Machine learning based network technology service abnormal traffic intelligent detection system
By constructing a spatiotemporal traffic interaction graph and performing self-supervised pre-training and dynamic prototype updates, the problems of insufficient detection capabilities and high operation and maintenance costs in existing technologies are solved, and efficient detection and traceable alarms for unknown encrypted traffic are achieved.
Patent Information
- Application Number
- CN202611224856.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-08-13
- Publication Date
- 2026-11-06
AI Technical Summary
Existing encrypted traffic anomaly detection schemes based on graph neural networks rely on large-scale labeled samples for supervised training. In scenarios with zero prior knowledge and inability to decrypt, it is difficult to obtain effective supervision signals, resulting in insufficient detection capability for unknown encrypted malicious traffic. After deployment, the model cannot adapt to continuous changes in traffic distribution, has high operation and maintenance costs, and the detection results lack auditable causal evidence.
By constructing a spatiotemporal flow interaction graph and employing self-supervised pre-training, the prototype set and neural symbol causal tracing are dynamically updated to achieve online adaptive detection, reduce the workload of annotation and computation, and provide auditable detection results.
It enhances the ability to detect unknown attacks, shortens the recovery cycle of detection capabilities, reduces operation and maintenance costs, and provides traceable alarm evidence.
Smart Images
Figure CN123055377A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, specifically to an intelligent detection system for abnormal traffic in network technology services based on machine learning. Background Technology
[0002] Network anomaly traffic detection is an important means of ensuring the secure operation of network technology services. Early detection schemes mainly adopted deep packet inspection technology, which identifies abnormal traffic by parsing the content of data packets and matching them with a known attack signature database. This type of scheme relies on plaintext parsing of the payload, which is difficult to adapt to the network environment where encryption protocols are widely used. With the development of machine learning technology, detection methods based on statistical features combined with supervised learning classifiers have been widely adopted. The general process includes collecting traffic data, manually labeling normal and abnormal samples, extracting statistical features, training classification models, and deploying detection. In recent years, graph neural networks have been introduced into the field of traffic detection because they can characterize the topological interaction relationships between hosts, and are used to model host communication graphs and identify abnormal connection patterns.
[0003] The closest existing technology to this invention is an encrypted traffic anomaly detection method based on graph neural networks. This method collects the five-tuples and basic statistical features of data packets at the network gateway, constructs a static communication graph with hosts as nodes and communication relationships as edges, encodes the communication graph using graph convolutional networks or graph attention networks, and inputs the encoding results into a classifier that has been trained with a large number of labeled samples for anomaly judgment. After the model is deployed, it uses fixed parameters for inference over a long period of time.
[0004] Existing technologies generally adopt a technical path of fixed parameters for long-term inference after model deployment, and manual full re-labeling and offline retraining after performance degradation. This invention breaks through this technical bias by maintaining a prototype set including normal prototypes and abnormal prototypes in the latent space. Only when the abnormal score exceeds the preset drift threshold and the buffer sample reaches the preset batch size, the corresponding prototype vector is updated by exponential moving average and only the parameters of the last layer of the pre-trained graph encoder are fine-tuned with small step gradients. The deep backbone parameters are not updated. Thus, online adaptation to concept drift is achieved without re-labeling all historical data or offline retraining of deep networks.
[0005] The existing technologies mentioned above have the following shortcomings: both graph coding and classification models rely on large-scale labeled samples for supervised training. In scenarios where plaintext labels cannot be obtained for encrypted traffic and the attack type is unknown, it is difficult to obtain effective supervision signals, resulting in insufficient detection capabilities for new and unknown attacks. After the model is deployed, it uses fixed parameter inference, which cannot track the continuous changes in traffic distribution over time. It can only rely on manual re-collection, labeling, and offline retraining to restore performance, resulting in high operation and maintenance costs. The decision-making process of deep learning models is not structured and analyzed, and the detection results lack auditable causal evidence, making it difficult to meet the requirements of security operation for alarm traceability. To address these issues, we propose a machine learning-based network technology service abnormal traffic intelligent detection system. Summary of the Invention
[0006] The purpose of this invention is to provide an intelligent detection system for abnormal traffic in network technology services based on machine learning.
[0007] The technical problem this invention aims to solve is that existing encrypted traffic anomaly detection schemes based on graph neural networks rely on large-scale labeled samples for supervised training. In scenarios with zero prior knowledge and inability to decrypt, it is difficult to obtain effective supervision signals, resulting in insufficient detection capability for unknown encrypted malicious traffic. After model deployment, fixed parameters are used for inference, which cannot adapt to the continuous evolution of traffic distribution. The detection performance can only be restored by manually collecting, labeling, and retraining offline, resulting in a long detection failure window and high operation and maintenance costs. In addition, the decision-making process of deep learning models lacks structured analysis, and the detection results lack auditable causal evidence, making it difficult to meet the requirements of security operation for alarm traceability.
[0008] To address the aforementioned technical problems, this invention provides an intelligent detection system for abnormal traffic in network technology services based on machine learning. This system includes a traffic metadata acquisition module, a spatiotemporal traffic interaction graph construction and self-supervised pre-training module, a dynamic prototype comparison and continuous learning module, a neural symbol causal tracing module, and an alarm output module.
[0009] The traffic metadata acquisition module uses a bypass capture method at the network gateway to obtain the timestamp, payload length, transmission direction, and address and port identifiers of the communicating parties in the data packets. It does not parse the payload content of the data packets, thus obtaining metadata that can be used for modeling without decryption.
[0010] The spatiotemporal traffic interaction graph construction and self-supervised pre-training module uses communication endpoints as nodes and data packet interactions occurring within a preset time window as edges. It constructs a spatiotemporal traffic interaction graph based on the timestamp, payload length, and transmission direction. The graph attention encoder is pre-trained by randomly occluding some edges in the graph and using a graph attention encoder to reconstruct the probability of the existence of the occluded edges based on the remaining edge structure. This allows the encoder to learn the inherent rules of traffic topology under label-free conditions, resulting in a pre-trained graph encoder.
[0011] The dynamic prototype contrastive continuous learning module maintains a prototype set including normal and abnormal prototypes in the latent space. It uses a pre-trained graph encoder to encode the local subgraph corresponding to the real-time traffic session to obtain sample embeddings. It calculates the Euclidean distance of the sample embedding to each prototype and takes the closest distance as the anomaly score. When the anomaly score exceeds the preset drift threshold, the corresponding sample is temporarily stored in the sample buffer to be updated. When the number of samples of the same category in the buffer reaches the preset batch size, the corresponding prototype vector is updated using an exponential moving average method. At the same time, the contrastive loss is calculated based on the current batch of samples. Only the last layer parameters of the pre-trained graph encoder and the prototype set are fine-tuned, without updating the deep backbone parameters of the encoder. Thus, it achieves online adaptation to concept drift with extremely low annotation and computing power costs.
[0012] The neural symbol causal tracing module extracts the attention weights generated by the pre-trained graph encoder during the encoding process and the distance contribution of the sample embedding to the nearest abnormal prototype in each dimension for samples identified as abnormal. The dimensional features whose contribution ranking is within a preset range are converted into readable network indicators according to a preset feature physical meaning mapping table. Combined with a preset numerical threshold, the readable network indicators are symbolized into several causal rules corresponding to the judgment conclusion. The confidence of each causal rule is calculated according to historical statistics. Causal rules with confidence scores lower than the preset confidence threshold are eliminated, providing an auditable causal explanation chain for the anomaly detection results.
[0013] The alarm output module encapsulates the retained causal rules, corresponding anomaly judgment results, and readable network indicators into structured alarm information and outputs it to security operations personnel or the connected security information and event management system.
[0014] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:
[0015] 1. This invention constructs a spatiotemporal traffic interaction graph based solely on data packet timestamps, payload length, and transmission direction, and performs pre-training using a self-supervised mask edge prediction mechanism. This enables the system to autonomously learn the topological features of unknown encrypted traffic without decryption or labeling, thereby improving its ability to detect unknown attacks.
[0016] 2. This invention reduces the amount of annotation work and parameter update calculations compared to the existing technology that re-annotates all historical data and retrains offline, by making small-step online fine-tuning only the parameters of the prototype and the last layer of the encoder without updating the deep backbone parameters. This also shortens the detection capability recovery cycle caused by changes in traffic distribution.
[0017] 3. This invention transforms attention weights and prototype distance contributions into structured causal rules with historical confidence, so that each alarm has traceable judgment criteria, making it easier for security operations personnel to verify the source of the alarm. Attached Figure Description
[0018] Figure 1 This is a schematic diagram of the overall system flow in an embodiment of the present invention;
[0019] Figure 2 This is a schematic diagram of the spatiotemporal graph construction and self-supervised pre-training sub-processes in an embodiment of the present invention;
[0020] Figure 3 This is a schematic diagram of the dynamic prototype learning and anomaly tracing alarm sub-process in an embodiment of the present invention. Detailed Implementation
[0021] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.
[0022] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.
[0023] In one specific embodiment, the system is deployed at a network gateway and includes a traffic metadata acquisition module, a spatiotemporal traffic interaction graph construction and self-supervised pre-training module, a dynamic prototype comparison and continuous learning module, a neural symbol causal tracing module, and an alarm output module connected in sequence.
[0024] The traffic metadata acquisition module uses kernel bypass packet capture and high-speed data plane processing technology to acquire data packets passing through the gateway, extracts the timestamp, payload length, transmission direction and address port identifiers of the two communicating parties for each data packet, without performing any decryption or payload parsing operations, and passes the extracted metadata to the spatiotemporal traffic interaction graph construction and self-supervised pre-training module.
[0025] The spatiotemporal traffic interaction graph construction and self-supervised pre-training module slices metadata according to a set time window. It constructs a spatiotemporal traffic interaction graph using communication endpoints as nodes and data packet interactions occurring within the time window as edges. The initial feature vector of a node is obtained by mapping the node's mean packet length, packet length variance, mean arrival time interval, and number of connections within the time window using a multilayer perceptron, denoted as:
[0026] ;
[0027] in, Represents a node The original statistical feature vector, This represents the mapping function of a multilayer perceptron. Represents a node Embedding vector in the initial layer;
[0028] The feature vector of an edge consists of the time interval between data packet exchanges between the two nodes connected by the edge, the difference in payload length, and the transmission direction indication.
[0029] ;
[0030] in, Represents a node With nodes The time interval between adjacent data packets, Represents a node With nodes The difference in payload length between the data packets. This represents the transmission direction indicator; a value of 1 indicates that the transmission was initiated by the node. To the node A value of 0 indicates that the node... To the node , Represents a node With nodes The feature vector of the edge between them;
[0031] The graph attention encoder encodes the spatiotemporal flow interaction graph layer by layer, the first... Layer node embedding updated as follows:
[0032] ;
[0033] in, Represents a node The set of neighboring nodes, Indicates the first The learnable weight matrix of the layer, Represents a non-linear activation function. Indicates the first Layer nodes For nodes Attention coefficient Represents a node In the The layer's embedding vector and attention coefficients are calculated using the following formula:
[0034] ;
[0035] in, This represents a learnable attention weight vector. This represents a vector concatenation operation, where the denominator is the number of nodes. The normalized summation of all neighbors;
[0036] To learn the intrinsic topological patterns of graphs under unlabeled conditions, the module edge set... The mask edge set is obtained by random sampling according to a preset ratio. Temporarily remove it from the graph and generate a result using negative sampling. An equal number of samples without edges are used as negative examples. The graph after removing the masked edges is then input into the graph attention encoder to obtain the final embedding of each node. ,in This represents the total number of layers in the graph attention network, and the probability of the existence of occluded edges is reconstructed based on the embeddings of the last layer:
[0037] ;
[0038] in, , Representing nodes respectively , Embedded vectors in the last layer, Indicates model prediction nodes With nodes Given the probability that an edge exists between them, the pre-training loss function is:
[0039] ;
[0040] in, Represents a node , The label indicates whether an edge actually exists between them; a value of 1 indicates that the edge exists, and a value of 0 indicates that it does not exist. This is constructed using negative sampling. This represents the loss predicted by the mask edges, calculated through backpropagation. The graph attention encoder parameters are updated, and the process of sampling mask edges, encoding layer by layer, calculating loss and updating parameters is repeated until the loss converges, resulting in a pre-trained graph encoder, which serves as the initial encoder for the subsequent online detection stage.
[0041] The dynamic prototype comparison continuous learning module first encodes historical labeled samples using a pre-trained graph encoder, and then initializes the prototype set by averaging the samples by category. ,in This represents the total number of currently identified categories, including normal categories and known abnormal categories. For real-time arriving traffic sessions, a corresponding spatiotemporal traffic interaction graph local subgraph is constructed and input into a pre-trained graph encoder to obtain real-time sample embeddings. ,calculate The Euclidean distances to each prototype are used to determine the anomaly score, with the shortest distance being selected.
[0042] ;
[0043] in, Indicates the first class prototype vector, Represents Euclidean distance. Indicates sample Abnormal scoring, if If the drift threshold is not exceeded, the category determination result corresponding to the sample is directly output. If the drift exceeds a preset threshold and the most recent prototype is a normal prototype, the sample is determined to be a sample to be updated and is temporarily stored in the sample buffer. When the number of samples of the same category in the buffer reaches a preset batch size, the embedding mean of the batch of samples is calculated. And update the corresponding prototype using an exponential moving average method:
[0044] ;
[0045] in, Indicates the first Category after the next update prototype vector, This represents the momentum coefficient, which ranges from 0 to 1. Indicates the first It was assigned to a category during the next update. The new sample embedding mean is calculated, and the contrastive loss is calculated based on the current batch of samples:
[0046] ;
[0047] in, Indicates sample The prototype vector that belongs to the correct category. This represents the temperature coefficient used to adjust the smoothness of the distribution. To indicate comparative loss, based solely on The final layer parameters and prototype set of the pre-trained graph encoder are fine-tuned with small step gradients without updating the deep backbone parameters of the encoder. The updated prototype set and the fine-tuned final layer parameters are then applied to subsequent real-time detection to achieve continuous online adaptation to concept drift.
[0048] The neural symbolic causal origination module extracts the attention weights of each layer in the graph attention encoding process for samples judged as abnormal. It then sorts the weights related to the target node according to their numerical values, identifying neighboring nodes and interaction edges within a preset ranking range as those that significantly contribute to the judgment result. Simultaneously, it calculates the sample embedding. Its most recent anomaly prototype For the difference components in each feature dimension, the feature dimensions corresponding to the difference components ranked within a preset range are determined as the main contributing feature dimensions. The aforementioned key nodes, interaction edges, and feature dimensions are converted into specific readable network-level indicators according to a preset feature physical meaning mapping table, such as source node address and destination node address, communication port, packet length mutation amplitude, and communication frequency per unit time. Then, the readable indicator is combined with its corresponding numerical threshold, and the confidence of each rule is calculated according to the preset symbolic template generation conditions and the causal rules corresponding to the judgment conclusions, using the following formula:
[0049] ;
[0050] in, The preconditions for a given symbolic rule. This represents the total number of samples in the historical data that meet this precondition. This represents the number of samples that meet the precondition and are judged as abnormal. Representation rules The confidence level is used to eliminate rules with a confidence level lower than the preset confidence threshold, and retain high-confidence rules as the causal explanation for the alarm.
[0051] The alarm output module encapsulates the retained causal rules, anomaly judgment results, and key network indicators into a structured explanation report, which is output to security operations personnel or the security information and event management system they are connected to along with the alarm. At the same time, the updated prototype set and fine-tuned final layer parameters of the dynamic prototype comparison and continuous learning module are continuously applied to the encoding and anomaly scoring of subsequent real-time traffic sessions. Together with the causal rules output by the neural symbol causal tracing module, they form a closed-loop detection process of data and feedback signals, which enables the system's detection capability to continuously iterate and enhance over time.
[0052] It should be noted that the graph attention encoder can be replaced by other graph neural network structures such as graph convolutional networks or graph isomorphic networks and pre-trained with the same mask edge prediction self-supervised task. The triggering mechanism for drift detection and prototype update can also be replaced by a detection method based on the change of sliding window statistical distribution instead of the fixed anomaly scoring threshold. The above substitution methods do not affect the implementation of the overall technical solution of the present invention.
[0053] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.
Claims
1. A machine learning-based intelligent network traffic detection system, characterized in that, include: The traffic metadata acquisition module is configured to acquire the timestamp, payload length, transmission direction, and address and port identifiers of the communicating parties in the data packet using a bypass capture method at the network gateway, without parsing the payload content of the data packet. The spatiotemporal traffic interaction graph construction and self-supervised pre-training module is connected to the traffic metadata acquisition module. It is configured to use communication endpoints as nodes and data packet interactions occurring within a preset time window as edges. It constructs a spatiotemporal traffic interaction graph based on the timestamp, payload length, and transmission direction. It pre-trains the graph attention encoder by randomly occluding some edges in the spatiotemporal traffic interaction graph and using a graph attention encoder to reconstruct the existence probability of the occluded edges based on the remaining edge structure, thereby obtaining a pre-trained graph encoder. The dynamic prototype comparison continuous learning module is connected to the spatiotemporal traffic interaction graph construction and self-supervised pre-training module. It is configured to maintain a prototype set including normal prototypes and abnormal prototypes in the latent space. It uses the pre-trained graph encoder to encode the local subgraph of the spatiotemporal traffic interaction graph corresponding to the real-time traffic session to obtain sample embeddings. It calculates the Euclidean distance between the sample embedding and each prototype in the prototype set and takes the closest distance as the anomaly score. When the anomaly score exceeds a preset drift threshold, the corresponding sample is temporarily stored in the sample buffer to be updated. When the number of samples of the same category in the sample buffer to be updated reaches a preset batch size, the corresponding prototype vector is updated using an exponential moving average method. At the same time, the comparison loss is calculated based on the current batch of samples and the prototype set. Only the last layer parameters of the pre-trained graph encoder and the prototype set are fine-tuned. The neural symbol causal tracing module, connected to the dynamic prototype comparison continuous learning module, is configured to extract the attention weights generated by the pre-trained graph encoder during the encoding process and the distance contributions of the sample to the nearest abnormal prototype in each dimension for samples judged as abnormal. The attention weights related to the target node are sorted according to their numerical values. The neighbor nodes and interaction edges that are within the preset ranking range are identified as the neighbor nodes and interaction edges that have a major contribution to the judgment result. The dimensional features that are within the preset ranking range after sorting the distance contributions in each dimension according to their numerical values are converted into readable network indicators according to a preset feature physical meaning mapping table. The readable network indicators are symbolized into several causal rules corresponding to the judgment conclusions based on a preset numerical threshold. The confidence of each causal rule is calculated according to historical statistics, and causal rules with confidence values lower than the preset confidence threshold are eliminated. The alarm output module is connected to the neural symbol causal tracing module and is configured to encapsulate the retained causal rules, corresponding anomaly judgment results, and readable network indicators into structured alarm information and output it.
2. The intelligent detection system for abnormal traffic of network technology services based on machine learning according to claim 1, characterized in that: In the spatiotemporal traffic interaction graph construction and self-supervised pre-training module, the initial feature vector of a node is obtained by mapping the mean packet length, packet length variance, mean arrival time interval, and number of connections of the node within the time window through a multilayer perceptron. The feature vector of an edge consists of the time interval of data packet interaction between the two nodes connected by the edge, the difference in payload length, and the transmission direction indication.
3. The intelligent detection system for abnormal traffic in network technology services based on machine learning according to claim 1, characterized in that: The spatiotemporal traffic interaction graph construction and self-supervised pre-training module randomly samples the edge set of the spatiotemporal traffic interaction graph according to a preset ratio to obtain a masked edge set. It generates non-existent edge samples with an equal number of samples as negative examples through negative sampling. It calculates the existence probability of the masked edge and the corresponding edge of the negative example using the node end-layer embedding output by the graph attention encoder. It calculates the masked edge prediction loss based on the existence probability and the label of whether the corresponding edge actually exists. It updates the parameters of the graph attention encoder through backpropagation based on the masked edge prediction loss.
4. The intelligent detection system for abnormal traffic in network technology services based on machine learning according to claim 1, characterized in that: The dynamic prototype comparison continuous learning module determines that the corresponding sample is a sample to be updated when the abnormal score exceeds the preset drift threshold and the most recent prototype is a normal prototype.
5. The intelligent detection system for abnormal traffic of network technology services based on machine learning according to claim 1, characterized in that: The updated prototype set from the dynamic prototype comparison continuous learning module and the fine-tuned final layer parameters of the pre-trained graph encoder are applied to the encoding and anomaly scoring of subsequent real-time traffic sessions. Together with the causal rules output by the neural symbol causal tracing module, they are used to continuously detect and alert subsequent real-time traffic sessions.
6. The intelligent detection system for abnormal traffic of network technology services based on machine learning according to claim 1, characterized in that: The neural symbol causal tracing module sorts the attention weights associated with the target node according to their numerical values, identifies neighbor nodes and interaction edges that rank within a preset range as those that contribute significantly to the judgment result, and calculates the difference components between the sample embedding and the most recent anomalous prototype in each feature dimension. The feature dimensions whose difference components rank within a preset range are identified as the main contributing feature dimensions. The confidence of the causal rule is calculated based on the ratio of the total number of samples that meet the corresponding conditions in historical samples to the number of samples that meet the conditions and are judged as anomalous.
7. A method for constructing and self-supervised pre-training a spatiotemporal flow interaction graph, characterized in that, include: At the network gateway, a bypass capture method is used to obtain the timestamp, payload length, transmission direction, and address and port identifiers of the communicating parties in the data packets, without parsing the payload content of the data packets; The acquired metadata is sliced according to a preset time window. The communication endpoint is used as the node and the data packet interaction that occurs within the time window is used as the edge. The initial feature vector of the node is calculated based on the average packet length, variance of packet length, average arrival time interval and number of connections of the node within the time window. The feature vector of the edge is calculated based on the time interval of data packet interaction between the two nodes connected by the edge, the difference of payload length and the transmission direction indication. A spatiotemporal traffic interaction graph is constructed. The edge set of the spatiotemporal flow interaction graph is randomly sampled according to a preset ratio to obtain a masked edge set, and the masked edge set is removed from the spatiotemporal flow interaction graph. At the same time, non-existent edge samples with the same number as the masked edge set are generated as negative examples through negative sampling. The spatiotemporal flow interaction graph after removing the masked edge set is input into the graph attention encoder, and the final layer embedding of each node is obtained by aggregating the neighbor information layer by layer. The existence probability of the masked edge set and the corresponding edge of the negative example is calculated based on the last layer embedding. The masked edge prediction loss is calculated based on the existence probability and the label of whether the corresponding edge actually exists. The parameters of the graph attention encoder are updated by backpropagation based on the mask edge prediction loss. The steps of sampling the mask edge set, encoding layer by layer, calculating the loss and updating the parameters are repeated until the mask edge prediction loss converges, thus obtaining the pre-trained graph encoder.
8. A dynamic prototype comparison continuous learning method for continuously learning a traffic anomaly detection model based on graph neural networks, characterized in that, include: In the latent space, prototype vectors are maintained for normal traffic and known abnormal traffic respectively, forming a prototype set; The sample embedding is obtained by encoding the local subgraph corresponding to the real-time traffic session using a pre-trained graph encoder. Calculate the Euclidean distance between the sample embedding and each prototype in the prototype set, and take the closest distance as the anomaly score, and determine the sample corresponding to the sample embedding to belong to the category represented by the prototype corresponding to the closest distance; When the abnormal score does not exceed the preset drift threshold, the category determination result corresponding to the sample is output; When the abnormal score exceeds the preset drift threshold, the corresponding sample is temporarily stored in the sample buffer to be updated; When the number of samples of the same category in the sample buffer to be updated reaches a preset batch size, the mean of the embedding of the batch of samples is calculated, and the mean is fused with the historical value of the prototype vector of the corresponding category in an exponential moving average manner to obtain the updated prototype vector. The contrast loss is calculated based on the batch of samples and the prototype set. The final layer parameters of the pre-trained graph encoder and the prototype set are fine-tuned according to the contrast loss, without updating the deep backbone parameters of the pre-trained graph encoder. The updated prototype set and the fine-tuned final layer parameters are applied to the encoding and anomaly scoring of subsequent real-time traffic sessions.
9. The dynamic prototype comparison continuous learning method according to claim 8, characterized in that: When the abnormal score exceeds the preset drift threshold and the nearest prototype is a normal prototype, the corresponding sample is determined to be a sample to be updated.