Abnormal flow detection method, device, electronic device and storage medium

Abstract

The present application relates to the field of communication technology, and in particular to an abnormal traffic detection method, device, electronic device and storage medium. In the method, N service types of each service flow are identified; N is an integer greater than or equal to 1; the comprehensive service flow is determined according to the alarm coefficient of the nth service type and the service flow of the nth service type; n is an integer greater than or equal to 1 and less than N; when the comprehensive service flow is greater than or equal to a second threshold, an alarm message is generated. The above scheme accurately identifies the service type of the service flow input by the user during the abnormal traffic detection process. Abnormal traffic is detected in time according to the alarm coefficient of the service type, forming a strong protection for the service flow and improving the efficiency of abnormal traffic detection.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an abnormal traffic detection method, device, electronic device and storage medium. Background Art

[0002] Abnormal network traffic is caused by various network attacks, which can affect the performance of the network. Therefore, as network traffic tends to be massive and complex, detecting and analyzing network traffic has become an important challenge and research in the field of network security. With the continuous development of informatization, almost all companies need to provide services, promote products, and establish brands through websites and applications. In order to provide stable and high-quality services, the company's informatization facilities must be well equipped for abnormal traffic identification and protection to ensure data security and system availability.

[0003] How to detect abnormal traffic has become an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide an abnormal traffic detection method, device, electronic device and storage medium for identifying the service type of user service traffic and detecting abnormal traffic.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting abnormal traffic, including:

[0006] Identify N service types of each service flow; N is an integer greater than or equal to 1;

[0007] Determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; wherein n is an integer greater than or equal to 1 and less than N;

[0008] The alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information; the historical alarm information is obtained within one or more preset periods, the prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of the one or more preset periods, and the historical comprehensive service flow is determined according to the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within one of the preset periods;

[0009] When the integrated service flow is greater than or equal to the second threshold, an alarm message is generated.

[0010] The above method, during the abnormal traffic detection process, accurately identifies the business type of the business traffic input by the user, detects the abnormal traffic in a timely manner, forms an effective protection for the business traffic, and improves the efficiency of abnormal traffic detection.

[0011] Optionally, the method further includes:

[0012] When the alarm information reaches a preset value, sending an alarm to the user;

[0013] Receive abnormal traffic protection instructions sent by users;

[0014] The abnormal traffic protection instruction is sent to the protection device to execute the operation corresponding to the abnormal traffic protection instruction.

[0015] The above method sends an alarm to the user and receives the abnormal traffic protection instruction sent by the user, so that the alarm information can be processed in time, the protection device performs the protection operation in time, and the protection efficiency is improved.

[0016] Optionally, the method further includes:

[0017] According to the prediction accuracy of the nth business type, the priority information of the N business types is determined; according to the order of the priority information from high to low, a detection chain is generated; the detection chain includes the nth business type and the alarm coefficient of the nth business type.

[0018] The above method determines the priority information of n service types, generates a detection chain, and determines the alarm coefficient of the service type, so that the alarm coefficients of different service types are updated in the detection chain.

[0019] Optionally, generating a detection chain according to the order of the priority information from high to low includes:

[0020] Determine the historical integrated service flow according to the kth detection information point and the first alarm coefficient of the kth detection information point; the kth detection information point is the nth service type determined in descending order of priority in the detection chain; k is an integer greater than or equal to 0;

[0021] When the historical integrated service flow is less than a first threshold, determining an updated first alarm coefficient according to the first alarm coefficient and a preset step size;

[0022] In the case where the historical comprehensive service flow is greater than or equal to the first threshold, determining the prediction accuracy of the detection chain; the prediction accuracy is the prediction accuracy of the kth detection information point in the historical alarm information;

[0023] When the prediction accuracy is greater than or equal to a preset probability, the first alarm coefficient is determined as the alarm coefficient of the kth detection information point.

[0024] The above method determines the first alarm coefficient as the alarm coefficient of the kth detection information point by comparing the historical comprehensive service flow with the first threshold, and updates the alarm coefficient of the kth detection information point.

[0025] Optionally, the method further includes:

[0026] In the case where the prediction accuracy of the detection chain is less than a preset probability, determining an updated first alarm coefficient according to the first alarm coefficient and the preset step size;

[0027] An updated historical integrated service flow is determined according to the kth detection information point and the updated first alarm coefficient.

[0028] The above method determines the updated historical comprehensive service flow by updating the first alarm coefficient, and further determines whether the above alarm coefficient can be used as the alarm coefficient of the kth detection information point.

[0029] Optionally, the method further includes:

[0030] When the updated first alarm coefficient reaches a maximum value and the historical integrated service flow is less than the first threshold, or the prediction accuracy is less than the preset probability, the updated historical integrated service flow is determined according to the kth detection information point and the maximum value of the alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point; the k+1th detection information point is the n+1th service type determined in descending order of priority in the detection chain;

[0031] In a case where the updated historical integrated service flow is less than the first threshold, an updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size.

[0032] The above method determines the updated historical comprehensive service flow by updating the second alarm coefficient of the k+1th detection information point, and further determines whether the above first alarm coefficient can be used as the alarm coefficient of the kth detection information point, and whether the above second alarm coefficient can be used as the alarm coefficient of the kth detection information point.

[0033] Optionally, the method further includes:

[0034] In the case where the updated historical comprehensive service flow is greater than or equal to the first threshold, determining an updated prediction accuracy; the updated prediction accuracy is the prediction accuracy of the kth detection information point and the k+1th detection information point in the historical alarm information;

[0035] When the updated prediction accuracy is greater than or equal to the preset probability, the maximum value of the alarm coefficient is determined as the alarm coefficient of the kth detection information point, and the updated second alarm coefficient is determined as the alarm coefficient of the k+1th detection information point.

[0036] The above method determines the prediction accuracy rate. When the prediction accuracy rate is greater than or equal to the preset probability, the maximum value of the alarm coefficient is determined as the alarm coefficient of the kth detection information point, and the updated second alarm coefficient is determined as the alarm coefficient of the k+1th detection information point.

[0037] Optionally, the method further includes:

[0038] When the updated prediction accuracy is less than the preset probability, an updated second warning coefficient is determined according to the second warning coefficient and the preset step size.

[0039] The method determines the updated second alarm coefficient by the second alarm coefficient and the preset step size, and further determines whether the first alarm coefficient can be used as the alarm coefficient of the kth detection information point, and whether the second alarm coefficient can be used as the alarm coefficient of the kth detection information point.

[0040] In a second aspect, an embodiment of the present application provides an abnormal flow detection device, comprising:

[0041] An identification module, used to identify N service types of each service flow; N is an integer greater than or equal to 1;

[0042] A processing module, configured to determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; wherein n is an integer greater than or equal to 1 and less than N;

[0043] The alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information; the historical alarm information is obtained within one or more preset periods, the prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of the one or more preset periods, and the historical comprehensive service flow is determined according to the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within one of the preset periods;

[0044] A generating module is used to generate alarm information when the comprehensive service flow is greater than or equal to a second threshold.

[0045] In a third aspect, an embodiment of the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any one of the abnormal traffic detection methods in the first aspect described above.

[0046] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the abnormal traffic detection method of the first aspect is implemented.

[0047] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, wherein the computer program is executed by a processor to implement the abnormal traffic detection method as described in any one of the first aspects above.

[0048] The technical effects brought about by any one of the implementation methods in the second to fifth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 A schematic diagram of an application scenario of an abnormal traffic detection method provided in an embodiment of the present application;

[0050] Figure 2 A flow chart of an abnormal flow detection method provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of an alarm SMS prompt interface provided in an embodiment of the present application;

[0052] Figure 4 A flow chart for determining a detection chain provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of a detection chain provided in an embodiment of the present application;

[0054] Figure 6 Another detection chain schematic diagram provided for an embodiment of the present application;

[0055] Figure 7 Another detection chain schematic diagram provided for an embodiment of the present application;

[0056] Figure 8 Another detection chain schematic diagram provided for an embodiment of the present application;

[0057] Fig. 9 Another detection chain schematic diagram provided for an embodiment of the present application;

[0058] Fig.10An overall flow chart for detecting abnormal traffic provided by an embodiment of the present application;

[0059] Fig.11 A schematic diagram of an abnormal flow detection device provided in an embodiment of the present application;

[0060] Fig.12 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0062] The application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. It is known to those skilled in the art that with the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.

[0063] In order to provide stable and high-quality services, the information facilities of enterprises must be well equipped to identify and protect abnormal traffic to ensure data security and system availability. However, most of the existing protection methods for abnormal traffic have a certain degree of delay and cannot be customized according to the characteristics of the user's input business traffic. Therefore, it is necessary to identify the type of user input business traffic, manage the input business traffic in a refined manner, and detect abnormal traffic in a timely manner.

[0064] In order to solve the above problems, the embodiments of the present application provide an abnormal traffic detection method, device, electronic device and storage medium. For example, N service types of each service flow are identified. Wherein, N is an integer greater than or equal to 1. According to the alarm coefficient of the nth service type and the service flow of the nth service type, the comprehensive service flow is determined. Wherein, n is an integer greater than or equal to 1 and less than N. The alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information. The historical alarm information is obtained within one or more preset periods. The prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of one or more preset periods. The historical comprehensive service flow is determined according to the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period. When the comprehensive service flow is greater than or equal to the second threshold, an alarm message is generated. In this way, the service type of the service flow input by the user can be accurately identified, abnormal traffic can be detected in time, and a strong protection can be formed for the service flow. Provide users with better network services and improve user experience.

[0065] like Figure 1 As shown, a schematic diagram of an application scenario of an optional abnormal traffic detection method of an embodiment of the present application includes a server 100 and a terminal 101. The server 100 and the terminal 101 can be communicatively connected through a network to implement the abnormal traffic detection method of the present application.

[0066] The user can use the server 100 to interact with the terminal 101 through the network, such as receiving or sending messages, etc. Various client applications can be installed on the terminal 101, such as programming applications, web browser applications, search applications, etc. The terminal 101 can be various electronic devices with a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, desktop computers, etc.

[0067] The server 100 is used to identify N service types of each service flow. N is an integer greater than or equal to 1. According to the alarm coefficient of the nth service type and the service flow of the nth service type, the comprehensive service flow is determined. Among them, n is an integer greater than or equal to 1 and less than N. The alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information. The historical alarm information is obtained within one or more preset periods. The prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of one or more preset periods. The historical comprehensive service flow is determined based on the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period. When the comprehensive service flow is greater than or equal to the second threshold, an alarm message is generated. Among them, the server 100 can be implemented as an independent server or a server cluster consisting of multiple servers.

[0068] like Figure 2 As shown, a flow chart of an abnormal traffic detection method provided in an embodiment of the present application may specifically include the following steps:

[0069] Step S201, identifying N service types of each service flow; N is an integer greater than or equal to 1;

[0070] Step S202: determining the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; n is an integer greater than or equal to 1 and less than N;

[0071] Step S203: When the comprehensive service flow is greater than or equal to the second threshold, generate alarm information.

[0072] In an optional implementation, the user starts the client through the operation interface of the terminal and inputs the service flow. For example, the user can click a video link on the client to watch the video.

[0073] In step S201, after the user inputs the service flow, the server identifies N service types of the input service flow according to the data packets of the input service flow, and detects whether the user input service flow is abnormal flow, where N is an integer greater than or equal to 1.

[0074] In an optional implementation, after receiving user input business traffic, deep packet inspection (DPI) is used to identify the user input business traffic.

[0075] In an optional implementation, deploying DPI equipment to key network nodes, i.e., traffic entrances, can greatly reduce resource consumption on the server side. When users input business traffic, DPI can detect abnormal traffic in a timely manner, and perform in-depth detection on the application layer loads of different networks (such as Domain Name System (DNS), Hypertext Transfer Protocol (HTTP), etc.). Identify the business traffic input by users and perform refined management of the business type of business traffic. By determining the user's business type, further accurately identify the user's business traffic and the flow trends of different types of user business traffic. Based on DPI's statistical analysis, the control surface can be guided to optimize and adjust the configuration of hardware equipment. Thereby providing users with better network services and improving the user experience.

[0076] In an optional implementation, the DPI device identifies the data packets of the user's input service traffic into the service types in Table 1 according to the mainstream Internet service classification table shown in Table 1. By identifying each service type of the input service traffic, the refinement of controlling the input service traffic is improved.

[0077] For example, if the protocol type of the input service traffic is file transfer, then the service type of the service traffic is traditional data service. If the protocol type of the input service traffic is text message, then the service type of the service traffic is instant messaging service.

[0078]

[0079]

[0080] Table 1

[0081] Before identifying the user input service traffic into a certain type of service in Table 1, the protocol type of the service traffic data packet is matched and identified according to the port identification rule, keyword identification rule, and five-tuple matching rule contained in the DPI.

[0082] The following describes how to specifically identify the protocol type of input service traffic based on port identification rules, keyword identification rules, and five-tuple matching rules.

[0083] In an optional implementation, port identification is to match the service flow data packet port packet by packet according to the service common port, and to match according to Table 2, the common port service table.

[0084] For example, if the port number is Transmission Control Protocol (TCP) 20, the protocol type of the service flow is File Transfer Protocol. If the port number is TCP 23, the protocol type of the service flow is Remote Connection Command.

[0085]

[0086]

[0087] Table 2

[0088] In an optional implementation, keyword recognition is to match service traffic data packets input by data users containing keywords packet by packet according to the keywords in the knowledge base, and to match according to Table 3, a common service keyword table.

[0089] For example, if the data packet of the service flow input by the user includes "GET" at the beginning of the TCP content, the protocol type of the service flow is Hypertext Transfer Protocol (HTTP). If the data packet of the service flow input by the user includes 13 and 14 bytes at the beginning of the MAC frame as 0x0800, and the protocol field in the IP header is 0x02, the protocol type of the service flow is Internet Control Message Protocol (ICMP).

[0090]

[0091]

[0092] Table 3

[0093] Five-tuple identification, namely, the five-tuple identification of the Internet Protocol (IP), includes the source address, destination address, protocol type, source port number, and destination port number. According to the five-tuple hash table corresponding to the identified five-tuple and the service type. For the service flow data packet input by the user, the five-tuple of the data flow is extracted packet by packet, and the hash value is calculated according to the five-tuple information of the IP message using the preset hash algorithm. The hash value is used to search the data in the hash table to match the service type of the above service flow.

[0094] It should be noted that there is no fixed order of identification for the above-mentioned port identification, keyword identification, and five-tuple matching methods, and any method is feasible for matching service traffic data packets. After any of the above-mentioned methods successfully matches the service traffic data packets, other matching methods do not need to match the service traffic data packets again. After identifying the service traffic, the data information corresponding to each service type is stored according to different service types. Among them, the data information includes information such as traffic data.

[0095] In an optional implementation, the service type of the service traffic input by the user is identified according to a preset period.

[0096] For example, the preset period is set to 5 minutes. When the time point corresponding to the current preset period arrives, N service types of all input service flows between the time point corresponding to the previous preset period and the time point corresponding to the current preset period are identified.

[0097] In another optional implementation, when the user inputs the service traffic, the service type of the service traffic is identified in real time according to the data packets of the input service traffic.

[0098] In step S202, the alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information. The historical alarm information is obtained within one or more preset periods. The prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of one or more preset periods. The historical comprehensive service flow is determined based on the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within a preset period. Wherein, n is an integer greater than or equal to 1 and less than N. Optionally, n takes an integer from 1 to N.

[0099] For example, the comprehensive business flow is calculated based on the product of the alarm coefficient of the first business type and the business flow of the first business type; the product of the alarm coefficient of the second business type and the business flow of the second business type, and so on. The comprehensive business flow is calculated based on the sum of the products of the alarm coefficients of N business types and the business flow of the N business types.

[0100] For example, the alarm coefficient of the first service type is 1.5. The service flow of the first service type is 20 Gigabytes (G). The alarm coefficient of the second service type is 1.1. The service flow of the second service type is 15G. Then the comprehensive service flow is 1.5×20+1.1×15=46.5G.

[0101] It is understandable that the alarm coefficient of the service type may be a real number, such as 0, 1, 1.5, 2, etc. The alarm coefficient is updated based on historical alarm data and will be introduced later.

[0102] In step S203, in an optional implementation, when the integrated service flow is greater than or equal to the second threshold, an alarm message is generated. Wherein, the integrated service flow is greater than or equal to the second threshold, indicating that abnormal flow is detected, and an alarm message needs to be generated at this time. Wherein, the alarm message includes information such as address information, message length, Uniform Resource Identifier (URI), and flow data of the service flow input by the user.

[0103] The second threshold of the embodiment of the present application is determined based on the maximum value of the total business traffic model input by the user within a preset period, combined with the misjudgment tolerance for preventing business traffic jitter. The second threshold represents the maximum value of the business traffic input within the preset period within the normal range. The second threshold can also be an empirical value pre-set by a person skilled in the art, and the second threshold can be reasonably set according to the specific application scenario.

[0104] In an optional implementation, the user connects with the online security knowledge base in combination with the service type, establishes a local security knowledge base by using a big data analysis engine, compares the Internet Protocol (IP) equipment, traffic, traffic behavior and other information in the service traffic input by the user with the local knowledge base, and determines whether there is any alarm information. The above-mentioned local security knowledge base can be updated according to user needs.

[0105] In an optional implementation, when the alarm information reaches a preset value, an alarm is sent to the user. An abnormal flow protection instruction sent by the user is received, the abnormal flow protection instruction is sent to the protection device, and an operation corresponding to the abnormal flow protection instruction is executed.

[0106] If the alarm information reaches the preset value during the detection period, an alarm SMS is sent to the user. After receiving the alarm SMS, the user replies with a SMS indicating a specific protection instruction. After receiving the SMS indicating a specific protection instruction sent by the user, the abnormal traffic protection instruction is sent to the protection device according to the abnormal traffic protection instruction, and the operation corresponding to the abnormal traffic protection instruction is performed.

[0107] It should be noted that the detection cycle includes one or more preset cycles. The detection cycle, preset cycle, and preset value of the embodiment of the present application may be empirical values ​​pre-set by those skilled in the art, and the detection cycle, preset cycle, and preset value may be reasonably set according to specific application scenarios.

[0108] When the alarm information is detected to exceed the preset value, the embodiment of the present application performs automatic protection according to the user's instruction, which can improve the protection efficiency. At the same time, the manufacturer's protection capability is called only when the abnormal flow protection operation is necessary, which greatly reduces the protection cost.

[0109] For example, if the preset period is 5 minutes, the service flow input by the user will be tested every 5 minutes. The detection period is 1 hour. The preset value is 5. If the number of alarm messages exceeds the preset value of 5 within 1 hour, an alarm SMS will be sent to the user. Figure 3 As shown, the alarm message indicates that the abnormal traffic has exceeded the preset value within the detection period. It also indicates the protection instructions corresponding to the specific digital symbols. Reply 1 indicates traffic cleaning. Reply 2 indicates firewall reinforcement. If the user sends 1, the abnormal traffic protection instruction sent by the user is received. The abnormal traffic protection instruction is sent to the protection device, and the operation corresponding to the abnormal traffic protection instruction is executed.

[0110] It should be noted that the alarm coefficient of the nth service type in the embodiment of the present application is updated according to historical alarm information. The user can also reasonably set the alarm coefficient according to the specific application scenario.

[0111] The following describes how to update the alarm coefficient of the nth service type:

[0112] Below, through Figure 4 Introduce a method for generating a detection chain in an embodiment of the present application.

[0113] See also Figure 4 , is an exemplary flow chart of a method for generating a detection chain in an embodiment of the present application, which may include the following operations:

[0114] Step S401, determining the historical comprehensive service flow according to the maximum value of the alarm coefficient and the historical service flow of N service types in a preset period in the historical alarm information;

[0115] Step S402: determining the prediction accuracy of the nth service type according to the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of all preset periods in the historical alarm information;

[0116] Step S403: Determine priority information of N service types according to the prediction accuracy of the nth service type;

[0117] Step S404: determine the historical comprehensive service flow according to the kth detection information point and the first alarm coefficient of the kth detection information point; the kth detection information point is the nth service type determined in descending order of priority in the detection chain; k is an integer greater than or equal to 0;

[0118] Step S405, determining whether the historical integrated service flow is less than a first threshold; if so, executing step S406; if not, executing step S410;

[0119] Step S406, determining whether the first warning coefficient is less than the maximum warning coefficient, if so, executing step S408; if not, executing step S407;

[0120] Step S407: Determine the updated historical comprehensive service flow according to the kth detection information point and the maximum value of the alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point; the k+1th detection information point is the n+1th service type determined in descending order of priority in the detection chain; return to step S405;

[0121] Step S408: determining an updated first alarm coefficient according to the first alarm coefficient and a preset step size;

[0122] Step S409: determine the updated historical comprehensive service flow according to the kth detection information point and the updated first alarm coefficient; return to execute step S405;

[0123] Step S410, determining the prediction accuracy of the kth detection information point in the historical alarm information;

[0124] Step S411, determine whether the prediction accuracy is less than the preset probability; if so, return to step S406; if not, execute step S412;

[0125] Step S412: Determine the first alarm coefficient as the alarm coefficient of the kth detection information point.

[0126] In step S401, in an optional implementation, the historical comprehensive service flow of the nth service type is determined by combining the maximum value of the alarm coefficient and the historical service flow of the nth service type in a preset period in the historical alarm information. The historical comprehensive service flow of the N service types in a preset period is determined according to the maximum value of the alarm coefficient and the historical service flow of the N service types in a preset period in the historical alarm information.

[0127] It should be noted that the maximum value of the alarm coefficient may be an empirical value pre-set by a person skilled in the art, and the maximum value of the alarm coefficient may be reasonably set according to a specific application scenario, such as 1.4, 1.5 or 2.

[0128] It is understandable that, because the historical service traffic of the nth service type in different preset periods is not necessarily the same, the historical comprehensive service traffic of different service types in different preset periods is not necessarily the same. The first thresholds in different preset periods may be the same or different.

[0129] For example, in a certain preset period, the historical service flow of the instant messaging service is 20G. The maximum value of the alarm coefficient is 1.5. The historical service flow of the instant messaging service 20G is multiplied by the maximum value of the alarm coefficient 1.5 to obtain the historical comprehensive service flow 30G.

[0130] The first threshold of the embodiment of the present application is determined based on the maximum value of the total business traffic model input by the user within a preset period, combined with the misjudgment tolerance for preventing business traffic jitter. The first threshold represents the maximum value of the input business traffic within the normal range within the preset period. The first threshold can also be an empirical value pre-set by a person skilled in the art, and the first threshold can be reasonably set according to the specific application scenario.

[0131] In step S402, in an optional implementation, the historical integrated service flow is determined according to the maximum value of the alarm coefficient and the historical service flow of N service types in a preset period in the historical alarm information. When the historical integrated service flow of the nth service type in a preset period is greater than or equal to the first threshold, it indicates that the service type detection is successful once.

[0132] After determining that the nth service type has been successfully detected once, in all preset periods in which historical alarm information is obtained, the historical comprehensive service flow in each preset period is calculated based on the historical service flow and the maximum value of the alarm coefficient of the nth service type in each preset period, and compared with the first threshold in each preset period. The number of times the historical comprehensive service flow is greater than or equal to the first threshold is recorded. The ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the preset period is taken as the prediction accuracy of the nth service type.

[0133] After calculating the prediction accuracy of the nth business type, the method for calculating the prediction accuracy of the n+1th business type can be implemented by referring to the method for calculating the prediction accuracy of the nth business type, which will not be repeated here.

[0134] When calculating the historical comprehensive business flow of the nth business type, using the maximum value of the alarm coefficient can increase the number of times the historical comprehensive business flow of the nth business type in the historical alarm information is greater than or equal to the first threshold, thereby increasing the prediction accuracy of the above nth business type.

[0135] In step S403, in an optional implementation, after the prediction accuracy rates of the N service types are determined, priority information of the N service types is determined according to the prediction accuracy rate of the nth service type.

[0136] According to the descending order of the prediction accuracy of the nth service type, priority information of the prediction accuracy of the nth service type among the N service types is determined.

[0137] For example, as shown in Table 4, different service types, prediction success times, and prediction accuracy are represented respectively. The order of priority information from high to low is determined according to the magnitude of the prediction accuracy. The order of priority information from high to low is: instant messaging service, streaming media service, traditional data service, and P2P service.

[0138]

[0139]

[0140] Table 4

[0141] It should be noted that when the prediction accuracy of two business types is the same, the two business types with the same prediction accuracy can be sorted according to the business type priority order pre-set by technical personnel in this field, and the pre-set business type priority order can be reasonably set according to the specific application scenario.

[0142] In step S404, a detection chain is generated in descending order of priority information. The detection chain includes the nth business type and the alarm coefficient of the nth business type. In an optional implementation, the historical business flow of the kth detection information point is multiplied by the first alarm coefficient of the kth detection information point to determine the historical comprehensive business flow. The kth detection information point is the kth business type determined in descending order of priority in the detection chain. k is an integer greater than or equal to 0.

[0143] It should be noted that the first alarm coefficient may be an empirical value pre-set by a person skilled in the art, and the first alarm coefficient may be reasonably set according to a specific application scenario, such as 0, 1 or 2.

[0144] For example, within a preset period, in the detection chain, the first service type determined in descending order of priority is the instant messaging service, and the first detection information point is the instant messaging service. The first alarm coefficient is 1.0. The historical service flow of the instant messaging service is 20G, and the historical service flow of the instant messaging service is 20G multiplied by the first alarm coefficient 1.0 to obtain the historical comprehensive service flow.

[0145] In step S405, in an optional implementation, it is determined whether the historical integrated service flow is less than a first threshold. If the historical integrated service flow is less than the first threshold, step S406 is executed to determine whether the first alarm coefficient is less than the maximum alarm coefficient. If the historical integrated service flow is not less than the first threshold, step S410 is executed to determine the prediction accuracy of the kth detection information point in the historical alarm information.

[0146] In step S406, in an optional implementation, it is determined whether the first alarm coefficient is less than the maximum alarm coefficient. If the first alarm coefficient is less than the maximum alarm coefficient, step S408 is executed to determine an updated first alarm coefficient according to the first alarm coefficient and a preset step size.

[0147] If the first alarm coefficient is not less than the maximum alarm coefficient, step S407 is performed to determine the updated historical comprehensive service flow according to the kth detection information point and the maximum alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point. The k+1th detection information point is the n+1th service type determined in descending order of priority in the detection chain.

[0148] In step S407, in an optional implementation, the historical service flow of the kth detection information point is multiplied by the maximum value of the alarm coefficient of the kth detection information point. The historical service flow of the k+1th detection information point is multiplied by the second alarm coefficient of the k+1th detection information point. The above two products are added to determine the updated historical comprehensive service flow. Among them, the k+1th detection information point is the n+1th service type determined in the order of priority from high to low in the detection chain.

[0149] It should be noted that the second alarm coefficient may be an empirical value pre-set by a person skilled in the art, and the second alarm coefficient may be reasonably set according to a specific application scenario, such as 0, 1 or 2.

[0150] In the case where the updated historical integrated service flow is greater than or equal to the first threshold, the updated prediction accuracy is determined. According to the kth detection information point and the maximum value of the alarm coefficient of the kth detection information point, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point, the number of times the historical integrated service flow is greater than or equal to the first threshold in other preset periods in the historical alarm information is determined.

[0151] The prediction accuracy of the update of the kth detection information point and the k+1th detection information point in the historical alarm information is determined based on the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of preset cycles in the historical alarm information.

[0152] In an optional implementation, when the updated prediction accuracy is greater than or equal to the preset probability, the maximum value of the alarm coefficient is determined to be the alarm coefficient of the kth detection information point. The updated second alarm coefficient is determined to be the alarm coefficient of the k+1th detection information point.

[0153] In an optional implementation, when the updated prediction accuracy is less than a preset probability, it is determined whether the second warning coefficient is less than a maximum warning coefficient value.

[0154] When the second alarm coefficient is less than the maximum alarm coefficient, the updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size. The updated historical comprehensive service flow is determined according to the kth detection information point and the maximum alarm coefficient, the k+1th detection information point and the updated second alarm coefficient of the k+1th detection information point.

[0155] When the second alarm coefficient is not less than the maximum alarm coefficient value, the updated historical comprehensive service flow is determined according to the kth detection information point and the maximum alarm coefficient value, the k+1th detection information point and the maximum alarm coefficient value of the k+1th detection information point, and the k+2th detection information point and the maximum alarm coefficient value of the k+2th detection information point. The k+2th detection information point is the n+2th service type determined in descending order of priority in the detection chain.

[0156] In step S408, in an optional implementation, when the historical integrated service flow is less than the first threshold value and the first alarm coefficient is less than the maximum value of the alarm coefficient, an updated first alarm coefficient is determined according to the first alarm coefficient and a preset step size. An updated historical integrated service flow is determined according to the k-th detection information point and the updated first alarm coefficient of the k-th detection information point.

[0157] It should be noted that the preset step size can be an empirical value pre-set by a person skilled in the art, and the preset step size can be reasonably set according to the specific application scenario. If the preset step size is too small, the historical comprehensive business flow, prediction accuracy and other information will not change significantly after the alarm coefficient is adjusted. If the preset step size is too large, the historical comprehensive business flow, prediction accuracy and other information will change unreasonably after the alarm coefficient is adjusted.

[0158] For example, in the detection chain, the first service type determined in order of priority from high to low is the instant messaging service, and the first detection information point is the instant messaging service. The first alarm coefficient is 1.0. The historical service flow of the instant messaging service is 20G, and the historical service flow of the instant messaging service is 20G multiplied by the first alarm coefficient 1.0 to obtain the historical comprehensive service flow. When the above-mentioned historical comprehensive flow is less than the first threshold value of 30G within the preset period and the first alarm coefficient 1.0 is less than the maximum value of the alarm coefficient 1.5, according to the preset step size 0.1, the initial value of the alarm coefficient is updated to 1.0, and the updated first alarm coefficient is 1.1. The historical service flow of the instant messaging service is 20G and multiplied by the updated first alarm coefficient 1.1 to obtain a new historical comprehensive service flow of 22G. The updated historical comprehensive service flow is compared with the first threshold again.

[0159] In step S409, the updated historical integrated service flow is determined according to the kth detection information point and the updated first alarm coefficient. Then step S405 is executed to determine whether the updated historical integrated service flow is less than the first threshold.

[0160] In step S410, in an optional implementation, when the historical integrated service flow determined according to the k-th detection information point and the first alarm coefficient of the k-th detection information point is greater than or equal to the first threshold, the number of times the historical integrated service flow is greater than or equal to the first threshold within a preset period of the historical alarm information is determined. The prediction accuracy is determined according to the ratio of the number of times the historical integrated service flow is greater than or equal to the first threshold to the number of one or more preset periods.

[0161] The preset probability in the embodiment of the present application may be an empirical value pre-set by a person skilled in the art, and the preset probability may be reasonably set according to a specific application scenario.

[0162] It can be understood that the prediction accuracy of the detection chain represents the prediction accuracy of the detection information points contained in the detection chain in the historical alarm information. The detection chain may contain one or more detection information points. For example, multiple detection information points such as one detection information point, two detection information points or three detection information points. Taking the detection chain containing two detection information points as an example, within a preset period of obtaining historical alarm information, the product of the alarm coefficient of the first detection information point and the historical business flow of the first detection information point, and the product of the alarm coefficient of the second detection information point and the historical business flow of the second detection information point are calculated. The above two products are summed to determine the historical comprehensive business flow in the preset period. The above historical comprehensive business flow is compared with the first threshold of the preset period. If the historical comprehensive business flow is greater than or equal to the first threshold, it means that the detection chain predicts successfully once. Record the number of times the historical comprehensive business flow is greater than or equal to the first threshold in all preset periods of obtaining historical alarm information. The ratio of the number of times the historical comprehensive business flow is greater than or equal to the first threshold to the number of preset periods is taken as the prediction accuracy of the detection chain.

[0163] For example, assume that the historical alarm information is obtained within 2000 preset cycles. In the detection chain, the first service type determined in order of priority from high to low is the instant messaging service, and the first detection information point is the instant messaging service. In one of the preset cycles, according to the first detection information point and the first alarm coefficient of the first detection information point, it is determined that the historical comprehensive service flow is greater than the first threshold. Then in the remaining 1999 preset cycles, the historical comprehensive service flow is determined according to the first detection information point and the first alarm coefficient of the first detection information point, and it is determined whether the above historical comprehensive service flow is greater than the first threshold in the corresponding preset cycle. Calculate the number of times greater than or equal to the first threshold in the historical alarm information. The number of times greater than or equal to the first threshold in the historical alarm information is 1982 times, and the prediction accuracy of the instant messaging service is 1982÷2000=99.1%.

[0164] In step S411, in an optional implementation, it is determined whether the prediction accuracy of the kth detection information point in the historical alarm information is less than a preset probability.

[0165] If the prediction accuracy is less than the preset probability, return to step S406. Determine whether to update the first alarm coefficient by judging whether the first alarm coefficient is less than the maximum alarm coefficient. Or, determine the updated historical comprehensive service flow according to the kth detection information point and the maximum alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point.

[0166] When the first alarm coefficient is less than the maximum value of the alarm coefficient, an updated first alarm coefficient is determined according to the first alarm coefficient and a preset step size. An updated historical comprehensive service flow is determined according to the kth detection information point and the updated first alarm coefficient. It is again determined whether the updated historical comprehensive service flow is greater than the first threshold. Whether the updated prediction accuracy is less than a preset probability.

[0167] In step S412, in an optional implementation, when the prediction accuracy is greater than or equal to a preset probability, a first warning coefficient is determined as the warning coefficient of the kth detection information point.

[0168] The following Figure 4 The illustrated implementation method is described. For example, the historical alarm information is obtained within 2000 preset cycles. In preset cycle 1, the first threshold is 30G. In order to determine the order of each service type in the detection chain, each service type can be sorted in order of prediction accuracy from large to small. Among them, the historical service flow of the instant messaging service is 20G, and it is assumed that the maximum value of the alarm coefficient is 1.5. The historical comprehensive service flow of the instant messaging service is 22×1.5=33G. The historical comprehensive service flow of 33G is greater than the first threshold of 30G, which means that the instant messaging service is successfully detected in preset cycle 1. According to the service type and the maximum value of the alarm coefficient, continue to judge the relationship between the historical comprehensive service flow and the first threshold in preset cycle 2. Until all the remaining historical alarm information is detected. In preset cycle 2, the first threshold is 40G. The historical service flow of the instant messaging service is 30G. The maximum value of the alarm coefficient is 1.5. The historical comprehensive service flow of the instant messaging service is 30×1.5=45G. If the historical comprehensive service flow rate of 45G is greater than the first threshold value of 40G, it means that the instant messaging service is successfully detected in the preset period 2. The total number of times the historical comprehensive service flow rate of the instant messaging service is greater than or equal to the first threshold value is 1800 times. The prediction accuracy is the ratio of the total number of times the historical comprehensive service flow rate is greater than or equal to the first threshold value to the total number of preset periods, which is 1800÷2000=90%. The prediction accuracy of the instant messaging service is 90%. According to the above method, the prediction accuracy of the streaming media service is determined to be 60%. The prediction accuracy of the P2P service is 50%. According to the order of prediction accuracy from large to small, the priority information is determined as instant messaging service, streaming media service, and P2P service. Therefore, the first detection information point in the detection chain is the instant messaging service.

[0169] Assume that the first alarm coefficient is 1.0. The historical service flow of the instant messaging service is 20G. The historical service flow of the instant messaging service is 20G multiplied by the first alarm coefficient 1.0 to obtain the historical comprehensive service flow 20×1.0=20G.

[0170] Assume that the preset step size is 0.1. When the historical comprehensive flow rate 20G is less than the first threshold value 50G within the preset period, it is determined whether the first alarm coefficient 1.0 is less than the maximum alarm coefficient value 1.5.

[0171] When the first alarm coefficient is less than the maximum alarm coefficient, Figure 5 As shown, according to the preset step size of 0.1, the first alarm coefficient is updated to 1.0, and the updated first alarm coefficient is 1.1. After confirming the updated first alarm coefficient, the historical service flow of the instant messaging service 20G is multiplied by the updated first alarm coefficient 1.1 to obtain a new historical comprehensive service flow 22G. The updated historical comprehensive service flow is compared with the first threshold again. When the updated historical comprehensive service flow is less than the first threshold, it is determined whether the updated first alarm coefficient 1.1 is less than the maximum value of the alarm coefficient 1.5.

[0172] When the updated historical comprehensive service flow is less than the first threshold value, and the first alarm coefficient 1.1 is less than the maximum value of the alarm coefficient 1.5, the first alarm coefficient is continuously updated until the historical comprehensive service flow is greater than or equal to the first threshold value. Assuming that when the first alarm coefficient is 1.3, the historical comprehensive service flow is greater than or equal to the first threshold value, it can be determined whether the prediction accuracy of the detection chain is greater than or equal to the preset probability.

[0173] When the prediction accuracy of the instant messaging service is greater than or equal to the preset probability, the following can be generated: Figure 6 When the prediction accuracy of the detection chain is less than the preset probability, the step of updating the first alarm coefficient can be returned until the prediction accuracy of the detection chain is greater than or equal to the prediction probability.

[0174] It is understandable that if the updated first alarm coefficient is not less than the maximum alarm coefficient, but the historical comprehensive service flow is less than the first threshold or the prediction accuracy of the detection chain is still less than the preset probability, a second detection information point can be added. The second detection information point can be a service type with the second priority, such as streaming media service. At this time, the alarm coefficient of the first detection information point in the detection chain, that is, the instant messaging service, is 1.5, and the alarm coefficient of the second detection information point in the detection chain, that is, the streaming media service, is the initial value, such as 1.0. Figure 7 According to the above method for determining the historical comprehensive service flow, the updated historical comprehensive service flow can be determined according to the alarm coefficient of the instant messaging service, the flow of the instant messaging service, the alarm coefficient of the streaming media service and the flow of the streaming media service.

[0175] If the historical comprehensive service flow is less than the first threshold, the alarm coefficient of the streaming service can be updated. The method of updating the alarm coefficient of the streaming service can be implemented by referring to the method of updating the alarm coefficient of the instant messaging service, which will not be repeated here.

[0176] It is understandable that if the alarm coefficient of the streaming media service is not less than the maximum alarm coefficient, but the historical comprehensive service traffic is less than the first threshold or the prediction accuracy of the detection chain is still less than the preset probability, a third detection information point can be added, and so on, until the historical comprehensive service traffic is greater than or equal to the first threshold or the prediction accuracy of the detection chain is greater than or equal to the preset probability.

[0177] According to the above method, we can generate Figure 8 The detection chain shown in FIG. 1 shows that the alarm coefficient of the instant messaging service is 1.5, the alarm coefficient of the streaming media service is 1.5, and the alarm coefficient of the P2P service is 1.1.

[0178] In an optional implementation, all detection chains whose prediction accuracy reaches a preset probability are calculated and stored. If the user needs it, the alarm coefficient is selected according to the set rules.

[0179] Each detection chain has an accuracy rate. Therefore, the detection chain can be selected based on the accuracy rate as a setting rule. The length of each detection chain is not consistent, including the first detection information point to the nth detection information point. The shorter the detection chain selected by the user, the higher the efficiency of detecting abnormal traffic, but the prediction accuracy will be reduced accordingly. The longer the detection chain selected by the user, the lower the efficiency of detecting abnormal traffic, but the prediction accuracy will be increased accordingly. Therefore, the detection chain can be selected based on the length of the detection chain as a setting rule.

[0180] The nth service type and the alarm coefficient of the nth service type in different detection chains may be the same or different. Therefore, the detection chain can be selected based on the alarm coefficient of the nth service type as a setting rule. It should be noted that in the detection chain, the closer the alarm coefficient is to 1, the closer it is to the actual value of the traffic of the service type, and the higher the detection accuracy.

[0181] For example, Fig. 9As shown, there are 4 different detection chains. The user's setting rules are: the prediction rate reaches 99% as the first principle, the prediction chain is as short as possible as the second principle, and the alarm decision coefficients are as close to 1 as possible as the third principle. According to the first principle, detection chain 1 is excluded. According to the second principle, detection chain 4 is excluded from detection chains 2, 3, and 4. According to the third principle, because in detection chains 2 and 3, the alarm coefficients of instant messaging services and streaming media services are both 1.5. However, the alarm coefficient of traditional data services in detection chain 2, 1.3, is less than the alarm coefficient of traditional data services in detection chain 3, 1.4, and is closer to 1. Therefore, detection chain 2 is selected. According to detection chain 2, 1.5 is determined as the alarm coefficient of instant messaging services, 1.5 is determined as the alarm coefficient of streaming media services, and 1.3 is determined as the alarm coefficient of traditional data services.

[0182] The embodiment of the present application determines the alarm coefficient according to the detection chain method, which is simpler to implement and more convenient than other methods. The alarm coefficient is updated through historical alarm information to improve the detection accuracy of alarm traffic and the detection efficiency of abnormal traffic.

[0183] like Fig.10 As shown, an embodiment of the present application provides an overall flow chart for detecting abnormal traffic.

[0184] Step S1001, identifying N service types of each service flow; N is an integer greater than or equal to 1;

[0185] Step S1002: Determine priority information of N service types according to the prediction accuracy of the nth service type;

[0186] Step S1003: determining the historical comprehensive service flow according to the kth detection information point and the first alarm coefficient of the kth detection information point; the kth detection information point is the nth service type determined in descending order of priority in the detection chain;

[0187] Step 1004: when the historical comprehensive service flow is greater than the first threshold, determine the prediction accuracy of the kth detection information point in the historical alarm information;

[0188] Step 1005: when the prediction accuracy is greater than or equal to the preset probability, determine the first warning coefficient as the warning coefficient of the kth detection information point; k is an integer greater than or equal to 0;

[0189] Step 1006: Determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; n is an integer greater than or equal to 1 and less than N;

[0190] Step S1007: When the comprehensive service flow is greater than or equal to the second threshold, generate alarm information;

[0191] Step S1008: When the alarm information reaches a preset value, an alarm is sent to the user;

[0192] Step S1009: receiving an abnormal traffic protection instruction sent by a user;

[0193] Step S1010: Send the abnormal traffic protection instruction to the protection device to execute the operation of the abnormal traffic protection instruction.

[0194] The present application embodiment provides an abnormal flow detection device, such as Fig.11 As shown, the device includes: an identification module 1101, a processing module 1102, and a generation module 1103, wherein:

[0195] An identification module 1101 is used to identify N service types of each service flow; N is an integer greater than or equal to 1;

[0196] The processing module 1102 is used to determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; the n is an integer greater than or equal to 1 and less than N;

[0197] The alarm coefficient of the nth service type is determined according to the prediction accuracy of the nth service type in the historical alarm information; the historical alarm information is obtained within one or more preset periods, the prediction accuracy is the ratio of the number of times the historical comprehensive service flow is greater than or equal to the first threshold to the number of the one or more preset periods, and the historical comprehensive service flow is determined according to the alarm coefficient of the nth service type and the historical service flow of the nth service type in the historical alarm information within one of the preset periods;

[0198] The generating module 1103 is used to generate alarm information when the comprehensive service flow is greater than or equal to the second threshold.

[0199] Optionally, the processing module 1102 is further configured to:

[0200] When the alarm information reaches a preset value, sending an alarm to the user;

[0201] Receive abnormal traffic protection instructions sent by users;

[0202] The abnormal traffic protection instruction is sent to the protection device to execute the operation of the abnormal traffic protection instruction.

[0203] Optionally, the processing module 1102 is further configured to:

[0204] Determining priority information of the N service types according to the prediction accuracy of the nth service type;

[0205] A detection chain is generated according to the order of the priority information from high to low; the detection chain includes the nth service type and the alarm coefficient of the nth service type.

[0206] Optionally, the processing module 1102 is further configured to:

[0207] Determine the historical integrated service flow according to the kth detection information point and the first alarm coefficient of the kth detection information point; the kth detection information point is the nth service type determined in descending order of priority in the detection chain; k is an integer greater than or equal to 0;

[0208] When the historical integrated service flow is less than a first threshold, determining an updated first alarm coefficient according to the first alarm coefficient and a preset step size;

[0209] In the case where the historical comprehensive service flow is greater than or equal to the first threshold, determining the prediction accuracy of the detection chain; the prediction accuracy is the prediction accuracy of the kth detection information point in the historical alarm information;

[0210] When the prediction accuracy is greater than or equal to a preset probability, the first alarm coefficient is determined as the alarm coefficient of the kth detection information point.

[0211] Optionally, the processing module 1102 is further configured to:

[0212] In the case where the prediction accuracy of the detection chain is less than a preset probability, determining an updated first alarm coefficient according to the first alarm coefficient and the preset step size;

[0213] An updated historical integrated service flow is determined according to the kth detection information point and the updated first alarm coefficient.

[0214] Optionally, the processing module 1102 is further configured to:

[0215] When the updated first alarm coefficient reaches a maximum value and the historical integrated service flow is less than the first threshold, or the prediction accuracy is less than the preset probability, the updated historical integrated service flow is determined according to the kth detection information point and the maximum value of the alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point; the k+1th detection information point is the n+1th service type determined in descending order of priority in the detection chain;

[0216] In a case where the updated historical integrated service flow is less than the first threshold, an updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size.

[0217] Optionally, the processing module 1102 is further configured to:

[0218] In the case where the updated historical comprehensive service flow is greater than or equal to the first threshold, determining an updated prediction accuracy; the updated prediction accuracy is the prediction accuracy of the kth detection information point and the k+1th detection information point in the historical alarm information;

[0219] When the updated prediction accuracy is greater than or equal to the preset probability, the maximum value of the alarm coefficient is determined as the alarm coefficient of the kth detection information point, and the updated second alarm coefficient is determined as the alarm coefficient of the k+1th detection information point.

[0220] Optionally, the processing module 1102 is further configured to:

[0221] When the updated prediction accuracy is less than the preset probability, an updated second warning coefficient is determined according to the second warning coefficient and the preset step size.

[0222] like Fig.12 As shown, the electronic device 120 is in the form of a general electronic device. The components of the electronic device 120 may include but are not limited to: the at least one processor 121, the at least one memory 122, and a bus 123 connecting different system components (including the memory 122 and the processor 121).

[0223] Bus 123 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.

[0224] The memory 122 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1221 and / or a cache memory 1222 , and may further include a read-only memory (ROM) 1223 .

[0225] The memory 122 may also include a program / utility 1225 having a set (at least one) of program modules 1224, such program modules 1224 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0226] The electronic device 120 may also communicate with one or more external devices 124 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 120, and / or communicate with any device that enables the electronic device 120 to communicate with one or more other electronic devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 125. Furthermore, the electronic device 120 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 126. As shown, the network adapter 126 communicates with other modules for the electronic device 120 via a bus 123. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 120, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0227] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 122 including instructions, and the instructions can be executed by the processor 121 to complete the abnormal traffic detection method. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0228] In an exemplary embodiment, a computer program product is also provided, including a computer program, and when the computer program is executed by the processor 121, any method of the abnormal traffic detection method provided in the present application is implemented.

[0229] In an exemplary embodiment, various aspects of an abnormal traffic detection method provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of the abnormal traffic detection method according to various exemplary embodiments of the present application described above in this specification.

[0230] The program product may adopt any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0231] The program product for abnormal flow detection method of the embodiment of the present application can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on an electronic device. However, the program product of the present application is not limited to this. In this document, the readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, device or device.

[0232] The readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein the readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0233] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0234] The program code for performing the operation of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages, such as Java, C++, etc., and also conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user electronic device, partially on the user device, as an independent software package, partially on the user electronic device and partially on the remote electronic device, or completely on the remote electronic device or server. In the case of involving a remote electronic device, the remote electronic device can be connected to the user electronic device through any type of network, such as a local area network (LAN) or a wide area network (WAN), or can be connected to an external electronic device, such as connecting through the Internet using an Internet service provider.

[0235] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0236] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0237] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0238] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable image scaling device to produce a machine, so that the instructions executed by the processor of the computer or other programmable image scaling device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0239] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable image scaling device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, the instruction device being implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0240] These computer program instructions may also be loaded onto a computer or other programmable image scaling device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0241] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0242] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting abnormal traffic, characterized in that: The method comprises: Identify N service types of each service flow; N is an integer greater than or equal to 1; Determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; wherein n is an integer greater than or equal to 1 and less than N; The alarm coefficient of the nth service type is determined according to a comparison result between a prediction accuracy rate of the nth service type in historical alarm information and a preset probability; the historical alarm information is obtained within one or more preset periods, the prediction accuracy rate is a ratio of the number of times the historical comprehensive service flow is greater than or equal to a first threshold to the number of the one or more preset periods, and the historical comprehensive service flow is determined according to a preset maximum value of the alarm coefficient and a historical service flow rate of the nth service type in the historical alarm information within one of the preset periods; When the integrated service flow is greater than or equal to the second threshold, an alarm message is generated.

2. The method according to claim 1, characterized in that The method further comprises: When the alarm information reaches a preset value, sending an alarm to the user; Receive abnormal traffic protection instructions sent by users; The abnormal traffic protection instruction is sent to the protection device to execute the operation corresponding to the abnormal traffic protection instruction.

3. The method according to claim 1, characterized in that The method further comprises: Determining priority information of the N service types according to the prediction accuracy of the nth service type; A detection chain is generated according to the order of the priority information from high to low; the detection chain includes the nth service type and the alarm coefficient of the nth service type.

4. The method according to claim 3, characterized in that: Generating a detection chain according to the order of the priority information from high to low includes: Determine the historical integrated service flow according to the kth detection information point and the first alarm coefficient of the kth detection information point; the kth detection information point is the nth service type determined in descending order of priority in the detection chain; k is an integer greater than or equal to 0; When the historical integrated service flow is less than a first threshold, determining an updated first alarm coefficient according to the first alarm coefficient and a preset step size; In the case where the historical comprehensive service flow is greater than or equal to the first threshold, determining the prediction accuracy of the detection chain; the prediction accuracy is the prediction accuracy of the kth detection information point in the historical alarm information; When the prediction accuracy is greater than or equal to a preset probability, the first alarm coefficient is determined as the alarm coefficient of the kth detection information point.

5. The method according to claim 4, characterized in that The method further comprises: In the case where the prediction accuracy of the detection chain is less than a preset probability, determining an updated first alarm coefficient according to the first alarm coefficient and the preset step size; An updated historical integrated service flow is determined according to the kth detection information point and the updated first alarm coefficient.

6. The method according to claim 4, characterized in that The method further comprises: When the updated first alarm coefficient reaches the maximum value of the alarm coefficient and the historical integrated service flow is less than the first threshold, or the prediction accuracy is less than the preset probability, the updated historical integrated service flow is determined according to the kth detection information point and the maximum value of the alarm coefficient, the k+1th detection information point and the second alarm coefficient of the k+1th detection information point; the k+1th detection information point is the n+1th service type determined in descending order of priority in the detection chain; In a case where the updated historical integrated service flow is less than the first threshold, an updated second alarm coefficient is determined according to the second alarm coefficient and the preset step size.

7. The method according to claim 6, characterized in that The method further comprises: In the case where the updated historical comprehensive service flow is greater than or equal to the first threshold, determining an updated prediction accuracy; the updated prediction accuracy is the prediction accuracy of the kth detection information point and the k+1th detection information point in the historical alarm information; When the updated prediction accuracy is greater than or equal to the preset probability, the maximum value of the alarm coefficient is determined as the alarm coefficient of the kth detection information point, and the updated second alarm coefficient is determined as the alarm coefficient of the k+1th detection information point.

8. The method according to claim 7, characterized in that The method further comprises: When the updated prediction accuracy is less than the preset probability, an updated second warning coefficient is determined according to the second warning coefficient and the preset step size.

9. An abnormal flow detection device, characterized in that: include: An identification module, used to identify N service types of each service flow; N is an integer greater than or equal to 1; A processing module, configured to determine the comprehensive service flow according to the alarm coefficient of the nth service type and the service flow of the nth service type; wherein n is an integer greater than or equal to 1 and less than N; The alarm coefficient of the nth service type is determined according to a comparison result between a prediction accuracy rate of the nth service type in historical alarm information and a preset probability; the historical alarm information is obtained within one or more preset periods, the prediction accuracy rate is a ratio of the number of times the historical comprehensive service flow is greater than or equal to a first threshold to the number of the one or more preset periods, and the historical comprehensive service flow is determined according to a preset maximum value of the alarm coefficient and a historical service flow rate of the nth service type in the historical alarm information within one of the preset periods; A generating module is used to generate alarm information when the comprehensive service flow is greater than or equal to a second threshold.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the abnormal traffic detection method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that When the computer program product is called by a computer, the computer executes the steps of the method according to any one of claims 1 to 8.

Images