Abnormal detection method, device, medium and electronic device for system flow data

Abstract

The present disclosure relates to the field of network communication technology, and specifically, to a method, device, medium and electronic device for detecting anomalies in system traffic data. The method includes: obtaining a system traffic data sequence within a target time period; performing a first hypothesis check corresponding to a first anomaly detection model on the system traffic data sequence; if the system traffic data sequence fails to pass the first hypothesis check, performing a second hypothesis check corresponding to a second anomaly detection model on the system traffic data sequence, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model; if the system traffic data sequence passes the second hypothesis check, performing anomaly detection on the system traffic data sequence using the second anomaly detection model to obtain an anomaly detection result. In this way, while selecting a high-precision model as much as possible, it is possible to ensure that the selected anomaly detection model is applicable, so as to obtain an anomaly detection result with higher accuracy.

Description

Technical Field

[0001] The present disclosure relates to the field of network communication technology, and in particular to a method, device, medium and electronic device for detecting anomalies in system flow data. Background Art

[0002] System traffic data has the random characteristics of being sometimes smooth and sometimes fluctuating. At present, a fixed threshold is usually set for traffic anomaly detection. Taking the setting of the upper threshold as an example, if the system traffic is large as the benchmark, the upper threshold will be set too high, which will lead to missed reports when the system traffic is small; if the system traffic is small as the benchmark, the upper threshold will be set too low, which will lead to false reports when the system traffic is large. The setting of fixed thresholds cannot adapt to the randomness of traffic. This monitoring method has a large number of blind spots, which is not conducive to the rapid discovery and disposal of traffic anomalies. Summary of the invention

[0003] The purpose of the present disclosure is to provide a method, device, medium and electronic device for detecting anomalies in system flow data, so as to improve the accuracy of anomaly detection in system flow data.

[0004] In order to achieve the above-mentioned object, the present disclosure provides a method for detecting anomalies in system flow data in a first aspect, comprising:

[0005] Obtain system flow data sequence within the target time period;

[0006] Performing a first hypothesis check corresponding to a first anomaly detection model on the system flow data sequence;

[0007] In the case where the system flow data sequence fails the first hypothesis check, performing a second hypothesis check corresponding to a second anomaly detection model on the system flow data sequence, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model;

[0008] When the system flow data sequence passes the second hypothesis check, the second anomaly detection model is used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result.

[0009] Optionally, the first hypothesis check includes a Jarque-Bera check and / or a Kolmogorov-Smirnov check; the first anomaly detection model is a detection model based on a normal distribution;

[0010] The second hypothesis check includes a stationarity check and / or a randomness check; the second anomaly detection model is a detection model based on time series.

[0011] Optionally, the method further comprises:

[0012] When the system flow data sequence fails to pass the second hypothesis check, a third anomaly detection model is used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result, wherein the accuracy of the third anomaly detection model is less than the accuracy of the second anomaly detection model.

[0013] Optionally, the first anomaly detection model, the second anomaly detection model and the third anomaly detection model are of different types.

[0014] Optionally, the third anomaly detection model is a detection model based on a neural network.

[0015] Optionally, obtaining the system flow data sequence within the target time period includes:

[0016] Data sampling is performed on each node in the target system according to the target sampling interval to obtain the original traffic data of each node;

[0017] For each sampling moment, determine the system flow data of the target system at the sampling moment according to the original flow data of each node obtained at the sampling moment, and associate the sampling moment and the system flow data and store them in a system flow data table;

[0018] The system flow data within the target time period is acquired from the system flow data table to obtain the system flow data sequence.

[0019] Optionally, the method further comprises:

[0020] For a predetermined number of consecutive sampling moments, determining information on the degree of change between the system flow data at two adjacent sampling moments;

[0021] The target sampling interval is adjusted according to the change degree information.

[0022] Optionally, adjusting the target sampling interval according to the change degree information includes:

[0023] In the continuous predetermined number of sampling moments, if the number of change degree information greater than the preset first change degree threshold reaches the preset number threshold, shortening the target sampling interval;

[0024] In the predetermined number of consecutive sampling moments, if the number of change degree information less than a preset second change degree threshold reaches the number threshold, the target sampling interval is increased; wherein the first change degree threshold is greater than the second change degree threshold.

[0025] A second aspect of the present disclosure provides a system flow data anomaly detection device, comprising:

[0026] An acquisition module is used to acquire a system flow data sequence within a target time period;

[0027] A first verification module, configured to perform a first hypothesis verification corresponding to a first anomaly detection model on the system flow data sequence;

[0028] A second verification module is used to perform a second hypothesis verification corresponding to a second anomaly detection model on the system flow data sequence when the system flow data sequence fails to pass the first hypothesis verification, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model;

[0029] The first anomaly determination module is used to perform anomaly detection on the system flow data sequence using the second anomaly detection model to obtain an anomaly detection result when the system flow data sequence passes the second hypothesis check.

[0030] A third aspect of the present disclosure provides a non-temporary computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method provided in the first aspect of the present disclosure.

[0031] A fourth aspect of the present disclosure provides an electronic device, including:

[0032] a memory having a computer program stored thereon;

[0033] A controller, wherein when the computer program is executed by the controller, the steps of the method provided in the first aspect of the present disclosure are implemented.

[0034] In the above technical scheme, the first hypothesis check can be used to determine whether the system flow data sequence can meet the boundary conditions of the first anomaly detection model with higher accuracy; if the first hypothesis check fails, it can be determined that the system flow data sequence exceeds the data range that can be accurately processed by the first anomaly detection model and cannot meet the boundary conditions of the first anomaly detection model. Even if the system flow data sequence is input into the first anomaly detection model, an anomaly detection result with higher accuracy cannot be obtained; further, the second hypothesis check can be used to determine whether the anomaly detection result can be determined using a second anomaly detection model with relatively lower accuracy. If the second hypothesis check passes, it can be determined that the system flow data sequence meets the boundary conditions of the second anomaly detection model. The system flow data sequence is input into the second anomaly detection model to obtain an anomaly detection result with higher accuracy. In this way, through the hypothesis check corresponding to the anomaly detection model, the selected anomaly detection model can be adapted to the current system flow data, and will not output erroneous results due to the influence of various random factors such as time-varying and nonlinearity of the flow data. While selecting a high-precision model as much as possible, ensure that the selected anomaly detection model is applicable to obtain an anomaly detection result with higher accuracy.

[0035] Other features and advantages of the present disclosure will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The accompanying drawings are used to provide a further understanding of the present disclosure and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present disclosure but do not constitute a limitation of the present disclosure. In the accompanying drawings:

[0037] Figure 1 It is a flowchart of a method for detecting anomalies in system flow data provided by an exemplary embodiment of the present disclosure.

[0038] Figure 2 It is a schematic diagram of a short message gateway system provided by an exemplary embodiment of the present disclosure.

[0039] Figure 3 is a relationship diagram between Poisson distribution and normal distribution provided by an exemplary embodiment of the present disclosure.

[0040] Figure 4 It is a schematic diagram of an exemplary embodiment of the present disclosure providing a detection model based on normal distribution for performing anomaly detection on a system flow data sequence.

[0041] Figure 5 It is a schematic diagram of an exemplary embodiment of the present disclosure providing a time series-based detection model for performing anomaly detection on a system flow data sequence.

[0042] Figure 6It is a schematic diagram of a system flow data sequence provided by an exemplary embodiment of the present disclosure.

[0043] Figure 7 It is a block diagram of a system flow data anomaly detection device provided by an exemplary embodiment of the present disclosure.

[0044] Figure 8 An exemplary embodiment of the present disclosure provides a block diagram of an electronic device. DETAILED DESCRIPTION

[0045] The specific implementation of the present disclosure is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described herein is only used to illustrate and explain the present disclosure, and is not used to limit the present disclosure.

[0046] It should be noted that all actions of acquiring signals, information or data in the present disclosure are carried out in compliance with the relevant data protection laws and policies of the country where the device is located and with the authorization given by the owner of the corresponding device.

[0047] Figure 1 FIG. 1 is a flow chart of a method for detecting abnormality in system flow data provided by an exemplary embodiment of the present disclosure. Figure 1 As shown, the method may include S101 to S104. It should be noted that the method provided by the present disclosure can be applied to the abnormal detection of traffic data of various systems, such as game software systems, enterprise management systems, etc. In order to understand the present disclosure more clearly, the following will take the system traffic data as the message traffic of the SMS gateway system (i.e., the number of messages) as an example for illustration. However, it should be understood that the example of the system traffic data as the message traffic of the SMS gateway system should not be understood as limiting the application field and protection scope of the present disclosure.

[0048] S101, obtaining a system flow data sequence within a target time period.

[0049] Figure 2 FIG. 1 is a schematic diagram of a short message gateway system provided by an exemplary embodiment of the present disclosure. Figure 2 As shown, according to the hierarchical structure of the SMS gateway system, the SMS gateway system 200 can be divided into four layers, namely the host layer 201, the data layer 202, the analysis layer 203 and the presentation layer 204. The SMS gateway system 200 belongs to a distributed cluster, and the data collection module can be deployed on each host corresponding to the host layer 201 to complete the task of collecting message traffic. Afterwards, the host layer 201 can upload the collected message traffic to the data layer 202 through the data bus, and the data layer 202 can filter and integrate the received message traffic through the stream-batch integration technology to obtain the system traffic data, so as to provide the analysis layer 203 with abnormal judgment of the system traffic data.

[0050] In the analysis layer 203, when making an abnormality judgment, the system flow data belonging to the target time period is first obtained from the data layer 202, and a system flow data sequence to be detected is formed in the order from early to late. Among them, the target time period can be determined based on a sliding time window, or can be determined based on the current moment and a preset duration. For example, if an abnormality detection operation is to be performed at the current moment, the moment corresponding to the preset duration before the current moment is used as the starting moment of the target time period, and the current moment is used as the ending moment of the target time period to obtain the target time period.

[0051] S102: Perform a first hypothesis check corresponding to a first anomaly detection model on the system flow data sequence.

[0052] S103: When the system flow data sequence fails the first hypothesis check, a second hypothesis check corresponding to the second anomaly detection model is performed on the system flow data sequence.

[0053] Among them, the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model.

[0054] Exemplarily, the accuracy of the second anomaly detection model is less than that of the first anomaly detection model, indicating that when the system flow data sequence can simultaneously meet the boundary conditions of the first anomaly detection model and the second anomaly detection model, the accuracy of the output result of the first anomaly detection model is higher than the accuracy of the output result of the second anomaly detection model, that is, compared with the second anomaly detection model, the first anomaly detection model can more accurately determine whether the system flow data is abnormal.

[0055] Boundary conditions refer to the variation patterns of the variables or their derivatives solved on the boundary of the solution area with time and place. If the variation patterns are met, the boundary conditions are satisfied. The more accurate the model is, the more susceptible it is to the influence of various random factors such as the time variation and nonlinearity of the flow data, and the more difficult it is to meet the corresponding boundary conditions. Once the obtained system flow data sequence fails to meet the boundary conditions of the corresponding model, that is, the system flow data sequence exceeds the data range that can be accurately processed by the model, it can be determined that the system flow data sequence cannot adapt to the model, and the model is more likely to output wrong results.

[0056] When the accuracy of the second anomaly detection model is less than that of the first anomaly detection model, the boundary condition requirements of the second anomaly detection model are easier to meet than those of the first anomaly detection model, and the model has higher universality. For the same system flow data sequence, when the system flow data sequence cannot be adapted to the first anomaly detection model but can be adapted to the second anomaly detection model, the output result of the second anomaly detection model has higher accuracy.

[0057] Therefore, the system flow data sequence can be subjected to a first hypothesis check corresponding to the first anomaly detection model, and the first hypothesis check can be used to determine whether the system flow data sequence can meet the boundary conditions of the first anomaly detection model. In the case of passing the first hypothesis check, it can be determined that the system flow data sequence can meet the boundary conditions of the first anomaly detection model, the system flow data sequence can be adapted to the first anomaly detection model, and the anomaly detection result output by the first anomaly detection model is accurate. In the case of failing the first hypothesis check, it can be determined that the system flow data sequence does not meet the boundary conditions of the first anomaly detection model, the system flow data sequence cannot be adapted to the first anomaly detection model, and the anomaly detection result output by the first anomaly detection model has low accuracy. At this time, in order to obtain an anomaly detection result with higher accuracy, a second anomaly detection model with lower accuracy and higher universality than the first anomaly detection model can be selected for anomaly judgment.

[0058] Similarly, in order to determine whether the current system traffic data sequence is compatible with the second anomaly detection model, a second hypothesis check corresponding to the second anomaly detection model may be performed on the system traffic data sequence so that the selected anomaly detection model can adapt to the randomness of the system traffic data.

[0059] In this way, through the hypothesis verification corresponding to the anomaly detection model, the selected anomaly detection model can be adapted to the current system flow data, and will not output erroneous results due to the influence of various random factors such as the time-varying and nonlinear nature of the flow data. This can ensure that the selected anomaly detection model is applicable to improve the accuracy of the anomaly detection results of the system flow data.

[0060] S104: When the system flow data sequence passes the second hypothesis check, use the second anomaly detection model to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result.

[0061] Exemplarily, when the second hypothesis check is passed, it can be determined that the system flow data sequence can meet the boundary conditions of the second anomaly detection model, the system flow data sequence can be adapted to the second anomaly detection model, and the anomaly detection result output by the second anomaly detection model is accurate. Therefore, the second anomaly detection model can be used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result.

[0062] In the above technical scheme, the first hypothesis check can be used to determine whether the system flow data sequence can meet the boundary conditions of the first anomaly detection model with higher accuracy; if the first hypothesis check fails, it can be determined that the system flow data sequence exceeds the data range that can be accurately processed by the first anomaly detection model and cannot meet the boundary conditions of the first anomaly detection model. Even if the system flow data sequence is input into the first anomaly detection model, an anomaly detection result with higher accuracy cannot be obtained; further, the second hypothesis check can be used to determine whether the anomaly detection result can be determined using a second anomaly detection model with relatively lower accuracy. If the second hypothesis check passes, it can be determined that the system flow data sequence meets the boundary conditions of the second anomaly detection model. The system flow data sequence is input into the second anomaly detection model to obtain an anomaly detection result with higher accuracy. In this way, through the hypothesis check corresponding to the anomaly detection model, the selected anomaly detection model can be adapted to the current system flow data, and will not output erroneous results due to the influence of various random factors such as time-varying and nonlinearity of the flow data. While selecting a high-precision model as much as possible, ensure that the selected anomaly detection model is applicable to obtain an anomaly detection result with higher accuracy.

[0063] Optionally, the method for detecting anomalies in system flow data provided by the present disclosure may further include:

[0064] When the system flow data sequence passes the first hypothesis check, the first anomaly detection model is used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result.

[0065] Exemplarily, when the system flow data sequence passes the first hypothesis check, it can be determined that the system flow data sequence does not exceed the data range that can be accurately processed by the first anomaly detection model, meets the boundary conditions of the first anomaly detection model, and the system flow data sequence can be adapted to the first anomaly detection model, and the anomaly detection result output by the first anomaly detection model is accurate. The accuracy of the first anomaly detection model is greater than the accuracy of the second anomaly detection model, and it can more accurately determine whether the system flow data is abnormal. Therefore, the first anomaly detection model can be used to perform anomaly detection on the system flow data sequence to obtain anomaly detection results with higher accuracy.

[0066] Optionally, the method for detecting anomalies in system flow data provided by the present disclosure may further include:

[0067] When the system flow data sequence fails to pass the second hypothesis check, the system flow data sequence is subjected to anomaly detection using a third anomaly detection model to obtain an anomaly detection result, wherein the accuracy of the third anomaly detection model is less than the accuracy of the second anomaly detection model.

[0068] Exemplarily, if the system flow data sequence fails to pass the second hypothesis check, it can be determined that the system flow data sequence does not meet the boundary conditions of the second anomaly detection model, the system flow data sequence cannot be adapted to the second anomaly detection model, and the accuracy of the anomaly detection result output by the second anomaly detection model is low. At this time, in order to obtain an anomaly detection result with higher accuracy, a third anomaly detection model with lower accuracy and higher universality than the second anomaly detection model can be selected for anomaly detection judgment to improve the accuracy of the anomaly detection result of the system flow data.

[0069] Optionally, the first anomaly detection model, the second anomaly detection model, and the third anomaly detection model are of different types.

[0070] Optionally, the first hypothesis check may include a Jarque-Bera check and / or a Kolmogorov-Smirnov check; accordingly, the first anomaly detection model may be a detection model based on a normal distribution.

[0071] For example, there are many reasons for the messages arriving at the SMS gateway system. It may be a verification code SMS for logging into an account, or a reminder SMS for transfer consumption. In most cases, the messages are independent of each other. The SMS gateway system is equivalent to the crossroads of the information highway. Messages from all directions arrive here for convergence and distribution, and will continuously provide services to the outside world. Therefore, the message traffic of the SMS gateway system conforms to the steady independent incremental counting process, and can be modeled according to the Poisson process. The parameter lambda in the Poisson process means the number of messages arriving at the data layer of the SMS gateway system per unit time. Figure 3 is a relationship diagram between Poisson distribution and normal distribution provided by an exemplary embodiment of the present disclosure. Figure 3 It can be obtained that when the parameter lambda of the Poisson distribution gradually increases, the Poisson distribution will become more and more similar to the normal distribution. In actual production, the number of messages arriving at the data layer of the SMS gateway system per unit time can reach tens of thousands, so the message traffic can be modeled according to the normal distribution. Therefore, the first anomaly detection model can be a detection model based on the normal distribution.

[0072] As described above, in order to determine whether the anomaly detection model is adaptable to the current system flow data, a first hypothesis check corresponding to the first anomaly detection model may be performed on the system flow data sequence. The first hypothesis check corresponding to the detection model based on the normal distribution may include a Jarque-Bera check and / or a Kolmogorov-Smirnov check.

[0073] The Jarque-Bera test is a parametric hypothesis test based on the morphological aspects of skewness and kurtosis. The selected test statistic can be:

[0074]

[0075] Where JB is the test statistic of the Jarque-Bera test, s is the sample skewness, k is the sample kurtosis, and T is the degree of freedom. If the determined JB value does not exceed the critical value, it can be determined that the Jarque-Bera test has passed.

[0076] The Kolmogorov-Smirnov test is a nonparametric hypothesis test based on the cumulative distribution function. Its core is to find the maximum distance between samples and compare it with the critical value to determine whether it falls into the rejection domain, thereby determining whether there is a significant difference between the empirical distribution and the ideal distribution. If it is determined that there is no significant difference, it can be determined that the Kolmogorov-Smirnov test has passed.

[0077] In order to ensure the validity and reliability of the first hypothesis check, the Jarque-Bera check and the Kolmogorov-Smirnov check can be introduced at the same time, that is, when the system flow data sequence passes the Jarque-Bera check and the Kolmogorov-Smirnov check at the same time, it is determined that the system flow data sequence passes the first hypothesis check.

[0078] When it is determined that the system flow data sequence passes both the Jarque-Bera check and the Kolmogorov-Smirnov check, the abnormal detection result can be determined based on the detection model of the normal distribution. Specifically, the mean and standard deviation of the system flow data sequence can be determined, and then the abnormal detection result can be determined based on the distribution of each data in the system flow data sequence relative to the mean.

[0079] For example, Figure 4 As shown, for traffic data within the range of one standard deviation around the mean, it is determined as normal data. For traffic data outside the range of two standard deviations around the mean, it is determined as abnormal data. For traffic data within the range of two standard deviations around the mean but outside the range of one standard deviation, it can be determined whether it is normal data or abnormal data based on pre-configured strategies. For example, strategies can include the following three:

[0080] a. It is better to have a false alarm than to miss a report. This strategy is suitable for security protection when undertaking important tasks. At this time, the traffic data that falls outside the range of one standard deviation but falls within the range of two standard deviations is determined as abnormal data.

[0081] b. Select the balance of false positives and false negatives. This strategy is suitable for most daily situations. At this time, you can set a threshold to distinguish whether the traffic data that falls outside the range of one standard deviation but falls within the range of two standard deviations is abnormal. For example, when the absolute value of the deviation between the traffic data and the mean is greater than the threshold, it is determined as abnormal data. When the absolute value of the deviation between the traffic data and the mean is not greater than the threshold, it is determined as normal data.

[0082] c. It is better to miss a report than to report a false report. This strategy is suitable for administrators who do not want to be disturbed as much as possible. At this time, the traffic data that falls outside the range of one standard deviation but falls within the range of two standard deviations is determined as normal data.

[0083] In this way, the detection model based on normal distribution can accurately determine whether there are abnormalities in the system flow data.

[0084] Optionally, the second hypothesis check may include a stationarity check and / or a randomness check; accordingly, the second anomaly detection model may be a detection model based on a time series.

[0085] Exemplarily, a stationarity check can be used to determine whether the system flow data sequence is stationary. The stationarity check can be, for example, an Augmented Dickey-Fuller test, referred to as an ADF test, i.e., a unit root test, which is an augmented form of the Dickey-Fuller test. When there is a high-order lag correlation in the system flow data sequence, the ADF test can be used. The ADF test actually determines whether there is a unit root in the sequence: if the sequence is stationary, there is no unit root; otherwise, there is a unit root. Therefore, when the system flow data sequence passes the ADF test, it can be determined that the system flow data sequence is stationary.

[0086] Randomness check can be used to determine whether the autocorrelation of the system flow data series is significant. The randomness check can be a Ljung-Box test. The statistic Q of the Ljung-Box test follows a chi-square distribution with m degrees of freedom. Through the Ljung-Box test, it can be tested whether the autocorrelation of the time series is significant within the m-order lag range. If it is determined that the Ljung-Box test cannot be passed, it can be determined that the data autocorrelation in the system flow data series is not significant.

[0087] In order to ensure the validity and reliability of the second hypothesis check, the stationarity check and the randomness check can be introduced at the same time, that is, when the system flow data sequence passes the stationarity check and the randomness check at the same time, it is determined that the system flow data sequence passes the second hypothesis check.

[0088] The detection model based on time series can be an ARIMA model (Autoregressive Integrated Moving Average model), which can organically integrate the three technologies of difference, autoregression and sliding average to jointly complete the judgment of the reasonable range of traffic data. As new data is generated, the model will continue to adjust to adapt to changes in the environment, and can overcome the situation in which random analysis is more sensitive to system time variability to a certain extent. As time changes, new traffic data is constantly generated, generating new traffic data sequences, such as Figure 5 As shown in the figure, as time goes by, the boundaries of the confidence interval and the strategy interval are constantly changing, that is, the reasonable range of traffic is constantly changing. Therefore, the detection model based on time series can accurately determine whether there is anomaly in the system traffic data.

[0089] Optionally, the third anomaly detection model may be a detection model based on a neural network.

[0090] For example, in extreme cases where the message traffic changes very drastically and the nonlinearity is very obvious, the system traffic data sequence may not pass the first hypothesis check and the second hypothesis check. At this time, a more universal neural network-based detection model can be used for anomaly detection. The neural network-based detection model is trained using machine learning and is a machine learning model that can make anomaly judgments based on the system traffic data sequence.

[0091] For example, the third anomaly detection model may be a nonlinear support vector machine (SVM) model. The SVM model can map the original linearly inseparable nonlinear samples to a higher-dimensional feature space, so that the samples are linearly separable in the feature space, wherein the kernel function corresponding to the SVM model may be a Laplace kernel.

[0092] The SVM model can be trained according to historical data containing positive and negative samples, and the trained SVM model is used as the third anomaly detection model.

[0093] Optionally, new training data containing positive and negative samples can be continuously obtained over time. By using the new training data to update the SVM model, the SVM model can be continuously corrected over time. For example, the influence of historical data in different time periods on the model can be limited based on an exponential weighting method. As time goes by, the influence of early historical data on the model will become smaller and smaller, and the final SVM model can be continuously adapted to new data. In this way, through a continuous iterative process, the accuracy of the abnormal judgment results obtained by the SVM model can be improved.

[0094] The first anomaly detection model based on normal distribution, the second anomaly detection model based on time series, and the third anomaly detection model based on neural network have decreasing accuracy and increasing universality, that is, the possibility of meeting the corresponding boundary conditions increases. By verifying the assumptions corresponding to the anomaly detection model, it can be determined whether the system traffic data sequence is compatible with the anomaly detection model. While selecting a high-precision model as much as possible, avoid the influence of traffic randomness and ensure that the selected anomaly detection model is applicable to obtain anomaly detection results with higher accuracy.

[0095] When it is determined that the system flow data is abnormal, an alarm message can be generated.

[0096] For example, the alarm information can be displayed on the presentation layer of the SMS gateway system. When it is determined that the message traffic is abnormal, the state of the SMS gateway at this time can be recorded, and the alarm information of "traffic abnormality" can be displayed on the corresponding screen on the presentation layer to prompt the administrator that the system traffic data is abnormal.

[0097] Optionally, in S101, obtaining a system flow data sequence within a target time period may include:

[0098] Data sampling is performed on each node in the target system according to the target sampling interval to obtain the original traffic data of each node;

[0099] For each sampling moment, the system flow data of the target system at the sampling moment is determined according to the original flow data of each node obtained at the sampling moment, and the sampling moment and the system flow data are associated and stored in the system flow data table;

[0100] The system flow data within the target time period is obtained from the system flow data table to obtain a system flow data sequence.

[0101] For example, the target system may be an SMS gateway system. The host layer of the SMS gateway system may sample data from each node in the target system according to the target sampling interval to obtain the original traffic data of each node, wherein each node may correspond to a host. The host layer may upload the original traffic data to the data layer and store it in the real-time intermediate result table of the data layer. For each sampling moment, the data layer may determine the system traffic data of the target system at the sampling moment based on the content in the real-time intermediate result table at the sampling moment, that is, the original traffic data of each node. For example, the content in the real-time intermediate result table may be processed by the batch-stream integration technology. Associating the sampling moment with the system traffic data is equivalent to marking a timestamp for the system traffic data to complete data integration; and storing the associated content in the system traffic data table for use by the subsequent analysis layer.

[0102] Optionally, the method for detecting anomalies in system flow data provided by the present disclosure may further include:

[0103] For a predetermined number of consecutive sampling moments, determining information on the degree of change between system flow data at two adjacent sampling moments;

[0104] Adjust the target sampling interval based on the degree of change information.

[0105] For example, from the perspective of random processes, the statistics of system traffic data can be a counting process. If time is used as the horizontal axis and the number of system traffic data is used as the vertical axis, and the sample values ​​are marked on the plane rectangular coordinate system, the realization process (or track) of this random process can be obtained. As time goes by, the number of system traffic data continues to increase, but due to the randomness of traffic generation, the data growth rate is sometimes fast and sometimes slow. Specifically, it can be Figure 6 As shown, the system flow data in the area indicated by arrow A changes slowly, while the system flow data in the area indicated by arrow B changes dramatically. For a predetermined number of consecutive sampling moments, the first-order derivative between the system flow data at two adjacent sampling moments can be determined, that is, the ratio of the change amount of the system flow data at two adjacent sampling moments to the duration of the interval between the two sampling moments can be determined, and the ratio is used as the change degree information to adjust the target sampling interval.

[0106] In an optional embodiment, adjusting the target sampling interval according to the change degree information may include:

[0107] In a predetermined number of consecutive sampling moments, if the number of change degree information greater than a preset first change degree threshold reaches a preset number threshold, shortening the target sampling interval;

[0108] If the number of change degree information less than the preset second change degree threshold reaches the number threshold in a predetermined number of consecutive sampling moments, the target sampling interval is increased.

[0109] The first change degree threshold is greater than the second change degree threshold.

[0110] Exemplarily, if the degree of change information is greater than the first degree of change threshold, it means that the flow data changes greatly between two adjacent sampling moments. If, in a predetermined number of consecutive sampling moments, the number of degree of change information that is greater than the preset first degree of change threshold reaches the preset number threshold, it means that the system flow data has changed dramatically. In order to better characterize the local detail characteristics of the flow data, the target sampling interval can be shortened to perform more intensive sampling. If the degree of change information is less than the second degree of change threshold, it means that the flow data changes less between two adjacent sampling moments. If, in a predetermined number of consecutive sampling moments, the number of degree of change information that is less than the preset second degree of change threshold reaches the preset number threshold, it means that the system flow data changes smoothly. In order to reduce energy consumption and reduce the amount of data processing in the system, the target sampling interval can be increased to reduce the amount of sampling.

[0111] When making adjustments, the target sampling interval may be adjusted according to a preset step length, for example, the target sampling interval may be increased or decreased by a preset step length.

[0112] In this way, the target sampling interval can be dynamically adjusted according to the change degree of flow data, so that the target sampling interval is adapted to the actual change state of the system flow data. When it is determined that the system flow data has undergone drastic changes, more intensive sampling is performed to better characterize the local details of the flow data; when it is determined that the system flow data changes slowly, the target sampling interval can be increased to reduce energy consumption and reduce the amount of data processing in the system.

[0113] Based on the same inventive concept, the present disclosure also provides a device for detecting anomalies in system flow data. Figure 7 FIG. 7 is a block diagram of a system flow data anomaly detection device 700 provided by an exemplary embodiment of the present disclosure. Figure 7 The system flow data anomaly detection device 700 may include an acquisition module 701 , a first verification module 702 , a second verification module 703 and a first anomaly determination module 704 .

[0114] The acquisition module 701 is used to acquire the system flow data sequence within the target time period;

[0115] The first verification module 702 is used to perform a first hypothesis verification corresponding to the first anomaly detection model on the system flow data sequence;

[0116] The second verification module 703 is used to perform a second hypothesis verification corresponding to a second anomaly detection model on the system flow data sequence when the system flow data sequence fails to pass the first hypothesis verification, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model;

[0117] The first anomaly determination module 704 is used to perform anomaly detection on the system flow data sequence using the second anomaly detection model to obtain an anomaly detection result when the system flow data sequence passes the second hypothesis check.

[0118] In the above technical scheme, the first hypothesis check can be used to determine whether the system flow data sequence can meet the boundary conditions of the first anomaly detection model with higher accuracy; if the first hypothesis check fails, it can be determined that the system flow data sequence exceeds the data range that can be accurately processed by the first anomaly detection model and cannot meet the boundary conditions of the first anomaly detection model. Even if the system flow data sequence is input into the first anomaly detection model, an anomaly detection result with higher accuracy cannot be obtained; further, the second hypothesis check can be used to determine whether a second anomaly detection model with relatively lower accuracy can be used to determine the anomaly detection result. If the second hypothesis check passes, it can be determined that the system flow data sequence meets the boundary conditions of the second anomaly detection model. The system flow data sequence is input into the second anomaly detection model to obtain an anomaly detection result with higher accuracy. In this way, through the hypothesis check corresponding to the anomaly detection model, the selected anomaly detection model can be adapted to the current system flow data, and will not output erroneous results due to the influence of various random factors such as time-varying and nonlinearity of the flow data. While selecting a high-precision model as much as possible, ensure that the selected anomaly detection model is applicable to obtain an anomaly detection result with higher accuracy.

[0119] Optionally, the first hypothesis check includes a Jarque-Bera check and / or a Kolmogorov-Smirnov check; the first anomaly detection model is a detection model based on a normal distribution;

[0120] The second hypothesis check includes a stationarity check and / or a randomness check; the second anomaly detection model is a detection model based on time series.

[0121] Optionally, the system flow data anomaly detection device 700 may further include a second anomaly determination module.

[0122] The second anomaly determination module is used to perform anomaly detection on the system flow data sequence using a third anomaly detection model to obtain an anomaly detection result when the system flow data sequence fails to pass the second hypothesis check, wherein the accuracy of the third anomaly detection model is less than the accuracy of the second anomaly detection model.

[0123] Optionally, the first anomaly detection model, the second anomaly detection model and the third anomaly detection model are of different types.

[0124] Optionally, the third anomaly detection model is a detection model based on a neural network.

[0125] Optionally, the acquisition module 701 includes a collection submodule, a first determination submodule and a second determination submodule.

[0126] The acquisition submodule is used to sample data from each node in the target system according to the target sampling interval to obtain the original flow data of each node;

[0127] The first determination submodule is used to determine the system flow data of the target system at each sampling moment according to the original flow data of each node obtained at the sampling moment, and associate the sampling moment and the system flow data and store them in the system flow data table;

[0128] The second determining submodule is used to obtain the system flow data belonging to the target time period from the system flow data table to obtain a system flow data sequence.

[0129] Optionally, the system flow data anomaly detection device 700 may further include a change determination module and an adjustment module.

[0130] The change determination module is used to determine the change degree information between the system flow data at two adjacent sampling moments for a continuous predetermined number of sampling moments;

[0131] The adjustment module is used to adjust the target sampling interval according to the change degree information.

[0132] Optionally, the adjustment module includes a first adjustment submodule and a second adjustment submodule.

[0133] The first adjustment module is used to shorten the target sampling interval if the number of change degree information greater than a preset first change degree threshold reaches a preset number threshold during a continuous predetermined number of sampling moments;

[0134] The second adjustment module is used to increase the target sampling interval if the number of change degree information less than a preset second change degree threshold reaches a quantity threshold in a continuous predetermined number of sampling moments; wherein the first change degree threshold is greater than the second change degree threshold.

[0135] Optionally, the system traffic data is the message traffic of the SMS gateway system.

[0136] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0137] Figure 8 An exemplary embodiment of the present disclosure provides a block diagram of an electronic device 1900. For example, the electronic device 1900 may be provided as a server. Figure 8The electronic device 1900 includes a processor 1922, which may be one or more, and a memory 1932 for storing a computer program executable by the processor 1922. The computer program stored in the memory 1932 may include one or more modules each corresponding to a set of instructions. In addition, the processor 1922 may be configured to execute the computer program to perform the above-mentioned method for detecting abnormalities in system flow data.

[0138] In addition, the electronic device 1900 may further include a power supply component 1926 and a communication component 1950, wherein the power supply component 1926 may be configured to perform power management of the electronic device 1900, and the communication component 1950 may be configured to implement communication, for example, wired or wireless communication, of the electronic device 1900. In addition, the electronic device 1900 may further include an input / output (I / O) interface 1958. The electronic device 1900 may operate based on an operating system stored in the memory 1932.

[0139] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned method for detecting abnormalities in system flow data are implemented. For example, the non-transitory computer-readable storage medium may be the above-mentioned memory 1932 including program instructions, and the above-mentioned program instructions may be executed by the processor 1922 of the electronic device 1900 to complete the above-mentioned method for detecting abnormalities in system flow data.

[0140] In another exemplary embodiment, a computer program product is also provided. The computer program product includes a computer program executable by a programmable device. The computer program has a code portion for executing the above-mentioned method for detecting anomalies in system flow data when executed by the programmable device.

[0141] The preferred embodiments of the present disclosure are described in detail above in conjunction with the accompanying drawings; however, the present disclosure is not limited to the specific details in the above embodiments. Within the technical concept of the present disclosure, a variety of simple modifications can be made to the technical solution of the present disclosure, and these simple modifications all fall within the protection scope of the present disclosure.

[0142] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present disclosure will not further describe various possible combinations.

[0143] In addition, various embodiments of the present disclosure may be arbitrarily combined, and as long as they do not violate the concept of the present disclosure, they should also be regarded as the contents disclosed by the present disclosure.

Claims

1. A method for detecting anomalies in system flow data, characterized in that: include: Obtain system flow data sequence within the target time period; Performing a first hypothesis check corresponding to a first anomaly detection model on the system flow data sequence; In the case where the system flow data sequence fails the first hypothesis check, performing a second hypothesis check corresponding to a second anomaly detection model on the system flow data sequence, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model; In the case where the system flow data sequence passes the second hypothesis check, the second anomaly detection model is used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result, wherein the hypothesis check is used to determine whether the system flow data sequence satisfies the boundary conditions of the corresponding anomaly detection model, and the boundary conditions are the variation rules of the variables solved on the boundary of the solution area or their derivatives with time and place; When the system flow data sequence fails to pass the second hypothesis check, a third anomaly detection model is used to perform anomaly detection on the system flow data sequence to obtain an anomaly detection result, wherein the accuracy of the third anomaly detection model is less than the accuracy of the second anomaly detection model.

2. The method according to claim 1, characterized in that The first hypothesis check includes a Jarque-Bera check and / or a Kolmogorov-Smirnov check; the first anomaly detection model is a detection model based on a normal distribution; The second hypothesis check includes a stationarity check and / or a randomness check; the second anomaly detection model is a detection model based on time series.

3. The method according to claim 1, characterized in that The first anomaly detection model, the second anomaly detection model, and the third anomaly detection model are of different types.

4. The method according to claim 1, characterized in that: The third anomaly detection model is a detection model based on a neural network.

5. The method according to claim 1, characterized in that The step of obtaining a system flow data sequence within a target time period includes: Data sampling is performed on each node in the target system according to the target sampling interval to obtain the original traffic data of each node; For each sampling moment, determine the system flow data of the target system at the sampling moment according to the original flow data of each node obtained at the sampling moment, and associate the sampling moment and the system flow data and store them in a system flow data table; The system flow data within the target time period is acquired from the system flow data table to obtain the system flow data sequence.

6. The method according to claim 5, characterized in that The method further comprises: For a predetermined number of consecutive sampling moments, determining information on the degree of change between the system flow data at two adjacent sampling moments; The target sampling interval is adjusted according to the change degree information.

7. The method according to claim 6, characterized in that The step of adjusting the target sampling interval according to the change degree information includes: In the continuous predetermined number of sampling moments, if the number of change degree information greater than the preset first change degree threshold reaches the preset number threshold, shortening the target sampling interval; In the predetermined number of consecutive sampling moments, if the number of change degree information less than a preset second change degree threshold reaches the number threshold, the target sampling interval is increased; wherein the first change degree threshold is greater than the second change degree threshold.

8. A device for detecting abnormality of system flow data, characterized in that: include: An acquisition module is used to acquire a system flow data sequence within a target time period; A first verification module, configured to perform a first hypothesis verification corresponding to a first anomaly detection model on the system flow data sequence; A second verification module is used to perform a second hypothesis verification corresponding to a second anomaly detection model on the system flow data sequence when the system flow data sequence fails to pass the first hypothesis verification, wherein the accuracy of the second anomaly detection model is less than the accuracy of the first anomaly detection model; A first anomaly determination module is used to perform anomaly detection on the system flow data sequence using the second anomaly detection model to obtain an anomaly detection result when the system flow data sequence passes the second hypothesis check, wherein the hypothesis check is used to determine whether the system flow data sequence satisfies the boundary conditions of the corresponding anomaly detection model, and the boundary conditions are the variation rules of the variables solved on the boundary of the solution area or their derivatives with time and place; The second anomaly determination module is used to perform anomaly detection on the system flow data sequence using a third anomaly detection model to obtain an anomaly detection result when the system flow data sequence fails to pass the second hypothesis check, wherein the accuracy of the third anomaly detection model is less than the accuracy of the second anomaly detection model.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

10. An electronic device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the steps of the method according to any one of claims 1 to 7.

Images