Abstract:

A streaming multi-layer network consists of multiple dynamically interacting network layers （such as physical layer， protocol layer， and application layer）， and its data exhibits temporal cross layer coupling. However， using non sliding window methods will not be able to capture the dynamic spatiotemporal coupling effect of data between multi-layer networks， resulting in high DBI values in data mining. Therefore， a deep mining algorithm for anomalous data in downstream multi-layer networks with dynamic time window constraints is proposed. Using sliding windows to divide the streaming multi-layer network data stream into multiple time windows， and within each time window， combining local anomaly factors （LOFs） to mine suspected anomalous data； In response to the cross layer coupling characteristics of abnormal patterns in multi-layer network data， a Markov chain model is introduced to construct a temporal state transition probability matrix and a spatial cross state transition probability matrix， effectively capturing the dynamic spatiotemporal coupling effect characteristics of abnormal data. This feature is input into a C-LSTM hybrid model to achieve deep mining of abnormal data. The experimental results show that the algorithm can use dynamic time windows to mine suspected abnormal data， and the deep mining results of abnormal data can match the actual label results； DBI values below 0.2 in various types of abnormal data mining can more accurately distinguish between various categories of abnormal data and normal data.

Key words: dynamic time window, streaming multi-layer network, abnormal data, deep excavation, Markov chain, LSTM