267 results about "Traffic identification" patented technology

The invention discloses a lightweight malicious network traffic detection method based on heterogeneous modal feature fusion, and mainly solves the problems of low feature extraction efficiency and insufficient single modal feature representation of the existing method. Comprising the following steps: acquiring and optimizing a network flow data set, preprocessing the network flow data set, and extracting and generating spatial feature, time sequence feature and behavior pattern feature vectors; an improved self-attention mechanism network is constructed, a lightweight heterogeneous modal feature fusion model LMF is designed, multi-modal feature deep fusion is performed through dynamic weight distribution, a lightweight classification model is trained, and the model is utilized to detect network malicious traffic. Through the lightweight heterogeneous modal feature fusion model LMF and in combination with a dynamic weight distribution mechanism, spatial distribution, time sequence dependence and behavior semantic information of network traffic are deeply mined, data processing efficiency, malicious traffic detection accuracy and system robustness are improved, and the method is suitable for efficient malicious traffic identification and defense in the field of network security.

The invention relates to the technical field of Internet of Things anomaly identification, in particular to an Internet of Things anomaly traffic identification method and system based on a deep neural network. The method comprises the following steps: collecting communication data of each piece of IoT equipment in real time from an edge gateway of the Internet of Things; preprocessing the collected communication data, and constructing a multi-dimensional feature vector; based on a convolutional neural network and a bidirectional long-short-term memory network, performing time sequence feature extraction and anomaly discrimination on the multi-dimensional feature vector to output a traffic anomaly probability; and comparing the abnormal probability output by the depth time sequence modeling neural network with a dynamic threshold value, and if the abnormal probability exceeds a preset threshold value, determining that the traffic is abnormal. A gating mechanism is introduced into a bidirectional long-short-term memory layer, a gating coefficient is calculated at a time step level, the influence weight of time step information on final output is dynamically adjusted, feature expression of key time steps is strengthened, noise or irrelevant information is suppressed, and the sensitivity of a model to time sequence data is improved.

The invention discloses a traffic identification method, a traffic identification device and electronic equipment. The method comprises the following steps: acquiring encrypted traffic data in a network; packet-level feature extraction and flow-level feature extraction are carried out on the encrypted traffic data, packet-level features and flow-level features corresponding to the encrypted traffic data are obtained, and the packet-level features are used for representing attribute features of a single data packet in the encrypted traffic data; the flow level feature is used for representing the feature of the whole data flow corresponding to the encrypted flow data; fusing the packet level feature and the flow level feature to obtain a fusion feature corresponding to the encrypted flow data; and carrying out classification identification on the fusion features to obtain a classification result of the encrypted traffic data. According to the method and the device, the technical problem that the identification accuracy of the encrypted traffic application is relatively low due to the fact that the encrypted traffic content is invisible and deep information in traffic data is difficult to fully mine by a single feature extraction method in related technologies is solved.

The invention is suitable for the technical field of network security, and provides an abnormal traffic identification method, device and equipment, a medium and a computer program, and the method comprises the steps: obtaining a comprehensive traffic feature of a to-be-detected traffic; the total data amount of the to-be-detected traffic is obtained through a pre-trained algorithm distribution model, a recognition algorithm corresponding to the to-be-detected traffic is output based on the total data amount, the recognition algorithm is a first clustering algorithm or a second clustering algorithm, and the total data amount of the traffic suitable for the first clustering algorithm is larger than the total data amount of the traffic suitable for the second clustering algorithm; classifying the traffic to be detected according to the comprehensive traffic features, the recognition algorithm and a plurality of abnormal centers corresponding to the recognition algorithm; and under the condition that the to-be-detected traffic belongs to any abnormal center, determining that the to-be-detected traffic is abnormal traffic. According to the invention, anomaly identification during traffic classification for different conditions is realized, and the accuracy, efficiency and automation degree of abnormal traffic identification can be improved.

The invention discloses an LSTM (Long Short Term Memory)-based fraud-related network traffic identification method and a server, and is applied to the field of network traffic analysis. According to the method, original flow data are collected in real time through network flow collection equipment, communication feature data and behavior feature data are extracted from each communication address, and weighted combination is carried out by adopting adaptive weight coefficients based on feature matching degree and feature abnormality to obtain a suspicious degree score; and outputting an early warning result to the communication address exceeding the preset suspicious threshold. According to the technical scheme provided by the invention, a multi-layer fraud-related network flow identification architecture and a closed-loop feature evaluation mechanism are constructed, so that the identification accuracy of continuously changing fraud-related communication behaviors is effectively improved.

The invention discloses a traffic checkpoint holographic recognition method and system based on multi-mode perception and a medium, and relates to the technical field of traffic management, and the method comprises the steps: collecting an original perception data set in real time through a multi-mode sensor array disposed at a target traffic checkpoint; performing time-space synchronization processing on the original sensing data set to generate a multi-modal data frame sequence; performing fusion processing on the multi-modal data frame sequence by using a deep learning model to generate a holographic feature vector of the target vehicle; and based on the holographic feature vector, target identity recognition and behavior analysis of the target vehicle are carried out, a recognition result is output, and abnormal event early warning is carried out. The technical problems of low traffic recognition precision and insufficient real-time performance caused by the fact that an existing traffic monitoring system cannot efficiently fuse various sensor data for holographic recognition are solved, and the technical effect of improving traffic management efficiency and safety through multi-modal data space-time synchronization and deep feature fusion is achieved.

The invention discloses a flow characteristic adaptive QoS intelligent prediction adjustment method, and relates to the field of network flow management, and the method comprises the steps: 1, collecting flow data in real time, and constructing a multi-dimensional characteristic vector based on protocol types, port numbers and user behavior dynamic classification; 2, high-frequency / low-frequency components are separated, and QoS parameter prediction is output through fusion of an LSTM short-term prediction module and a periodic trend analysis module; 3, solving a resource pre-allocation scheme by adopting reinforcement learning by taking minimization of packet delay as a target; and 4, executing traffic identification, speed limiting and priority queue scheduling by using NPU hardware unloading. According to the method, the precision is improved through a high-frequency / low-frequency combined prediction architecture, decision delay is compressed to a large extent through reinforcement learning and NPU cooperation, and meanwhile online model iteration is achieved through a prediction error triggering mechanism.

The invention provides a traffic jam intelligent identification method and system based on deep learning. The method comprises the steps of obtaining a multi-source traffic recognition optimized data set by obtaining and optimizing a multi-source traffic recognition data set, then constructing traffic scene label feature data, recognizing dynamic traffic scene category feature data, evaluating a traffic jam initial evaluation index, analyzing a traffic jam recognition influence factor, and optimizing to obtain a traffic jam correction index. And finally, performing threshold value comparison with a preset dynamic traffic jam identification threshold value, judging whether traffic jam exists or not according to a threshold value comparison result, analyzing and identifying a jam cause, and generating an intelligent traffic jam identification report at the same time. According to the invention, multi-source heterogeneous data is collected, data fusion and feature extraction are completed through the deep learning model, congestion identification is realized by combining dynamic scene classification and adaptive threshold determination, and congestion cause tracing analysis is completed by using the deep learning classification model, so that traffic congestion intelligent identification based on deep learning is realized.

The invention provides a network traffic identification method and system for an unknown cryptographic protocol, and relates to the technical field of network traffic analysis, and the method comprises the steps: carrying out the preprocessing of captured dynamic traffic data, and obtaining target traffic data; acquiring a multi-dimensional feature parameter set based on predetermined feature dimension collection; constructing an initial knowledge graph, and introducing a graph dimension reduction mechanism to carry out dimension reduction processing to obtain a target knowledge graph; performing clustering analysis on the network flow knowledge graph database to obtain a target class cluster; reading a predetermined clustering degree evaluation strategy, and performing clustering degree evaluation analysis to obtain a target clustering degree; and if the preset clustering degree limit value is reached, marking the target protocol type corresponding to the target class cluster as the protocol type of the target traffic data. The technical problem that in the prior art, a static feature recognition method is generally adopted, effective detection on an unknown password protocol is lacked, the requirement for continuous evolution of the protocol cannot be met, and then network security vulnerabilities are caused is solved.

An efficient open set encryption traffic identification method for super-large scale traffic relates to the technical field of data security, solves the technical problems of insufficient resource efficiency, feature expression and open set identification in the prior art, and comprises the following steps: S1, inputting a network traffic data set, and generating dimension reduction data of an optimal dimension through a PCA dimension reduction algorithm; s2, inputting the dimension reduction data of the optimal dimension into an improved MobileNetV3 model, and in combination with an improved SE attention mechanism and a composite structure of Dense connection and residual connection, extracting features and outputting a classification result; s3, judging whether a classification result belongs to a known category, a drift sample or an unknown category by using an open set recognition algorithm based on confidence; s4, if the classification result is a drift sample or an unknown category, incremental learning based on knowledge distillation is started, parameters of the improved MobileNetV3 model are updated, and old knowledge is reserved. According to the invention, the network security protection capability can be effectively improved.

The invention discloses a Tor network exit traffic identification system and method fusing a multi-scale LSTM and a Transform network, and belongs to the technical field of anonymous network traffic analysis and network security. The system comprises five core components, namely a multi-scale feature extraction module, a feature fusion module, a global dependency modeling module, a dynamic weighted aggregation module and a classification module. The multi-scale feature extraction module adopts parallel bidirectional LSTM branches with different time resolutions to capture a microcosmic burst mode and a macroscopic session behavior at the same time; the feature fusion module unifies the scale features to the same time sequence length and splices the scale features; the global dependence modeling module utilizes a multi-head self-attention mechanism to learn long-distance time sequence dependence; the dynamic weighted aggregation module highlights a key time slice through adaptive weight pooling; and the classification module outputs website category labels. According to the system, the recognition accuracy on a GTT23 data set is remarkably improved compared with that of an existing method, and good recognition capability and robustness are shown for various flow defense mechanisms.

The invention discloses a multi-source heterogeneous network security method and an intelligent terminal, and relates to the technical field of data security, and the method comprises the steps: constructing a first traffic feature sub-graph according to first network traffic data, and constructing a second traffic feature sub-graph according to second network traffic data; performing node feature remapping on the second traffic feature sub-graph according to the first traffic feature sub-graph to obtain a cross feature sub-graph; performing node feature correction on the first flow feature sub-graph according to the cross feature sub-graph to form a fusion feature sub-graph; calculating a topological correlation entropy between nodes according to the fusion feature sub-graph, updating a node connection relationship based on the topological correlation entropy to obtain a dynamic fusion feature graph, and reversely updating node features in the cross feature sub-graph according to the dynamic fusion feature graph; according to the method, the traffic structure change can be dynamically perceived, the identification capability on potential attack behaviors is enhanced, and security risk detection and abnormal traffic identification are stably and efficiently carried out in a multi-source and dynamically changed complex network environment.

The invention provides a network abnormal traffic identification method and system applied to big data, and the method comprises the steps: receiving an original traffic data stream flowing in a network transmission link, and extracting the associated attribute information carried by the original traffic data stream; performing link association analysis processing on the original traffic data flow to obtain a traffic association map and traffic transmission link characteristics; and inputting the traffic association map and the traffic transmission link features into a preset anomaly identification network, and generating traffic anomaly association features through hierarchical interaction processing. And triggering a classification decision-making mechanism based on the traffic anomaly association features, and outputting an anomaly identification result of the network traffic. And finally, generating flow control guide information according to an abnormal identification result, and sending the flow control guide information to a flow control node to execute a control operation. According to the method, flow data are analyzed from multiple dimensions, association between features is fully mined, accurate identification and effective management and control are realized, the capability of the network to deal with abnormal flow is effectively improved, and stable operation of the network and data security are guaranteed.

The invention relates to a cross-end traffic identification and user behavior attribution analysis method and system. The method comprises the following steps: obtaining a user behavior data set according to application store advertisement click data and landing page downloading data; matching the user behavior data set through a preset equipment fingerprint database to obtain a global user identifier and real-time behavior data corresponding to the user behavior data set; classifying the users through a sliding window algorithm according to the global user identifier and the real-time behavior data to obtain new users and active users; attributing the newly-added users and the active users to obtain attribution results of the newly-added users and attribution results of the active users; and integrating the attribution result of the new user, the attribution result of the active user and the historical new attribution rule calculation result to generate the real-time inquirable channel efficiency, so that the method has the advantages of effectively avoiding the settlement misjudgment and realizing the channel efficiency optimization under the complex business scene of the specific financial field.

The invention discloses a network security-oriented abnormal traffic identification processing method. The method comprises the following steps of: constructing a traffic baseline model of target network link access equipment in different scenes and time windows based on historical traffic data; collecting flow characteristic data and bandwidth characteristic data of the equipment in real time, comparing the data with the flow baseline model, and identifying abnormal equipment through the baseline deviation degree; the content type is identified by using URL classification and deep packet inspection technologies, and the destination and the anomaly degree of the abnormal traffic are determined in combination with the attribute and traffic consumption of the known type of content and the traffic consumption and bandwidth occupation duration of the unknown type of content; and generating a detection report and pushing the detection report to an administrator terminal. Through scene-divided and multi-dimensional dynamic baseline modeling and flow feature and bandwidth feature fusion collaborative analysis, abnormal equipment and flow are accurately identified, the misjudgment rate is reduced, the network security operation and maintenance efficiency is improved, and the method is suitable for abnormal flow monitoring of various network environments.

The invention discloses an abnormal traffic monitoring method and system based on a security gateway, and the method comprises the steps: obtaining a TLS handshake feature in a traffic request in response to the traffic request of a target user, and carrying out the Hash calculation of the TLS handshake feature, and obtaining a JA3 Hash fingerprint; performing three-level cache matching on the JA3 hash fingerprints in sequence, and extracting fingerprint tags of the JA3 hash fingerprints which are not matched in three-level cache; performing feature extraction on the traffic data corresponding to the fingerprint tag to obtain traffic features; and inputting the traffic characteristics into a pre-trained abnormal traffic identification model based on Transform to obtain an abnormal traffic identification result. According to the method provided by the invention, the detection precision of the abnormal traffic is improved.

The invention relates to a PCDN traffic identification control method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps of obtaining traffic access records of a plurality of candidate broadband users, performing PCDN feature recognition and reasoning on the traffic access records of the plurality of candidate users to obtain PCDN traffic information, the PCDN traffic information comprising PCDN broadband user accounts and PCDN traffic identifiers, sending the PCDN traffic information to a management and control device, and sending the PCDN traffic information to the management and control device. The PCDN flow information is used for the management and control equipment to position the PCDN flow so as to manage and control the PCDN flow. The PCDN traffic can be accurately identified, the PCDN traffic is effectively controlled, and other normal service traffic of a user is not affected.

The invention discloses a method and a system for identifying general overseas VPN (Virtual Private Network) proxy traffic based on a TCP (Transmission Control Protocol). The method comprises the following steps: S1, carrying out switch TCP traffic mirroring and session SYN related time delay calculation; s2, performing hash table interaction and time delay calculation under downlink message load distinguishing; s3, on the basis of judgment of the time delay # imgabs0 # and a threshold value D, counting and logic insertion are carried out on the HashVPS hash table; s4, periodically triggering HashVPS traversal and VPS proxy service affirmation in a timing manner; the system is suitable for the general overseas VPN proxy traffic identification method based on the TCP protocol. Aiming at various TCP transmission VPN protocols, the method breaks through conventional identification limitation, is not afraid of encryption, disguising and mining proxy traffic characteristic differences, constructs a complete identification closed loop, accurately screens out proxy traffic, and builds a network security defense line.

The invention is suitable for the field of vehicle information security, and provides a CAN intrusion detection method based on a signal relation graph Transform, which comprises the following steps: converting a frame sequence of a CAN network into a signal sequence, deeply mining key signal features in a message, systematically analyzing complex relevance between signals, and constructing a signal node feature representation system. In order to further improve the detection precision, the method uses a graph attention network and a Transform model, and optimizes the extraction and learning process of input signal features, thereby significantly reducing the false alarm rate in abnormal traffic recognition. By accurately capturing abnormal behaviors in the CAN network, the method can effectively cope with potential network attacks, meets the requirements of the advanced intelligent networked vehicle for functional security and network security, and provides important technical support for realizing a high-reliability and high-security vehicle-mounted communication system.

The invention discloses a time fine-grained network flow identification method and system, and belongs to the technical field of communication networks, and the method comprises the steps: firstly collecting a data flow generated by a communication data network, and compressing the data flow to obtain compressed network flow data; performing segmentation and data cleaning according to the quintuple, standardizing the length of the network flow data of each flow, and converting the standardized network data flow into a gray image in a binary form; and finally, cooperatively carrying out network traffic joint identification on the generated grayscale image through an HMAT algorithm and a network traffic identification method combined with LSTM improved space-time vision Transform, and obtaining an identification result. The method not only improves the precision and efficiency of traffic classification, but also can adapt to diversified requirements in a complex network environment in real time, and provides powerful technical support for network security management and service quality optimization.

The invention relates to the technical field of Internet of Things, in particular to an Internet of Things card abnormal traffic identification and multistage response control system, which comprises a quantum key distribution and generation module, a data acquisition and preprocessing module, an abnormal traffic identification module, a multistage response execution module and a quantum security management module. According to the method, the preprocessed traffic features are converted into low-dimensional core fingerprints, high-robustness detection of encrypted traffic anomalies is realized by combining a quantum heuristic CNN and gradient mask adversarial training hybrid intelligent model, and the detection accuracy is guaranteed by matching risk score quantification anomaly degree and baseline dynamic update. According to the method, the pain points that in traditional encrypted traffic detection, identification is difficult without decryption, and adversarial attack is likely to happen are effectively solved, and the security, robustness and reliability of Internet of Things card traffic management and control are remarkably improved.

The invention discloses a real-time isolation method and device based on AI traffic anomaly recognition, and relates to the technical field of network security and artificial intelligence, and the method comprises the steps: collecting network traffic data based on a preset traffic path, fusing communication protocol data, timestamp data, source address data and target address data, and obtaining a fusion result; the method comprises the steps of generating a traffic behavior model, analyzing the traffic behavior model, determining abnormal features in traffic behaviors and a distribution mode of the abnormal features, and switching a current traffic processing task to an isolation task when the distribution mode of the abnormal features meets a preset isolation condition. And generating an isolation area and an isolation signal according to the distribution mode of the abnormal characteristics, and executing an isolation task based on the isolation area and the isolation signal. By means of the mode, the technical problem that in the prior art, the processing efficiency of abnormal flow recognition and isolation is low is solved.

The invention discloses a network security protection method and system based on flow analysis, and relates to the technical field of network security protection, and the method specifically comprises the following steps: judging whether there is a multi-protocol interaction flow condition based on a protocol type classification result, if there is the condition, determining all protocols participating in interaction, and if there is the multi-protocol interaction flow condition, determining all protocols participating in interaction; classifying the data into a protocol interaction identifier set; obtaining interaction behavior characteristic information of each protocol in the protocol interaction identification set, analyzing the interaction behavior characteristic information after obtaining, and evaluating the change degree of interaction behaviors among the protocols in the protocol interaction identification set; and executing dynamic regulation and control on the cross-protocol flow identification mechanism according to an evaluation result. According to the invention, the problem in the prior art that identification and regulation cannot be carried out according to the change degree of interaction behaviors between protocols under the condition of multi-protocol interaction traffic is solved, dynamic regulation of a cross-protocol traffic identification mechanism is realized, and the identification capability and protection precision of mixed protocol camouflage attacks are effectively improved.

The invention relates to an abnormal network traffic identification method and device and a medium, and belongs to the technical field of network security. The method comprises the following steps: collecting a real-time network data packet; processing the real-time network data packet to obtain semantic features and time sequence feature indexes; an improved BERT model is adopted to encode the semantic features to obtain a high-dimensional semantic vector, and the BERT model is improved and comprises the steps that corresponding Tokenizer and Embedding layers are designed for the semantic features; modeling and coding the time sequence characteristic indexes by using a Prophet model to obtain time sequence characteristic vectors; generating a multi-modal feature vector; detecting the multi-modal feature vector by using the model to obtain an identification result; wherein the reinforcement learning network model adopts a DDQN algorithm, the model comprises a state, an action and a reward, and parameters of the network model are updated according to the final reward executed by the action. According to the scheme, the abnormal network traffic can be accurately identified, and new and unknown attack modes can be continuously adapted.

The invention relates to the technical field of flow monitoring, in particular to a data center switch abnormal flow detection method and device, equipment and a medium, and the method comprises the following steps: collecting port flow, calculating a jump ratio, identifying an abnormal path, analyzing a multi-feature behavior, tracking the attribution of flow direction oscillation aggregation equipment, and outputting a detection result. According to the method, the port abrupt change phenomenon is identified through linkage of the jump ratio and the dynamic threshold value, the discrimination logic for the network jitter initial offset is established by combining the path continuous node response delay difference, and the path-level composite feature anomaly judgment is established by fusing the multi-dimensional index intersection behavior. Potential path oscillation is identified according to flow direction alternation in a period and traced to equipment granularity to realize chain affiliation aggregation, so that the granularity and accuracy of abnormal flow identification are enhanced, closed-loop abnormality diagnosis from transient abnormality to a path level to equipment affiliation is realized, the perception capability in a complex link disturbance and multi-point abnormality cooperation scene is improved, and the reliability of abnormal flow identification is improved. And the abnormal flow detection definition of the data center switch is improved.

The invention discloses an abnormal traffic identification method, system and device based on deep packet inspection, and a medium. The method comprises the following steps: collecting original traffic data in a network through a mirror image port or a probe, obtaining original message data, cleaning and labeling the original message data, and generating a structured data set; performing depth feature extraction on the structured data set to generate a feature vector; training a classification model by using the feature vectors, generating a detection model, analyzing the new flow data through the detection model, and outputting an abnormal probability and grading early warning; positioning an abnormal type according to the abnormal probability and graded early warning, generating a structured report, and linking the safety equipment to execute a blocking operation; and performing incremental training according to the detected feedback data, and updating the detection model. The invention provides an abnormal traffic identification method based on deep packet inspection according to the characteristics of diversified protocol levels and strong concealment and evolution of abnormal behaviors in network traffic.

The invention belongs to the technical field of intranet security, and discloses an intranet encryption malicious traffic identification method and system based on an attention mechanism, and the method comprises the steps: carrying out the encryption processing of original CAN bus data through employing an XTEA lightweight algorithm, and simulating a real intranet encryption environment; the encrypted data are converted into two-dimensional image features and sequential sequence features at the same time, efficient spatial feature extraction is performed by using an optimized CNN structure, and the sequential features are captured by combining a GRU network, a self-attention mechanism and a Transform encoder; and training is carried out through feature fusion, so that accurate recognition of different types of attacks is realized. According to the method, on the premise of not depending on hardware, high-precision identification is realized under the condition that malicious traffic encrypted by the in-vehicle network does not need to be decrypted, the requirements of the in-vehicle network on real-time performance and resource consumption are met, and meanwhile, high-precision identification capability is still kept in the face of various attacks.

The application relates to a cryptocurrency auxiliary supervision method based on keyword traffic identification, and belongs to the technical field of blockchain supervision. The application combines data information of a blockchain network and a communication function of a network node, first collects traffic data, extracts keyword features in the traffic data according to a communication protocol, matches specific fields with categories of cryptocurrencies, and obtains a preliminary judgment result of categories corresponding to the traffic. Then, simulated data packets are created according to a communication protocol of a target cryptocurrency in the preliminary judgment, a connection is established with a target node, the data packets are sent, returned data packets are received and parsed, and key information in the returned data packets is analyzed to verify the judgment result and determine the type of the target node. The node and information thereof are stored in a database in a labeled manner, and the node label is continuously monitored and regularly updated. The application realizes efficient identification of cryptocurrency traffic, and enhances the supervision efficiency of a supervision platform on cryptocurrencies.

The invention relates to the technical field of information security, in particular to an encrypted traffic identification method based on big data, which comprises the following steps of: acquiring a network data packet, extracting flow statistical characteristics and a TLS handshake protocol field, generating an original characteristic vector after numeralization processing; determining a traffic data type based on the type identification model, further calculating a network data feature coefficient, and determining an encrypted traffic identification model based on a comparison result with a historical coefficient; inputting the original feature vector into the model to obtain an initial recognition result and a flow confidence coefficient, classifying the recognition result based on the flow confidence coefficient, and executing corresponding regulation and control operation based on the recognition result; and re-collecting the regulated data packet, extracting the network state data to calculate a regulation efficiency index, and determining whether to regulate the historical network data feature coefficient based on the regulation efficiency index and the identification efficiency index. Through a closed-loop feedback optimization mechanism, adaptive adjustment of encrypted traffic identification is realized, and the identification accuracy and the regulation and control efficiency are improved.

The invention belongs to the technical field of intelligent traffic, and provides a traffic dynamic identification system, in order to solve the problem of low traffic dynamic identification accuracy in the traditional technology, the system adopts a first determination module to respond to a traffic dynamic identification instruction, determine a target road section and determine the road condition type of the target road section; a second determination module is used for determining a road condition information acquisition mode according to the road condition type; an information acquisition module is used for acquiring road condition information data based on a road condition information acquisition mode; a target identification module is used for identifying target objects of corresponding types according to the road condition information data and based on a plurality of preset single-class target identification models; the traffic dynamic presentation module is used for presenting all the target objects on the virtualized roads corresponding to the target road sections, the traffic dynamic states corresponding to the target road sections are obtained, and the accuracy of traffic dynamic state recognition is improved from the two aspects of road condition information data collection and target object recognition.