In recent years, as the Internet has become larger and more complex, network faults and abnormal communication behaviors have increased. Continuous monitoring and timely anomaly detection are essential for stable network services and cybersecurity protection. Key Performance Indicators (KPIs) and network traffic are two common types of time-series data in network security monitoring: KPIs reflect infrastructure anomalies caused by misoperations, device failures, or attacks, while network traffic directly characterizes abnormal communications at network boundaries. However, existing methods often struggle with multivariate feature mining, complex variable dependencies, hidden anomaly patterns, and strong noise interference, making accurate and timely detection difficult.

To address these challenges, our center proposed FECCD, a multivariate-correlation-based network security anomaly detection method that applies time-series analysis to security data modeling rather than forecasting. FECCD follows an “independent modeling first, correlation discovery later” strategy. It first uses variable-wise convolution and frequency-domain feature extraction to capture the trend, periodicity, and local variations of each KPI or traffic variable while avoiding premature cross-variable mixing. Then, a dynamic mask mechanism adaptively selects strongly correlated variable pairs to mine logical dependencies and suppress irrelevant interference. Experiments on four public datasets show that FECCD achieves an average F1 score of 91.08% and obtains the best results on SMD, IDS-2017, and DDoS-2019. On IDS-2017, it reaches 83.35% F1, outperforming the best baseline by 9.28 percentage points.

This research achievement has been accepted by ICONIP 2025，a recommended Class C conference by the China Computer Federation (CCF) and an important international academic conference in the field of neural information processing and artificial intelligence. The co-first authors of the paper are Du Guanyao and Wu Yize from our center, and the corresponding author is Senior Engineer Long Chun. This work was jointly supported by the Cybersecurity and Informatization Program of the Chinese Academy of Sciences (CAS-WX2022GC-04) and the Youth Innovation Promotion Association of the Chinese Academy of Sciences (2023181).

System Architecture Diagram of the FECCD Framework

Related Publication：Du G, Wu Y, Zhao J, et al. FECCD: Frequency Enhanced Channel Correlations Discovery for Multivariate Time Series Forecasting[C]//International Conference on Neural Information Processing. Singapore: Springer Nature Singapore, 2025: 49-60.