MindFlow: A Network Traffic Anomaly Detection Model Based on MindSpore

TL;DR

MindFlow addresses the challenge of detecting network traffic anomalies in IoT/IIoT environments with complex, high-volume data. It employs a CNN–BiLSTM architecture implemented on the MindSpore framework to capture spatial and temporal patterns in reconstructed time-series traffic. On the NF-BoT-IoT dataset, MindFlow achieves 99% across accuracy, precision, recall, and F1, demonstrating strong detection performance and robustness, aided by MindSpore's hardware acceleration. The work highlights a practical approach for real-time intrusion detection in edge-enabled IoT networks, and suggests directions for cross-domain adaptation and deployment efficiency.

Abstract

With the wide application of IoT and industrial IoT technologies, the network structure is becoming more and more complex, and the traffic scale is growing rapidly, which makes the traditional security protection mechanism face serious challenges in dealing with high-frequency, diversified, and stealthy cyber-attacks. To address this problem, this study proposes MindFlow, a multi-dimensional dynamic traffic prediction and anomaly detection system combining convolutional neural network (CNN) and bi-directional long and short-term memory network (BiLSTM) architectures based on the MindSpore framework, and conducts systematic experiments on the NF-BoT-IoT dataset. The experimental results show that the proposed model achieves 99% in key metrics such as accuracy, precision, recall and F1 score, effectively verifying its accuracy and robustness in network intrusion detection.

Figures (3)

• Figure 1: The overall architecture of the proposed CNN-BiLSTM network traffic anomaly detection model based on the MindSpore framework. The model integrates convolutional layers for local feature extraction and a bidirectional LSTM for temporal dependency modeling, enabling effective identification of complex spatiotemporal patterns in network traffic data.
• Figure 2: Context-aware representation learning using a bidirectional LSTM. The left-to-right and right-to-left LSTM layers encode the input sequence into $\mathbf{h}{Lt}$ and $\mathbf{h}{Rt}$, which are concatenated to form the context vector $\mathbf{h}_c$. The final prediction $\mathbf{P}$ is obtained via a softmax layer.
• Figure 3: Training loss curve of the CNN-BiLSTM model over 20 epochs. The loss decreased from 0.1650 to 0.0002, indicating rapid convergence and stable optimization.