Port traffic false active alarm method, device, equipment, medium and program product

Abstract

The present disclosure provides a port traffic false active alarm method, which can be applied to the field of network security technology. The port traffic false active alarm method includes: collecting real-time port traffic of a first port; obtaining a port dynamic baseline of the first port, wherein the port dynamic baseline is obtained by training based on historical port traffic information of the first port; monitoring the real-time port traffic based on the port dynamic baseline; and issuing a port traffic false active alarm when the time when the real-time port traffic is below the port dynamic baseline reaches a preset false active determination time. The present disclosure also provides a port traffic false active alarm device, equipment, storage medium and program product.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a port traffic false active alarm method, device, equipment, medium and program product. Background Art

[0002] At present, in the field of central network operation and maintenance, false active events of network device ports occur from time to time. False active events refer to events that are normal on the configuration and status planes but abnormal on the forwarding plane. For network device port traffic false active events, it is usually necessary to manually log in to the network device and query the traffic of the network device port through specific instructions to further investigate whether the network device has port traffic false active events.

[0003] However, this method has a low degree of automation and cannot detect false activity events and complete fault location in a timely manner. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a port traffic false active alarm method, apparatus, device, medium and program product for improving the timeliness and accuracy of the port traffic false active alarm.

[0005] According to a first aspect of the present disclosure, a port traffic false active alarm method is provided, comprising: collecting real-time port traffic of a first port; obtaining a port dynamic baseline of the first port, wherein the port dynamic baseline is trained based on historical port traffic information of the first port; monitoring the real-time port traffic based on the port dynamic baseline; and issuing a port traffic false active alarm when the time when the real-time port traffic is below the port dynamic baseline reaches a preset false active determination time.

[0006] According to an embodiment of the present disclosure, after collecting the real-time port traffic of the first port, the method further includes: issuing a port traffic false active alarm when the time when the real-time port traffic is zero reaches a preset false active determination time.

[0007] According to an embodiment of the present disclosure, the training method of the port dynamic baseline includes: obtaining the historical port traffic information; preprocessing the historical port traffic information to obtain the historical port timing traffic; and training based on the historical port timing traffic through a preset dynamic baseline training model to obtain the port dynamic baseline.

[0008] According to an embodiment of the present disclosure, the preprocessing of the historical port traffic information to obtain the historical port timing traffic includes: arranging the port traffic in the historical port traffic information in chronological order to form the historical port timing traffic.

[0009] According to an embodiment of the present disclosure, the port dynamic baseline is obtained by training based on the historical port timing traffic through a preset dynamic baseline training model, including: predicting the port dynamic baseband based on the historical port timing traffic, the port dynamic baseband including a port dynamic upper baseline and a port dynamic lower baseline; and selecting the port dynamic lower baseline as the port dynamic baseline.

[0010] According to an embodiment of the present disclosure, when the time when the real-time port traffic is below the dynamic baseline of the port reaches a preset false alive determination time, a port traffic false alive alarm is issued, or when the time when the real-time port traffic is zero reaches a preset false alive determination time, the port traffic false alive alarm is issued, including: determining the network area where the first port is located; determining the area level based on the network area; and obtaining the preset false alive determination time based on the area level.

[0011] According to an embodiment of the present disclosure, the port traffic pseudo-active determination time is determined based on an ARP entry aging time, a MAC entry aging time, a routing protocol, and a TCP protocol.

[0012] A second aspect of the present disclosure provides a port traffic false active alarm device, comprising: a real-time port traffic acquisition module, a port dynamic baseline acquisition module, a dynamic monitoring module and a false active alarm module, wherein the real-time port traffic acquisition module is used to collect real-time port traffic of a first port; the port dynamic baseline acquisition module is used to obtain a port dynamic baseline of the first port, wherein the port dynamic baseline is obtained by training based on historical port traffic information of the first port; the dynamic monitoring module is used to monitor the real-time port traffic based on the port dynamic baseline; and the false active alarm module is used to issue a port traffic false active alarm when the time when the real-time port traffic is below the port dynamic baseline reaches a preset false active determination time.

[0013] According to an embodiment of the present disclosure, the device further includes: a static monitoring module, which is used to issue a false active alarm of the port traffic when the time when the real-time port traffic is zero reaches a preset false active determination time.

[0014] According to an embodiment of the present disclosure, the device further includes: a port dynamic baseline training module, which is used to obtain the historical port traffic information; pre-process the historical port traffic information to obtain the historical port timing traffic; and based on the historical port timing traffic, train through a preset dynamic baseline training model to obtain the port dynamic baseline.

[0015] According to an embodiment of the present disclosure, the port dynamic baseline training module is further used to arrange the port traffic in the historical port traffic information in chronological order to form the historical port timing traffic.

[0016] According to an embodiment of the present disclosure, the port dynamic baseline training module is also used to predict the port dynamic baseband based on the historical port timing traffic, and the port dynamic baseband includes a port dynamic upper baseline and a port dynamic lower baseline; and select the port dynamic lower baseline as the port dynamic baseline.

[0017] According to an embodiment of the present disclosure, the device further includes: a false active determination time acquisition module, configured to determine a network area where the first port is located; determine an area level based on the network area; and acquire the preset false active determination time based on the area level.

[0018] According to an embodiment of the present disclosure, the port traffic pseudo-active determination time is determined based on an ARP entry aging time, a MAC entry aging time, a routing protocol, and a TCP protocol.

[0019] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned port traffic false active alarm method.

[0020] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned port traffic false active alarm method.

[0021] According to a fifth aspect of the present disclosure, a computer program product is provided, including a computer program, which implements the above-mentioned port traffic false active alarm method when executed by a processor.

[0022] In the embodiments of the present disclosure, the real-time port traffic is monitored through the pre-trained port dynamic baseline, and the refined monitoring of the monitoring object is realized according to the historical characteristics and rules, thereby improving the accuracy of the traffic monitoring on the port. At the same time, the automated monitoring of port traffic false active events greatly improves the timeliness of port traffic false active event alarms and reduces the operation and maintenance risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0024] Figure 1The application scenario diagram of the port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown.

[0025] Figure 2 The flowchart of the port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown.

[0026] Figure 3 The flowchart of the port dynamic baseline training method according to the embodiment of the present disclosure is schematically shown.

[0027] Figure 4 The flowchart of the method for determining the false-alive determination time according to an embodiment of the present disclosure is schematically shown.

[0028] Figure 5 The structural block diagram of the port traffic false active alarm device according to an embodiment of the present disclosure is schematically shown.

[0029] Figure 6 A block diagram of an electronic device suitable for implementing a port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0031] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0032] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0033] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0034] Before the embodiments of the present disclosure are disclosed in detail, the key technical terms to be used in the present disclosure are explained one by one:

[0035] False active event: refers to an event in which the configuration and status planes of the network device port are normal, but the forwarding plane is abnormal.

[0036] Simple Network Management Protocol: (SNMP) supports operations such as monitoring network status, modifying network device configuration, and receiving network event warnings.

[0037] Address Resolution Protocol (ARP for short) is a TCP / IP protocol that obtains the physical address based on the IP address.

[0038] Transmission Control Protocol: (Transmission Control Protocol, abbreviated as TCP) is a connection-oriented, reliable, byte stream-based transport layer communication protocol.

[0039] Static routing protocol: It is a unidirectional routing protocol manually configured by the administrator. It lacks flexibility and is only suitable for small and medium-sized networks with few routing entries to be configured.

[0040] Routing Information Protocol: (Routing Information Protocol, abbreviated as RIP) is an internal gateway protocol and dynamic routing protocol.

[0041] Open Shortest Path First (OSPF) is a typical link-state routing protocol. Routers exchange routing status rather than routing tables. OSPF obtains all link status information in the network and calculates the precise network path to each destination.

[0042] Dynamic baseline: A baseline predicted through historical data. This baseline can be used to determine whether an abnormality has occurred. It should be noted that dynamic is a statement compared to static. The dynamic baseline is obtained through historical data training. At the same time, due to the inconsistency of the sampling period and sampling time of historical data, the dynamic baseline can also change in real time.

[0043] Dynamic baseband: The range defined by the dynamic baseline (or dynamic upper baseline and dynamic lower baseline) including the upper and lower thresholds is called the dynamic baseband.

[0044] In the prior art, no timely and effective monitoring means are adopted for port traffic false active events, resulting in that port traffic false active events cannot be discovered in time. Furthermore, if a fixed traffic threshold is used to monitor false active events, the accuracy of abnormal alarms is low and excessive operation and maintenance resources are consumed.

[0045] An embodiment of the present disclosure provides a port traffic false active alarm method, which collects real-time port traffic of a first port; obtains a port dynamic baseline of the first port, wherein the port dynamic baseline is trained based on historical port traffic information of the first port; monitors the real-time port traffic based on the port dynamic baseline; and issues a port traffic false active alarm when the time when the real-time port traffic is below the port dynamic baseline reaches a preset false active determination time.

[0046] In the embodiments of the present disclosure, the real-time port traffic is monitored through the pre-trained port dynamic baseline, and the refined monitoring of the monitoring object is realized according to the historical characteristics and rules, thereby improving the accuracy of the traffic monitoring on the port. At the same time, the automated monitoring of port traffic false active events greatly improves the timeliness of port traffic false active event alarms and reduces the operation and maintenance risks.

[0047] Figure 1 The application scenario diagram of the port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown.

[0048] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0049] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0050] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0051] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0052] It should be noted that the port traffic false active alarm method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the port traffic false active alarm device provided in the embodiment of the present disclosure can generally be set in the server 105. The port traffic false active alarm method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the port traffic false active alarm device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0053] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0054] The following will be based on Figure 1 The scene described by Figure 2 to Figure 4 The port traffic false active alarm method of the disclosed embodiment is described in detail.

[0055] Figure 2 The flowchart of the port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown.

[0056] like Figure 2As shown, the port traffic false active alarm method of this embodiment includes operations S210 to S240 , and the port traffic false active alarm method can be executed by the server 105 .

[0057] In operation S210 , real-time port traffic of a first port is collected.

[0058] Specifically, the port traffic information may be collected based on the SNMP protocol. The collected traffic format may be as shown in the following Table 1:

[0059] Table 1

[0060]

[0061] It should be noted that network device port traffic collection is different from other WAN traffic collection. Network device port traffic collection is essentially traffic collection in the LAN. Therefore, the scope of traffic monitoring is smaller and the monitoring accuracy is finer. Therefore, compared with traffic collection in the WAN, a higher sampling frequency needs to be maintained for port traffic collection of network devices. For example, the sampling frequency in the WAN scenario can be set to 1 sampling every 2 minutes or 1 sampling every 1 minute, while the sampling frequency in the network device port scenario can be set to 1 sampling every 30 seconds or 1 sampling every 15 seconds.

[0062] In operation S220, a port dynamic baseline of the first port is obtained, wherein the port dynamic baseline is obtained by training based on historical port traffic information of the first port.

[0063] Specifically, as shown in Table 1 above, when the port is “port1”, the port dynamic baseline pre-trained corresponding to “port1” is selected accordingly.

[0064] In operation S230, the real-time port traffic is monitored based on the port dynamic baseline.

[0065] In operation S240, when the time during which the real-time port traffic is below the port dynamic baseline reaches a preset false-alive determination time, a port traffic false-alive alarm is issued.

[0066] According to an embodiment of the present disclosure, after collecting the real-time port traffic of the first port, the method further includes: issuing a port traffic false active alarm when the time when the real-time port traffic is zero reaches a preset false active determination time.

[0067] Specifically, when monitoring the real-time port traffic, if the time when the real-time port traffic is zero reaches a preset false-active determination time, it is no longer necessary to monitor the real-time port traffic through the port dynamic baseline.

[0068] It is understandable that the port dynamic baseline is a curve based on historical data fitting. Through this curve, the real-time port traffic can be monitored to determine whether the real-time port traffic is lower than the curve, and whether the time lower than the curve is greater than the preset false active determination time to determine the occurrence of a false active event. It should be noted that the port dynamic baseline may be 0, 1K or 10K at certain moments. Therefore, the port dynamic baseline is in a smaller traffic range and requires higher accuracy.

[0069] It can be understood that the time when the real-time port flow is 0, or the time when the real-time port flow is less than the dynamic port baseline, refers to a continuous and uninterrupted time.

[0070] In the embodiments of the present disclosure, the real-time port traffic is monitored through the pre-trained port dynamic baseline, and the refined monitoring of the monitoring object is realized according to the historical characteristics and rules, thereby improving the accuracy of the traffic monitoring on the port. At the same time, the automated monitoring of port traffic false active events greatly improves the timeliness of port traffic false active event alarms and reduces the operation and maintenance risks.

[0071] Figure 3 The flowchart of the port dynamic baseline training method according to the embodiment of the present disclosure is schematically shown.

[0072] like Figure 3 As shown, the port dynamic baseline training method of this embodiment includes operations S310 to S330.

[0073] In operation S310, the historical port traffic information is acquired.

[0074] In operation S320, the historical port traffic information is preprocessed to obtain historical port sequence traffic.

[0075] According to an embodiment of the present disclosure, the preprocessing of the historical port traffic information to obtain the historical port timing traffic includes: arranging the port traffic in the historical port traffic information in chronological order to form the historical port timing traffic.

[0076] In operation S330, based on the historical port timing traffic, training is performed through a preset dynamic baseline training model to obtain the port dynamic baseline.

[0077] According to an embodiment of the present disclosure, the port dynamic baseline is obtained by training based on the historical port timing traffic through a preset dynamic baseline training model, including: predicting the port dynamic baseband based on the historical port timing traffic, the port dynamic baseband including a port dynamic upper baseline and a port dynamic lower baseline; and selecting the port dynamic lower baseline as the port dynamic baseline.

[0078] Specifically, the preset dynamic baseline training model may adopt a prophet model.

[0079] The process of collecting the historical port traffic is consistent with the process of collecting the real-time traffic. After the historical port traffic is collected, it is pre-processed to form the historical port timing traffic. The historical port timing traffic is shown in the following Table 2:

[0080] Table 2

[0081] TimeSTP (collection time) Value (flow value) 1650045601 344080.4666 1650047701 300141.1922 1650050701 52483.17835 1650051302 51837.34506 1650051901 58452.11422 1650052201 51522.60258 1650052801 369279.2796 1650053401 542152.5353 1650053702 51836.12852 1650059101 52458.31973 … …

[0082] As shown in Table 2 above, for the flow data of the same port, the historical port timing flow is formed in the order of the collection time. And the historical port timing flow is put into the prophet model to predict the future port flow. Furthermore, through the predicted future port flow, a port dynamic baseband can be formed, and the port dynamic baseline includes an upper threshold and a lower threshold (or upper and lower baselines), and the upper threshold and the lower threshold are curves. For false active events, the present disclosure only cares about the sudden drop in port flow, therefore, only the lower threshold of the port dynamic baseline is taken as the port dynamic baseline.

[0083] Figure 4 The flowchart of the method for determining the false-alive determination time according to an embodiment of the present disclosure is schematically shown.

[0084] like Figure 4 As shown, the method for determining the false active determination time of this embodiment includes operations S410 to S430.

[0085] In operation S410, a network area where the first port is located is determined.

[0086] In operation S420, a region level is determined based on the network region.

[0087] In operation S430, the preset false active determination time is acquired based on the area level.

[0088] According to an embodiment of the present disclosure, the network area includes multiple areas, different network areas correspond to different area levels, and the preset false active determination time includes multiple areas, different area levels correspond to different preset false active determination times.

[0089] According to an embodiment of the present disclosure, the port traffic pseudo-active determination time is determined based on an ARP entry aging time, a MAC entry aging time, a routing protocol, and a TCP protocol.

[0090] Specifically, the above-mentioned port traffic pseudo-active determination time can be determined based on a single item among the above-mentioned ARP table entry aging time, MAC table entry aging time, routing protocol and TCP protocol, or can be determined based on any combination of the above-mentioned ARP table entry aging time, MAC table entry aging time, routing protocol and TCP protocol. Among them, the routing protocol includes static routing protocol, RIP dynamic routing protocol and OSPF dynamic routing protocol, etc. Among them, the ARP table entry aging time and the MAC table entry aging time have different settings in different devices and / or different systems. Therefore, when considering the table entry aging time, it is necessary to comprehensively consider the specific device conditions and system conditions.

[0091] Specifically, through the network area where the port is located. For example, two levels of network areas are now divided, namely network area 1 and network area 2. Among them, network area 1 is a relatively core and important network area, and network area 2 is a non-core network area. Therefore, for network area 1, the preset false live determination time is calculated strictly according to the port protocol. Therefore, even if a false alarm occurs in the false live determination time calculated strictly according to the port protocol, it does not matter. The primary purpose of the core network area is to ensure that the core network can operate normally. For non-core network areas, developers can add a certain error value on the basis of the port traffic false live determination time calculated strictly according to the port protocol, so that the false alarm can be reduced in the non-core network area. For example, the preset port traffic false live determination time of the core network area is set to 2 minutes, that is, when the real-time traffic of the port in the core network area is under the dynamic baseline of the port for 2 consecutive minutes, a false live alarm is executed. For another example, the preset port traffic false live determination time of the non-core network area is set to 5 minutes, that is, when the real-time traffic of the port in the non-core network area is under the dynamic baseline of the port for 5 consecutive minutes, a false live alarm is executed.

[0092] Based on the above port traffic false active alarm method, the present disclosure also provides a port traffic false active alarm device. Figure 5 The device is described in detail.

[0093] Figure 5 The structural block diagram of the port traffic false active alarm device according to an embodiment of the present disclosure is schematically shown.

[0094] like Figure 5As shown, the port traffic false active alarm device 500 of this embodiment includes a real-time port traffic acquisition module 510 , a port dynamic baseline acquisition module 520 , a dynamic monitoring module 530 and a false active alarm module 540 .

[0095] The real-time port traffic acquisition module 510 is used to collect the real-time port traffic of the first port. In one embodiment, the real-time port traffic acquisition module 510 can be used to perform the operation S210 described above, which will not be described in detail here.

[0096] The port dynamic baseline acquisition module 520 is used to acquire the port dynamic baseline of the first port, wherein the port dynamic baseline is obtained by training based on the historical port traffic information of the first port. In one embodiment, the port dynamic baseline acquisition module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0097] The dynamic monitoring module 530 is used to monitor the real-time port traffic based on the port dynamic baseline. In one embodiment, the dynamic monitoring module 530 can be used to perform the operation S230 described above, which will not be described in detail here.

[0098] The false live alarm module 540 is used to issue a port traffic false live alarm when the time for which the real-time port traffic is below the port dynamic baseline reaches a preset false live determination time. In one embodiment, the false live alarm module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0099] According to an embodiment of the present disclosure, the device further includes: a static monitoring module, which is used to issue a false active alarm of the port traffic when the time when the real-time port traffic is zero reaches a preset false active determination time.

[0100] According to an embodiment of the present disclosure, the device further includes: a port dynamic baseline training module, which is used to obtain the historical port traffic information; pre-process the historical port traffic information to obtain the historical port timing traffic; and based on the historical port timing traffic, train through a preset dynamic baseline training model to obtain the port dynamic baseline.

[0101] According to an embodiment of the present disclosure, the port dynamic baseline training module is further used to arrange the port traffic in the historical port traffic information in chronological order to form the historical port timing traffic.

[0102] According to an embodiment of the present disclosure, the port dynamic baseline training module is also used to predict the port dynamic baseband based on the historical port timing traffic, and the port dynamic baseband includes a port dynamic upper baseline and a port dynamic lower baseline; and select the port dynamic lower baseline as the port dynamic baseline.

[0103] According to an embodiment of the present disclosure, the device further includes: a false active determination time acquisition module, configured to determine a network area where the first port is located; determine an area level based on the network area; and acquire the preset false active determination time based on the area level.

[0104] According to an embodiment of the present disclosure, the port traffic pseudo-active determination time is determined based on an ARP entry aging time, a MAC entry aging time, a routing protocol, and a TCP protocol.

[0105] According to an embodiment of the present disclosure, any multiple modules among the real-time port traffic acquisition module 510, the port dynamic baseline acquisition module 520, the dynamic monitoring module 530 and the false live alarm module 540 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the real-time port traffic acquisition module 510, the port dynamic baseline acquisition module 520, the dynamic monitoring module 530 and the false live alarm module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the real-time port traffic acquisition module 510, the port dynamic baseline acquisition module 520, the dynamic monitoring module 530 and the false active alarm module 540 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0106] Figure 6 A block diagram of an electronic device suitable for implementing a port traffic false active alarm method according to an embodiment of the present disclosure is schematically shown.

[0107] like Figure 6As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0108] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0109] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the I / O interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0110] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0111] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0112] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0113] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0114] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0115] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0116] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0117] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0118] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0119] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A port traffic false active alarm method, comprising: Collecting real-time port traffic of the first port; Acquire a port dynamic baseline of the first port, wherein the port dynamic baseline is obtained by training based on historical port traffic information of the first port, and the port dynamic baseline is a port lower baseline of a dynamic baseband, and the dynamic baseband is obtained by training based on historical port traffic information of the first port; Monitoring the real-time port traffic based on the port dynamic baseline; and When the time for which the real-time port traffic is below the dynamic baseline of the port reaches a preset false-alive determination time, a port traffic false-alive alarm is issued; or when the time for which the real-time port traffic is zero reaches a preset false-alive determination time, the port traffic false-alive alarm is issued; Wherein, when the time when the real-time port traffic is below the dynamic baseline of the port reaches a preset false alive determination time, a port traffic false alive alarm is issued, or when the time when the real-time port traffic is zero reaches a preset false alive determination time, the port traffic false alive alarm is issued, including: determining the network area where the first port is located; determining the area level based on the network area; and obtaining the preset false alive determination time based on the area level, wherein the core degree of the area level is negatively correlated with the length of the preset false alive determination time.

2. The method according to claim 1, wherein: The training method of the port dynamic baseline includes: Obtaining the historical port traffic information; Preprocessing the historical port traffic information to obtain historical port timing traffic; and Based on the historical port timing traffic, training is performed through a preset dynamic baseline training model to obtain the port dynamic baseline.

3. The method according to claim 2, wherein: The preprocessing of the historical port traffic information to obtain the historical port timing traffic includes: The port traffic in the historical port traffic information is arranged in chronological order to form the historical port time sequence traffic.

4. The method according to claim 2, wherein: The method of training the historical port timing traffic by a preset dynamic baseline training model to obtain the port dynamic baseline includes: Based on the historical port timing traffic, predicting a port dynamic baseband, the port dynamic baseband including a port dynamic upper baseline and a port dynamic lower baseline; and The port dynamic lower baseline is selected as the port dynamic baseline.

5. The method according to claim 4, wherein: The port traffic pseudo-active determination time is determined based on the ARP table entry aging time, the MAC table entry aging time, the routing protocol and the TCP protocol.

6. A port traffic false active alarm device, comprising: Real-time port traffic acquisition module, port dynamic baseline acquisition module, dynamic monitoring module and false alarm module, in, The real-time port traffic acquisition module is used to collect the real-time port traffic of the first port; The port dynamic baseline acquisition module is used to acquire the port dynamic baseline of the first port, wherein the port dynamic baseline is obtained by training based on the historical port traffic information of the first port, and the port dynamic baseline is the port baseline of the dynamic baseband, and the dynamic baseband is obtained by training based on the historical port traffic information of the first port; The dynamic monitoring module is used to monitor the real-time port traffic based on the port dynamic baseline; and The false live alarm module is used to issue a port traffic false live alarm when the time when the real-time port traffic is below the port dynamic baseline reaches a preset false live determination time; or to issue the port traffic false live alarm when the time when the real-time port traffic is zero reaches a preset false live determination time; Wherein, when the time when the real-time port traffic is below the dynamic baseline of the port reaches a preset false alive determination time, a port traffic false alive alarm is issued, or when the time when the real-time port traffic is zero reaches a preset false alive determination time, the port traffic false alive alarm is issued, including: determining the network area where the first port is located; determining the area level based on the network area; and obtaining the preset false alive determination time based on the area level, wherein the core degree of the area level is negatively correlated with the length of the preset false alive determination time.

7. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images