636 results about "Traffic analysis" patented technology

The invention discloses a network line intelligent operation and maintenance monitoring management system and method. The method comprises the steps that an intelligent network monitoring and optimizing system regularly collects network equipment information through a protocol, and a monitoring agent collects server and machine room environment data; processing data in real time by adopting distributed storage and a stream processing framework; predicting a network fault by adopting threshold monitoring and a machine learning model, and identifying a bottleneck and scheduling resources based on flow analysis; in combination with deep packet inspection and an AI algorithm, network traffic is monitored in real time, security threats are identified, and IPS system protection is deployed; a repair operation is automatically triggered through a self-healing strategy, and backup resources are started; the AI engine analyzes historical and real-time data, generates network topology and link state visual content, and automatically generates reports, optimization and decision support; according to the intelligent operation and maintenance monitoring management system and method for the network line, a fault tree analysis and decision support system is introduced, and a plurality of fault reasons are intelligently analyzed and repair measures are automatically executed.

A method is provided for encrypted network traffic analysis. The method includes capturing network traffic data; calculating entropy of said data to classify traffic as encrypted or non-encrypted; applying statistical and sequential feature hybridization on encrypted traffic to extract comprehensive features; analyzing the features using a neural network model to identify encrypted traffic types and detect anomalies; and refining the analysis based on entropy and neural network insights through a feedback loop.

The invention provides a flow analysis and threat detection method and device based on machine learning, and the method comprises the steps: collecting a real-time flow data package of a target network environment, carrying out the protocol analysis and session recombination, and generating a real-time flow feature data set containing multi-dimensional flow features; loading a pre-trained multi-level threat classification model, inputting the real-time traffic feature data set into a feature extraction layer of the model, carrying out normalized coding on traffic features of corresponding dimensions through feature coding channels, generating a real-time feature vector sequence, inputting the real-time feature vector sequence into a primary classifier of the model, and classifying the real-time traffic features according to the real-time feature vector sequence; and performing abnormal probability calculation and cluster division on the real-time feature vector sequence through a mixed detection unit, outputting a primary threat tag and an abnormal confidence coefficient corresponding to each real-time feature vector, inputting the primary threat tag and the abnormal confidence coefficient into an aggregation classifier, performing dynamic weighted aggregation, and generating a comprehensive threat score so as to judge whether a threat response strategy is triggered or not. According to the invention, the accuracy and timeliness of threat detection in a complex network environment can be improved.

The invention discloses a network data intelligent tool system and method based on a model context protocol MCP, and relates to the technical field of computer networks. The system comprises an AI analysis main body, an MCP Pcap tool engine, context management, a Pcap data source, various MCP Pcap tools, a Pcap tool gateway interface, a Pcap tool interface and a data packet interface. The invention provides an interaction mechanism of direct embedding and bypass data forwarding in tool calling. According to the method, direct embedded transmission of small-size data in tool calling is supported, separation of data transmission and instruction calling is achieved, the technical bottleneck that large-size Pcap data cannot be efficiently exchanged through a text channel is effectively overcome, efficient processing of the AI model on network packet capture data is achieved, and the data transmission efficiency is improved. And the efficiency and the automation degree of large-scale network traffic analysis are improved.

The invention relates to the technical field of intelligent logistics distribution, in particular to an automobile market logistics distribution scheduling system based on AI optimization, which comprises a data acquisition module, an order management module, a traffic flow analysis module and a scheduling decision module. Wherein the data acquisition module is used for acquiring current position data and traffic flow data of a delivery vehicle and order information of a customer in real time; the order management module is used for carrying out priority ranking on the orders; the traffic flow analysis module is used for predicting traffic conditions in a period of time in the future and identifying a road section and a time period which are about to be congested; and the scheduling decision module is used for optimizing the scheduling and distribution paths of the vehicles to generate an optimal scheduling scheme. According to the invention, by combining real-time traffic prediction, order priority ranking and a path optimization algorithm, the logistics distribution efficiency is effectively improved, distribution delay and resource waste are reduced, and timely distribution of high-priority orders is ensured.

The invention discloses a smart city traffic signal lamp management and control system, and relates to the technical field of traffic signal control. The system comprises a region division module, a traffic flow detection sensor, a region traffic flow analysis module, a signal lamp management and control strategy generation module, an inter-region signal lamp cooperative control module and a variable information sign and information processing and generation module. The system can accurately monitor and analyze urban traffic flow conditions in real time by comprehensively applying an advanced region division algorithm, a traffic flow detection technology and an accurate traffic flow state evaluation model, and can intelligently generate a signal lamp management and control strategy according to an analysis result, so that the traffic lamp management and control efficiency is improved. Comprising the steps that a congestion relieving dynamic timing algorithm is adopted in a congestion area, the number of times of signal lamp switching is reduced, a flow balance guiding timing algorithm is applied in an area with small flow, in addition, cooperative control over signal lamps between the areas can be achieved, and efficient connection and balanced distribution of traffic flow between the areas are ensured.

The invention discloses an information security risk assessment method based on an API. The method comprises the steps that API assets in an enterprise are obtained through flow analysis; identifying and positioning the log file or sensitive data in the file by using a sensitive data identification model; integrating the vulnerability rule set, and detecting vulnerability vulnerabilities existing on the API through an API vulnerability detection model; a behavior risk automatic monitoring engine is set, and real-time monitoring and early warning are carried out on the behavior of abnormally calling the AP I to obtain data; constructing a network attack monitoring model; drawing an API risk link relationship based on a risk monitoring model trained by historical monitoring data, and speculating a suspicious data leakage path in combination with clue association ranking analysis; performing comprehensive trace reserving on the API data use behavior; and calculating the risk by using a matrix method, and generating an API information security risk assessment report. Through the method, a comprehensive API security risk assessment system can be established, API security risks can be effectively identified and managed, and enterprise data security is protected.

The invention relates to the technical field of traffic monitoring, in particular to a Beidou-based traffic flow real-time monitoring method and system, and the method comprises the following steps: receiving signal data and analyzing a signal source based on a Beidou short message communication terminal, extracting vehicle positioning information and road occupation information in vehicle operation state data, and transmitting the vehicle positioning information and the road occupation information to a Beidou short message communication terminal; and analyzing the vehicle speed and the traffic flow density, and carrying out matching operation on the analysis result and the road section number to obtain traffic flow state data. According to the method, vehicle positioning and road occupation information is extracted through signal analysis, efficient acquisition and integration of traffic state data are realized, road section numbers are matched to improve data space precision, traffic pressure is reflected, dynamic flow analysis is supported, adjacent road section data are integrated, abnormal areas are positioned, shunting paths and proportions are optimized, and emergency response efficiency is improved. Real-time regulation and control of traffic flow are realized through dynamic pushing, the flexibility and responsiveness of traffic operation are enhanced, and the monitoring precision and the road network operation efficiency are comprehensively improved.

The invention discloses a multi-stage spatial-temporal clustering method and system based on a fused mahalanobis distance. The method comprises the following steps: acquiring a spatio-temporal data set, and determining a spatio-temporal neighbor relation of samples in the data set; calculating a space communication distance and a time decay distance of the sample; fusing the space communication distance and the time decay distance by using a mahalanobis distance to obtain a relative distance of the sample; selecting a class cluster center from the data set according to the local density of the sample and the relative distance; adopting a multi-stage distribution strategy to distribute non-class-cluster center samples to corresponding class clusters; wherein the multi-stage allocation strategy comprises an inevitable allocation stage based on space-time shared neighbor and a similarity allocation stage based on a weighted similarity matrix. According to the method, the key problems that an existing space-time clustering algorithm is insufficient in space-time attribute coupling processing and sensitive to distribution errors are solved, and the clustering accuracy, robustness and practicability in the fields of intelligent traffic analysis, seismic sequence recognition and the like are remarkably improved.

The invention provides a generative adversarial-driven intelligent security defense method and system, and solves the problem of dynamic network security defense through three-layer architecture innovation: 1, data fusion layer reconstruction: employing a multi-modal feature extraction engine driven by an MoE architecture, dynamically allocating computing power resources to a plurality of expert models, and improving the heterogeneous data distillation efficiency; an LLM for fine adjustment in the security field is introduced, a cross-modal semantic similarity matrix is constructed, and the accuracy of unstructured threat intelligence analysis is improved; a second dynamic attack and defense layer is constructed, a GPT-4 architecture attack generator is deployed, and generation of a multi-stage APT attack chain is simulated; a double-agent reinforcement learning framework is designed, and the confrontation training efficiency is improved; upgrading a three-cognitive decision-making layer, constructing a dynamic threat map based on a time sequence diagram neural network, and updating an adjacent matrix in real time; a plurality of agent clusters are deployed, the capabilities of encrypted traffic analysis and attack blocking are improved, and the problems of data layer defects, attack and defense confrontation limitation and decision-making layer bottleneck in the prior art are solved.

The invention discloses a micro-service full-link gray level traffic management system and method based on PaaS, and relates to the field of traffic management, and the system comprises an intelligent traffic analysis and decision center module, a micro-service arrangement and management platform, a full-link data analysis module, a dynamic safety protection and compliance auditing module, and a distributed configuration center. According to the micro-service full-link gray flow management system and method based on the PaaS, dynamic self-adaptive gray strategy formulation can be carried out, the latest service target, the gray version release plan and the system performance index threshold can be synchronously obtained in cooperation with a distributed configuration center, and the flow management efficiency is improved based on the information and the intelligent screening result of the flow. A routing strategy and a version switching strategy of gray traffic can be dynamically generated, and in the strategy making process, the real-time load condition of a system, the availability of micro-services and key index changes of services are fully considered.

Embodiments relate to generating specialized large language models by performing transfer learning on a base large language model. The base large language model is trained using network traffic capture files as training data to predict information in a network traffic capture file during inference. The base large language model is modified into specialized large language models for including in different applications for performing communication network analysis. In this way, the specialized large language models may be developed in an expedient and efficient manner by leveraging the training performed on the base large language model.

The invention provides a network traffic data security assessment method and system based on deep learning. The method comprises the following steps: converting original network traffic data into a graph structure data set comprising a topological structure, node attributes and time sequence behaviors; in the process, the time-space fusion input tensor is formed through the association strength between adjacent matrix and Laplacian matrix coding network entities and the fusion of time sequence characteristics extracted by time window slices. Compared with traditional flow analysis which only pays attention to a single protocol or a rate threshold value, the method achieves global relevance expression of network behaviors through graph structure modeling. Through graph structure modeling, multi-dimensional feature fusion and probabilistic risk assessment, the method can adapt to dynamic change of network topology and continuous evolution of an attack mode, so that a final assessment result is more accurate.

The invention relates to the technical field of network flow analysis, in particular to a non-intrusive network flow real-time analysis method and system based on an eBPF, and the method comprises the steps: deploying an eBPF program in a kernel mode, and capturing a network data packet entering a kernel protocol stack in real time; identifying an application layer protocol type and analyzing a key field; the structured data is transmitted to the user mode through the annular buffer area; and the user state carries out TCP stream recombination and session-level aggregation statistics on the structured data. According to the invention, on the premise that application codes are not modified, real-time and structured protocol analysis can be carried out on various common application layer protocols in a kernel layer; end-to-end delay is accurately disassembled through a full-link delay disassembling mechanism, and a performance bottleneck link is positioned; the analysis result is output in the form of structured data, second-level performance statistics and abnormal behavior detection are supported, and the operation and maintenance analysis efficiency and the system observability are remarkably improved.

The invention relates to the field of network security, and discloses a network abnormal traffic monitoring and attack defense system based on artificial intelligence, which comprises a data preprocessing module used for receiving original traffic data, executing cleaning, duplicate removal and normalization processing, and dividing a processing result into data fragments according to a preset time window; the network flow analysis module is used for receiving the data fragments, performing feature extraction and mode analysis and outputting an analysis result representing the flow abnormal degree, and the analysis result at least comprises a score value representing the overall abnormal degree and a feature vector representing the flow mode feature; the attack judgment module is used for comparing the score value with a preset abnormal threshold value so as to judge whether network abnormal traffic exists or not, if yes, the feature vector is further matched with a pre-constructed abnormal traffic type feature library, and a specific abnormal traffic type is determined according to a matching result; and the attack defense module is used for automatically triggering and executing a corresponding defense strategy.

The invention discloses a pipe network water leakage point detection and distance positioning method based on flow analysis. The method comprises the following steps: S1, constructing a flow balance model of a pipeline network; s2, monitoring the flow state of each node of the pipeline network in real time based on the flow balance model constructed in the step S1, and performing preliminary positioning on a leakage point when pipeline leakage is detected; s3, flow gradient analysis and reverse hydraulic fine positioning: in the suspected leakage area locked in the step S2, meter-scale precision positioning of a water leakage point is realized through a flow gradient analysis and reverse hydraulic iterative model; and S4, a plurality of sensor nodes are arranged on the water leakage pipeline determined in the step S3, detection data are collected, the position of a leakage point is determined according to a related positioning fusion algorithm, comprehensive decision making is carried out on the leakage point and the leakage point determined through flow gradient analysis and reverse hydraulic power in the step S3, and finally the accurate position of the pipeline leakage point is judged. The problems of low precision, weak interference resistance and the like of a traditional method can be solved, and accurate detection of leakage points is realized.

The invention provides a real-time network security monitoring and protection method and system based on deep learning, and the method comprises the steps: extracting the local features of network traffic through a convolutional neural network, analyzing the time sequence features of abnormal network traffic through a long-short term memory network, and recognizing a network attack type; calculating the intensity of the network attack based on the traffic rate, the duration and the number of source IPs of the network attack, calculating a risk score based on the local features of the network traffic, and carrying out weighted calculation on the risk score and the intensity of the network attack to obtain a comprehensive score; and in response to different types of network attacks and in combination with the comprehensive scores of the different types of network attacks, executing different network attack protection measures, adjusting the protection level in real time according to the strength and risk scores of the network attacks, recording network attack information and protection measures, and generating a security log. The network flow can be analyzed in real time, the network attack type can be identified, corresponding protection measures can be taken, the accuracy of network attack detection is improved, and the risk is reduced.

Systems, computer program products, and methods are described herein for advanced network traffic analysis in a computing environment. The present disclosure is configured to retrieve, from a traffic data log of a Web Application Firewall (WAF), information associated with a blocked traffic instance; implement, using a code analysis subsystem, a security testing protocol on a host application associated with the blocked traffic instance; determine an exposure associated with the host application based on at least implementing the security testing protocol; generate a notification comprising information associated with the exposure; and transmit a signal configured to cause a computing device associated with the host application to display the notification.

The invention discloses a road traffic information monitoring system and method, and the method comprises the steps: deploying a video monitor, a sensor, an unmanned plane and a satellite device to collect real-time road traffic data, and protecting the data safety through encryption transmission and multilayer identity authentication; the flow is monitored in real time by combining image recognition and sensor data, congestion is analyzed, traffic violation is recognized, and an alarm is given; future flow is predicted through machine learning and big data analysis, and the signal lamp period is intelligently adjusted; through combination of real-time and historical data, accident risk points are identified and early warning is carried out, and early warning is automatically issued and adjustment and control are carried out for severe weather. The AI technology automatically identifies accidents and notifies a management center, dispatches emergency resources, optimizes signal lamps and lane traffic, and dynamically adjusts surrounding flow; according to the road traffic information monitoring system and method, an automatic emergency processing system is established, accidents are automatically detected and alarms are triggered under the conditions of traffic accidents and emergencies, and emergency resources are quickly dispatched.

The invention relates to a lightweight network intrusion detection method fusing multiple tasks and transfer learning. The method comprises the following steps: acquiring to-be-detected traffic data; the to-be-detected traffic data are input into a multi-task intrusion detection model, whether the to-be-detected traffic is abnormal or not is judged, abnormal traffic is classified, performance indexes of network traffic are predicted, and the multi-task intrusion detection model is constructed based on a pre-trained lightweight deep learning model and is obtained through training of a training set. The training set comprises two-dimensional image data marked as normal traffic or abnormal traffic, attack categories and continuous values. According to the method, collaborative optimization of tasks such as anomaly detection, attack classification and performance prediction is realized, the overall performance of detection is remarkably improved, and meanwhile, efficient and accurate network traffic analysis can still be realized under the condition of limited data by utilizing the pre-trained lightweight deep learning model in transfer learning.

The invention discloses a data packet analysis method and device based on eBPF and electronic equipment. Relates to the field of cloud computing, and the method comprises the steps that a to-be-analyzed data packet captured by an eBPF kernel mode program from an operating system kernel is acquired based on an extended Berkley data packet filter eBPF user mode program, the eBPF user mode program is a program running in a user space of an operating system, and the eBPF kernel mode program is a program running in a kernel space of the operating system; determining a target analytic function; a target analytic function on a function calculation platform is called through the flow entry function, and the function calculation platform is a service system for operating the function according to needs; and based on the target analysis function, performing analysis processing on the to-be-analyzed data packet to obtain an analysis result of the to-be-analyzed data packet. According to the method and the device, the problem of limited processing capability of an eBPF flow analysis system on a single node in related technologies is solved.

The invention relates to the technical field of capacity evaluation and redistribution, in particular to a 4G baseband processing capacity dynamic expansion method and system, which comprises the following steps: acquiring a scheduling cycle connection request and rate, generating a load identifier in combination with a processing utilization rate trend, cross-positioning a high-density target block matching activation path, and carrying out dynamic expansion on the 4G baseband processing capacity. Extracting a frequency band request frequency and a flow analysis bearing level, processing interference intensity sorting frequency resources, screening frequency points, and splicing to generate a path configuration result. According to the invention, the connection request number and the data transmission rate in the 4G baseband scheduling period are collected to accurately identify the increased load section, the potential load rising pressure can be perceived in advance, the target block is crossly positioned according to the connection request position distribution and the data aggregation degree, and the processing resources are accurately bound to the high-demand path. The precision of spectrum resource scheduling is enhanced through priority ordering, and communication quality guarantee and continuous supply of processing resources in a high-concurrency access scene are supported.

The invention relates to an internet of things quality of service (QoS) management method and system, and aims to solve the problem that the internet of things quality of service is unstable through a self-adaptive flow optimization technology. The system comprises a device identification module, a flow analysis module, a flow prediction module, a resource allocation module, a congestion control module, a safety guarantee module, a user feedback module and the like, predicts a flow trend by using a machine learning algorithm, dynamically adjusts resource allocation, and improves network efficiency and user experience. The method is suitable for various scales of Internet of Things environments, and is of great significance for promoting the development of the Internet of Things technology.

The invention provides a dynamic honeypot deployment and optimization method and system based on intelligent flow analysis, and belongs to the field of computer security and network security. The method comprises the following steps: collecting network traffic and preprocessing to obtain a feature vector; then, the trained random forest model is used for carrying out attack type identification on the network flow; clustering analysis is carried out on all the attack traffic, similar attack traffic forms clusters, priority ranking is carried out on the clusters, honeypots of corresponding positions and types are deployed according to matching rules in the sequence of the priorities of the clusters from high to low, and the attack traffic belonging to a certain cluster is introduced into the corresponding honeypot; a deep Q network is used in each honeypot for learning, and the optimal balance between the capture rate and the resource utilization rate is realized by modifying the configuration of the honeypot and observing the capture condition of attack traffic and the resource consumption of the honeypot. According to the method, intelligent deployment of the honeypot and dynamic configuration in the honeypot are realized, the attack capture rate of the honeypot is improved, and the resource utilization rate is maximized.

The invention provides a method and system for judging suspicious traffic in encrypted traffic, and the method comprises the steps: collecting to-be-detected encrypted traffic, and extracting the encrypted traffic features of the to-be-detected encrypted traffic; wherein the encrypted traffic feature comprises a first traffic feature and a second traffic feature, and the second traffic feature comprises domain name popularity; the second traffic feature is determined based on a malicious neighborhood value determined according to the relation graph; the relation graph comprises domain name nodes, entity nodes, edges connecting the entity nodes and edges connecting the entity nodes and the domain name nodes, and the edge attributes of the edges of the relation graph comprise communication related data and traffic types; determining the traffic type of the to-be-measured encrypted traffic based on the encrypted traffic feature of the to-be-measured encrypted traffic, the traffic type including normal traffic and suspicious traffic; and in response to the fact that the traffic type of the to-be-tested encrypted traffic is suspicious traffic, performing subsequent decryption analysis on the to-be-tested encrypted traffic through a decryption DPI module.

Techniques for unknown exploit detection using attack traffic analysis and real-time attack event streaming are disclosed. In some embodiments, a system / process / computer program product for exploit detection using attack traffic analysis and real-time attack event streaming includes receiving a stream that includes a plurality of attack events from a security platform at a cloud security service; generating a cluster of attack events from the stream; and tagging the cluster with an unknown attack pattern for further automated security analysis at the cloud security service, wherein the tagged unknown attack pattern cluster does not match a preexisting signature for a known attack pattern.

The invention discloses an LSTM (Long Short Term Memory)-based fraud-related network traffic identification method and a server, and is applied to the field of network traffic analysis. According to the method, original flow data are collected in real time through network flow collection equipment, communication feature data and behavior feature data are extracted from each communication address, and weighted combination is carried out by adopting adaptive weight coefficients based on feature matching degree and feature abnormality to obtain a suspicious degree score; and outputting an early warning result to the communication address exceeding the preset suspicious threshold. According to the technical scheme provided by the invention, a multi-layer fraud-related network flow identification architecture and a closed-loop feature evaluation mechanism are constructed, so that the identification accuracy of continuously changing fraud-related communication behaviors is effectively improved.

The invention relates to the field of service management, and discloses a big data analysis-based online exhibition service management system and method, which uploads collected and recorded exhibition information data to a cloud database for processing, and analyzes the exhibition information data during an exhibition to perform traffic analysis, thereby improving the service management efficiency. And then the matching degree of the exhibitors and the booths is analyzed based on the flow analysis result, and the booth matching degree and the audience preference degree are comprehensively analyzed in combination with the analysis result of the browsing paths and the interactive behaviors of the audiences, so that the booths are subjected to priority ranking, and intelligent recommendation is performed to the exhibitors. The effect evaluation module evaluates the recommendation effect of the booth, and dynamically adjusts the booth sequence in real time according to the evaluation result, thereby facilitating the continuous optimization of the recommendation effect of the booth, improving the accuracy, reliability and recommendation efficiency of the booth recommendation, and improving the recommendation efficiency of the booth. Therefore, automation and intelligentization of booth recommendation and distribution are realized more comprehensively.

The invention discloses an encrypted traffic classification method based on Transform, and belongs to the technical field of network security and encrypted traffic analysis. In order to solve the problems that load content in a novel encryption protocol (such as TLS 1.3 and VPN) is encrypted, structural disturbance is complex, category distribution is unbalanced and the like, the invention provides a dual-phase Transform framework (DPFT) with pre-training and structure optimization fine tuning. According to the framework, two self-supervision tasks of masked burst prediction (MBP) and burst structure discrimination (BSDT) are introduced in a pre-training stage, and deep data packet representation is learned from unlabeled traffic, so that the deep data packet representation is learned from the unlabeled traffic; in the fine tuning stage, dynamic weighting of word embedding and position embedding, multi-head attention pooling and Focus Loss are adopted, so that the modeling capability of the model on an encrypted traffic complex structure is enhanced, and the recognition sensitivity on minority class samples is improved. Experimental results show that the method disclosed by the invention is obviously superior to the existing method on various encrypted traffic data sets (including TLS 1.3, VPN, malicious traffic and the like), and achieves leading performance on classification accuracy and macro average F1 index.

The invention discloses a traffic flow prediction method and device, a storage medium and electronic equipment. The method relates to the technical field of traffic flow analysis, and comprises the following steps: constructing a multi-source traffic data pool, and preprocessing historical traffic data in the multi-source traffic data pool to obtain a target multi-source traffic data pool; performing data enhancement processing on the historical traffic data in the target multi-source traffic data pool by adopting a pre-trained GANs model to obtain an enhanced sample set for training a target traffic flow prediction model; performing model training on an initial traffic flow prediction model by adopting a Dropout method based on the enhanced sample set to obtain a target traffic flow prediction model meeting a preset condition; and performing traffic flow prediction on multi-source traffic data acquired in real time by using the target traffic flow prediction model to obtain a traffic flow prediction result. According to the method, the accuracy of urban traffic flow prediction can be improved.