Network anomaly detection method and system based on spatio-temporal convolutional network and topology perception

Abstract

The disclosure discloses a network anomaly detection method and system based on spatio-temporal convolutional network and topology perception, and belongs to the technical field of network anomaly detection. Including: obtaining the device topology connection relationship of the network to be detected, constructing the adjacency matrix of the network device to be detected; obtaining the time series of the performance matrix of the network to be detected; using the sliding window to slide on the time series of the network performance matrix to be detected; Sliding, to extract the time series fragments in the sliding window; use the adjacency matrix of the network device to be detected and each time series fragment extracted as the input sequence, and input it into the pre-trained graph-based gated convolutional anomaly detection network; the output is to be Detect whether the network is abnormal.

Description

technical field [0001] The invention relates to the technical field of network anomaly detection, in particular to a network anomaly detection method and system based on spatio-temporal convolutional network and topology perception. Background technique [0002] The statements in this section merely mention the background technology related to the invention and do not necessarily constitute the prior art. [0003] As the network scale increases, the surge in traffic will increase the load on network devices and cause network congestion. Therefore, the status of devices and links is crucial to the quality of service (QoS) in the network. Various KPIs (key performance indicators such as packet flow, queue delay, memory usage, link delay, etc.) are monitored to detect anomalies and troubleshoot them in a timely manner. However, state-of-the-art algorithms only consider individual KPIs when detecting anomalies, while ignoring the spatial connectivity of devices in the network....

AI Technical Summary

Problems solved by technology

[0006] However, for these supervised algorithms, different types of KPIs require a lot of human resources, which is time-consuming

However, most unsupervised anomaly detection algorithms take a long time to model a single KPI, and it is difficult to meet the parallel processing of a large number of KPIs in the network topology.

[0007] In addition, these anomaly detection algorithms also ignore the spatial dependence caused by the connections between devices in the network topology

For example, when a packet is transmitted on a link, the throughput variation of a device can affect its neighbors, which can greatly affect the detection results of graph-based data.

Images