The invention relates to the technical field of
industrial network security, and provides a traffic
anomaly detection method and device based on multiple time scales and online
incremental learning, equipment and a medium. The core of the method is that
metadata are generated by collecting and analyzing the network traffic of the
industrial control system; constructing and dynamically optimizing a network traffic behavior
baseline model by combining data
packet aggregation, short-term and long-term multi-window
collaboration and an incremental updating mechanism; and finally, performing multi-dimensional
anomaly detection on the real-time traffic by using the model. Through a multi-window cooperation mechanism, second-level instantaneous flow sudden change and hour-level long-term service trend in an industrial
control network are synchronously captured, and the problem that a single detection window is poor in adaptability to a complex industrial
control flow mode is effectively solved; through an incremental updating mechanism, low-overhead and self-adaptive dynamic evolution of the
baseline model is realized, and the
false alarm rate and the maintenance cost are remarkably reduced, so that the robustness, the accuracy and the efficiency of
industrial network traffic
anomaly detection are comprehensively improved.