Flow data statistical analysis method and system based on large model

Abstract

The invention provides a traffic data statistical analysis method and system based on a large model and a computer program product, and belongs to the technical field of computer network security and data analysis. The method comprises the following steps: acquiring a resource set currently requested by a client; identifying to-be-counted resources and to-be-checked clients; analyzing traffic transmission features, web text features and / or encryption features of the to-be-counted resources within a preset duration; the large model outputs a security checking result for the to-be-checked client; and based on a security checking result, executing security measures for the subsequent resource request of the to-be-checked client. The system comprises the cloud server. According to the scheme provided by the invention, network fraud, malicious traffic and disguised attack data streams can be identified for the fraudulent data of the client by utilizing the existing large model based on network security, so that the value degree of a statistical result of traffic data analysis is improved, and the delay and blockage of cloud resource services are avoided.

Description

Technical Field

[0001] The present invention belongs to the field of computer network security and data analysis technology, and in particular relates to a traffic data statistical analysis method and system based on a large model, a computer-readable storage medium, a computer program product and an electronic device for implementing the method. Background Art

[0002] As the scale of the Internet continues to expand, network security issues are also facing greater pressure and challenges. The diversity of network environments is also increasing, and the emergence of new network environments such as cloud computing, the Internet of Things, and edge computing has posed new challenges to the increasingly severe network security situation.

[0003] As an important active network security strategy, network traffic anomaly detection technology has been gradually applied to network security protection. Network traffic anomaly detection technology studies and analyzes traffic data in the network, determines abnormal traffic instances, and promptly discovers attack behaviors in the network, providing network managers with real-time decision-making basis, thereby improving the overall security and stability of the network. For example, the Chinese patent publication (CN117749426A) proposes an abnormal traffic detection method based on graph neural networks, which can generate security alerts or provide decision support based on the detection results of abnormal network traffic, helping network security managers to quickly respond to potential network security issues and formulate response strategies.

[0004] However, with the full encryption of network traffic load, encrypted transmission technology has become one of the methods for malicious traffic to evade detection. For encrypted transmission client requests, the traditional abnormal traffic monitoring method has too small a sample size and low accuracy. In addition, the indicator of abnormal traffic detection lies in the "high-speed traffic characteristics", but there is a new trend in current network data attacks, namely low-rate attacks, which generate low-rate attack traffic that can be hidden in normal transmission control protocols and use the adaptive mechanism of network protocols to cause false congestion in the network, damage the connection quality between the client and the server, and make the server unable to provide normal services to users. This type of attack is more covert and difficult to detect because they use low-rate attack traffic, which is enough to occupy the key resources of the target system, but not enough to trigger the traditional abnormal traffic detection mechanism. Especially in the cloud computing environment, if this type of attack end is hidden in multiple client clusters, it will take advantage of the characteristics of shared resources in the cloud computing environment and affect multiple tenants or users by occupying shared resources, resulting in significant delays and blockages in cloud resource services. Summary of the invention

[0005] In response to the above technical problems, the technical solution of the present invention can utilize the existing large model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the client's deceptive data, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0006] In a first aspect of the present invention, a traffic data statistical analysis method based on a large model is proposed, wherein the method is applied to a cloud server, wherein the cloud server is connected to N clients {R1, R2, ..., R N}Remote communication, N>1;

[0007] The method applied to the cloud server includes the following steps S100-S500:

[0008] S100: Get client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource;

[0009] S200: When more than a predetermined proportion T of the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the predetermined proportion T is ≥ 50%.

[0010] S300: Analyze the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0011] S400: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients exceeding the predetermined ratio;

[0012] S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests from each of the clients exceeding the predetermined proportion, and the security measures include current limiting, interrupting service, or maintaining service.

[0013] The requested resource in step S100 includes a combination of at least two of the following resources:

[0014] CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

[0015] The step S300 specifically includes:

[0016] For each resource to be counted, perform the following analysis process:

[0017] S301: Determine whether the client request for the resource to be counted is encrypted;

[0018] If yes, proceed to step S303, otherwise, proceed to step S302;

[0019] S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period;

[0020] S303: Obtain traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period.

[0021] In a second aspect of the present invention, a traffic data statistical analysis method based on a large model is proposed, wherein the method is applied to N requesting clients {R1, R2, ..., R N}; the N requesting clients {R1, R2, ..., R N} remotely communicate with a cloud server, the method comprising the following steps:

[0022] SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a request resource to the cloud server; the request resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i=1, 2, ..., N;

[0023] SS200: The cloud server counts each client R i The resource set S currently requested i ;

[0024] SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked;

[0025] SS400: the cloud server analyzes the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resources to be counted within a preset time period;

[0026] SS500: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients to be screened;

[0027] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, and the security measures include current limiting, service interruption or service maintenance.

[0028] The encryption characteristics in step SS400 include encryption method, encryption length and / or estimated decryption time;

[0029] The large model based on network security in step SS500 outputs a security check result for each of the clients to be checked, specifically including:

[0030] SS501: Determine whether the data input of the large model includes the encryption feature,

[0031] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check; if no, proceed to step SS502;

[0032] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0033] Part or all of the steps of a large model-based traffic data statistical analysis method described in the first or second aspect can be automatically implemented through various forms of electronic devices and computer program instructions; the computer program instructions can be stored in different forms of storage media and loaded into computer electronic devices for execution.

[0034] Therefore, in the third aspect of the present invention, a computer-readable storage medium is also provided for storing computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the traffic data statistical analysis method based on a large model as described in the first or second aspect.

[0035] In the fourth aspect of the present invention, an electronic device is also proposed, which includes a processor and a memory, the memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the large model-based traffic data statistical analysis method described in the first or second aspect.

[0036] In a fifth aspect of the present invention, a computer program product is also proposed, which includes a computer program. When the computer program is executed, the traffic data statistical analysis method based on a large model described in the first or second aspect is implemented.

[0037] Corresponding to the method technical solution, in order to execute the method, in a sixth aspect of the present invention, a traffic data statistical analysis system based on a large model is proposed, the system includes a client request acquisition unit, a resource identification unit to be counted, a feature acquisition unit, a security investigation unit, a security measure execution unit and a cloud server, the cloud server is connected to a large model based on network security;

[0038] The client request acquisition unit is used to obtain the client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; N>1;

[0039] The resource identification unit to be counted is used to count each client R i The resource set S currently requested i ; When the resource sets currently requested by clients exceeding a predetermined ratio T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the clients exceeding the predetermined ratio T are used as clients to be checked;

[0040] The feature acquisition unit is used to acquire the traffic transmission feature, network text feature, and / or encryption feature of the resource to be counted within a preset time period;

[0041] The security investigation unit is used to use the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security investigation result for each of the clients to be investigated;

[0042] The security measure execution unit is used to execute security measures for subsequent resource requests of each of the clients to be checked based on the security check result, and the security measures include current limiting, service interruption or service maintenance.

[0043] The encryption characteristics include encryption method, encryption length, and estimated decryption time.

[0044] The large model based on network security includes a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder, and a traffic threshold interception module;

[0045] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0046] If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check;

[0047] Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0048] The solution of the present invention can utilize the existing large model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the deceptive data of the client, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services.

[0049] Further advantages of the present invention will be further reflected in detail in the specific embodiments section in conjunction with the drawings of the specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1 A schematic diagram of a specific scenario in which an embodiment of the present invention is applied

[0052] Figure 2 This is a schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to an embodiment of the present invention.

[0053] Figure 3 This is a schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to another embodiment of the present invention.

[0054] Figure 4 This is a schematic diagram of the functional modules of a traffic data statistical analysis system based on a large model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0055] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments that are the same as the present application. Instead, they are only examples of devices and methods that are the same as some aspects of the present application as detailed in the attached claims.

[0056] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0057] At the same time, in the specific implementation of this application, if user-related data is involved, when the embodiment of this application is applied to a specific product or technology, the user's permission or consent must be obtained, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0058] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0059] See also Figure 1 , Figure 1 A schematic diagram showing a specific scenario in which an embodiment of the present invention is applied.

[0060] exist Figure 1 In the figure, multiple clients are shown, including mobile clients, desktop clients and other types of user clients, including virtual machines, servers, physical hosts, etc. The multiple clients communicate remotely with the cloud computing environment, and when the user makes a request, the corresponding resource support is obtained from the cloud server to complete the corresponding task operation.

[0061] As an example, the current user's client needs to carry out software development and code editing, so an integrated development environment IDE application is needed. Its functions are generally divided into two parts: project management and code editing. Among them, project management includes functions such as project creation, opening, closing, compiling and packaging, and code editing includes functions such as text editing, code auto-completion and code highlighting. IDE integrates multiple functions in the software development process, which can enable developers to develop software more quickly and conveniently.

[0062] However, the construction of traditional IDE development tools often requires a lot of manpower and material resources. With the continuous development of cloud technology, more and more cloud platform companies have begun to migrate IDE tools to the cloud and provide web versions of IDE for users to use, so that users can develop software directly on the web page without installing any applications. The WebIDE system mainly includes a client and a backend cloud server. Users access the cloud server through the web page on the client. The server dispatches the corresponding request resources according to the user's request and returns the corresponding cloud server and page.

[0063] For the convenience of description, multiple user clients are referred to as N request clients {R1, R2, …, R N}, the N request clients {R1, R2, ..., R N}Remote communication with cloud servers;

[0064] Take a client R i For example, a client R i Sending a client request to the cloud server, wherein the client request is used to schedule a request resource to the cloud server; the request resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i=1, 2, ..., N;

[0065] Taking the aforementioned IDE development product as an example, after the background IDE cloud server receives the target user's initialization page access request sent by the client, under normal circumstances, it allocates a target container to the target user through the container platform to process the target user's code editing request. In this way, each user can be assigned to an independent background server, which can alleviate the problem of resource preemption, reduce lag, and improve user safety.

[0066] However, in actual applications, due to the openness of cloud resources (especially for public clouds), malicious network attacks, abnormal traffic attacks, and disguised request data can also disguise themselves as normal clients to issue resource requests, causing impact on normal resource services in the cloud.

[0067] In the prior art, the network traffic anomaly detection technology mentioned in the above background technology can be used to determine the abnormal traffic instances and timely discover the attack behaviors in the network.

[0068] However, with the emergence of new network environments such as cloud computing, the Internet of Things, and edge computing, network attacks, traffic attacks, and disguised request data are no longer characterized by "peak traffic", but are usually manifested as low-rate attacks. They generate low-rate attack traffic that can be hidden in normal transmission control protocols, and use the adaptive mechanism of network protocols to cause false congestion in the network, damaging the connection quality between the client and the server, making it impossible for the server to provide normal services to users. Such attacks are more covert and difficult to detect because they use low-rate attack traffic, which is enough to occupy the key resources of the target system, but not enough to trigger traditional abnormal traffic detection mechanisms; especially in a cloud computing environment, if such attack ends are hidden in multiple client clusters, they will take advantage of the characteristics of shared resources in the cloud computing environment and affect multiple tenants or users by occupying shared resources, resulting in significant delays and blockages in cloud resource services.

[0069] to this end, Figure 1The technical solution introduces a big model based on network security as an auxiliary. After statistical analysis of the traffic data in the above situation, the resources to be counted and the clients to be checked are identified, and then corresponding security measures are taken. The existing big model based on network security is used to identify network fraud, malicious traffic, and disguised attack data streams based on the deceptive data of the client, thereby improving the value of the statistical results of the traffic data analysis and avoiding delays and blockages in cloud resource services.

[0070] Before introducing the subsequent specific embodiments of the present invention, the meaning of the large model based on network security in the embodiments of the present invention is first introduced.

[0071] First of all, it should be made clear that the "big model based on network security" in the embodiment of the present invention itself is not the area that needs to be improved in the technical solution of the present invention. From the subsequent embodiments, it can be seen that the focus of the technical solution of the present invention is how to specifically identify the resources to be counted and the clients to be checked, and then use the existing big model based on network security to perform corresponding troubleshooting operations.

[0072] In this field (computer network security related fields), there are many existing (open source or commercial) network security models. Table 1 lists the names and principles of some of the large models based on network security as follows:

[0073] Table 1

[0074]

[0075] Preferably, the large model based on network security described in the present application includes a deep learning module and a traffic threshold interception module.

[0076] The deep learning module uses the basic data of threat intelligence and abnormal traffic monitoring as text features, and completes threat intelligence sharing and abnormal traffic discovery based on the semantic analysis capabilities of the large model. In addition, by pre-training on a large-scale code base, the large model can learn common code structures and patterns such as code grammar rules, naming conventions, and function calls. Most of the malware and vulnerability exploits commonly used in APT attacks rely on code writing, so the large model can be used to identify common code structures, design patterns, vulnerability patterns, etc. and associate them with existing knowledge, so that when encountering similar code structures, it can quickly understand their meaning and discover possible security issues;

[0077] In addition, the deep learning module can also integrate the stacked integrated adversarial defense method of the encrypted malicious traffic detection model.

[0078] The traffic threshold interception module, on the one hand, detects data attacks through traffic anomalies based on existing technologies (such as the network traffic anomaly detection technology mentioned in the background technology); on the other hand, it identifies the abnormal features in the time domain and frequency domain of low-rate attack traffic hidden in the normal transmission control protocol disguised as a low-rate attack, and then classifies and detects it through the improved Stacking algorithm. It can accurately learn the abnormal features and thus has the ability to detect traffic containing low-rate attacks.

[0079] For a detailed introduction to the above-mentioned large model based on network security, please refer to the prior art. This embodiment will not be specifically expanded on this. The following prior art can be used as a reference:

[0080] [1] Chen Ruilong, Hu Tao, Bu Youjun, et al. Stacked integrated adversarial defense method for encrypted malicious traffic detection model [J / OL]. Computer Applications, 1-12.

[0081] [2]A static mechanism based on behavioral analysis is forDDoS attack countermeasure.I EEE Transactions on Information Forensics andSecurity,2022,17:2732;

[0082] [3]Sequence alignment detection of TCP-targeted synchronous low-rate DoS attacks. Computer Networks, 2019, 152: 64

[0083] [4] Low-rate denial of service attack detection method based on TCP time-frequency domain characteristics[J]. Journal of Sichuan University (Natural Science Edition), 2024, 61(03): 178-187.

[0084] Although the above-mentioned prior art has proposed various large models based on network security, their applications are all for single or small number of client environments. However, in a cloud computing environment, the number of access clients is usually hundreds, thousands or even tens of thousands, and the number during peak concurrent periods will be even higher. At this time, if the above-mentioned various large models based on network security are used to perform abnormal fluency detection for all access clients without distinction, it will affect the normal service of the cloud.

[0085] For this purpose, see first Figure 2 Embodiment of the invention. Figure 2A schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to an embodiment of the present invention is shown. The method is applied to a cloud server, and the cloud server is connected to N clients {R1, R2, ..., R N}Remote communication, N>1;

[0086] The method comprises the following steps:

[0087] S100: Get client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource;

[0088] S200: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted;

[0089] S300: Analyze the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period;

[0090] S400: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients exceeding the predetermined ratio;

[0091] S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests from each of the clients exceeding the predetermined proportion, and the security measures include current limiting, interrupting service, or maintaining service.

[0092] The requested resource in step S100 includes a combination of at least two of the following resources:

[0093] CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

[0094] Furthermore, in the aforementioned IDE example, the requested resource also includes a target container allocation request.

[0095] The client sends a container allocation request to the container platform of the cloud server, wherein the container allocation request is used to request the container platform to allocate a target container to a target user of the client.

[0096] Preferably, the predetermined ratio T≥50%.

[0097] In step S200, if more than half When the resource sets currently requested by the clients all contain at least one commonly requested resource, the commonly requested resource is used as the resource to be counted;

[0098] For example, when N=500, if the requested resources received from more than 250 clients all include GPU resources and upload channel resources, {GPU resources, upload channel resources} are taken as the resources to be counted;

[0099] The step S300 specifically includes:

[0100] For each resource to be counted, perform the following analysis process:

[0101] S301: Determine whether the client request for the resource to be counted is encrypted;

[0102] If yes, proceed to step S303, otherwise, proceed to step S302;

[0103] S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period;

[0104] S303: Obtaining traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period;

[0105] In this step, if the client request for the resource to be counted is not encrypted, there is no need to call the stacked integrated adversarial defense method of the encrypted malicious traffic detection model integrated in the deep learning module. The next security investigation process can be directly entered based on the existing traffic transmission characteristics and network text characteristics.

[0106] Specifically, traffic transmission characteristics are characterized by the abnormal characteristics of low-rate attack traffic in the time domain and frequency domain within a preset time period; network text characteristics are the characteristics used by content-based anomaly detection methods, including code structure, design patterns, vulnerability patterns, etc.

[0107] On the other hand, if the client request for the resource to be counted is encrypted, it is necessary to call the stacked integrated adversarial defense method of the encrypted malicious traffic detection model integrated in the deep learning module, and the encryption features here include encryption method, encryption length and / or estimated decryption time. The encryption method refers to the encryption method used for the resource request message, such as HASH encryption, character encryption, etc.; the encryption length refers to the number of encryption bits used by the encryption method, such as 64-bit encryption, 256-bit encryption; the estimated decryption time refers to the time required to decrypt the message without a key. In practical applications, commonly used encryption features include encryption method and encryption length. The embodiments of the present application also use encryption method and encryption length as preliminary sample features for model training.

[0108] At this time, the traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period are obtained.

[0109] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0110] SS501: Determine whether the data input of the large model includes the encryption feature,

[0111] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check; if no, proceed to step SS502;

[0112] The deep learning module integrating convolutional neural network, recurrent neural network and encoder can be found in the aforementioned prior art literature [1].

[0113] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0114] The specific implementation method of the traffic threshold interception module here can be found in the aforementioned documents [2]-[4].

[0115] Next, the traffic transmission characteristics, network text characteristics, and / or encryption characteristics are used as data inputs of a large model based on network security, and the large model based on network security outputs a security investigation result for each of the clients that exceeds the predetermined proportion; based on the security investigation result, the cloud server executes security measures for subsequent resource requests of each of the clients that exceeds the predetermined proportion, and the security measures include current limiting, interrupting service, or maintaining service.

[0116] It can be seen that in the above process, it is not necessary to target all N clients {R1, R2, …, R N} for investigation (because in actual situation the resources requested by N clients are different), but once the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource will be taken as the resource to be counted. This will identify the disguised low-speed attack data stream to the greatest extent, thereby improving the value of the statistical results of the traffic data analysis and avoiding delays and blockages in cloud resource services.

[0117] Of course, the setting of the predetermined ratio T also determines that the number of clients checked in the above process is reduced to a limited extent.

[0118] To further reduce the number of checks while ensuring complete accuracy, Figure 2 The method is further improved as follows:

[0119] After step S300 and before step S400, the method further includes:

[0120] S310: When it is identified that the traffic transmission feature, network text feature, and / or encryption feature of a certain client within a preset time period are abnormal, the client is treated as a client to be checked;

[0121] At this time, the step S400 is correspondingly modified as follows:

[0122] S400: Using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, the large model based on network security outputs a security screening result for each of the clients to be screened;

[0123] Step S500 is modified accordingly as follows:

[0124] S500: Based on the security screening result, the cloud server executes security measures for subsequent resource requests of each of the clients to be screened, and the security measures include current limiting, interrupting service, or maintaining service.

[0125] Figure 3 A schematic diagram of the main flow of a traffic data statistical analysis method based on a large model according to another embodiment of the present invention is shown. Figure 3 The method is applied to N request clients {R1, R2, ..., R N}, the N request clients {R1, R2, ..., R N} remotely communicate with a cloud server, the method comprising the following steps:

[0126] SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a request resource to the cloud server; the request resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i=1, 2, ..., N;

[0127] SS200: The cloud server counts each client R i The resource set S currently requested i ;

[0128] SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked;

[0129] SS400: the cloud server analyzes the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resources to be counted within a preset time period;

[0130] SS500: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients to be screened;

[0131] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, and the security measures include current limiting, service interruption or service maintenance.

[0132] The encryption characteristics in step SS400 include encryption method, encryption length, and estimated decryption time;

[0133] The large model based on network security in step SS500 outputs a security check result for each of the clients to be checked, specifically including:

[0134] SS501: Determine whether the data input of the large model includes the encryption feature,

[0135] If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check; if no, proceed to step SS502;

[0136] SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0137] and Figure 2 Corresponding to the improved method of steps S300-500, Figure 3 In the embodiment, steps SS300-SS600 are improved as follows:

[0138] SS300: When the resource sets currently requested by clients exceeding a predetermined ratio T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted;

[0139] SS400: the cloud server analyzes the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resources to be counted within a preset time period;

[0140] When it is identified that the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of a certain client within a preset time period are abnormal, the client is regarded as a client to be checked;

[0141] SS500: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients to be screened;

[0142] SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, and the security measures include current limiting, service interruption or service maintenance.

[0143] Based on the method embodiment, further introduction Figure 4 The system embodiment is as follows: Figure 4 The present invention is a schematic diagram of the functional modules of a traffic data statistical analysis system based on a large model according to an embodiment of the present invention.

[0144] exist Figure 4 In the system, the system includes a client request acquisition unit, a resource identification unit to be counted, a feature acquisition unit, a security investigation unit, a security measure execution unit and a cloud server, and the cloud server is connected to a large model based on network security;

[0145] The client request acquisition unit is used to obtain the client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; N>1;

[0146] The resource identification unit to be counted is used to count each client R i The resource set S currently requested i ; When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted;

[0147] The feature acquisition unit is used to acquire the traffic transmission feature, network text feature, and / or encryption feature of the resource to be counted within a preset time period;

[0148] The security investigation unit is used to use the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security investigation result for each of the clients to be investigated;

[0149] The security measure execution unit is used to execute security measures for subsequent resource requests of each of the clients to be checked based on the security check result, and the security measures include current limiting, service interruption or service maintenance.

[0150] The encryption characteristics include encryption method, encryption length, and estimated decryption time.

[0151] The large model based on network security includes a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder, and a traffic threshold interception module;

[0152] The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including:

[0153] If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check;

[0154] Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

[0155] In one embodiment, the to-be-counted resource identification unit takes the clients exceeding the predetermined ratio T as the to-be-checked clients;

[0156] In another embodiment, when the feature acquisition unit obtains abnormalities in the traffic transmission features, network text features, and / or encryption features of a certain client within a preset time period, the client is treated as a client to be checked.

[0157] After the security check, taking the aforementioned user terminal requesting the IDE service as an example, if the security measure for a client to be checked is to maintain the service, the IDE server allocates a container to the user upon receiving the user's initialization page access request to process the user's page access request;

[0158] In order to further improve the rationality of resource allocation, in this embodiment, multiple users can share a background server to process project management requests, and each user processes code editing requests through the container assigned to it, that is, the IDE server can serve as a background server for project management to process the user's project management requests; the container assigned to the user is specifically used to process the user's code editing request.

[0159] If the security measure for a client to be checked is to interrupt the service, the server will feedback to the user that there is an abnormality after receiving the initial page access request, and the user is required to send a resource request again and carry more user login information (such as account + password + host ID, etc.) in the resource request for secondary identity authentication;

[0160] If the security measure for a client to be checked is a flow-limiting service, the server will feedback to the user that flow-limiting exists after receiving the initialization page access request;

[0161] At this time, if the user's resource request itself includes a resource application amount D, the resource application amount D is multiplied by the predetermined ratio T as the resource allocation amount, and the container platform server temporarily creates a container as the target container according to the resource allocation amount and sends it to the user client;

[0162] If the user's resource request itself does not include the resource application amount D, the container platform server will temporarily create a basic container as the target container and send it to the user client when there are idle container resources. The resource amount of the basic container is equal to the system default basic value.

[0163] The solution of the present invention can utilize the existing large model based on network security to identify network fraud, malicious traffic and disguised attack data streams for the deceptive data of the client, thereby improving the value of the statistical results of traffic data analysis and avoiding delays and blockages in cloud resource services; especially for multi-user requests in an IDE environment, the above solution can also alleviate the problem of resource preemption, reduce jamming, and improve the security of use by legitimate users.

[0164] The present invention provides multiple embodiments, each of which can constitute an independent technical solution and may contribute to the prior art and solve corresponding technical problems. However, it should be pointed out that different embodiments can be combined with each other without violating logic; at the same time, each embodiment can solve at least one technical problem, but it is not required that each individual embodiment solves multiple or all technical problems.

[0165] For other technologies, principles, algorithms or models not elaborated in detail in this application, please refer to the prior art.

[0166] The foregoing has shown and described the method embodiments and system of the present invention, but it is understandable to those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the present invention, and the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A traffic data statistical analysis method based on a large model, the method is applied to a cloud server, the cloud server and N clients {R1, R2, ..., R N }Remote communication, N>1; It is characterized in that The method comprises the following steps: S100: Get client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; S200: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; S300: Analyze the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resource to be counted within a preset time period; S400: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients exceeding the predetermined ratio; S500: Based on the security check result, the cloud server executes security measures for subsequent resource requests from each of the clients exceeding the predetermined proportion, and the security measures include current limiting, interrupting service, or maintaining service.

2. A traffic data statistical analysis method based on a large model as claimed in claim 1, characterized in that: The requested resource in step S100 includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources.

3. A traffic data statistical analysis method based on a large model as claimed in claim 1, characterized in that: The predetermined ratio T≥50%.

4. The method for statistical analysis of traffic data based on a large model as claimed in claim 1, characterized in that: The step S300 specifically includes: For each resource to be counted, perform the following analysis process: S301: Determine whether the client request for the resource to be counted is encrypted; If yes, proceed to step S303, otherwise, proceed to step S302; S302: Obtaining traffic transmission characteristics and network text characteristics of the resource to be counted within a preset time period; S303: Obtain traffic transmission characteristics and encryption characteristics of the resource to be counted within a preset time period.

5. A traffic data statistical analysis method based on a large model, the method is applied to N request clients {R1, R2, ..., R N }, the N request clients {R1, R2, ..., R N }Remote communication with cloud server, characterized in that, The method comprises the following steps: SS100: Client R i Sending a client request to the cloud server, wherein the client request is used to schedule a request resource to the cloud server; the request resource includes a combination of at least two of the following resources: CPU resources, GPU resources, memory resources, storage resources, upload channel resources, and download channel resources; i=1, 2, ..., N; SS200: The cloud server counts each client R i The resource set S currently requested i ; SS300: When the resource sets currently requested by clients exceeding a predetermined proportion T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted, and the clients exceeding the predetermined proportion T are used as clients to be checked; SS400: the cloud server analyzes the traffic transmission characteristics, network text characteristics, and / or encryption characteristics of the resources to be counted within a preset time period; SS500: using the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, and the large model based on network security outputs a security screening result for each of the clients to be screened; SS600: Based on the security check result, the cloud server executes security measures for subsequent resource requests of each of the clients to be checked, and the security measures include current limiting, service interruption or service maintenance.

6. A traffic data statistical analysis method based on a large model as claimed in claim 5, characterized in that: The encryption characteristics in step SS400 include encryption method, encryption length and / or estimated decryption time; The large model based on network security in step SS500 outputs a security check result for each of the clients to be checked, specifically including: SS501: Determine whether the data input of the large model includes the encryption feature, If yes, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check; if no, proceed to step SS502; SS502: The large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

7. A traffic data statistical analysis system based on a large model, the system comprising a cloud server, the cloud server connected to a large model based on network security, characterized in that: The system further comprises: The client request acquisition unit is used to obtain the client R i The resource set S currently requested i , i=1,2,…,N; resource set S i Contains at least one requested resource; N>1; The resource identification unit to be counted is used to count each client R i The resource set S currently requested i ; When the resource sets currently requested by clients exceeding a predetermined ratio T all contain at least one commonly requested resource, the commonly requested resource is used as a resource to be counted; the clients exceeding the predetermined ratio T are used as clients to be checked; A feature acquisition unit, used to acquire traffic transmission features, network text features, and / or encryption features of the resource to be counted within a preset time period; A security investigation unit, configured to use the traffic transmission feature, network text feature, and / or encryption feature as data input of a large model based on network security, wherein the large model based on network security outputs a security investigation result for each of the clients to be investigated; A security measure execution unit is used to execute security measures on the subsequent resource requests of each of the clients to be checked based on the security check result, wherein the security measures include current limiting, interrupting service or maintaining service.

8. A traffic data statistical analysis system based on a large model as claimed in claim 7, characterized in that: The encryption characteristics include encryption method, encryption length, and estimated decryption time.

9. A traffic data statistical analysis system based on a large model as claimed in claim 8, characterized in that: The large model based on network security includes a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder, and a traffic threshold interception module; The network security-based large model outputs a security screening result for each of the clients to be screened, specifically including: If the data input of the large model includes the encryption feature, the large model calls a deep learning module integrating a convolutional neural network, a recurrent neural network and an encoder to perform the security check; Otherwise, the large model calls the traffic threshold interception module to perform the security check based on the traffic transmission characteristics and network text characteristics.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, it is used to implement a traffic data statistical analysis method based on a large model as described in any one of claims 1-4 or 5-6 above.

Images