The invention relates to the field of
data detection, in particular to a network traffic
anomaly detection method based on aggregated
mimicry distillation. According to the method, protocol level analysis is carried out on traffic through a multi-
branch feature extraction network, and a unified representation vector is generated through a cross-layer
fusion mechanism; calculating a first abnormal
score based on a protocol
perception weighted confrontation soft contrast mechanism; a heterogeneous teacher model is constructed and dynamically weighted and aggregated, and the student model generates a second abnormal
score through knowledge
distillation learning; forming a heterogeneous redundant detection
pool by the student model, the teacher model and the rule
detector, dynamically selecting the
detector and applying adaptive disturbance to obtain a third abnormal
score; and dynamically fusing the three types of abnormal scores to output a detection result. According to the method, the problems of protocol semantic segmentation, weak boundary sample discrimination, knowledge migration simplification and defense path
predictability are effectively solved, and the detection accuracy, robustness and dynamic defense capability are remarkably improved.