Search

CN-122027525-A - Method and device for detecting network congestion anomaly in real time for edge government affair data

CN122027525ACN 122027525 ACN122027525 ACN 122027525ACN-122027525-A

Abstract

The invention discloses a method and a device for detecting congestion anomalies of an edge government data real-time network, wherein the method comprises the steps of inputting collected multivariable time sequence data into a parallel re-parameterized time convolution network, obtaining initial time sequence characteristics considering both local and global, capturing spatial correlation between the initial time sequence characteristics by utilizing a local-global fusion module based on the initial time sequence characteristics of the local and global to obtain implicit spatial fusion characteristics, obtaining a reconstruction result based on the implicit spatial fusion characteristics, and detecting congestion anomalies of the real-time network based on the reconstruction result to solve network congestion. The apparatus includes a processor and a memory. The invention can accurately realize the monitoring of the flow congestion of the government network, the security protection of hidden network attack and the rapid troubleshooting of the bottom node equipment with extremely low reasoning delay.

Inventors

  • JIA ZHENHONG
  • WU HAO
  • REN ZHENG
  • LV XIAOYI
  • ZHAO HUI

Assignees

  • 新疆空天地一体化实验室技术有限公司
  • 新疆大学

Dates

Publication Date
20260512
Application Date
20260326

Claims (9)

  1. 1. The method for detecting the network congestion anomaly in real time for the edge government affair data is characterized by comprising the following steps of: Inputting the collected multivariable time sequence data into a parallel re-parameterized time convolution network to obtain initial time sequence characteristics considering local and global; Capturing the spatial correlation between the initial time sequence features by utilizing a local-global fusion module based on the initial time sequence features of the local and global, and acquiring implicit spatial fusion features; And acquiring a reconstruction result based on the implicit space fusion characteristic, and detecting congestion abnormality of the real-time network based on the reconstruction result, so as to solve network congestion.
  2. 2. The method for detecting congestion anomaly of the edge government data-oriented real-time network according to claim 1, wherein the re-parameterized time convolution network comprises a local time convolution branch and a global time convolution branch; Capturing a millisecond-level short-period trend through a local network with the expansion rate fixed to be 1; And the global time convolution branch captures long-range service fluctuation through a global network with the expansion rate exponentially increasing with the layer number.
  3. 3. The method for detecting network congestion anomaly in real time for edge government data according to claim 1, wherein the implicit spatial fusion features are as follows: splicing the local and global initial time sequence features in the channel dimension to obtain a joint feature matrix ; Cross-variable interaction is carried out on the combined feature matrix by adopting 1X 1 convolution, and fusion features are output : ; Wherein, the To activate the function.
  4. 4. The method for detecting the congestion anomaly of the edge government data-oriented real-time network according to claim 1, wherein the obtaining the reconstruction result based on the implicit space fusion characteristics is as follows: The encoder automatically determines the optimal head number h according to the characteristic dimension D, and generates a potential representation Z; ; extremely simple reconstruction, namely adopting a single linear layer to match with cross-layer residual error connection for decoding to obtain a reconstructed output : ; Wherein, the To traverse the iteration variables of the candidate integer, Is a positive integer set, mod is a modulo operator, To normalize the output value to an activation function of the (0, 1) interval, For the linear transform weight matrix of the decoder, For the bias term of the decoder, A shape transformation operation to deform the dimension of the latent variable Z to match the output space dimension.
  5. 5. The method for detecting congestion anomalies of the edge-oriented government data real-time network according to claim 1, wherein the joint feature matrix is characterized in that The method comprises the following steps: ; Wherein, the For the feature dimension of a single branch, For the length of the sequence, As a local time series feature matrix, As a global timing feature matrix, Is a real set.
  6. 6. The method for detecting network congestion anomalies in real time for edge government data according to claim 4, wherein the step of detecting network congestion anomalies is based on input feature dimensions Automatic determination of attention head count After splicing and linear transformation, the multi-head result is input into an improved feedforward network, the feedforward network is subjected to fine adjustment on a standard position-independent feedforward network, leakyReLU is adopted as an activation function, and the purpose of enhancing the weak nonlinear deviation of a model on government edge data is achieved: ; Wherein, the 、 And (3) with 、 Weights and bias terms for the first and second full link layers respectively, As an input feature vector to the feed-forward neural network, Is the output characteristic after two layers of full-connection conversion.
  7. 7. The method for real-time network congestion anomaly detection for border government data of claim 1 further comprising, during the training phase, each convolution block employing a 1x 1 fusion branch, The branch weights are aligned along the timing dimension to the end positions of the 3 x 1 main convolution kernel and an asymmetric time domain zero padding is performed on the remaining timing positions: ; Wherein' "Represents all output channels, input channel index and time step index, superscript (1) represents 1x 1 cross-channel fusion auxiliary branches, Is a new weight tensor after zero padding of the 1 x 1 auxiliary branch, Is equivalent weight after 1×1 auxiliary branches are fused, t is time step index in convolution kernel, and its value range is {0, 1, 2}.
  8. 8. An edge government data oriented real-time network congestion anomaly detection device comprising a processor and a memory, the memory having program instructions stored therein, the processor invoking the program instructions stored in the memory to cause the device to perform the method of any of claims 1-7.
  9. 9. A computer readable storage medium, characterized in that the computer readable storage medium stores a computer program comprising program instructions which, when executed by a processor, cause the processor to perform the method of any of claims 1-7.

Description

Method and device for detecting network congestion anomaly in real time for edge government affair data Technical Field The invention relates to the field of network detection, in particular to a method and a device for detecting network congestion abnormality in real time for edge government affair data. Background With the deep advancement of the construction of the digital government, government service systems have been extended to basic communities, remote villages and towns, and mobile law enforcement terminals. The multi-dimensional time sequence data (such as equipment running state, network flow and user operation behavior log) generated by the edge nodes (such as community government service self-service machine, mobile law enforcement terminal and basic level Internet of things sensing equipment) has the characteristics of large data volume, high real-time requirement and limited network bandwidth. Although the traditional cloud centralized anomaly detection architecture has high precision, the following limitations exist: The transmission delay is high, the edge data is required to be transmitted back to the cloud for analysis, and the millisecond real-time response requirement cannot be met; The complex graphics primitive mechanism requires a large amount of GPU (graphics processor) resources and is difficult to deploy on edge devices (such as ARM (advanced reduced instruction set machine) architecture terminals and embedded devices); The energy consumption is too high, and frequent matrix operations and attention calculations lead to rapid drain of the edge device battery. The existing lightweight method (such as traditional TCN (time convolution network) and statistical model) can run at the edge, but lacks modeling capability for complex time-space correlation among multiple variables, and is difficult to detect hidden cooperative attack or equipment cascading failure in a government system. Therefore, a novel anomaly detection architecture with complex training and extremely simple reasoning is needed, and millisecond-level real-time response of the edge end is realized while the detection precision is ensured. Disclosure of Invention The invention provides a method and a device for detecting network congestion anomaly in real time for government affair data, which aim to overcome the bottleneck of limited computing power of edge equipment and provide a lightweight anomaly detection architecture based on structural heavy parameterization, and the method can accurately realize government affair network traffic congestion monitoring, hidden network attack safety protection and quick investigation of bottom node equipment faults with extremely low reasoning delay, and is described in detail below: In a first aspect, a method for detecting network congestion anomaly in real time for edge government affair data, the method includes: Inputting the collected multivariable time sequence data into a parallel re-parameterized time convolution network to obtain initial time sequence characteristics considering local and global; Capturing the spatial correlation between the initial time sequence features by utilizing a local-global fusion module based on the initial time sequence features of the local and global, and acquiring implicit spatial fusion features; And acquiring a reconstruction result based on the implicit space fusion characteristic, and detecting congestion abnormality of the real-time network based on the reconstruction result, so as to solve network congestion. The reparameterized time convolution network comprises a local time convolution branch and a global time convolution branch; Capturing a millisecond-level short-period trend through a local network with the expansion rate fixed to be 1; And the global time convolution branch captures long-range service fluctuation through a global network with the expansion rate exponentially increasing with the layer number. Wherein the implicit spatial fusion features are: splicing the local and global initial time sequence features in the channel dimension to obtain a joint feature matrix ; Cross-variable interaction is carried out on the combined feature matrix by adopting 1X 1 convolution, and fusion features are output: Wherein, the To activate the function. The method comprises the steps of obtaining a reconstruction result based on implicit space fusion characteristics: The encoder automatically determines the optimal head number h according to the characteristic dimension D, and generates a potential representation Z; extremely simple reconstruction, namely adopting a single linear layer to match with cross-layer residual error connection for decoding to obtain a reconstructed output : Wherein, the The iteration variables of the candidate integers are traversed,A positive integer set, mod is the modulo operator,To normalize the output value to an activation function of the (0, 1) interval,For the linear transform weight matrix of the de