lower bounds of the dynamic baseline for the current time of the service flow. Compare the real-time traffic rate with the upper and lower bounds of the dynamic baseline. Trigger an anomaly alarm when the real-time traffic rate exceeds the upper or lower bound of the dynamic baseline.

[0038] The formula for generating the upper bound of the dynamic baseline is as follows: ; The formula for generating the lower bound of the dynamic baseline is as follows: ; in, This is the upper bound of the dynamic baseline. As the lower bound of the dynamic baseline, The baseline center value, The standard deviation of the residual term. These are the coefficients for the initial confidence interval.

[0039] The resulting dynamic baseline interval is: This interval follows the baseline center value. and time Dynamic changes enable real-time dynamic updates of the baseline.

[0040] Real-time acquisition of the current rate of the business flow Compare it with the upper bound of the dynamic baseline. and the lower realm Comparison: like > or < If an anomaly occurs, an anomaly alarm will be triggered. The anomaly alarm information should include at least the service flow identifier, the time of the anomaly, the real-time traffic rate value, the upper limit of the dynamic baseline, and the lower limit of the dynamic baseline, so that operations and maintenance personnel can quickly locate the source and severity of the anomaly.

[0041] Step 5: Continuously monitor the multidimensional temporal characteristics of the business flow. When the statistical distribution of the business flow is detected to deviate significantly for the first time, temporarily increase the tolerance factor to expand the normal range of the baseline. When the statistical distribution is detected to drift significantly and continuously, it is determined that the business flow has changed its business mode. The current baseline model is discarded and the data in the most recent time window is used to re-execute the temporal decomposition and initial dynamic baseline modeling to complete the baseline reconstruction.

[0042] The specific method for detecting whether the statistical distribution has shifted is the sliding window Kolmogorov-Smirnov test (KS test). Specifically, a reference window containing historical feature vectors is maintained. A detection window containing recent real-time feature vectors Reference Window The optimal size is the 1008 most recent data points (corresponding to minute-level data for one week), and the detection window... The size is preferably the 168 most recent data points (corresponding to minute-level data for one day). During each detection cycle (preferably once per hour), the data is... and Perform a two-sample KS test to calculate the maximum distance between the empirical cumulative distribution functions of the two windows: ; in, Represents the possible values ​​of a random variable, indicating the range of all possible values. Take the supremum (i.e., the maximum value). and These are the empirical cumulative distribution functions for the reference window and the detection window, respectively. Exceeding the preset threshold (corresponding to the significance level) When the value is less than 0.05, a statistically significant deviation is considered to have occurred. However, baseline reconstruction is not immediately triggered at this point; instead, a two-level response mechanism is initiated.

[0043] The first level is a soft response: when a significant statistical deviation is detected for the first time, the tolerance factor is immediately and temporarily increased from its current value, preferably by 1.5 to 2.0 times, to temporarily widen the normal baseline range. The technical significance of this mechanism is that, before confirming whether the drift is persistent, although the old baseline model has deviated from the current statistical distribution of flow, by temporarily increasing the tolerance factor, the rate values ​​of most normal flow can still fall within the widened baseline range, thus avoiding a storm of false alarms caused by the failure of the old baseline during the drift persistence determination period.

[0044] Meanwhile, the system continues to monitor subsequent detection cycles. .like If a state exceeding a preset threshold is continuously exceeded for a preset number of detection cycles (preferably 3 consecutive detection cycles, i.e., 3 consecutive hours), then a statistically significant and persistent drift is determined to have occurred, triggering a second-level hard response. The specific operation of the hard response is: discard the current complete baseline model, including the trend term. Periodic terms residual standard deviation and all relevant parameters; in the current detection window Using historical data of an appropriate length prior to it as a new training dataset, the temporal decomposition and initial dynamic baseline modeling of step two and the tolerance factor calculation of step three are re-executed; the new baseline is put into use immediately after it is generated.

[0045] like If the system fails to exceed the preset threshold during continuous monitoring after the first deviation (i.e., the deviation is a momentary jitter rather than a continuous change), the temporarily amplified tolerance factor will be restored to the normal value after the deviation ends, and the system will continue to operate with the original baseline, thereby avoiding unnecessary reconstruction operations.

[0046] The design of the above two-level response mechanism fully considers two different time scales of network traffic changes: the scale of instantaneous jitter (minute level) and the scale of pattern transition (hour level or even day level). By using soft response to deal with the former and hard response to deal with the latter, it effectively balances system stability and response timeliness.

[0047] After baseline reconstruction is completed, the current detection window is used. Update the reference window based on the data. This prepares for the next round of drift detection.

[0048] Step Six: After the baseline operation cycle of Steps One to Five is completed, the false alarm rate and false negative rate are calculated periodically. When the false alarm rate or false negative rate deviates from the preset target range, the preset threshold and tolerance factor of the burst index in Step Three are automatically adjusted according to the preset adjustment rule table. The adjustment rule table specifies a one-to-one correspondence between raising the high threshold of burst index when the false alarm rate is too high and lowering the low threshold of burst index when the false negative rate is too high.

[0049] The false alarm rate is calculated as the proportion of times an alarm is erroneously triggered within a period deemed normal, out of all detected alarms. The false negative rate is calculated as the proportion of times an anomaly is not detected within a period known or subsequently confirmed as abnormal, out of all actual anomalies. The calculation period is preferably once daily, with a target false alarm rate preferably set below 5% and a target false negative rate preferably set below 2%.

[0050] The preset adjustment rule table specifies the adjustment direction and magnitude of each parameter under different detection index conditions, as detailed in Table 1.

[0051] Table 1. Rules for Evaluating Control Effect and Adjusting Parameters

[0052] After each adjustment, the system verifies the effect in a new operating cycle. If the detected indicators improve after the adjustment, the adjusted parameter values ​​are maintained; if the detected indicators deteriorate after the adjustment, the system reverts to the parameter values ​​before the adjustment. Each adjustment does not exceed 20% of the initial value, and the adjustment interval is no less than 7 days to prevent parameter oscillation. The above rule table is stored in the system's configuration database and is periodically read and executed by the parameter optimization module.

[0053] To more fully illustrate the technical effects of this embodiment, a complete application example is given below. The method described in this embodiment is deployed in an enterprise network. Two typical service flows exist in the network: video conferencing and data backup. Video conferencing experiences peak usage from 9:00 AM to 11:00 AM and from 2:00 PM to 4:00 PM on weekdays, exhibiting significant burst characteristics in traffic, with a burst index of [missing information]. Typically between 3.5 and 5.0; data backup operations are performed daily from 2:00 AM to 4:00 AM, with stable traffic characteristics and a low burst index. It is usually between 1.0 and 1.1.

[0054] During the initial deployment phase, the system completed step two, time-series decomposition modeling, after a week of data accumulation. For video conferencing services, due to... The value remains higher than With a threshold of 3.0, step three sets the basic tolerance factor to 1.8, expanding the baseline range by approximately 1.8 times. Even with drastic traffic fluctuations during normal operating hours, the real-time rate value remains within the baseline range, significantly reducing the false alarm rate from approximately 25% in existing methods to less than 3%. For data backup services, because... The value remains below With a threshold of 1.2, step three sets its basic tolerance factor to 0.6, narrowing the baseline range to 0.6 times its original value. When the backup task experiences a slow increase in transmission rate due to a decline in storage device performance, this minor anomaly is sensitively detected and triggers an alarm, allowing maintenance personnel to intervene in advance and avoid the risk of backup failure.

[0055] Subsequently, the company upgraded its video conferencing system from standard definition to high definition, resulting in an overall increase in bandwidth rate of approximately 60%, and changes in burst characteristics. The sliding window KS test in step five detected the issue for the first time the day after the upgrade was completed. If the threshold is exceeded, a soft response is immediately activated to temporarily increase the tolerance factor to 3.0. During 3 hours of continuous monitoring, The persistent exceedance of limits confirmed the drift was continuous. The system automatically triggered a hard response, discarding the old baseline model and re-performing step two's temporal decomposition using data from the most recent 24 hours. The new baseline center value adaptively increased by approximately 60%. The reconstructed baseline accurately reflected the new model of high-definition video conferencing services. Throughout the upgrade process, the system generated no false alarms and required no manual intervention from network administrators.

[0056] After a month of operation, the evaluation of the control effect in step six found that the false alarm rate was stable below 2%, the false alarm rate was stable below 1.5%, all parameters remained within a reasonable range, and the system was operating well.

[0057] Therefore, the present invention adopts the above-mentioned network traffic dynamic baseline control method driven by service flow, which can realize accurate baseline adaptation of differentiated service flows, real-time dynamic adjustment driven by burstiness, autonomous baseline reconstruction when service mode changes, and closed-loop self-optimization of detection parameters, effectively reducing false alarm rate and false negative rate, and reducing manual parameter tuning costs.

[0058] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A service flow-driven network traffic dynamic baseline control method, characterized in that, Includes the following steps: Step 1: Collect network traffic data, identify the service type of each service flow, and extract the traffic rate sequence and burst index of each service flow; Step 2: Perform time-series decomposition on the historical traffic rate sequence of each business flow, breaking down the historical traffic rate sequence into trend, periodic and residual terms. Use the sum of the trend and periodic terms as the baseline center value, and use the statistical distribution characteristics of the residual terms as the initial benchmark for the baseline fluctuation range. Step 3: Based on the business type and burst index of each business flow, determine the tolerance factor for each business flow; for business flows with a burst index higher than the preset threshold, set the tolerance factor to be greater than 1 to expand the baseline normal range of the business flow; for business flows with a burst index lower than the preset threshold, set the tolerance factor to be less than 1 to narrow the baseline normal range of the business flow. Step 4: Scale the confidence interval coefficients of the residual terms using the tolerance factor. Based on the baseline center value, generate the upper and lower bounds of the dynamic baseline for the current time of the business flow. Compare the real-time traffic rate with the upper and lower bounds of the dynamic baseline. Trigger an abnormal alarm when the real-time traffic rate exceeds the upper or lower bound of the dynamic baseline. Step 5: Continuously monitor the multidimensional temporal characteristics of the business flow. When the statistical distribution of the business flow is detected to deviate significantly for the first time, temporarily increase the tolerance factor to expand the normal range of the baseline. When the statistical distribution is detected to drift significantly and continuously, it is determined that the business flow has changed its business mode. The current baseline model is discarded and the data in the most recent time window is used to re-execute the temporal decomposition and initial dynamic baseline modeling to complete the baseline reconstruction.

2. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that, The formula for calculating the suddenness index in step one is as follows: ； in, For the suddenness index, The peak rate within the current detection window. It is the short-term mean. The standard deviation is the short-term standard deviation.

3. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that, Step two's time series decomposition uses the STL time series decomposition algorithm to break down the historical flow rate sequence into: ； in, This is a historical flow rate sequence. For trend items, It is a periodic term. For residuals; baseline center value .

4. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that, In step three, when determining the tolerance factor for each business flow, the business value weight is also considered. The tolerance factor is adjusted for cost sensitivity, resulting in the final tolerance factor. Calculate using the following formula: ； in, This is the basic tolerance factor determined based on the suddenness index. The cost sensitivity coefficient is 0 < <1, The business value weight has a value range of (0,1]. and satisfy × <1.

5. The network traffic dynamic baseline control method driven by service flow according to claim 4, characterized in that, The formula for generating the upper bound of the dynamic baseline in step four is as follows: ； The formula for generating the lower bound of the dynamic baseline is as follows: ； in, This is the upper bound of the dynamic baseline. As the lower bound of the dynamic baseline, The baseline center value, The standard deviation of the residual term. These are the coefficients for the initial confidence interval.

6. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that, Step five involves detecting whether the statistical distribution of the business flow has undergone a statistically significant and persistent drift, specifically using the sliding window KS test method: Maintain a reference window containing historical feature vectors. and a detection window containing recent real-time feature vectors In each detection cycle and Perform a two-sample KS test to calculate the maximum distance between the empirical cumulative distribution functions of the two windows. ;exist When the preset threshold is exceeded and the preset number of detection cycles are exceeded consecutively, it is determined that the statistical distribution of the business flow has undergone a statistically significant and continuous drift.

7. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that: The abnormal alarm information in step four includes the service flow identifier, the time of the abnormality, the real-time traffic rate value, the upper limit of the dynamic baseline, and the lower limit of the dynamic baseline.

8. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that: The multidimensional time-series features continuously monitored in step five include flow rate sequence, burst index, and protocol distribution characteristics.

9. The network traffic dynamic baseline control method driven by service flow according to claim 1, characterized in that, It also includes step six: After the baseline operation cycle of steps one to five is completed, the false alarm rate and the missed alarm rate are calculated periodically. When the false alarm rate or the missed alarm rate deviates from the preset target range, the preset threshold and tolerance factor of the burst index in step three are automatically adjusted according to the preset adjustment rule table. The adjustment rule table specifies a one-to-one correspondence between raising the high threshold of burst index when the false alarm rate is too high and lowering the low threshold of burst index when the missed alarm rate is too high.

Images