A Bayesian-based Abnormal Network Traffic Tracing Method and System

Abstract

The present invention discloses a Bayesian-based abnormal network traffic backtracking method and system. The method includes: Step 1, obtaining the range of abnormal traffic backtracking analysis to be performed through the 95 charging traffic algorithm; Step 2, for different optical attenuation commands obtained by different network devices, executing the operation commands corresponding to the adapted network devices through a network device adaptation program to obtain the optical attenuation value when the abnormal traffic occurs, and storing it in the optical attenuation database; Step 3, constructing a Bayesian traffic backtracking model, combining with a preset historical fault database, analyzing the optical attenuation data in the optical attenuation database, and obtaining the probability that the traffic after the abnormal traffic backtracking within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking. The present invention performs artificial intelligence data analysis on network abnormal traffic through the 95 traffic calculation method combined with the optical attenuation index, provides an intelligent traffic backtracking method with reference value and scientific basis, and highlights the status of artificial intelligence in traffic backtracking.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and particularly relates to a method and system for abnormal network traffic backtracking based on Bayesian. Background Art

[0002] Network security is an important part of the national security system. With the continuous improvement of the development level of the network society and the increasing popularity of network applications, while the network brings convenience to people, it also brings security risks that cannot be ignored.

[0003] Abnormal network traffic information will cause technical difficulties and significant economic losses to the network traffic cost accounting and network fault troubleshooting in the data center. In the network maintenance scenario of the computer room, technicians cannot effectively handle and solve the problems such as traffic cost accounting and traffic anomaly analysis caused by sudden abnormal network traffic. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide a method and system for abnormal network traffic backtracking based on Bayesian in view of the above-mentioned deficiencies of the prior art. Based on the industry-standard network traffic 95 algorithm and optical attenuation monitoring indicators, an abnormal network traffic backtracking analysis is carried out by constructing a Bayesian traffic backtracking model. A more standard, accurate and scientific traffic value is provided for the normal traffic value in the current time period. The economic losses caused by the inaccuracy of traffic cost accounting caused by abnormal network bandwidth traffic are greatly reduced, and at the same time, the security of network traffic and the efficiency of system services are improved.

[0005] In order to achieve the above technical objectives, the technical solutions adopted by the present invention are as follows:

[0006] A method for abnormal network traffic backtracking based on Bayesian, comprising:

[0007] Step 1, obtaining the range of abnormal traffic backtracking analysis through the 95 charging traffic algorithm;

[0008] Step 2, for different optical attenuation commands obtained by different network devices, executing the corresponding operation commands for the adapted network devices through the network device adaptation program to obtain the optical attenuation value when the abnormal traffic occurs, and storing it in the optical attenuation database to confirm the cause of the abnormality. For the abnormality caused by traffic, go to Step 3;

[0009] Step 3, constructing a Bayesian traffic backtracking model, combining with the preset historical fault database, analyzing the optical attenuation data in the optical attenuation database, and obtaining the probability that the abnormal traffic after backtracking in a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking.

[0010] In order to optimize the above technical solutions, the specific measures taken also include:

[0011] In the above step 1, through the 95-billing traffic algorithm, one point is taken every 5 minutes. Then, 12 points are taken in one hour, 12 * 24 points are taken in one day, and 12 * 24 * 30 = 8640 points are taken in one month (calculated based on 30 days).

[0012] Remove the 5% of the points with the highest traffic from the 8640 points obtained. The remaining 95% of the points form the normal traffic range, that is: the number of billing points obtained is 8208 points, of which 432 points are not billed and form the range for backtracking analysis of abnormal traffic.

[0013] In the above step 2, the optical attenuation database stores the optical attenuation value data, IPs of network devices of different manufacturers and models, with a time interval of five minutes; the unit of the optical attenuation value data is db.

[0014] The above step 2 includes:

[0015] S1. Through the program execution, collect the optical attenuation values of the network ports within the time period of the range for backtracking analysis of abnormal traffic in step 1.

[0016] S2. Compare the optical attenuation value data in S1 with the historical average optical attenuation value standard system to reconfirm whether the current traffic anomaly is caused by traffic or due to hardware failures such as optical modules resulting in network traffic anomalies.

[0017] In the above step 3, the historical fault database stores the content, level, type, faulty device and its IP, and the start and end times of the faulty initiation of abnormal network faults.

[0018] The model formula of the Bayesian traffic backtracking model described in the above step 3 is:

[0019] ZY(D|+) = ZY(+|D)ZY(D) / (ZY(+|D)ZY(D) + ZY(+|N)ZY(N))

[0020] Among them, ZY(+|D) is the accuracy rate of the optical attenuation value when the abnormal traffic optical attenuation value fault occurs;

[0021] ZY(D) is the incidence rate of the abnormal traffic optical attenuation value fault. The incidence rate of the abnormal traffic optical attenuation value fault = the total number of historical abnormal traffic optical attenuation value faults / the total number of abnormal traffic optical attenuation value faults in the historical fault database;

[0022] ZY(+|N) is the probability of misjudging as an abnormal traffic optical attenuation value fault = the number of false alarms in the same time period / the total number of abnormal traffic optical attenuation value faults in the same time period;

[0023] ZY(N) represents the probability that the abnormal traffic optical attenuation value does not have a fault.

[0024] Bayesian-based Abnormal Network Traffic Backtracking System, the system includes a 95 abnormal traffic algorithm module, an optical attenuation value data acquisition module, and a Bayesian traffic backtracking module;

[0025] The 95 abnormal traffic algorithm module is used to obtain the range of abnormal traffic backtracking analysis to be performed through the 95 charging traffic algorithm;

[0026] The optical attenuation value data acquisition module is used to, for different optical attenuation commands obtained for different network devices, execute the corresponding operation commands for adapting to the network devices through the network device adaptation program to obtain the optical attenuation value when abnormal traffic occurs, store it in the optical attenuation database, confirm the cause of the abnormality, and for the abnormality caused by traffic, enter the Bayesian traffic backtracking module;

[0027] The Bayesian traffic backtracking module is used to construct a Bayesian traffic backtracking model, combine the pre-set historical fault database, analyze the optical attenuation data in the optical attenuation database, and obtain the probability that the traffic after backtracking of the abnormal traffic occurring within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking.

[0028] The present invention has the following beneficial effects:

[0029] The present invention performs artificial intelligence data analysis on network abnormal traffic through the 95 traffic calculation method combined with the optical attenuation index, provides an intelligent traffic backtracking method with reference value and scientific basis, and highlights the status of artificial intelligence in traffic backtracking. Description of the Drawings

[0030] Figure 1 It is the method flow chart in the present invention. Detailed Embodiment

[0031] The following further describes the embodiments of the present invention in detail with reference to the drawings.

[0032] See Figure 1 , a Bayesian-based abnormal network traffic backtracking method of the present invention includes:

[0033] Step 1: Obtain the range of abnormal traffic backtracking analysis to be performed through the 95 charging traffic algorithm;

[0034] Step 2: For different optical attenuation commands obtained for different network devices, execute the corresponding operation commands for adapting to the network devices through the network device adaptation program to obtain the optical attenuation value when abnormal traffic occurs, store it in the optical attenuation database, confirm the cause of the abnormality, and for the abnormality caused by traffic, enter Step 3;

[0035] Step 3: Construct a Bayesian traffic backtracking model, and combine it with the pre-set historical fault database to analyze the optical attenuation data in the optical attenuation database, so as to obtain the probability that the traffic after the abnormal traffic backtracking within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking.

[0036] In the embodiment, in the said Step 1, by using the 95-billing traffic algorithm, one point is taken every 5 minutes, so 12 points are taken in one hour, 12*24 points are taken in one day, and 12*24*30 = 8640 points are taken in one month calculated by 30 days;

[0037] Remove the 5% of the points with the highest traffic from the obtained 8640 points, and the remaining 95% of the points form the normal traffic range, that is: the number of obtained billing points is 8208 points, among which, 432 points are not billed and form the range for abnormal traffic backtracking analysis.

[0038] In the embodiment, the said Step 2 includes:

[0039] S1. Collect the optical attenuation values of the network ports during the time period of the abnormal traffic backtracking analysis range in Step 1 through program execution; as shown in Table 1;

[0040] S2. Compare the optical attenuation value data in S1 with the historical average optical attenuation value standard system to reconfirm whether the current traffic anomaly is caused by traffic or due to hardware failures such as optical modules causing network traffic anomalies. See Table 2 for the historical average optical attenuation value standard system.

[0041] Table 1 Optical attenuation data during the period from 00:01 to 01:00 on a certain day during the monitoring process

[0042]

[0043]

[0044] Table 2 Example of fault data stored in the historical fault database

[0045]

[0046] The optical attenuation database mentioned in Step 2 can store the optical attenuation value data, IP of network devices of different manufacturers and models, and the time interval can be selected as five minutes; the unit of the optical attenuation value data is db.

[0047] In the embodiment, the historical fault database mentioned in Step 3 stores relevant information such as the content, level, type, faulty device and IP, and the start and end times of the fault of the abnormal network fault.

[0048] In the embodiment, the analysis and construction process of the Bayesian traffic backtracking model mentioned in Step 3 is as follows:

[0049]

Bayesian Traffic Backtracking Model

[0050]

Prior Probability

[0051]

Conditional Probability

[0052]

Adjustment Factor

[0053]

Posterior Probability

Prior Probability

[0054] Mathematical formula of the model:

[0055] ZY(D|+) = ZY(+|D)ZY(D) / (ZY(+|D)ZY(D) + ZY(+|N)ZY(N))

[0056] Obtain

Probability of approaching the true traffic after backtracking

[0057] Description of relevant parameters:

[0058]

Posterior Probability

Prior Probability

[0059] The mathematical formula description of the posterior probability is

[0060] Posterior Probability = ZY(+|D) × Adjustment Factor

[0061]

D

[0062]

/

[0063]

ZY

[0064]

ZY(D|+)

[0065]

ZY(+|D)

[0066] Formula description:

[0067] False alarm rate of abnormal traffic fault data = Number of false alarms in the historical fault database / Total number of abnormal traffic faults

[0068]

ZY(D)

[0069]

ZY(+|N)

[0070]

ZY(N)

[0071] That is, the Bayesian traffic backtracking model constructed in step three is:

[0072] ZY(D|+) = ZY(+|D)ZY(D) / (ZY(+|D)ZY(D) + ZY(+|N)ZY(N))

[0073] Among them, ZY(+|D) is the accuracy rate of the optical attenuation value when the abnormal traffic optical attenuation value fault occurs;

[0074] ZY(D) is the abnormal traffic optical attenuation value fault incidence rate. The abnormal traffic optical attenuation value fault incidence rate = the total number of historical abnormal traffic optical attenuation value faults / the total number of abnormal traffic optical attenuation value faults in the historical fault database;

[0075] ZY(+|N) is the probability of misjudging as an abnormal traffic optical attenuation value fault = the number of false alarms in the same time period / the total number of abnormal traffic optical attenuation value faults in the same time period;

[0076] ZY(N) = represents the probability that the abnormal traffic optical attenuation value does not have a fault.

[0077] A Bayesian-based abnormal network traffic backtracking system, the system includes a 95 abnormal traffic algorithm module, an optical attenuation value data acquisition module, and a Bayesian traffic backtracking module;

[0078] The 95 abnormal traffic algorithm module is used to obtain the range of abnormal traffic backtracking analysis through the 95 charging traffic algorithm;

[0079] The optical attenuation value data acquisition module is used to execute the operation commands corresponding to the network device through the network device adaptation program for different optical attenuation commands obtained for different network devices, obtain the optical attenuation value when the abnormal traffic occurs, and store it in the optical attenuation database, confirm the cause of the abnormality. For the abnormality caused by traffic, enter the Bayesian traffic backtracking module;

[0080] The Bayesian traffic backtracking module is used to construct a Bayesian traffic backtracking model, combine with a pre-set historical fault database, analyze the optical attenuation data in the optical attenuation database, and obtain the probability that the traffic after abnormal traffic backtracking occurring within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking.

[0081] The abbreviations and key terms used in the present invention are defined as follows:

[0082] Optical attenuation generally refers to the attenuation of an optical channel. Therefore, generally at both ends of an optical channel, a light source is placed at one end to emit light, and an optical power meter is used to receive light at the other end. Light source optical power - measured point optical power = optical attenuation;

[0083] Currently, the optical fiber attenuation value within the industry standard is normal within -30 dB, and the lower the better. The maximum allowable loss of the optical fiber is -40 dB. When the optical attenuation exceeds -30 dB, network latency and data packet loss will increase significantly.

[0084] 95% abnormal traffic algorithm: Take a point every 5 minutes, 12 points in 1 hour, 12 * 24 points in 1 day, and 12 * 24 * 30 = 8640 points in a month calculated according to 30 days. Then remove the 5% of the traffic with the highest value, and the remaining 95% is the normal traffic range. The number of billing points is 8208 points. There are 432 points that do not need to be billed, that is, the abnormal traffic range.

[0085] Based on the industry-standard network traffic 95% algorithm and optical attenuation monitoring indicators, the present invention conducts abnormal network traffic backtracking analysis by constructing a Bayesian traffic backtracking model. It provides a more standard, accurate, and scientific traffic value for the normal traffic value in the current time period. It greatly reduces the economic losses caused by the inaccuracy of traffic cost accounting due to abnormal network bandwidth traffic, and at the same time improves the security of network traffic and the efficiency of system services.

[0086] The above is only the preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions falling within the idea of the present invention belong to the protection scope of the present invention. It should be noted that for those of ordinary skill in the art in this technical field, several improvements and refinements made without departing from the principle of the present invention should be regarded as within the protection scope of the present invention.

Claims

1. A Bayesian-based abnormal network traffic backtracking method, characterized in that, Including: Step 1: Obtain the range for abnormal traffic backtracking analysis through the 95 billing traffic algorithm; Step 2: For different optical attenuation commands obtained for different network devices, execute the corresponding operation commands for the adapted network devices through the network device adaptation program to obtain the optical attenuation value when the abnormal traffic occurs, and store it in the optical attenuation database to confirm the cause of the abnormality. For abnormalities caused by traffic, proceed to Step 3; Step 2 includes: S1: Collect the optical attenuation values of the network ports during the time period of the range for abnormal traffic backtracking analysis in Step 1 through the program; S2: Compare the optical attenuation value data in S1 with the historical average optical attenuation value standard system to reconfirm whether the current traffic abnormality is caused by traffic or by hardware failures such as optical modules resulting in network traffic abnormalities; Step 3: Construct a Bayesian traffic backtracking model, combine it with the pre-set historical fault database, analyze the optical attenuation data in the optical attenuation database, and obtain the probability that the traffic after backtracking of the abnormal traffic occurring within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the backtracking.

2. The method for backtracking abnormal network traffic based on Bayesian according to claim 1, characterized in that In Step 1, through the 95 billing traffic algorithm, one point is taken every 5 minutes, so 12 points are taken in one hour, 12 * 24 points are taken in one day, and 12 * 24 * 30 = 8640 points are taken in one month calculated according to 30 days; Remove the 5% of the points with the highest traffic from the 8640 points obtained, and the remaining 95% of the points form the normal traffic range, that is: the number of billing points obtained is 8208 points. Among the 8640 points, 432 points are not billed, forming the range for abnormal traffic backtracking analysis.

3. The method for abnormal network traffic backtracking based on Bayesian according to claim 1, characterized in that, The optical attenuation database in Step 2 stores the optical attenuation value data, IPs of network devices of different manufacturers and models, with a time interval of five minutes; the unit of the optical attenuation value data is db.

4. A Bayesian-based abnormal network traffic backtracking method according to claim 1, characterized in that The historical fault database in Step 3 stores the content, level and type of abnormal network faults, the faulty devices and IPs, and the fault initiation and completion times.

5. A Bayesian-based abnormal network traffic backtracking method according to claim 1, characterized in that, The model formula of the Bayesian traffic backtracking model in Step 3 is: ZY(D|+) = ZY(+|D)ZY(D) / (ZY(+|D)ZY(D) + ZY(+|N)ZY(N)) Among them, ZY(+|D) is the accuracy rate of the optical attenuation value when the abnormal traffic optical attenuation value fault occurs; ZY(D) is the incidence rate of the abnormal traffic optical attenuation value fault. The incidence rate of the abnormal traffic optical attenuation value fault = the total number of historical abnormal traffic optical attenuation value faults / the total number of abnormal traffic optical attenuation value faults in the historical fault database; ZY(+|N) is the probability of being misjudged as an abnormal traffic optical attenuation value fault = the number of false alarms in the same time period / the total number of abnormal traffic optical attenuation value faults in the same time period; ZY(N) = represents the probability that the abnormal traffic optical attenuation value does not have a fault.

6. A Bayesian-based abnormal network traffic backtracking system for implementing the Bayesian-based abnormal network traffic backtracking method according to any one of claims 1-5, characterized in that, The system includes a 95 abnormal traffic algorithm module, an optical attenuation value data acquisition module, and a Bayesian traffic backtracking module; The 95 abnormal traffic algorithm module is used to obtain the range for abnormal traffic backtracking analysis through the 95 billing traffic algorithm; The optical attenuation value data acquisition module is used to obtain different optical attenuation commands for different network devices, execute the operation commands corresponding to the adapted network devices through the network device adaptation program to obtain the optical attenuation value when abnormal traffic occurs, store it in the optical attenuation database, confirm the cause of the abnormality, and for the abnormality caused by traffic, enter the Bayesian traffic traceback module; In the optical attenuation value data acquisition module, the optical attenuation value of the network port is collected through program execution during the time period to be analyzed for abnormal traffic traceback in Step 1; the optical attenuation value data is compared with the historical average optical attenuation value standard system to reconfirm whether the current traffic abnormality is caused by traffic or by hardware failures such as optical modules resulting in network traffic abnormalities; The Bayesian traffic traceback module is used to construct a Bayesian traffic traceback model, analyze the optical attenuation data in the optical attenuation database in combination with the preset historical fault database, and obtain the probability that the traffic after the abnormal traffic traceback within a specified time period is close to the real traffic. The greater the probability, the higher the authenticity of the traceback.

Images