Abnormal traffic identification method, device, electronic device and storage medium

Abstract

The present disclosure provides an abnormal traffic identification method, device, electronic device and storage medium, which relate to the field of computer technology, and in particular to the field of network security technology. The specific implementation scheme is: extracting at least one traffic feature from a real-time traffic data stream; comparing at least one traffic feature with historical traffic features under different monitoring time periods to obtain a comparison result; identifying abnormal traffic features from the comparison result, and the abnormal traffic features are used to characterize traffic features that are inconsistent with the changing trends of historical traffic features. The use of the present disclosure improves the security of Internet information and the stability of Internet services.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to the field of network security technology. Background Art

[0002] There is a large amount of non-user access in Internet access, such as the use of crawler technology to automatically capture Internet information traffic. This abnormal access that does not follow access restrictions and behavioral norms not only poses a threat to the security of Internet information, but also poses a threat to the stability of Internet services due to the excessive traffic occupied by abnormal access. Therefore, it is necessary to identify abnormal traffic. Summary of the Invention

[0003] The present disclosure provides a method, device, electronic device, and storage medium for identifying abnormal traffic.

[0004] According to one aspect of the present disclosure, a method for identifying abnormal traffic is provided, comprising:

[0005] extracting at least one traffic feature from the real-time traffic data stream;

[0006] Comparing the at least one traffic characteristic with historical traffic characteristics under different monitoring time periods to obtain a comparison result;

[0007] An abnormal traffic feature is identified from the comparison result, where the abnormal traffic feature is used to characterize a traffic feature that is inconsistent with a change trend of the historical traffic feature.

[0008] According to another aspect of the present disclosure, there is provided an abnormal traffic identification device, comprising:

[0009] A feature extraction module, configured to extract at least one traffic feature from a real-time traffic data stream;

[0010] a feature comparison module, configured to compare the at least one traffic feature with historical traffic features under different monitoring periods to obtain a comparison result;

[0011] The feature recognition module is used to identify abnormal traffic features from the comparison results, where the abnormal traffic features are used to characterize traffic features that are inconsistent with the change trend of the historical traffic features.

[0012] According to another aspect of the present disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned abnormal traffic identification method.

[0013] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the above-mentioned abnormal traffic identification method.

[0014] According to another aspect of the present disclosure, a computer program product is provided, including computer instructions, wherein the computer instructions are stored in a computer-readable storage medium, and when the computer instructions are executed by a processor, the above-mentioned abnormal traffic identification method is implemented.

[0015] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description.

[0016] By adopting the present disclosure, abnormal traffic characteristics can be identified in real time, thereby improving the security of Internet information and the stability of Internet services. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0018] Figure 1 is a flow chart of an abnormal traffic identification method according to an embodiment of the present disclosure;

[0019] Figure 2 is a flow chart of an abnormal traffic identification method according to an embodiment of the present disclosure;

[0020] Figure 3 A schematic diagram of a process of pre-configuring a database in a method for identifying abnormal traffic according to an embodiment of the present disclosure;

[0021] Figure 4 A schematic diagram of a flow chart of traffic feature comparison in a method for identifying abnormal traffic according to an embodiment of the present disclosure;

[0022] Figure 5 A schematic diagram of an abnormal traffic identification framework according to an embodiment of the present disclosure;

[0023] Figure 6 is a structural diagram of an abnormal flow identification device according to an embodiment of the present disclosure;

[0024] Figure 7 It is a block diagram of an electronic device used to implement the abnormal traffic identification method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0026] The present disclosure provides a method for identifying abnormal traffic. Figure 1 Shown, including:

[0027] S101. Extract at least one traffic feature from a real-time traffic data stream.

[0028] S102: Compare at least one traffic characteristic with historical traffic characteristics during a predetermined monitoring period to obtain a comparison result.

[0029] In some examples, the predetermined monitoring time includes: a predetermined long monitoring time (such as a monitoring time of several days as a cycle), and a predetermined short time (such as a monitoring time of several hours as a cycle). The historical traffic characteristics under different monitoring time periods, that is, the historical traffic characteristics under the predetermined long monitoring time period and the historical traffic characteristics under the predetermined short monitoring time period, can be compared with at least one traffic characteristic respectively to obtain one or more categories of comparison results.

[0030] S103: Identify abnormal traffic characteristics from the comparison result, where the abnormal traffic characteristics are used to characterize traffic characteristics that are inconsistent with the change trend of the historical traffic characteristics.

[0031] In an example of S101-S103, a Flink feature engine can be loaded to support real-time data stream computing. Based on the Flink feature engine as a distributed open source computing framework for data stream processing and batch data processing, at least one traffic feature can be extracted from the real-time traffic data stream, wherein the type of at least one traffic feature includes at least one of an Internet Protocol (IP) number and a user identification (UID) number. The at least one traffic feature is compared with historical traffic features under different monitoring time periods (for example, a monitoring time period used to reflect the long-term historical change trend of the traffic feature, and a monitoring time period used to reflect the short-term sudden increase or decrease of the traffic feature) to obtain a comparison result. If the at least one extracted traffic feature is inconsistent with the change trend of the historical traffic feature, it means that there is an abnormal traffic feature in the comparison result. Therefore, the abnormal traffic feature can be identified from the comparison result and used as an abnormal traffic feature.

[0032] By using the embodiments of the present disclosure, at least one traffic feature can be extracted from a real-time traffic data stream, thereby comparing the at least one traffic feature with historical traffic features under different monitoring periods to obtain a comparison result. After obtaining the comparison result, an abnormal traffic feature can be identified from the comparison result, and the abnormal traffic feature is used to characterize traffic features that are inconsistent with the changing trend of the historical traffic feature. Since abnormal traffic features can be identified in real time, non-user access behaviors such as those achieved by crawler technology are avoided, thereby improving the security of Internet information. Moreover, after identifying abnormal access, the abnormal access can be blocked to avoid the traffic occupied by the abnormal access, thereby improving the stability of Internet services.

[0033] In one embodiment, extracting at least one traffic feature from a real-time traffic data stream includes: segmenting the real-time traffic data stream according to a time window to obtain data stream segments matching the time window, and extracting at least one traffic feature from the data stream segments. In this embodiment, the time window can be 5 minutes, i.e., the real-time traffic data stream is segmented every 5 minutes. If an abnormal traffic feature is found in the segmented data stream segments, an abnormality alarm message can be directly sent. The 5-minute time window is merely an example. The shorter the time window, the faster the abnormal traffic feature can be identified, thereby achieving better real-time abnormality monitoring.

[0034] In one embodiment, the method further includes: sending an abnormal alarm message after identifying abnormal traffic characteristics. With this embodiment, the abnormal alarm message can be sent immediately after identifying abnormal traffic characteristics, thereby promptly locating the abnormal situation, or the abnormal alarm message can be sent after a predetermined period of time after identifying abnormal traffic characteristics, thereby preventing normal business traffic from being falsely reported.

[0035] In one embodiment, at least one flow feature is compared with historical flow features under different monitoring time lengths to obtain a comparison result, including: comparing at least one flow feature with historical flow features under a first monitoring time length to obtain a first processing result (the first processing result is used to characterize the historical change trend of the flow feature). Comparing at least one flow feature with historical flow features under a second monitoring time length to obtain a second processing result (the second processing result is used to characterize the sudden increase or decrease of the flow feature within a preset short time). A comparison result is obtained based on the first processing result and the second processing result. Using this embodiment, a multi-standard comparison standard with different monitoring time lengths is used to qualitatively characterize at least one flow feature to accurately determine whether the at least one flow feature is an abnormal flow feature.

[0036] In one embodiment, it also includes: configuring the type of traffic feature to be compared, comparing at least one traffic feature with the type of traffic feature (such as at least one of the IP number and UID number), obtaining a third processing result, and updating the comparison result according to the third processing result to obtain an updated comparison result. Abnormal traffic features are identified from the updated comparison result. Using this embodiment, not only can the at least one extracted traffic feature be compared with the historical traffic feature, but the at least one extracted traffic feature can also be compared with the pre-configured traffic feature and its type, so that through this comprehensive comparison, it can be accurately determined whether the at least one traffic feature is an abnormal traffic feature. Moreover, the initial comparison result can be updated and stored in the database to facilitate the continuous improvement of the traffic feature database.

[0037] In some examples, the following abnormal traffic identification methods are provided, such as Figure 2 Shown, including:

[0038] S201: Acquire a real-time traffic data stream, and divide the real-time traffic data stream into time windows.

[0039] Exemplarily, the execution entity of this embodiment can be a server (such as a local server, a cloud server, a server cluster, etc.), a computer, a terminal device, a processor, a chip, etc., which is not limited in this embodiment.

[0040] The real-time traffic data stream comes from the website's real-time access log; the time window can be a shorter time interval, for example, 5 minutes or 10 minutes, preferably 5 minutes. The length of the current time window can be flexibly set according to actual conditions (for example, taking into account real-time monitoring and load balancing).

[0041] It should be pointed out that when identifying traffic anomaly characteristics, if only the traffic data within a short period of time (such as seconds) in the obtained log data is compared, false alarms may easily occur in businesses with large traffic disturbances. Setting a time window at the minute level such as 5 minutes or 10 minutes takes into account both the real-time nature and richness of the data, avoiding false alarms.

[0042] S202: Pre-configure required traffic characteristics, and calculate at least one traffic characteristic of the real-time traffic data flow within the time window in real time.

[0043] like Figure 3 As shown, step S202 may further include:

[0044] S2021. The staff pre-configures the traffic features to be used based on historical experience. The pre-configuration includes adding, modifying and / or deleting traffic features.

[0045] Staff can add, modify and / or delete traffic features through configuration operations; if the statistical value of a parameter surges within a time window, the parameter can be used as a new traffic feature to represent a currently unknown new attack and / or cheating type, thus achieving real-time perception of new attack and / or cheating types; and if the new attack and / or cheating type represented by a certain traffic feature no longer appears, staff can delete or modify this traffic feature to other required traffic features. Modification of traffic features includes: modification of traffic feature type and / or value.

[0046] S2022. Calculate in real time at least one traffic feature of the real-time traffic data stream within the time window. The at least one traffic feature can be one or more combinations of parameters such as page views (PV), cheating PV, number of IP addresses, number of UIDs, etc. The traffic feature calculated each time is used in the subsequent step S203. The traffic feature is also stored in the database for future use as historical data.

[0047] It should be pointed out that if there is a situation where competitors maliciously crawl user data, one or more parameters such as PV, cheating PV, number of IP addresses, and number of UIDs, which are traffic characteristics, will inevitably experience a sudden change in parameter values ​​within a short period of time (for example, using a 5-minute time window to count statistical information of multiple dimensions, such as the number of PVs in 5 minutes, the number of cheating PVs in 5 minutes, the number of IP addresses in 5 minutes, the number of UIDs in 5 minutes, etc.). The introduction of multiple traffic characteristics provides multi-dimensional statistical information, which will greatly improve the accuracy of traffic risk perception.

[0048] S203: Compare the extracted at least one traffic feature with at least one historical traffic feature threshold.

[0049] The at least one historical traffic feature threshold can be obtained by performing statistical calculations on the historical traffic features.

[0050] Specifically, if Figure 4 As shown, step S203 may further include:

[0051] S2031. Compare the extracted at least one traffic feature with at least one traffic feature threshold value of the same historical period.

[0052] For example, the traffic feature threshold of the same historical period can be obtained by calculating the traffic feature threshold α corresponding to the period 24±2 hours before the current moment. The value range of the traffic feature threshold α is: μ1-c×δ1<α<μ1+c×δ1, where μ1 is the average value of the corresponding traffic feature in the 24±2 hour period, δ1 is the standard deviation of the corresponding traffic feature in the 24±2 hour period, and c is a constant defined according to different businesses.

[0053] S2032. Compare the extracted at least one traffic feature with at least one traffic feature threshold of an adjacent time period.

[0054] For example, the traffic feature threshold of adjacent time periods can be obtained by calculating the traffic feature threshold β in the time period 0-6 hours ago at the current time. The value range of the traffic feature threshold β is: μ2-c×δ2<α<μ2+c×δ2, where μ2 is the average value of the corresponding traffic feature in the time period 0-6 hours ago, δ2 is the standard deviation of the corresponding traffic feature in the time period 0-6 hours ago, and c is a constant defined according to different businesses.

[0055] As shown in S2031-S2032, a two-comparison or dual-standard comparison method is used. This method can not only capture short-term sudden increases and decreases in traffic characteristics, but also prevent false alarms caused by sudden increases and decreases in normal business traffic. For example, during the 8:00-9:00 am period, a page view (or click volume) often experiences a sudden increase in traffic. If the traffic characteristics of this period are only compared with the corresponding traffic characteristics from 0-6 hours before this period, false alarms will be generated for normal traffic surges, resulting in a waste of resources. By rationally selecting the historical traffic characteristic threshold calculation method and calculation period, the computational complexity of the historical traffic characteristic threshold calculation is reduced, and the accuracy of traffic risk perception is increased.

[0056] S204: If the comparison result is abnormal, send an abnormality alarm message.

[0057] For example, if at least one traffic feature of the real-time traffic data stream within the extracted time window is not within the threshold range of at least one traffic feature in the same historical period, then continue to judge whether at least one traffic feature of the real-time traffic data stream is within the threshold range of at least one traffic feature in the adjacent time period. If at least one traffic feature of the real-time traffic data stream is also not within the threshold range of at least one traffic feature in the adjacent time period, then send an abnormal alarm message for the currently identified abnormal situation.

[0058] By adopting the embodiments of the present disclosure, multi-dimensional, dual-standard, real-time online alarm sending is achieved, and new unknown new attacks and / or cheating types can be identified, thereby improving the timeliness and accuracy of traffic risk perception, avoiding false alarms, and saving computing resources.

[0059] In Internet access, taking non-user behavior access achieved by crawler technology as an example, crawler technology can automatically capture the traffic of World Wide Web information. This abnormal access to network data without following access restrictions and behavioral norms will not only cause the loss of core content assets, but also pose a threat to the stability of website services because abnormal access occupies too much traffic. In order to maintain the security of World Wide Web information, it is usually necessary to identify abnormal network traffic.

[0060] In view of this, it is necessary to block crawler traffic to reduce the crawling of core Internet content assets (such as encyclopedias, entries and other high-quality information content) to improve security, avoid wasting server resources, and improve service stability. Based on the ever-increasing anti-crawler strategies, more and more accurate malicious risk control subject identification can be obtained, including IP addresses, UIDs, etc.

[0061] For example, raw data such as website log data records the time of each visit, the object visited, and the visitor's identity information. Using batch processing based on a large relational database to block crawler traffic and better identify abnormal risk control entities (or abnormal traffic characteristics) presents the following challenges.

[0062] 1) Incomplete strategy system: A strategy system built based on rules established by manual experience can never fully understand the patterns of fraudulent traffic. A system is needed to perceive the possibility of traffic risks in real time, allowing manual intervention and analysis to uncover missing or inaccurate parts of the existing strategy system.

[0063] 2) Countermeasures against black market attacks: Black market attacks will constantly attempt to circumvent existing anti-cheating strategies. A system is needed to detect new attack types in real time, allowing for manual intervention to strengthen the strategy system and block new attack types.

[0064] 3) Human error risk: During routine strategy development and debugging, R&D engineers on traffic anti-fraud platforms may still make operational or coding errors that could lead to errors or even failure of the strategy system. Therefore, a system is needed to detect abnormal real-time traffic flow.

[0065] 4) System bugs: The policy engine, blacklist library, and real-time computing behind the traffic anti-fraud platform rely on a large number of different cloud resources. Cloud resource anomalies and crashes often occur, requiring engineers to intervene promptly. A system is needed to immediately detect real-time traffic anomalies caused by system crashes.

[0066] To summarize, a complete traffic anti-fraud system requires a real-time risk perception system to promptly identify abnormal traffic characteristics so that abnormal alarm information can be promptly issued to relevant R&D personnel.

[0067] The current traffic feature recognition technology only selects data flows within a short period of time for comparison, and the data flows are non-real-time, which is prone to false alarms in services with large traffic disturbances. In this application example, the real-time traffic data flow is identified. The real-time traffic data flow enters Figure 5 After the traffic anti-cheating system shown is installed, it first completes the extraction of various traffic features in a 5-minute time window (for example, PV, cheating PV, IP number, UID number, etc. are extracted. The traffic features are stored in the database after each extraction and compared with the historically calculated traffic features in the first monitoring time (such as the comparison period, for example, the year-on-year period of the same hour yesterday. If it is currently 10 o'clock, you can check the average value of yesterday's 10 o'clock) and the second monitoring time (such as the month-on-month period, for example, the average value of the 6 hours before the current time). If there is an abnormality, an abnormal alarm message is sent.

[0068] Specifically, such as Figure 5 The traffic anti-cheating system shown includes: an acquisition module 501, a feature engine module 502, a historical information recording module 503, a monitoring and calculation module 504 and an alarm module 505.

[0069] The acquisition module 501 is used to acquire real-time traffic data streams and divide the real-time traffic data streams into time windows. Exemplarily, the acquisition module 501 of this embodiment can be a server (such as a local server, a cloud server, a server cluster, etc.), a computer, a terminal device, a processor, or a chip, etc., which is not limited in this embodiment. The real-time traffic data stream comes from the real-time access log of the website; and the time window can be a shorter time interval, for example, 5 minutes or 10 minutes. Preferably, the time window is 5 minutes.

[0070] The feature engine module 502 is used to pre-configure the required traffic features and extract at least one traffic feature of the real-time traffic data stream within the time window in real time. Among them, the staff can pre-configure the traffic features to be used based on historical experience, and the pre-configuration includes the addition, modification and / or deletion of traffic features. The staff can also complete the addition, modification and / or deletion of traffic features through configuration operations; if the statistical value of a certain parameter surges within the time window, the parameter can be used as a new traffic feature to represent a currently unknown new attack and / or cheating type, which realizes real-time perception of new attacks and / or cheating types; and if the new attack and / or cheating type represented by a certain traffic feature no longer appears, the staff can delete or modify this traffic feature to other required traffic features. The modification of traffic features includes: modification of traffic feature type and / or value. It should be pointed out that the feature engine module can use the Flink feature engine module or other engine modules that can meet the real-time requirements; preferably, the feature engine module is the Flink feature engine module; the scenario of this example focuses on abnormal traffic risk perception and traffic feature identification. This scenario has very high real-time requirements and needs to detect abnormal traffic risks and alarm within 5 minutes. Therefore, the applicant introduced the Flink feature engine module. Through research, the applicant found that Flink, as a framework and distributed processing engine, has the characteristics of maintaining high throughput and low latency, and is very suitable for real-time statistics. It has never been disclosed that Flink can be used for traffic risk perception. In response to the real-time requirements of traffic risk perception technology, the applicant creatively applied Flink to the configuration and statistics of traffic features, and achieved very good technical results compared with related technologies.

[0071] The historical information recording module 503 is configured to receive at least one traffic feature extracted by the feature engine module 502 and send the historical traffic feature to the monitoring and calculation module 504. The at least one traffic feature calculated by the feature engine module 502 is sent to the historical information recording module 503 and can be sent to the monitoring and calculation module 504 as a historical traffic feature in the future for statistical calculation of traffic feature thresholds for the same historical period and / or traffic feature thresholds for adjacent time periods. The historical information recording module 503 can be a database.

[0072] The monitoring calculation module 504 is configured to compare the calculated at least one traffic feature with at least one historical traffic feature threshold.

[0073] The at least one historical traffic characteristic threshold is obtained by performing statistical calculations on the historical traffic characteristics, as follows:

[0074] The at least one calculated traffic feature is compared with at least one traffic feature threshold value of the same historical period. For example, the traffic feature threshold value of the same historical period can be obtained by calculating the traffic feature threshold value α corresponding to the period 24±2 hours before the current moment by the monitoring calculation module 504. The value range of the traffic feature threshold value α is: μ1-c×δ1<α<μ1+c×δ1, where μ1 is the average value of the traffic feature corresponding to the period 24±2 hours, δ1 is the standard deviation of the traffic feature corresponding to the period 24±2 hours, and c is a constant defined according to different services. The at least one calculated traffic feature is compared with at least one traffic feature threshold value of an adjacent period. For example, the traffic feature threshold value of an adjacent period can be obtained by calculating the traffic feature threshold value β of the period 0-6 hours before the current moment by the monitoring calculation module 504. The value range of the traffic feature threshold value β is: μ2-c×δ2<α<μ2+c×δ2, where μ2 is the average value of the traffic feature corresponding to the period 0-6 hours before, δ2 is the standard deviation of the traffic feature corresponding to the period 0-6 hours before, and c is a constant defined according to different services. If at least one traffic feature of the real-time traffic data flow within the time window calculated by the feature engine module 502 is not within the range of at least one traffic feature threshold of the same historical period, then it will continue to determine whether at least one traffic feature of the real-time traffic data flow is within the range of at least one traffic feature threshold of the adjacent time period. If at least one traffic feature of the real-time traffic data flow is also not within the range of at least one traffic feature threshold of the adjacent time period, then the comparison result is abnormal and traffic risk is perceived.

[0075] The alarm module 505 sends an alarm message if there is an abnormality in the comparison result.

[0076] The above-mentioned traffic anti-cheating system, through two comparisons or dual-standard comparisons, can not only capture the sudden increase or decrease of traffic characteristics in a short period of time, but also prevent false alarms caused by sudden increase or decrease of normal traffic of the business itself. For example, in the morning period of 8:00-9:00, there is often a sudden increase in traffic for entries. If the traffic characteristics of this period are only compared with the corresponding traffic characteristics in the period 0-6 hours before this period, a false alarm operation will be made for the normal traffic surge, resulting in a waste of resources. By reasonably selecting the traffic characteristic threshold calculation method and calculation period, the amount of calculation of the traffic characteristic threshold is reduced and the accuracy of traffic risk perception is increased. After identifying abnormal traffic characteristics, abnormal alarm information can be sent, which not only realizes multi-dimensional, dual-standard, and real-time online alarm sending, but also can identify new unknown new attacks and / or cheating types, improve the timeliness and accuracy of traffic risk perception, avoid false alarms, and save computing resources.

[0077] like Figure 6The abnormal traffic identification device of an embodiment of the present disclosure includes: a feature extraction module 601, which is used to extract at least one traffic feature from a real-time traffic data stream; a feature comparison module 602, which is used to compare the at least one traffic feature with historical traffic features under different monitoring time periods to obtain a comparison result; and a feature identification module 603, which is used to identify abnormal traffic features from the comparison results, and the abnormal traffic features are used to characterize traffic features that are inconsistent with the changing trend of the historical traffic features.

[0078] In one embodiment, the feature extraction module 601 is used to divide the real-time traffic data flow according to the time window to obtain data flow segments matching the time window; and extract the at least one traffic feature from the data flow segments.

[0079] In one embodiment, an alarm module is further included, which is used to send abnormal alarm information after identifying the abnormal traffic characteristics.

[0080] In one embodiment, the feature comparison module 602 is used to compare the at least one flow feature with the historical flow feature under a first monitoring period to obtain a first processing result; wherein the first processing result is used to characterize the historical change trend of the flow feature; and compare the at least one flow feature with the historical flow feature under a second monitoring period to obtain a second processing result; wherein the second processing result is used to characterize the sudden increase or decrease in the flow feature within a preset short time; and the comparison result is obtained based on the first processing result and the second processing result.

[0081] In one embodiment, an update module is also included for configuring the type of traffic characteristics to be compared; comparing the at least one traffic characteristic with the type of traffic characteristics to obtain a third processing result; updating the comparison result according to the third processing result to obtain an updated comparison result; and identifying abnormal traffic characteristics from the updated comparison result.

[0082] In one embodiment, the at least one traffic feature includes at least one of an IP number and a UID number.

[0083] In the technical solutions disclosed herein, the acquisition, storage, and application of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0084] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0085] Figure 7A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0086] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. Various programs and data required for the operation of the device 700 can also be stored in the RAM 703. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0087] Various components in device 700 are connected to I / O interface 705, including an input unit 706, such as a keyboard, mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, optical disk, etc.; and a communication unit 709, such as a network card, modem, wireless communication transceiver, etc. The communication unit 709 allows device 700 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0088] The computing unit 701 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as the abnormal traffic identification method. For example, in some embodiments, the abnormal traffic identification method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the abnormal traffic identification method described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the abnormal traffic identification method in any other suitable manner (e.g., via firmware).

[0089] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0090] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0091] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0092] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0093] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0094] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0095] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0096] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal traffic, comprising: extracting at least one traffic feature from the real-time traffic data stream; Comparing the at least one traffic characteristic with historical traffic characteristics under different monitoring time periods to obtain a comparison result; identifying an abnormal traffic feature from the comparison result, wherein the abnormal traffic feature is used to characterize a traffic feature that is inconsistent with a change trend of the historical traffic feature; The step of comparing the at least one traffic characteristic with historical traffic characteristics under different monitoring durations to obtain a comparison result includes: Comparing the at least one traffic characteristic with historical traffic characteristics over a first monitoring period to obtain a first processing result; wherein the first processing result is used to characterize a historical change trend of the traffic characteristic; and the first monitoring period includes a preset long time period for reflecting a long-term historical change trend of the traffic characteristic; Comparing the at least one flow characteristic with historical flow characteristics over a second monitoring period to obtain a second processing result; wherein the second monitoring period includes a preset short period of time for reflecting a long-term historical change trend of the flow characteristic; and the second processing result is used to characterize a sudden increase or decrease in the flow characteristic over the preset short period of time; Obtaining the comparison result according to the first processing result and the second processing result; Configure the type of traffic characteristics to be compared; comparing the at least one flow feature with the type of the flow feature to obtain a third processing result; updating the comparison result according to the third processing result to obtain an updated comparison result; identifying abnormal traffic characteristics from the updated comparison results; The configuration method of the type of traffic characteristics to be compared includes: When the parameter statistical value of the traffic feature surges within the preset time window, the traffic feature type corresponding to the parameter is used as a new traffic feature type; when the parameter statistical value of the traffic feature is 0 within the preset time window, the traffic feature type corresponding to the parameter is deleted or modified to another traffic feature type.

2. The method according to claim 1, wherein The extracting at least one traffic feature from the real-time traffic data stream includes: Dividing the real-time traffic data flow according to the time window to obtain data flow segments matching the time window; The at least one traffic feature is extracted from the data stream segment.

3. The method according to claim 1 or 2, further comprising: After the abnormal traffic characteristics are identified, abnormal alarm information is sent.

4. The method according to claim 1, wherein The at least one traffic feature includes: at least one of an Internet Protocol IP number and a user identity verification UID number.

5. An abnormal traffic identification device, comprising: A feature extraction module, configured to extract at least one traffic feature from a real-time traffic data stream; a feature comparison module, configured to compare the at least one traffic feature with historical traffic features under different monitoring periods to obtain a comparison result; a feature recognition module, configured to recognize abnormal traffic features from the comparison result, wherein the abnormal traffic features are used to characterize traffic features that are inconsistent with the changing trend of the historical traffic features; Among them, the feature comparison module is used to: Comparing the at least one traffic characteristic with historical traffic characteristics over a first monitoring period to obtain a first processing result; wherein the first processing result is used to characterize a historical change trend of the traffic characteristic; and the first monitoring period includes a preset long time period for reflecting a long-term historical change trend of the traffic characteristic; Comparing the at least one flow characteristic with historical flow characteristics over a second monitoring period to obtain a second processing result; wherein the second monitoring period includes a preset short period of time for reflecting a long-term historical change trend of the flow characteristic; and the second processing result is used to characterize a sudden increase or decrease in the flow characteristic over the preset short period of time; Obtaining the comparison result according to the first processing result and the second processing result; Also includes update modules for: Configure the type of traffic characteristics to be compared; comparing the at least one flow feature with the type of the flow feature to obtain a third processing result; updating the comparison result according to the third processing result to obtain an updated comparison result; identifying abnormal traffic characteristics from the updated comparison results; The configuration method of the type of traffic characteristics to be compared includes: When the parameter statistical value of the traffic feature surges within the preset time window, the traffic feature type corresponding to the parameter is used as a new traffic feature type; when the parameter statistical value of the traffic feature is 0 within the preset time window, the traffic feature type corresponding to the parameter is deleted or modified to another traffic feature type.

6. The device according to claim 5, wherein The feature extraction module is used to: Dividing the real-time traffic data flow according to the time window to obtain data flow segments matching the time window; The at least one traffic feature is extracted from the data stream segment.

7. The device according to claim 5 or 6, further comprising an alarm module for: After the abnormal traffic characteristics are identified, abnormal alarm information is sent.

8. The device according to claim 5, wherein The at least one traffic feature includes at least one of an Internet protocol number and a user identification number.

9. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 4.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-4.

11. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 4.

Images