Abnormality detection method, electronic equipment, readable storage medium and computer product

Abstract

The invention provides an anomaly detection method, electronic equipment, a readable storage medium and a computer product, and relates to the technical field of intrusion detection. The method comprises the following steps: analyzing flow data of a network element to be detected to obtain a sequence to be detected; performing anomaly detection on each to-be-detected sequence through a state machine or an incomplete detection model to obtain an anomaly score; and determining a detection result of the to-be-detected network element according to an abnormal value obtained by integrating the plurality of abnormal scores and a preset abnormal threshold value. According to the method and the device, a plurality of to-be-detected sequences contained in the network element can be detected, and a proper state machine or an incomplete detection model can be selected for corresponding processing according to the integrity condition of the to-be-detected sequences, so that the abnormal score representing the probability of the abnormal condition is obtained; therefore, the final detection result of the to-be-detected network element is determined according to the abnormal value obtained by integrating the plurality of abnormal scores and the preset abnormal threshold value, the effectiveness and accuracy of abnormal detection are effectively improved, and the detection cost required by detection is reduced.

Description

Technical Field

[0001] The present application relates to the field of intrusion detection technology, and in particular to an anomaly detection method, an electronic device, a readable storage medium, and a computer product. Background Art

[0002] The security detection methods of 5G networks usually include methods based on traffic feature matching, behavior feature analysis, and probability statistical analysis. For example, in the detection of abnormal identity terminals, the signaling content in the N2 interface is parsed. When the signaling is a failure message and the signaling process is registration and the failure reason value is an illegal UE or illegal ME, it is determined to be an illegal terminal. When the password is brute-force cracked, a large number of user-initiated verification signaling can be found in the network.

[0003] Among the various existing anomaly detection methods, the detection method based on feature matching can only detect known attacks, the method based on behavioral feature analysis has a low detection rate for some hidden behaviors of attackers, such as forged signaling, etc., the overhead based on probability statistical analysis is large, and the false alarm rate is high when there is a deviation between the actual data and the sample. Therefore, the accuracy of anomaly detection during communication is low and the detection cost is high, which cannot meet the current anomaly detection needs. Summary of the invention

[0004] In view of this, the purpose of the embodiments of the present application is to provide an anomaly detection method, an electronic device, a readable storage medium and a computer product to improve the problems of low accuracy and high detection cost of anomaly detection in the prior art.

[0005] In order to solve the above problems, in a first aspect, an embodiment of the present application provides an abnormality detection method, the method comprising:

[0006] Analyze and process the flow data of the network element to be tested to obtain the sequence to be tested;

[0007] Performing anomaly detection on each of the sequences to be tested by using a state machine or an incomplete detection model to obtain an anomaly score;

[0008] The detection result of the network element to be tested is determined according to an abnormal value obtained by integrating the multiple abnormal scores and a preset abnormal threshold.

[0009] In the above implementation process, the flow data of the network element to be tested can be parsed and processed to obtain multiple sequences to be tested, and each sequence to be tested can be detected for anomalies through a state machine or an incomplete detection model to obtain an abnormality score that characterizes the abnormal situation of each abnormal sequence, and then the multiple abnormal scores are integrated and processed to obtain the abnormal value of the network element to be tested as a whole, so as to determine the detection result of the network element to be tested as a whole by the difference between the preset abnormal threshold and the abnormal value. It is possible to perform anomaly detection on each sequence, and to perform integrated detection in combination with the abnormal scores of multiple sequences to be tested, which effectively reduces the unfavorable situations such as false alarms caused by determining the probability detection results based on a single sequence, and selects a suitable state machine or incomplete detection model for real-time detection according to the actual situation of the sequence to be tested, which effectively reduces the detection cost, and can perform targeted detection on different sequences to be tested, thereby improving the accuracy of anomaly detection, and is suitable for a variety of different network communication scenarios, meeting the anomaly detection needs in a variety of different scenarios.

[0010] Optionally, performing anomaly detection on each of the sequences to be tested by a state machine or an incomplete detection model to obtain an anomaly score includes:

[0011] Determining the signaling integrity of the sequence to be tested;

[0012] If it is determined that the signaling integrity status indicates that the signaling of the sequence to be tested is complete, an abnormality detection is performed on the sequence to be tested by the state machine to obtain the abnormality score;

[0013] If it is determined that the signaling completeness indicates that the signaling of the sequence to be tested is incomplete, an abnormality detection is performed on the sequence to be tested using the incomplete detection model to obtain the abnormality score.

[0014] In the above implementation process, the signaling completeness in the sequence to be tested can be determined according to the analysis and processing of the traffic data, so as to select an appropriate method to perform abnormal detection on the sequence to be tested according to the signaling completeness. When the signaling completeness indicates that the signaling of the sequence to be tested is complete, the information of the sequence to be tested is complete and continuous, and there is no signaling loss. A state machine with low detection overhead and high detection accuracy can be used to perform abnormal detection on the sequence to be tested, and a corresponding abnormal score can be obtained. When the signaling completeness indicates that the signaling of the sequence to be tested is incomplete, the information of the sequence to be tested is missing, discontinuous, and there is a signaling loss. Considering the difference between complete information and incomplete information, a pre-trained incomplete detection model can be used to perform abnormal detection on the sequence to be tested, and a corresponding abnormal score can be obtained. It is possible to select a corresponding state machine or incomplete detection model to perform abnormal detection on the sequence to be tested according to the signaling completeness of the sequence to be tested, while improving the accuracy of abnormal detection, effectively reducing the computational cost required for detection.

[0015] Optionally, performing anomaly detection on the sequence to be tested by the state machine to obtain the anomaly score includes:

[0016] Analyze the target protocol of the sequence to be tested by learning the model to obtain the corresponding state machine;

[0017] Each signaling in the sequence to be tested is received and processed by the state machine to obtain a detection state of each signaling; wherein the detection state includes: a failure state, a success state and an illegal state;

[0018] When the detection state is the illegal state, determining the abnormal score to be the abnormal threshold;

[0019] When the number of failure states within the target time period is greater than an upper limit, determining the abnormal score based on the historical failure situations of the state machine;

[0020] In the case where all the detection states are successful states, or the number of failure states within the target time period is less than or equal to the upper limit number, the abnormal score is determined to be a non-abnormal value.

[0021] In the above implementation process, the target protocol of the sequence to be tested can be analyzed according to the learning model first, so as to output the corresponding state machine to detect and process the sequence to be tested. During the processing, the state machine can receive and process each signaling in the sequence to be tested, obtain the detection state of each signaling, and determine the corresponding abnormal score based on multiple detection states. When a certain detection state is an illegal state, it indicates that the corresponding signaling is an illegal attack signaling, and the abnormal threshold can be directly output as the corresponding abnormal score. In a short time, that is, when the number of failure states in the target time period is greater than the upper limit, it indicates that the failure state is too frequent in a short time, and there may be abnormal situations. The corresponding abnormal score can be determined according to the historical failure of the state machine. When all detection states are successful states, it indicates that each signaling state is normal, or when the number of failure states in the target time period is less than or equal to the upper limit, it indicates that there is a normal failure in the interaction, that is, the probability of signaling abnormality is low, and the non-abnormal value can be directly output as the abnormal score. It is possible to perform abnormal detection on each signaling in the sequence to be tested through the state machine of the corresponding protocol, which effectively improves the accuracy of abnormal detection and reduces the computational cost required for abnormal detection.

[0022] Optionally, performing anomaly detection on the sequence to be tested by using the incomplete detection model to obtain the anomaly score includes:

[0023] Determining the number of signaling losses in the sequence to be tested;

[0024] Determine a target model from the plurality of incomplete detection models according to the number of losses, and perform anomaly detection on the sequence to be tested by using the target model to obtain a probability detection result;

[0025] In the case where the probability detection result indicates that the sequence to be tested is abnormal, determining the abnormality score based on the number of losses;

[0026] When the probability detection result indicates that the sequence to be tested is normal, the abnormal score is determined to be a non-abnormal value.

[0027] In the above implementation process, when the information of the sequence to be tested is missing or discontinuous, due to the different number of lost signaling, each corresponding incomplete situation is also different. Therefore, multiple incomplete detection models for different incomplete situations can be pre-trained. In order to carry out targeted processing for different types of incomplete situations, the number of signaling losses in the sequence to be tested can be determined according to the analytical processing of the traffic data, so as to determine the corresponding target model in multiple incomplete detection models according to the actual number of losses, so as to perform abnormal detection on the sequence to be tested according to the target model, and obtain the corresponding probability detection result. In the case where the probability detection result represents the abnormality of the sequence to be tested, considering the correlation between the number of signaling losses and the abnormal situation, the abnormal score representing the abnormal situation of the sequence to be tested can be determined according to the number of losses. In the case where the probability detection result represents that the sequence to be tested is normal, the signaling loss is just the normal situation of not capturing the signaling, and the non-abnormal value can be directly used as the abnormal score. It is possible to select a suitable incomplete detection model for abnormal detection and determine the corresponding abnormal score according to the actual situation of the number of losses, which effectively improves the accuracy and effectiveness of abnormal detection for different incomplete situations.

[0028] Optionally, performing anomaly detection on the sequence to be tested by using the target model to obtain a probability detection result includes:

[0029] Calculating the occurrence probability value of the signaling in the sequence to be tested by using the target model;

[0030] If it is determined that the occurrence probability value is less than the minimum probability threshold in the target model, determining that the probability detection result of the sequence to be tested is abnormal;

[0031] If it is determined that the occurrence probability value is greater than or equal to the minimum probability threshold, then it is determined that the probability detection result of the sequence to be tested is normal.

[0032] In the above implementation process, the occurrence probability value of the signaling in the sequence to be tested can be calculated according to the selected target model to compare the occurrence probability value with the minimum probability threshold in the target model. When the occurrence probability value is less than the minimum probability threshold, it indicates that the probability of the signaling in the sequence to be tested is too low, and there may be an abnormality. The corresponding probability detection result of the sequence to be tested is abnormal. When the occurrence probability value is greater than or equal to the minimum probability threshold, it indicates that the probability of the signaling in the sequence to be tested is normal, and the corresponding abnormality detection of the sequence to be tested is normal. The ability to perform abnormality detection on the sequence to be tested according to the occurrence probability value of the signaling effectively improves the effectiveness and accuracy of abnormality detection by the target model.

[0033] Optionally, the flow data of the network element to be tested is parsed and processed to obtain a sequence to be tested, including:

[0034] Collecting the flow data of the network element to be tested in the target interface;

[0035] Performing protocol identification on the traffic data to obtain a target protocol;

[0036] Parsing is performed based on the target protocol to obtain a plurality of sequences to be tested corresponding to a plurality of dialogues; wherein each sequence to be tested includes a plurality of signalings.

[0037] In the above implementation process, the flow data of the network element to be tested in the target interface can be collected first to perform real-time anomaly detection on the network element to be tested. Taking into account the different types of application layer network protocols used by different interfaces and network elements in communication scenarios, in order to perform targeted anomaly detection, the flow data can be identified by protocol to obtain the target protocol used by the network element to be tested, and the target protocol can be parsed to obtain multiple test sequences containing signaling corresponding to multiple conversations. The ability to collect data, identify protocols and parse and process before anomaly detection effectively improves the effectiveness of the sequence to be tested.

[0038] Optionally, the incomplete detection model is determined by:

[0039] Determine the length of the division sequence based on different types of application protocols;

[0040] Determine a plurality of training sets and test sets that discard 1 to n signalings; wherein the maximum signaling length of the sequence is m, and n=m-1;

[0041] The probability model is trained based on the training set, the test set and the divided sequence length to obtain a plurality of the incomplete detection models.

[0042] In the above implementation process, considering the influence of different numbers of signaling loss on the probability of signaling occurrence, in order to perform targeted detection on the sequences to be tested with different numbers of loss, multiple different incomplete detection models can be pre-trained. The length of the divided sequence during detection can be determined according to different types of application protocols, so that the incomplete detection model can detect network elements of different application protocols. In addition, multiple training sets and test sets with 1 to n signaling discarded can be set to bring the training sets and test sets, as well as the length of the divided sequence, into the probability model for training, so as to train and test the incomplete situations with different numbers of loss, and obtain multiple incomplete detection models. It is possible to simulate different signaling loss situations to train multiple different incomplete detection models, so as to perform effective anomaly detection on multiple sequences to be tested with different numbers of loss, effectively improving the effectiveness and pertinence of anomaly detection on incomplete sequences to be tested.

[0043] Optionally, the abnormal threshold is a value obtained by normalizing historical abnormal data;

[0044] The step of determining the detection result of the network element to be tested based on an abnormal value obtained by integrating the plurality of abnormal scores and a preset abnormal threshold value comprises:

[0045] Determine anomaly scores corresponding to a plurality of the sequences to be tested within a target period;

[0046] Performing cumulative processing based on a plurality of the abnormal scores to obtain the abnormal value;

[0047] If it is determined that the abnormal value is greater than or equal to the preset abnormal threshold, determining that the detection result of the network element to be tested is abnormal;

[0048] If it is determined that the abnormal value is smaller than the abnormal threshold, it is determined that the detection result of the network element to be tested is normal.

[0049] In the above implementation process, in order to improve the timeliness of the abnormal value, the abnormal scores of multiple sequences to be tested within the target period can be accumulated to obtain an abnormal value with timeliness, thereby reducing the adverse effect of historical data that is too old on abnormal detection. The abnormal value is compared with the abnormal threshold obtained by normalizing the historical abnormal data. The abnormal threshold is a numerical value that characterizes the occurrence of an abnormal situation. When the abnormal value is greater than or equal to the abnormal threshold, the numerical value of the abnormal value is greater than the numerical value of the abnormal situation, and the probability of the network element to be tested having an abnormal situation is greater. The detection result of the network element to be tested is determined to be abnormal. When the abnormal value is less than the abnormal threshold, the numerical value of the abnormal value is less than the numerical value of the abnormal situation, and the probability of the network element to be tested having an abnormal situation is smaller, and the detection result of the network element to be tested is determined to be normal. The occurrence of an abnormal situation is characterized by a numerical value, and the detection result of the network element to be tested is determined by comparing the size of the numerical value, which effectively reduces the adverse situation of abnormal false alarms and improves the effectiveness and accuracy of the detection results.

[0050] In a second aspect, an embodiment of the present application further provides an anomaly detection device, the device comprising: an analysis module, a detection module and a result module;

[0051] The analysis module is used to analyze the flow data of the network element to be tested to obtain a sequence to be tested;

[0052] The detection module is used to perform anomaly detection on each of the sequences to be tested through a state machine or an incomplete detection model to obtain an anomaly score;

[0053] The result module is used to determine the detection result of the network element to be tested according to an abnormal value obtained by integrating a plurality of the abnormal scores and a preset abnormal threshold.

[0054] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores program instructions, and when the processor reads and runs the program instructions, it executes the steps in any implementation of the above-mentioned abnormality detection method.

[0055] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the steps in any implementation of the above-mentioned anomaly detection method are executed.

[0056] In a fifth aspect, an embodiment of the present application further provides a computer program product, which includes a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps in any one of the methods described in the anomaly detection method are implemented.

[0057] In summary, the embodiments of the present application provide a common detection method, an electronic device, a readable storage medium and a computer product, which can detect multiple sequences to be tested contained in a network element, and can also select a suitable state machine or an incomplete detection model for corresponding processing based on the completeness of the sequence to be tested, so as to obtain an abnormal score that characterizes the probability of an abnormal situation, thereby determining the final detection result of the network element to be tested based on the abnormal value obtained by integrating multiple abnormal scores and a preset abnormal threshold, thereby effectively improving the effectiveness and accuracy of abnormal detection and reducing the detection cost required for detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A block diagram of an electronic device provided in an embodiment of the present application;

[0060] Figure 2 A flowchart of an anomaly detection method provided in an embodiment of the present application;

[0061] Figure 3 A detailed flowchart of step S300 provided in an embodiment of the present application;

[0062] Figure 4 A detailed flow chart of step S320 provided in an embodiment of the present application;

[0063] Figure 5 A detailed flowchart of step S330 provided in an embodiment of the present application;

[0064] Figure 6 A detailed flow chart of step S332 provided in an embodiment of the present application;

[0065] Figure 7 A detailed flow chart of step S200 provided in an embodiment of the present application;

[0066] Figure 8 A flowchart of another anomaly detection method provided in an embodiment of the present application;

[0067] Fig. 9 A detailed flowchart of step S400 provided in an embodiment of the present application;

[0068] Fig.10A schematic diagram of the structure of an anomaly detection device provided in an embodiment of the present application.

[0069] Icons: 100 - electronic device; 111 - memory; 112 - storage controller; 113 - processor; 114 - peripheral interface; 115 - input and output unit; 116 - display unit; 600 - abnormality detection device; 610 - analysis module; 620 - detection module; 630 - result module. DETAILED DESCRIPTION

[0070] The technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments of the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the embodiments of the present application.

[0071] In the related technologies, security detection is usually carried out based on traffic feature matching, behavior feature analysis and probability statistical analysis. However, among the existing anomaly detection methods, the detection method based on feature matching can only detect known attacks, and the method based on behavior feature analysis has a low detection rate for some hidden behaviors of attackers, such as forged signaling, etc. The probability statistical analysis has a large overhead, and the false alarm rate is high when the actual data deviates from the sample. Therefore, the accuracy of anomaly detection during communication is low and the detection cost is high, which cannot meet the current anomaly detection needs.

[0072] In order to solve the above problems, an embodiment of the present application provides an anomaly detection method, which is applied to electronic devices with logical computing functions such as servers, personal computers (PCs), tablet computers, smart phones, personal digital assistants (PDAs), etc., which can improve the effectiveness and accuracy of anomaly detection and reduce the detection cost required for detection.

[0073] Optionally, see Figure 1 , Figure 1 The block diagram of an electronic device provided in an embodiment of the present application. The electronic device 100 may include a memory 111, a storage controller 112, a processor 113, a peripheral interface 114, an input and output unit 115, and a display unit 116. A person skilled in the art may understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the electronic device 100. For example, the electronic device 100 may further include Figure 1 More or fewer components as shown, or with Figure 1Different configurations are shown.

[0074] The memory 111, storage controller 112, processor 113, peripheral interface 114, input / output unit 115 and display unit 116 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The processor 113 is used to execute the executable module stored in the memory.

[0075] The memory 111 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 111 is used to store programs, and the processor 113 executes the program after receiving the execution instruction. The method executed by the electronic device 100 defined by the process disclosed in any embodiment of the present application can be applied to the processor 113, or implemented by the processor 113.

[0076] The processor 113 may be an integrated circuit chip with signal processing capability. The processor 113 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. The general-purpose processor may be a microprocessor or any conventional processor.

[0077] The peripheral interface 114 couples various input / output devices to the processor 113 and the memory 111. In some embodiments, the peripheral interface 114, the processor 113 and the memory controller 112 can be implemented in a single chip. In other embodiments, they can be implemented by separate chips.

[0078] The input / output unit 115 is used to provide input data to the user. The input / output unit 115 may be, but is not limited to, a mouse and a keyboard.

[0079] The above-mentioned display unit 116 provides an interactive interface (such as a user operation interface) between the electronic device 100 and the user or is used to display image data for the user's reference. In this embodiment, the display unit can be a liquid crystal display or a touch display. If it is a touch display, it can be a capacitive touch screen or a resistive touch screen that supports single-point and multi-point touch operations. Supporting single-point and multi-point touch operations means that the touch display can sense touch operations generated simultaneously from one or more positions on the touch display, and the sensed touch operations are handed over to the processor for calculation and processing. In an embodiment of the present application, the display unit 116 can display the detection results of each network element to be tested, the probability detection results, and prompt information when the detection result is abnormal, and other information.

[0080] The electronic device in this embodiment can be used to execute each step in each abnormality detection method provided in the embodiment of the present application. The implementation process of the abnormality detection method is described in detail below through several embodiments.

[0081] See also Figure 2 , Figure 2 A flowchart of an anomaly detection method provided in an embodiment of the present application, the method may include steps S200-S400.

[0082] Step S200: parse and process the flow data of the network element to be tested to obtain a sequence to be tested.

[0083] The network element to be tested is the basic unit in the communication network architecture, which can perform specific network functions and services. Network elements communicate with each other through specific network protocols, and the network protocols for communication between different network elements are different. Data collection can be performed on the network structure where the network element to be tested is located to obtain the flow data of the network element to be tested, and the flow data can be parsed and processed to obtain multiple sequences to be tested.

[0084] Optionally, the network protocol of the network element to be tested and the completeness of the sequence to be tested may be determined by analysis.

[0085] Step S300: Perform anomaly detection on each sequence to be tested by using a state machine or an incomplete detection model to obtain an anomaly score.

[0086] Among them, since the network element to be tested includes multiple sequences to be tested, due to the distinctiveness of each sequence to be tested, anomaly detection can be performed on each sequence to be tested through a state machine or an incomplete detection model to obtain an anomaly score characterizing the abnormal situation of each abnormal sequence.

[0087] For example, a corresponding state machine or an incomplete detection model may be selected according to the completeness of the sequence to be tested determined by analysis.

[0088] For example, the state machine may be a network protocol state machine, and the incomplete detection model may be various types of probabilistic models.

[0089] Step S400, determining the detection result of the network element to be tested according to an abnormal value obtained by integrating multiple abnormal scores and a preset abnormal threshold.

[0090] Among them, considering the instability of the detection results when performing anomaly detection based on a single sequence, multiple anomaly scores can be integrated to obtain the overall anomaly value of the network element to be tested, so as to determine the overall detection result of the network element to be tested by the difference between the preset anomaly threshold and the anomaly value.

[0091] For example, the abnormality score can be a percentage value or a value that characterizes the possibility or probability of an abnormal situation occurring, and the abnormality threshold is a percentage value or a value that characterizes the occurrence of an abnormal situation. The abnormality score corresponds to the abnormality threshold. For example, when the abnormality threshold is 1, the abnormality score ranges from 0 to 1. When the abnormality threshold is 100%, the abnormality score ranges from 0% to 100%.

[0092] Optionally, when the detection result shows that the network element to be tested is abnormal, an abnormal prompt may be given through log output, such as generating an alarm or blocking related instructions to handle the abnormal situation.

[0093] exist Figure 2 In the illustrated embodiment, anomaly detection can be performed on each sequence, and integrated detection can be performed in combination with the anomaly scores of multiple sequences to be tested, which effectively reduces adverse situations such as false alarms caused by determining probability detection results based on a single sequence, and selects a suitable state machine or incomplete detection model for real-time detection according to the actual situation of the sequence to be tested, which effectively reduces the detection cost, and can perform targeted detection on different sequences to be tested, thereby improving the accuracy of anomaly detection, being applicable to a variety of different network communication scenarios, and meeting anomaly detection requirements in a variety of different scenarios.

[0094] Optionally, see Figure 3 , Figure 3 A detailed flowchart of step S300 is provided for an embodiment of the present application. Step S300 may include steps S310-S330.

[0095] Step S310: determine the signaling integrity status in the sequence to be tested.

[0096] The signaling integrity in the sequence to be tested may be determined based on the analysis of the traffic data, so that a suitable method may be selected to perform abnormality detection on the sequence to be tested according to the signaling integrity.

[0097] For example, the fields and information contained in the signaling information of each signaling in the test sequence can be extracted, and the format and length of the signaling message can be checked to see whether they comply with the protocol requirements, and the order in which the signaling messages are sent and received can be tracked to detect the continuity of the signaling and determine whether there are any lost or duplicate signaling messages, etc.

[0098] Optionally, the signaling completeness may include whether the signaling of the sequence to be tested is complete, for example, whether there is any signaling loss, and various information such as the number, location, and number of lost signaling.

[0099] Step S320: If it is determined that the signaling integrity status indicates that the signaling of the sequence to be tested is intact, an abnormality detection is performed on the sequence to be tested through a state machine to obtain an abnormality score.

[0100] Among them, when the signaling completeness indicates that the signaling of the sequence to be tested is complete, the information of the sequence to be tested is complete and continuous, and there is no signaling loss. A state machine with low detection overhead and high detection accuracy can be used to perform anomaly detection on the sequence to be tested and obtain a corresponding anomaly score.

[0101] Step S330: If the signaling integrity status indicates that the signaling of the sequence to be tested is incomplete, an abnormality detection is performed on the sequence to be tested using an incomplete detection model to obtain an abnormality score.

[0102] Among them, when the signaling completeness situation represents that the signaling of the sequence to be tested is incomplete, the information of the sequence to be tested is missing and discontinuous, and there is signaling loss. Considering the difference between complete information and incomplete information, the pre-trained incomplete detection model can be used to perform anomaly detection on the sequence to be tested and obtain the corresponding anomaly score.

[0103] exist Figure 3 In the illustrated embodiment, a corresponding state machine or an incomplete detection model can be selected according to the signaling completeness of the sequence to be tested to perform anomaly detection on the sequence to be tested, thereby effectively reducing the computational cost required for detection while improving the accuracy of anomaly detection.

[0104] Optionally, see Figure 4 , Figure 4 A detailed flow chart of step S320 is provided for an embodiment of the present application. Step S320 may include steps S321-S325.

[0105] Step S321, analyzing the target protocol of the sequence to be tested by learning the model to obtain the corresponding state machine.

[0106] The target protocol of the sequence to be tested can be analyzed according to the learning model to output the corresponding state machine to detect and process the sequence to be tested. When the network element to be tested interacts using the target protocol, the state of the network element will continuously migrate as signaling is sent and received.

[0107] For example, the learning model may include multiple types of large machine learning models that can perform corresponding language processing. When the signaling of the sequence to be tested is complete and continuous, the complete protocol document of the target protocol used by the sequence to be tested can be analyzed by the large machine learning model to output the corresponding protocol state machine for processing.

[0108] Step S322: receiving and processing each signaling in the sequence to be tested by a state machine to obtain a detection state of each signaling.

[0109] The processing state machine can receive and process each signaling in the sequence to be tested, and obtain the detection state of each signaling, which may include: failure state, success state and illegal state. Failure state.

[0110] It should be noted that the failure state is a state in which the signaling cannot be correctly transmitted or processed due to various reasons during the communication process, so that the communication cannot be established or maintained. Common signaling failure states may include: network congestion: when the signaling traffic in the network is too large and exceeds the carrying capacity of the network, it will cause signaling congestion, so that the signaling cannot be transmitted in time; signaling loss: during the signaling transmission process, due to network failure, equipment failure or other reasons, the signaling may be lost, so that the communication cannot be established or maintained; signaling error: the format, content or coding error of the signaling may cause the signaling to be unable to be correctly parsed and processed, so that the communication fails; user unreachable: when the user is in the state of shutdown, no signal, roaming, etc., the signaling may not reach the user, so that the communication cannot be established; insufficient resources: when the resources in the network (such as channels, memory, etc.) are insufficient, the signaling may not be correctly processed or transmitted, so that the communication fails, etc. The successful state is a state in which the signaling can be correctly transmitted and processed during the communication process, so that the communication can be smoothly established or maintained. Common signaling success states may include: signaling is correctly transmitted: signaling can be correctly transmitted according to the predetermined path and format without loss or error; signaling is correctly parsed: the receiving end can correctly parse the received signaling and perform corresponding processing according to the content of the signaling; communication is successfully established: under the guidance of the signaling, the communicating parties can successfully establish a connection and transmit data; resource allocation is successful: the network can allocate sufficient resources (such as channels, memory, etc.) to the communicating parties as needed to ensure smooth communication, etc. The illegal state is the state in which the format, content or behavior of the signaling violates the communication protocol or regulations during the communication process, resulting in the inability to establish or maintain communication. Common signaling illegal states may include: signaling format is illegal: the format of the signaling does not comply with the provisions of the communication protocol, such as incorrect length, missing or misplaced fields, etc.; signaling content is illegal: the content of the signaling contains illegal or illegal information, such as malicious code, attack instructions, etc.; signaling behavior is illegal: the behavior of the signaling violates the provisions of the communication protocol, such as unauthorized access, modification or deletion, etc.

[0111] Step S323: when the detected state is an illegal state, determine the abnormal score as an abnormal threshold.

[0112] When a certain detection state is currently detected as an illegal state, it indicates that the corresponding signaling is an illegal attack signaling, and the abnormal threshold can be directly output as the corresponding abnormal score. For example, the abnormal threshold 1 is directly used as the abnormal score.

[0113] Step S324: when the number of failure states within the target time period is greater than the upper limit, determine the abnormality score based on the historical failure situations of the state machine.

[0114] Among them, in a short time, that is, when the number of failure states within the target time period is greater than the upper limit, it means that the failure state is too frequent in a short period of time, and there may be an abnormal situation. The corresponding abnormal score can be determined according to the historical failure situation of the state machine.

[0115] Optionally, since the state machine rarely enters the failure state in normal business, when the state machine frequently enters the failure state during operation, the abnormal score of the sequence to be tested can be increased by Pfail. The complete signaling sequence obtained when training the incomplete detection model can be input into the state machine for operation, and the percentage of the failure state in all states is calculated as the corresponding Pfail value, that is, the abnormal score. The calculated Pfail value can also be multiplied by a proportional coefficient according to the overall number of actual sequences to be tested, etc. to obtain the final abnormal score. For example, when the abnormal threshold 1 corresponds to 100 sequences to be tested, the number of sequences to be tested of the network element to be tested is 1000, and the Pfail value can be multiplied by 100 / 1000 to obtain the corresponding abnormal score.

[0116] For example, the target time period can be set according to actual conditions and protocol requirements, for example, set to 2-4s, etc. Correspondingly, the upper limit number of times can also be set according to actual conditions and protocol requirements, for example, set to 10 times, etc.

[0117] Step S325, when all detection states are in a successful state, or the number of failure states within the target time period is less than or equal to the upper limit number, the abnormal score is determined to be a non-abnormal value.

[0118] Among them, when all detection states are successful, it indicates that each signaling state is normal; or, when the number of failure states within the target time period is less than or equal to the upper limit, it indicates that there is a normal failure in the interaction, that is, the probability of signaling anomaly is low, and the non-abnormal value can be directly output as the abnormal score.

[0119] For example, the non-abnormal value is a value indicating that no abnormal situation has occurred. Taking 100% and 1 as abnormal thresholds, the corresponding non-abnormal values ​​are 0% and 0, respectively.

[0120] exist Figure 4 In the illustrated embodiment, each signaling in the sequence to be tested can be detected for anomalies by using a state machine of the corresponding protocol, thereby effectively improving the accuracy of anomaly detection and reducing the computational cost required for anomaly detection.

[0121] Optionally, see Figure 5 , Figure 5 A detailed flowchart of step S330 is provided for an embodiment of the present application. Step S330 may include steps S331-S334.

[0122] Step S331, determining the number of signaling losses in the sequence to be tested.

[0123] Among them, when the information of the sequence to be tested is missing or discontinuous, due to the different number of lost signaling, each corresponding incomplete situation is also different. Therefore, multiple incomplete detection models for different incomplete situations can be pre-trained. In order to carry out targeted processing for different types of incomplete situations, the number of lost signaling in the sequence to be tested can be determined based on the analysis of traffic data.

[0124] Step S332, determining a target model from multiple incomplete detection models according to the number of losses, and performing anomaly detection on the sequence to be tested through the target model to obtain a probability detection result.

[0125] Among them, the corresponding target model can be determined in multiple incomplete detection models according to the actual number of losses, so as to perform anomaly detection on the sequence to be tested according to the target model to obtain the corresponding probability detection result.

[0126] Optionally, when the signaling is discontinuous, the corresponding target model λx can be selected according to the number of lost signals x in the current signaling in the sequence to be tested relative to the previously captured signaling. At the same time, the previously recorded M-1 signals are taken out of the memory and spliced ​​into a sequence of M signals (M is the length of the divided sequence when the target model is divided), and the probability of the signaling occurrence is calculated by the forward / backward algorithm, so as to obtain the corresponding probability detection result that characterizes whether the sequence to be tested is abnormal or not through the size of the probability.

[0127] Step S333: when the probability detection result indicates that the sequence to be tested is abnormal, determine the abnormality score based on the number of losses.

[0128] In the case where the probability detection result indicates that the sequence to be tested is abnormal, considering the correlation between the number of signaling losses and the abnormal situation, the abnormality score indicating the abnormal situation of the sequence to be tested can be determined according to the number of losses.

[0129] Optionally, the abnormal score of the sequence to be tested that is detected as abnormal can be determined by the number of lost signals. The number of lost signals is negatively correlated with the reliability of the sequence to be tested. The fewer the lost signals, the higher the reliability of judging whether the network element to be tested is abnormal. Therefore, its abnormal score can be set to Plost. An optional value of Plost is 1 / (p+1) or p / M, where p is the number of lost signals. Other calculation methods related to p can also be used to determine the corresponding abnormal score according to actual conditions and needs.

[0130] Step S334: when the probability detection result indicates that the sequence to be tested is normal, determine the abnormal score as a non-abnormal value.

[0131] Among them, when the probability detection result indicates that the sequence to be tested is normal, the signaling loss is just a normal situation where the signaling is not captured, and the non-abnormal value can be directly used as the abnormal score.

[0132] exist Figure 5 In the illustrated embodiment, a suitable incomplete detection model can be selected according to the actual situation of the number of losses to perform anomaly detection and determine the corresponding anomaly score, thereby effectively improving the accuracy and effectiveness of anomaly detection for different incomplete situations.

[0133] Optionally, see Figure 6 , Figure 6 A detailed flow chart of step S332 is provided for an embodiment of the present application. Step S332 may include steps S3321-S3323.

[0134] Step S3321, calculating the occurrence probability value of the signaling in the sequence to be tested through the target model.

[0135] Among them, since the incomplete detection model can be a variety of types of probability models, the occurrence probability value of the signaling in the sequence to be tested can be calculated according to the selected target model.

[0136] Optionally, the corresponding occurrence probability value may be calculated based on the fields, information, etc. of the signaling.

[0137] Step S3322: If the occurrence probability value is determined to be less than the minimum probability threshold in the target model, the probability detection result of the sequence to be tested is determined to be abnormal.

[0138] Among them, the occurrence probability value is compared with the minimum probability threshold in the target model. When the occurrence probability value is less than the minimum probability threshold, it indicates that the probability of signaling occurrence in the sequence to be tested is too low, and there may be an abnormality. The corresponding probability detection result of the sequence to be tested is abnormal.

[0139] Optionally, the minimum probability threshold may be a probability value of the sequence with the lowest probability of occurrence among all sequences in the training set used by the target model.

[0140] Step S3323: If it is determined that the occurrence probability value is greater than or equal to the minimum probability threshold, the probability detection result of the sequence to be tested is determined to be normal.

[0141] When the occurrence probability value is greater than or equal to the minimum probability threshold, it indicates that the probability of occurrence of signaling in the sequence to be tested is normal, and the corresponding abnormality detection of the sequence to be tested is normal.

[0142] exist Figure 6 In the illustrated embodiment, anomaly detection can be performed on the sequence to be tested according to the occurrence probability value of the signaling, thereby effectively improving the effectiveness and accuracy of anomaly detection performed by the target model.

[0143] Optionally, see Figure 7 , Figure 7 A detailed flowchart of step S200 is provided for an embodiment of the present application. Step S200 may include steps S210-S230.

[0144] Step S210: collecting flow data of the network element to be tested in the target interface.

[0145] The flow data of the network element to be tested in the target interface may be collected first, so as to perform real-time abnormality detection on the network element to be tested.

[0146] Optionally, you can first determine the target interface of the network element under test for which traffic data needs to be collected, and use various types of network packet capture tools such as tcpdump, tshark, Scapy, or various types of monitoring tools such as iftop, nload, ntop, etc. to collect traffic data in compliance with relevant laws, regulations, and privacy policies.

[0147] Step S220, performing protocol identification on the flow data to obtain the target protocol.

[0148] Among them, considering the different types of application layer network protocols used by different interfaces and network elements in communication scenarios, in order to perform targeted anomaly detection, the traffic data can be subjected to protocol identification to obtain the target protocol used by the network element to be tested.

[0149] It should be noted that network protocol refers to a set of rules and conventions followed when exchanging information between devices or systems participating in communication in a computer network. These rules define the format, sequence, processing method and corresponding error handling mechanism of data transmission to ensure that different devices can communicate effectively and reliably, such as N1, N2, N3, etc.

[0150] Step S230, performing analysis based on the target protocol to obtain multiple sequences to be tested corresponding to the multiple dialogues.

[0151] The target protocol may be parsed to obtain a plurality of test sequences including signaling corresponding to a plurality of dialogues.

[0152] Optionally, the target protocol may be parsed to determine the composition structure of the message, the naming and meaning of the fields, the data type, the message flow direction and timing, and other parameters. The content related to the target protocol may be extracted from multiple conversations of the network element to be tested, such as the original message data, the timestamp of the message, the sender and receiver of the message, and the context information of the message (such as the session ID, request ID, etc.). The content of each conversation may be parsed according to the definition of the target protocol. The parsing process may include: decoding the original message data into a readable format (such as decoding from a binary format to a text format), extracting key fields and values ​​in the message, verifying whether the format of the message complies with the protocol specification, and generating multiple sequences to be tested containing multiple signalings based on the parsed conversation content.

[0153] exist Figure 7 In the illustrated embodiment, data can be collected, protocol identified and analyzed before abnormality detection, thereby effectively improving the validity of the sequence to be tested.

[0154] Optionally, see Figure 8 , Figure 8 A flowchart of another anomaly detection method provided in an embodiment of the present application, the method may further include steps S510-S530.

[0155] Step S510: determining the length of the divided sequence based on different types of application protocols.

[0156] Among them, considering the impact of different signaling loss numbers on the signaling occurrence probability, in order to perform targeted detection on the sequences to be tested with different loss numbers, multiple different incomplete detection models can be pre-trained. The length of the divided sequence during detection can be first determined according to different types of application protocols, so that the incomplete detection model can detect network elements of different application protocols.

[0157] Step S520: determine to discard multiple training sets and test sets of 1 to n signalings.

[0158] Step S530, training the probability model based on the training set, the test set and the length of the divided sequence to obtain multiple incomplete detection models.

[0159] Among them, the maximum signaling length of the sequence is m, n=m-1, and multiple training sets and test sets with 1 to n signals discarded can be set to bring the training sets and test sets, as well as the divided sequence lengths into the probability model for training, so as to train and test incomplete situations with different numbers of losses and obtain multiple incomplete detection models.

[0160] Optionally, a probabilistic model, such as a hidden Markov model, a hidden semi-Markov model or a dynamic Bayesian network model, may be used for training to obtain a corresponding incomplete detection model.

[0161] For example, a hidden Markov model is used as an example. In order to obtain higher detection accuracy, multiple incomplete detection models can be trained specifically according to the number of signaling losses in the signaling sequence. The complete signaling sequence of the network element in the normal 5G communication network is obtained as the initial sample, and the sample is divided into sequences of equal length through a sliding window. The sequence length M is taken as the number of all different states in the state machine of this protocol. According to different protocols, 1 to n continuous signalings are randomly discarded to obtain n batches of incomplete signaling sequences. n depends on the longest signaling length in a single service of the state machine of the protocol type minus 1, that is, n=m-1. If too many signalings are discarded continuously and exceed the business process, this incomplete sequence will no longer have reference value. The hidden Markov model parameters are λ=(A, B, Π). The Baum Welch algorithm is used to learn the parameters of the above different batches of samples to obtain n different anomaly detection models λ1…λn.

[0162] exist Figure 8 In the illustrated embodiment, different signaling loss situations can be simulated to train multiple different incomplete detection models, so as to effectively perform anomaly detection on multiple test sequences with different loss amounts, thereby effectively improving the effectiveness and pertinence of anomaly detection on incomplete test sequences.

[0163] It should be noted that the abnormal threshold may be a value obtained by normalizing historical abnormal data, such as 1 or 100%.

[0164] Optionally, see Fig. 9 , Fig. 9 A detailed flowchart of step S400 is provided for an embodiment of the present application. Step S400 may include steps S410-S440.

[0165] Step S410, determining abnormal scores corresponding to multiple sequences to be tested within a target period.

[0166] Optionally, the target period may be a period that limits the number of sequences to be tested. For example, based on the current time node, 100 is selected as the target period, and the anomaly scores corresponding to the first 1-100 sequences to be tested may be obtained for processing. When the time is updated, the anomaly scores of the first 2-101 sequences to be tested may be obtained for processing, etc. The historical technical data before the target period may also be deleted to reduce storage pressure.

[0167] Step S420: performing accumulation processing based on multiple abnormal scores to obtain an abnormal value.

[0168] In order to improve the timeliness of outliers, the outlier scores of multiple sequences to be tested within the target period can be accumulated to obtain outliers with timeliness, thereby reducing the adverse effects of historical data that is too old on anomaly detection.

[0169] Step S430: If it is determined that the abnormal value is greater than or equal to the preset abnormal threshold, the detection result of the network element to be tested is determined to be abnormal.

[0170] Among them, the abnormal value is compared with the abnormal threshold obtained by normalization based on historical abnormal data. The abnormal threshold is a numerical value that characterizes the occurrence of an abnormal situation. When the abnormal value is greater than or equal to the abnormal threshold, for example, the abnormal value = abnormal threshold = 1, the numerical value of the abnormal value is greater than the numerical value of the abnormal situation. The probability of an abnormal situation occurring in the network element to be tested is relatively high, and the detection result of the network element to be tested is determined to be abnormal.

[0171] Step S440: If it is determined that the abnormal value is less than the abnormal threshold, the detection result of the network element to be tested is determined to be normal.

[0172] When the abnormal value is smaller than the abnormal threshold, for example, abnormal value=1 / 2<abnormal threshold, the abnormal value is smaller than the abnormal value, and the probability of abnormal situation occurring in the network element to be tested is small, and the detection result of the network element to be tested is determined to be normal.

[0173] exist Fig. 9 In the illustrated embodiment, a numerical value is used to characterize whether an abnormal situation occurs, and thus the detection result of the network element to be tested is determined by comparing the magnitude of the numerical value, which effectively reduces the adverse situation of abnormal false alarms and improves the effectiveness and accuracy of the detection result.

[0174] See also Fig.10 , Fig.10 A schematic diagram of the structure of an anomaly detection device provided in an embodiment of the present application, the anomaly detection device 600 includes: an analysis module 610, a detection module 620 and a result module 630;

[0175] The parsing module 610 is used to parse and process the flow data of the network element to be tested to obtain a sequence to be tested;

[0176] The detection module 620 is used to perform anomaly detection on each sequence to be tested through a state machine or an incomplete detection model to obtain an anomaly score;

[0177] The result module 630 is used to determine the detection result of the network element to be tested according to the abnormal value obtained by integrating multiple abnormal scores and the preset abnormal threshold.

[0178] In an optional implementation, the detection module 620 is specifically used to: determine the signaling completeness of the sequence to be tested; if the signaling completeness is determined to represent that the signaling of the sequence to be tested is complete, then an abnormality detection is performed on the sequence to be tested through a state machine to obtain an abnormality score; if the signaling completeness is determined to represent that the signaling of the sequence to be tested is incomplete, then an abnormality detection is performed on the sequence to be tested through an incomplete detection model to obtain an abnormality score.

[0179] In an optional implementation, the detection module 620 is specifically used to: analyze the target protocol of the sequence to be tested through a learning model to obtain a corresponding state machine; receive and process each signaling in the sequence to be tested through the state machine to obtain a detection status of each signaling; wherein the detection status includes: a failure status, a success status and an illegal status; when the detection status is an illegal status, determine the abnormal score as an abnormal threshold; when the number of failure statuses within the target time period is greater than an upper limit, determine the abnormal score based on the historical failure of the state machine; when all detection statuses are successful, or the number of failure statuses within the target time period is less than or equal to the upper limit, determine the abnormal score as a non-abnormal value.

[0180] In an optional embodiment, the detection module 620 is specifically used to: determine the number of signaling losses in the sequence to be tested; determine a target model in multiple incomplete detection models based on the number of losses, and perform anomaly detection on the sequence to be tested through the target model to obtain a probability detection result; when the probability detection result indicates that the sequence to be tested is abnormal, determine an anomaly score based on the number of losses; when the probability detection result indicates that the sequence to be tested is normal, determine the anomaly score as a non-abnormal value.

[0181] In an optional implementation, the detection module 620 is specifically used to: calculate the occurrence probability value of the signaling in the sequence to be tested through the target model; if it is determined that the occurrence probability value is less than the minimum probability threshold in the target model, then the probability detection result of the sequence to be tested is determined to be abnormal; if it is determined that the occurrence probability value is greater than or equal to the minimum probability threshold, then the probability detection result of the sequence to be tested is determined to be normal.

[0182] In an optional implementation, the parsing module 610 is specifically used to: collect traffic data of the network element to be tested in the target interface; perform protocol identification on the traffic data to obtain the target protocol; perform parsing based on the target protocol to obtain multiple sequences to be tested corresponding to multiple conversations; wherein each sequence to be tested contains multiple signalings.

[0183] In an optional embodiment, the anomaly detection device may also include a training module for determining the length of the divided sequence based on different types of application protocols; determining multiple training sets and test sets that discard 1 to n signaling; wherein the maximum signaling length of the sequence is m, n=m-1; and training the probability model based on the training set, the test set and the divided sequence length to obtain multiple incomplete detection models.

[0184] In an optional implementation, the abnormal threshold is a value obtained by normalizing historical abnormal data; the result module 630 is specifically used to: determine the abnormal scores corresponding to multiple sequences to be tested within the target period; perform cumulative processing based on multiple abnormal scores to obtain an abnormal value; if the abnormal value is determined to be greater than or equal to a preset abnormal threshold, the detection result of the network element to be tested is determined to be abnormal; if the abnormal value is determined to be less than the abnormal threshold, the detection result of the network element to be tested is determined to be normal.

[0185] Since the principle of solving the problem by the abnormality detection device in the embodiment of the present application is similar to that of the embodiment of the abnormality detection method mentioned above, the implementation of the abnormality detection device in this embodiment can refer to the description in the embodiment of the abnormality detection method mentioned above, and the repeated parts will not be repeated.

[0186] The embodiment of the present application further provides a computer-readable storage medium, in which computer program instructions are stored. When the computer program instructions are read and executed by a processor, the steps of any one of the abnormality detection methods provided in the embodiment are executed.

[0187] An embodiment of the present application also provides a computer program product, which includes a computer program / instructions. When the computer program / instructions are executed by a processor, the steps in any one of the anomaly detection methods are implemented.

[0188] In several embodiments provided in the present application, it should be understood that the disclosed device can also be implemented in other ways. The device embodiments described above are merely schematic, for example, the block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices according to the multiple embodiments of the present application. In this regard, each box in the block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram, and the combination of the block diagrams, can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0189] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0190] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0191] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0192] The above description is only a specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

[0193] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "include..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Analyze and process the flow data of the network element to be tested to obtain the sequence to be tested; Performing anomaly detection on each of the sequences to be tested by using a state machine or an incomplete detection model to obtain an anomaly score; The detection result of the network element to be tested is determined according to an abnormal value obtained by integrating the multiple abnormal scores and a preset abnormal threshold.

2. The method according to claim 1, characterized in that The performing anomaly detection on each of the sequences to be tested by a state machine or an incomplete detection model to obtain an anomaly score includes: Determining the signaling integrity of the sequence to be tested; If it is determined that the signaling integrity status indicates that the signaling of the sequence to be tested is complete, an abnormality detection is performed on the sequence to be tested by the state machine to obtain the abnormality score; If it is determined that the signaling completeness indicates that the signaling of the sequence to be tested is incomplete, an abnormality detection is performed on the sequence to be tested using the incomplete detection model to obtain the abnormality score.

3. The method according to claim 2, characterized in that The performing anomaly detection on the sequence to be tested by the state machine to obtain the anomaly score includes: Analyze the target protocol of the sequence to be tested by learning the model to obtain the corresponding state machine; Each signaling in the sequence to be tested is received and processed by the state machine to obtain a detection state of each signaling; wherein the detection state includes: a failure state, a success state and an illegal state; When the detection state is the illegal state, determining the abnormal score to be the abnormal threshold; When the number of failure states within the target time period is greater than an upper limit, determining the abnormal score based on the historical failure situations of the state machine; In the case where all the detection states are successful states, or the number of failure states within the target time period is less than or equal to the upper limit number, the abnormal score is determined to be a non-abnormal value.

4. The method according to claim 2, characterized in that: The performing anomaly detection on the sequence to be tested by using the incomplete detection model to obtain the anomaly score includes: Determining the number of signaling losses in the sequence to be tested; Determine a target model from the plurality of incomplete detection models according to the number of losses, and perform anomaly detection on the sequence to be tested by using the target model to obtain a probability detection result; In the case where the probability detection result indicates that the sequence to be tested is abnormal, determining the abnormality score based on the number of losses; When the probability detection result indicates that the sequence to be tested is normal, the abnormal score is determined to be a non-abnormal value.

5. The method according to claim 4, characterized in that The performing anomaly detection on the sequence to be tested by using the target model to obtain a probability detection result includes: Calculating the occurrence probability value of the signaling in the sequence to be tested by using the target model; If it is determined that the occurrence probability value is less than the minimum probability threshold in the target model, determining that the probability detection result of the sequence to be tested is abnormal; If it is determined that the occurrence probability value is greater than or equal to the minimum probability threshold, then it is determined that the probability detection result of the sequence to be tested is normal.

6. The method according to claim 1, characterized in that The process of parsing the flow data of the network element to be tested to obtain the sequence to be tested includes: Collecting the flow data of the network element to be tested in the target interface; Performing protocol identification on the traffic data to obtain a target protocol; Parsing is performed based on the target protocol to obtain a plurality of sequences to be tested corresponding to a plurality of dialogues; wherein each sequence to be tested includes a plurality of signalings.

7. The method according to any one of claims 1 to 6, characterized in that: in, The incomplete detection model is determined by: Determine the length of the division sequence based on different types of application protocols; Determine a plurality of training sets and test sets that discard 1 to n signalings; wherein the maximum signaling length of the sequence is m, and n=m-1; The probability model is trained based on the training set, the test set and the divided sequence length to obtain a plurality of the incomplete detection models.

8. The method according to any one of claims 1 to 6, characterized in that: in, The abnormal threshold is a value obtained by normalizing the historical abnormal data; The step of determining the detection result of the network element to be tested based on an abnormal value obtained by integrating the plurality of abnormal scores and a preset abnormal threshold value comprises: Determine anomaly scores corresponding to a plurality of the sequences to be tested within a target period; Performing cumulative processing based on a plurality of the abnormal scores to obtain the abnormal value; If it is determined that the abnormal value is greater than or equal to the preset abnormal threshold, determining that the detection result of the network element to be tested is abnormal; If it is determined that the abnormal value is smaller than the abnormal threshold, it is determined that the detection result of the network element to be tested is normal.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, wherein the memory stores program instructions, and when the processor runs the program instructions, the steps in the method according to any one of claims 1 to 8 are executed.

10. A computer-readable storage medium, characterized in that: The readable storage medium stores computer program instructions, and when the computer program instructions are read and executed by a processor, the steps of the method according to any one of claims 1 to 8 are executed.

11. A computer program product, characterized in that The computer program product comprises a computer program / instruction, and when the computer program / instruction is executed by a processor, the steps in the method according to any one of claims 1 to 8 are implemented.

Images