Detection method and device for network anomaly traffic and computer readable storage medium

Abstract

The invention discloses a detection method and device for network anomaly traffic and a computer readable storage medium. The detection method for the network anomaly traffic comprises the steps of: acquiring current traffic data of a plurality of ports in a current time period and historical traffic data corresponding tot he current time period; by utilizing a preset filter, respectively extracting current traffic characteristics and historical traffic characteristics of the ports from the current traffic data and the historical traffic data; respectively extracting high-level semantics of current traffic of the ports and high-level semantics of historical traffic of the ports from the current traffic characteristics and the historical traffic characteristics; calculating a semantic similarity between the current traffic and the historical traffic of the ports; judging whether the semantic similarity falls within a preset first value interval, and obtaining judgment results for current traffic states of the ports; and according to the judgment result for the current traffic state of each port, determining a fault port. By utilizing the detection method for the network anomaly traffic in the embodiment of the invention, the fault port can be timely found.

Description

technical field [0001] The present invention relates to the communication field, in particular to a method and device for detecting abnormal network traffic, and a computer-readable storage medium. Background technique [0002] At present, a computer room of a network operator is usually equipped with a large number of data communication devices, and a large amount of traffic needs to be exchanged between these data communication devices every day. Maintaining the normal operation of these data communication devices is crucial to improving communication quality. [0003] However, the inventors of the present application have found that due to the large number of data communication devices (hereinafter referred to as devices) in the computer room and the large number of ports on the same device, when one or more When a port fails and causes abnormal network traffic, the faulty port cannot be found in time. Contents of the invention [0004] Embodiments of the present inve...

AI Technical Summary

Problems solved by technology

[0003] However, the inventors of the present application have found that due to the large number of data communication devices (hereinafter referred to as devices) in the comput

Images