Method, device and electronic equipment for detecting abnormal traffic

Abstract

The application provides a method and device for detecting abnormal traffic, electronic equipment and a computer readable storage medium. A specific embodiment of the method comprises: inputting a to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model calculates the anomaly score based on a characteristic value of the to-be-detected traffic and pre-determined anomaly interval information; and determining the degree of abnormality of the to-be-detected traffic according to the anomaly score. The method can improve the detection accuracy of abnormal traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, in particular, to an abnormal traffic detection method and device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With normal application traffic on the network, various abnormal traffic on the network also comes along, affecting the normal operation of the network, and threatening the security and use of user hosts. Network anomalies are often caused by network attacks, worm viruses, network abuse, etc. For example: various network scans, distributed denial of service attacks (DDoS), network worm viruses, malicious downloads, improper use of network resources, etc. can cause network performance degradation, seriously affecting normal network use, causing network congestion, and even network interruption, network device failure, etc. Therefore, detecting abnormal network traffic and discovering known and unknown types of network anomalies in the network are important links in network security management.

[0003] In related technologies, there is a scheme for detecting abnormal traffic using a machine learning algorithm, but the abnormal traffic samples required for training the model are not easy to collect, and the same model is not suitable for multiple application scenarios (for example, a model trained based on bank data is not suitable for an education application scenario), so when the converged model is applied to actual detection scenarios, there are problems of low accuracy and poor model adaptability. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide an abnormal traffic detection method, device, electronic device and computer readable storage medium to improve the detection accuracy of abnormal traffic.

[0005] In a first aspect, the embodiments of the present application provide an abnormal traffic detection method, which comprises: inputting a to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model calculates the anomaly score based on a feature value of the to-be-detected traffic and pre-determined anomaly interval information; and determining an abnormality degree of the to-be-detected traffic according to the anomaly score. In this way, the anomaly detection model does not need to obtain abnormal traffic samples, and since it is established based on the feature value and the anomaly interval information determined by the feature value, it does not involve specific scene data, and can thus be applied to different application scenarios. Therefore, when the to-be-detected traffic is detected using the anomaly detection model, it has the advantages of high accuracy and strong model adaptability.

[0006] Optionally, the abnormal interval information is determined based on the following steps: extracting feature values corresponding to a plurality of historical traffics respectively, and dividing a plurality of intervals according to the feature values with the largest values; placing each of the historical traffics in a matching interval according to the corresponding feature value; for each interval, calculating a frequency of a number of historical traffics placed in the interval in a total number of the historical traffics; and merging the plurality of intervals according to the frequencies corresponding to each interval to obtain the abnormal interval information. In this way, the plurality of divided intervals can be merged according to the historical traffics, so that the number of intervals can be reduced without affecting the detection effect, and the operation speed of the abnormal detection model is improved to a certain extent.

[0007] Optionally, the merging the plurality of intervals according to the frequencies corresponding to each interval to obtain the abnormal interval information comprises: sorting the frequencies corresponding to each interval according to the numerical values; placing a cumulative sum of two adjacent frequencies in a sequence, and determining whether the cumulative sum causes a change in the arrangement order of the sequence; if not, merging the intervals corresponding to the two adjacent frequencies; and if yes, stopping the merging to obtain the abnormal interval information. In this way, the intervals can be dynamically merged according to the frequencies corresponding to each interval without affecting the rarity of the intervals, so that the number of intervals used to calculate the abnormal score is obtained, and the calculation rate is improved.

[0008] Optionally, the abnormal interval information comprises a number of abnormal intervals, and the abnormal detection model calculates the abnormal score by: initializing a number of traffics placed in the abnormal intervals corresponding to the number of abnormal intervals; for each current traffic, placing the current traffic in a target abnormal interval according to the feature value of the current traffic, and counting a number of traffics currently placed in the target abnormal interval; counting a total number of target traffics placed in a plurality of abnormal intervals with a number of traffics below the number of traffics in the target abnormal interval; counting a total number of traffics placed in the plurality of abnormal intervals; calculating a ratio of the total number of target traffics to the total number of traffics, and mapping the ratio according to a preset rule; and determining a value obtained after the mapping as the abnormal score. In this way, since the total number of target traffics is for a plurality of abnormal intervals with a number of traffics below the number of traffics in the target abnormal interval, the rarity of the current traffic can be better reflected, and the abnormal score is more reliable.

[0009] Optionally, the mapping the ratio according to the preset rule comprises: mapping the ratio into a logarithm corresponding to the ratio. In this way, the ratio can be mapped into a smaller granularity to improve the accuracy of detection.

[0010] Optionally, the feature value comprises information entropy obtained based on a statistical language model algorithm. In this way, the information entropy obtained based on the statistical language model algorithm can be taken as the feature value, so as to improve the accuracy of the anomaly score calculated by the anomaly detection model.

[0011] Optionally, the anomaly traffic detection method further comprises: updating the anomaly detection model based on the to-be-detected traffic. In this way, the accuracy of the anomaly detection model in detecting traffic can be improved.

[0012] In a second aspect, an embodiment of the present application provides an anomaly traffic detection device, which comprises: a calculation module configured to input to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model is configured to calculate the anomaly score based on a feature value of the to-be-detected traffic and pre-determined anomaly interval information; and a judgment module configured to judge the anomaly degree of the to-be-detected traffic according to the anomaly score. In this way, the anomaly detection model does not need to obtain anomaly traffic samples, and since it is established based on the feature value and the anomaly interval information determined by the feature value, it does not involve specific scene data, and thus can be applied to different application scenarios. Therefore, when the to-be-detected traffic is detected by using the anomaly detection model, the anomaly detection model has the advantages of high accuracy and strong model adaptability.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, which comprises a processor and a memory, and the memory stores computer readable instructions, when the computer readable instructions are executed by the processor, the steps in the method provided in the first aspect are executed.

[0014] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, when the computer program is executed by a processor, the steps in the method provided in the first aspect are executed.

[0015] Other features and advantages of the present application will be described in the following description, and some will become apparent from the description, or will be learned from the practice of the application. The purpose and other advantages of the present application can be achieved and obtained by the structure specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments of the present application. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0017] Figure 1 A flowchart of an abnormal traffic detection method provided by an embodiment of the present application is shown in FIG. 1.

[0018] Figure 2 A structural block diagram of an abnormal traffic detection device provided by an embodiment of the present application is shown in FIG. 2.

[0019] Figure 3 A structural schematic diagram of an electronic device for performing an abnormal traffic detection method provided by an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. The components of the embodiments of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0021] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0022] It should be noted that, in the case of no conflict, the embodiments in the present application or the technical features in the embodiments can be combined.

[0023] In the related art, when detecting abnormal traffic, there are problems of low accuracy and poor model adaptability; in order to solve the problem, the present application provides an abnormal traffic detection method, device, electronic device and computer readable storage medium; further, the abnormal traffic can be detected by an anomaly detection model. The anomaly detection model can be established based on an unsupervised manner, without obtaining abnormal traffic samples. And because it is established based on feature values and abnormal interval information determined by the feature values, it does not involve specific scene data, and can be applied to different application scenarios. Therefore, it has high accuracy and strong model adaptability.

[0024] In some application scenarios, the above abnormal traffic detection method can be applied to a server, a server cluster, a cloud platform or a terminal device that can perform data processing in essence. In these application scenarios, the server, the server cluster, the cloud platform or the terminal device can receive the to-be-detected traffic, and then can take it as an input of the anomaly detection model to output a corresponding detection result through the anomaly detection model.

[0025] The embodiment of the present application is applied to a server.

[0026] The defects of the above-mentioned solutions in the related art are the results obtained by the inventors after practice and careful study. Therefore, the discovery process of the above-mentioned problems and the solutions proposed by the embodiments of the present application to the above-mentioned problems should be the contributions made by the inventors to the present application in the process of the present application.

[0027] Please refer to Figure 1 which shows a flowchart of an abnormal traffic detection method provided by an embodiment of the present application. As shown in Figure 1 , the abnormal traffic detection method comprises the following steps 101 to 102.

[0028] Step 101, inputting a to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model calculates the anomaly score based on a feature value of the to-be-detected traffic and pre-determined anomaly interval information;

[0029] In some application scenarios, a server can obtain to-be-detected traffic. The above-mentioned to-be-detected traffic can be regarded as data that has not been parsed, for example, it can include a packet. After the server obtains the to-be-detected traffic, it can be parsed. For example, for http (Hyper Text Transfer Protocol, referred to as http, Hyper Text Transfer Protocol) traffic (i.e. traffic transmitted through Hyper Text Transfer Protocol), the server can extract its URL (Uniform Resource Locator, referred to as URL, Uniform Resource Locator) information, and the extraction process can be regarded as a parsing process. For DNS (Domain Name System, referred to as DNS, Domain Name System) traffic (i.e. traffic transmitted through Domain Name System), the server can extract its domain name information.

[0030] After the server parses the to-be-detected traffic, it can be input into an anomaly detection model. In some application scenarios, the above-mentioned anomaly detection model can calculate the anomaly score of the to-be-detected traffic based on the feature value of the to-be-detected traffic and the anomaly interval information.

[0031] The feature values may, for example, include the number of characters, the number of uppercase letters, and the number of lowercase letters, etc. For example, for HTTP traffic, the feature values may include the number of characters included in the URL, the number of uppercase letters, and the number of lowercase letters, etc.

[0032] The abnormal interval information may be considered as a plurality of interval information determined based on the feature values. The abnormal interval information may, for example, include interval length, interval number, and the like. For example, for the number of characters, if the number of characters is 10, 10 intervals may be divided, and the interval length of each interval may be 1, for example (i.e., each interval may be [0, 1], [1, 2], [2, 3],..., [9, 10]).

[0033] At step 102, the abnormal degree of the to-be-detected traffic is determined according to the abnormal score.

[0034] After the server calculates the abnormal score of the to-be-detected traffic by using the abnormal detection model, the abnormal degree of the to-be-detected traffic may be determined according to the abnormal score. In some application scenarios, an abnormal threshold may be set, and then the abnormal score may be compared with the abnormal threshold to determine the abnormal degree of the to-be-detected traffic. For example, if the abnormal threshold is 6 and the calculated abnormal score is 5, it may be considered that the probability of the to-be-detected traffic being abnormal traffic is weak; if the abnormal threshold is 3 and the calculated abnormal score is 5, it may be considered that the to-be-detected traffic is abnormal traffic. Then, the abnormal traffic may be quickly processed. In these application scenarios, the abnormal score or the abnormal degree (for example, “the probability of being abnormal traffic is high”) may be displayed to enable the staff to quickly process the abnormal traffic.

[0035] In this embodiment, the abnormal detection model does not need to obtain abnormal traffic samples, and since it is established based on feature values and abnormal interval information determined based on the feature values, it does not involve specific scene data, and thus may be applied to different application scenarios. Therefore, when the to-be-detected traffic is detected by using the abnormal detection model, the accuracy is high and the model adaptability is strong.

[0036] In some optional implementations, the abnormal interval information is determined based on the following steps:

[0037] At step 1, a plurality of feature values respectively corresponding to a plurality of historical traffics are extracted, and a plurality of intervals are divided according to the feature value with the largest value.

[0038] In some application scenarios, when determining the abnormal interval information, the server may determine based on historical traffic. Specifically, the server may extract a plurality of feature values respectively corresponding to a plurality of historical traffics, and may divide a plurality of intervals according to the feature value with the largest value.

[0039] In some optional implementations, the feature value includes information entropy obtained based on a statistical language model algorithm. The statistical language model may, for example, include an N-Gram (Chinese language model), and the feature value may, for example, include N-Gram entropy (i.e., the information entropy). Further, the N-Gram entropy may, for example, include 1-Gram entropy, 2-Gram entropy, and the like.

[0040] The server may, for example, extract 2-Gram entropy corresponding to each of the historical traffic, and may, for example, divide 160 intervals according to the maximum value 16 of the 2-Gram entropy, and the interval length of each interval may, for example, be 0.1. In this way, each interval may, for example, be [0, 0.1], [0.1, 0.2], [0.2, 0.3],..., [15.8, 15.9], [15.9, 16].

[0041] In the present implementation, the information entropy obtained based on the statistical language model algorithm may, for example, be used as the feature value to improve the accuracy of the abnormality score calculated by the abnormality detection model.

[0042] Step 2, each of the historical traffic is placed in a matching interval according to the respective feature value;

[0043] After the server divides the intervals, for each historical traffic, the historical traffic may, for example, be placed in a matching interval according to the corresponding feature value. For example, if the 2-Gram entropy corresponding to a historical traffic is 0.15, the historical traffic may, for example, be placed in the interval [0.1, 0.2].

[0044] Step 3, for each interval, the frequency of the number of historical traffic placed in the interval in the number of historical traffic is calculated;

[0045] After the server places each historical traffic in a matching interval, the frequency of the number of historical traffic placed in each interval in the number of historical traffic obtained may, for example, be calculated. For example, after placing the historical traffic with the 2-Gram entropy of 0.15 in the interval [0.1, 0.2], the number of historical traffic placed in the interval may, for example, increase from 0 to 1, and if the number of historical traffic obtained is 10, the corresponding frequency may, for example, be 0.1.

[0046] Step 4, the intervals are merged according to the frequency corresponding to each interval to obtain the abnormal interval information.

[0047] After the server calculates the frequencies corresponding to each interval, the server can merge the intervals according to the frequencies to obtain the abnormal interval information. Further, the abnormal interval information can also include the frequencies corresponding to each interval.

[0048] In the present implementation, the divided intervals can be merged according to historical traffic, so that the number of intervals can be reduced without affecting the detection effect, and the operation speed of the abnormal detection model is improved to a certain extent.

[0049] In some optional implementations, the step 4 of merging the intervals according to the frequencies corresponding to each interval to obtain the abnormal interval information can include the following sub-steps:

[0050] Sub-step 41: sorting the frequencies corresponding to each interval according to the numerical value;

[0051] In some application scenarios, after the server determines the frequencies corresponding to each interval, the server can sort the frequencies. In these application scenarios, for example, the numerical values can be arranged in descending order or ascending order.

[0052] Sub-step 42: placing the sum of the adjacent two frequencies in the sequence to determine whether the sum causes the arrangement order of the sequence to change;

[0053] After the server sorts the frequencies, the corresponding sequence can be obtained. Then, the server can add the adjacent two frequencies and place the sum in the sequence to determine whether it affects the original arrangement order.

[0054] For example, if 14 intervals are divided, which are [0, 0.1], [0.1, 0.2], [0.2, 0.3] … [1.1, 1.2], [1.3, 1.4], and the frequency sequence corresponding to each interval is 0.45, 0.35, 0.05, 0.04, 0.038, 0.032, 0.015, 0.014, 0.013, 0.012, 0.011, 0.008, 0.005, 0.002. If the frequencies greater than 0.05 (i.e. 0.45, 0.35) are added first, a frequency of 0.75 can be obtained. At this time, the new sequence obtained by placing it after the above sequence is 0.75, 0.05, 0.04, 0.038, 0.032, 0.015, 0.014, 0.013, 0.012, 0.011, 0.008, 0.005, 0.002. At this time, it can be determined whether the arrangement order of the new sequence changes.

[0055] Sub-step 43, if the cumulative sum does not cause the arrangement order of the sequence to change, the intervals corresponding to the two adjacent frequencies are merged.

[0056] In some application scenarios, if the server determines that the cumulative sum of the two adjacent frequencies does not cause the arrangement order of the sequence to change, the corresponding intervals can be merged. For example, 0.75 is placed after the sequence, which does not cause the arrangement order of the sequence to change, and then the intervals [0, 0.1] and [0.1, 0.2] corresponding to the two adjacent frequencies can be merged to obtain the interval [0, 0.2].

[0057] Further, based on the probability greater than 0.05 after merging, the probabilities less than 0.005 (i.e. 0.005, 0.002) can be further accumulated, and then the frequency of 0.007 can be obtained. At this time, it is placed after the above sequence, and the new sequence obtained is 0.75, 0.05, 0.04, 0.038, 0.032, 0.015, 0.014, 0.013, 0.012, 0.011, 0.008, 0.007. It still does not cause the arrangement order to change, and then merging can be continued. It should be noted that the above 0.05 and 0.005 as the merging judgment can be determined in advance, which can be changed, for example, the intervals with a probability greater than 0.06 can be merged first, and then the intervals with a frequency less than 0.004 can be merged.

[0058] Sub-step 44, if the cumulative sum causes the arrangement order of the sequence to change, stop merging to obtain the abnormal interval information.

[0059] In some application scenarios, if the server determines that the cumulative sum of the two adjacent frequencies causes the arrangement order of the sequence to change, merging can be stopped.

[0060] For example, at the first merging, the cumulative sum of the two adjacent frequencies 0.015 and 0.014 is 0.029, which is less than the previous probability 0.032, at this time the cumulative sum does not cause the sequence order to change, and then the two intervals can be merged. The merged intervals are [0, 0.2], [0.2, 0.3], [0.3, 0.4], [0.4, 0.5], [0.5, 0.6], [0.6, 0.8], [0.8, 0.9], [0.9, 1.0], [1.0, 1.1], [1.1, 1.2], [1.2, 1.4], and the frequencies are 0.75, 0.05, 0.04, 0.038, 0.032, 0.029, 0.013, 0.012, 0.011, 0.008, 0.007, respectively. At the second merging, the cumulative sum of the two adjacent frequencies 0.013 and 0.012 is 0.025, which is less than the previous probability 0.029, at this time the cumulative sum does not cause the sequence order to change, and then the two intervals can be merged. The merged intervals are [0, 0.2], [0.2, 0.3], [0.3, 0.4], [0.4, 0.5], [0.5, 0.6], [0.6, 0.8], [0.8, 1.0], [1.0, 1.1], [1.1, 1.2], [1.2, 1.4], and the frequencies are 0.75, 0.05, 0.04, 0.038, 0.032, 0.029, 0.025, 0.011, 0.008, 0.007, respectively. At the third merging, the cumulative sum of the two adjacent frequencies 0.011 and 0.008 is 0.019, which is less than the previous probability 0.025, at this time the cumulative sum does not cause the sequence order to change, and then the two intervals can be merged. The merged intervals are [0, 0.2], [0.2, 0.3], [0.3, 0.4], [0.4, 0.5], [0.5, 0.6], [0.6, 0.8], [0.8, 1.0], [1.0, 1.2], [1.2, 1.4], and the frequencies are 0.75, 0.05, 0.04, 0.038, 0.032, 0.029, 0.025, 0.019, 0.007, respectively. At this time, the cumulative sum of any two adjacent frequencies will cause the sequence order to change, and then the merging can be stopped, and the final abnormal interval information is obtained, and the number of intervals corresponding to the abnormal interval information is 9.

[0061] In some application scenarios, if the frequencies of the intervals are all high (for example, the intervals with the above-mentioned probability greater than 0.05), it can be considered that the current traffic in these intervals with higher frequencies has a higher probability of being abnormal traffic, and then the probability of the current traffic in the interval obtained after merging these intervals being abnormal traffic is still high. In other application scenarios, if the frequencies of the intervals are all low (for example, the intervals with the above-mentioned probability less than 0.005), it can be considered that the current traffic in these intervals with lower frequencies has a lower probability of being abnormal traffic, and then if the rarity is not changed (for example, the frequency cumulative sum does not cause the arrangement order of the sequence to change), the probability of the current traffic in the interval obtained after merging these intervals being abnormal traffic is still low. Then, the intervals can be dynamically merged through the above-mentioned steps 41 to 44.

[0062] In the implementation manner, the intervals can be dynamically merged based on the frequencies corresponding to the intervals without affecting the rarity of the intervals, to obtain the number of intervals for calculating the anomaly score, and improve the calculation rate.

[0063] In some optional implementation manners, the anomaly interval information includes the number of anomaly intervals, and the step of calculating the anomaly score by the anomaly detection model includes the following sub-steps:

[0064] Sub-step a, initializing the number of traffics in a plurality of anomaly intervals corresponding to the number of anomaly intervals;

[0065] In some application scenarios, when calculating the anomaly score, the number of traffics in each anomaly interval can be initialized. For example, if the number of anomaly intervals is 9, the number of traffics in the 9 anomaly intervals can be initialized to 0, to facilitate subsequent calculation.

[0066] Sub-step b, for each current traffic, according to the characteristic value of the current traffic, the current traffic is disposed in a corresponding target anomaly interval, and the number of currently disposed traffics in the target anomaly interval is counted;

[0067] The anomaly detection model can dispose each currently received traffic in a corresponding target anomaly interval according to the characteristic value of the current traffic. For example, if the 2-gram entropy of the current traffic is 1.0, the current traffic can be disposed in the interval [0.8, 1.0], which can be regarded as the above-mentioned target anomaly interval. After being disposed in the interval, the number of traffics in the interval can be increased by 1. If the original number of traffics in the interval is 89, the number of traffics is now 90.

[0068] Sub-step c, counting the total sum of target traffic numbers in a plurality of anomaly intervals in which the number of traffics is below the number of traffics in the target anomaly interval, and counting the total sum of traffic numbers disposed in the plurality of anomaly intervals;

[0069] The anomaly detection model can further count the target flow quantity sum. For example, the flow quantity in 9 abnormal intervals is determined to be below 90 (including 90), and if 4 abnormal intervals are found, the flow quantity in each abnormal interval is 90, 80, 20, and 10 respectively, and the target flow quantity sum is 200 (i.e., 90+80+20+10).

[0070] The anomaly detection model can count the flow quantity sum disposed in the plurality of abnormal intervals. For example, the flow quantity sum disposed in the 9 abnormal intervals described above can be 1000.

[0071] In sub-step d, a ratio of the target flow quantity sum to the flow quantity sum is calculated, and the ratio is mapped according to a preset rule.

[0072] After the anomaly detection model counts the target flow quantity sum and the flow quantity sum, the ratio of the two can be calculated. For example, the ratio of the target flow quantity sum (200) corresponding to the 9 abnormal intervals described above to the flow quantity sum (1000) can be 0.2.

[0073] After the anomaly detection model calculates the ratio, the ratio can be mapped according to a preset rule. The preset rule described above may, for example, include mapping according to a certain proportion. For example, 0.2 is mapped to 100 parts, and the granularity of each part is 0.002.

[0074] In some optional implementations, the mapping of the ratio according to the preset rule can include mapping the ratio to a logarithm corresponding to the ratio.

[0075] In some application scenarios, the mapping rule can be to map the ratio to a logarithm corresponding to the ratio. For example, the ratio can be mapped to a logarithm with a base of 10. In this way, the ratio can be mapped to a smaller granularity, achieving the purpose of improving the accuracy of detection.

[0076] In sub-step e, the value obtained after mapping is determined as the anomaly score.

[0077] After the anomaly detection model maps the ratio, the value obtained after mapping can be determined as the anomaly score.

[0078] In the present implementation, the anomaly score can be calculated based on the target flow quantity sum and the flow quantity sum disposed in the plurality of abnormal intervals. In this way, since the target flow quantity sum is for the plurality of abnormal intervals in which the flow quantity is below the flow quantity in the target abnormal interval, it can better reflect the rarity of the current flow, thereby making the anomaly score have high credibility.

[0079] In some optional implementation, the method for detecting abnormal traffic further comprises: updating the anomaly detection model based on the to-be-detected traffic.

[0080] In some application scenarios, when the to-be-detected traffic is processed by the anomaly detection model, the anomaly detection model can be updated based on the to-be-detected traffic. That is, after the to-be-detected traffic is placed in the corresponding interval by the anomaly detection model, the number of traffics placed in the interval will also increase accordingly, and then each to-be-detected traffic can play a role in the detection process of the next to-be-detected traffic, thereby playing a role in updating the anomaly detection model. In this way, the accuracy of the anomaly detection model in detecting traffic can be improved.

[0081] Please refer to Figure 2 which shows a structural block diagram of an abnormal traffic detection device provided by an embodiment of the present application. The abnormal traffic detection device can be a module, a program segment or code on an electronic device. It should be understood that the device corresponds to the above Figure 1 method embodiments, and can perform each step involved in the Figure 1 method embodiments. The specific functions of the device can be referred to the description in the above, and the detailed description is appropriately omitted here to avoid repetition.

[0082] Optionally, the abnormal traffic detection device comprises a calculation module 201 and a judgment module 202. The calculation module 201 is configured to input the to-be-detected traffic into the anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic, wherein the anomaly detection model calculates the anomaly score based on the feature value of the to-be-detected traffic and pre-determined anomaly interval information. The judgment module 202 is configured to judge the abnormal degree of the to-be-detected traffic according to the anomaly score.

[0083] Optionally, the anomaly interval information is determined based on the following steps: extracting feature values corresponding to a plurality of historical traffics respectively, and dividing a plurality of intervals according to the largest feature value; placing each of the historical traffics in a matching interval according to the feature value corresponding thereto; for each interval, calculating the frequency of the number of historical traffics placed in the interval in the plurality of historical traffic numbers; and according to the frequency corresponding to each interval, merging the plurality of intervals to obtain the anomaly interval information.

[0084] Optionally, the merging of the plurality of intervals according to the frequency corresponding to each interval to obtain the anomaly interval information comprises: sorting the frequency corresponding to each interval according to the numerical value; placing the cumulative sum of the adjacent two frequencies in the sequence, and judging whether the cumulative sum causes the arrangement order of the sequence to change; if not, merging the intervals corresponding to the adjacent two frequencies; and if yes, stopping the merging to obtain the anomaly interval information.

[0085] Optionally, the abnormal interval information comprises an abnormal interval number, and the step of calculating the abnormal score by the anomaly detection model comprises: initializing the number of flows disposed in each of a plurality of abnormal intervals corresponding to the abnormal interval number; for each current flow, disposing the characteristic value of the current flow in a corresponding target abnormal interval, and counting the number of flows currently disposed in the target abnormal interval; counting the target flow number sum disposed in a plurality of abnormal intervals in which the number of flows is less than the number of flows in the target abnormal interval; and counting the total number of flows disposed in the plurality of abnormal intervals; calculating the ratio of the target flow number sum to the total number of flows, and mapping the ratio according to a preset rule; and determining the value obtained after mapping as the abnormal score.

[0086] Optionally, the mapping of the ratio according to the preset rule comprises: mapping the ratio into a logarithm corresponding to the ratio.

[0087] Optionally, the characteristic value comprises information entropy obtained based on a statistical language model algorithm.

[0088] Optionally, the abnormal flow detection device further comprises an updating module, and the updating module is configured to update the anomaly detection model based on the to-be-detected flow.

[0089] It should be noted that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0090] Please refer to Figure 3 , Figure 3 A structural schematic diagram of an electronic device for performing the method for detecting abnormal flow provided by the embodiment of the present application, the electronic device can comprise: at least one processor 301, such as CPU, at least one communication interface 302, at least one memory 303 and at least one communication bus 304. Wherein, the communication bus 304 is used to realize the direct connection communication of these components. Wherein, the communication interface 302 of the device in the embodiment of the present application is used to communicate with other node devices. The memory 303 can be a high-speed RAM memory, or a non-volatile memory, such as at least one disk memory. The memory 303 can also be at least one storage device located away from the foregoing processor. The memory 303 stores computer readable instructions, when the computer readable instructions are executed by the processor 301, the electronic device can perform the method process shown above. Figure 1 The method process shown above.

[0091] It can be understood that, Figure 3The structure shown is only for illustration, and the electronic device may also include Figure 3 More or fewer components than shown, or with Figure 3 Different configurations shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0092] The embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following can be performed: Figure 1 The method process in the illustrated method embodiment is performed by the electronic device.

[0093] An embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments. For example, the method may include: inputting the flow to be detected into an anomaly detection model to obtain an anomaly score corresponding to the flow to be detected; wherein the anomaly detection model calculates the anomaly score based on the characteristic value of the flow to be detected and predetermined anomaly interval information; and judging the degree of anomaly of the flow to be detected according to the anomaly score.

[0094] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0095] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0096] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0097] In this document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions.

[0098] The above description is merely illustrative of the application and not in limitation of the principles of the application. Numerous modifications and adaptations thereof will be readily apparent to those skilled in the art without departing from the spirit and scope of the application as defined in the following claims.

Claims

1. A method of detecting abnormal traffic, characterized by, The method comprises: inputting a to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model calculates the anomaly score based on a feature value of the to-be-detected traffic and pre-determined anomaly interval information; judging an anomaly degree of the to-be-detected traffic according to the anomaly score; wherein the anomaly detection model is established based on an unsupervised manner; and the anomaly interval information is determined based on the following steps: extracting feature values corresponding to a plurality of historical traffics respectively, and dividing a plurality of intervals according to the largest feature value; placing each of the historical traffics in a matching interval according to the corresponding feature value; for each interval, calculating a frequency of a number of historical traffics placed in the interval in a total number of the historical traffics; merging the plurality of intervals according to the frequency corresponding to each interval to obtain the anomaly interval information.

2. The method of claim 1, wherein, The merging the plurality of intervals according to the frequency corresponding to each interval to obtain the anomaly interval information comprises: sorting the frequency corresponding to each interval according to the numerical value; placing a cumulative sum of two adjacent frequencies in a sequence, and judging whether the cumulative sum causes a change in the arrangement order of the sequence; if not, merging the intervals corresponding to the two adjacent frequencies; if yes, stopping the merging to obtain the anomaly interval information.

3. The method of claim 1, wherein, The anomaly interval information comprises a number of anomaly intervals, and the anomaly detection model calculates the anomaly score by the following steps: initializing a number of traffics placed in the anomaly intervals corresponding to the number of anomaly intervals; for each current traffic, placing the current traffic in a target anomaly interval according to a feature value of the current traffic, and counting a number of traffics currently placed in the target anomaly interval; counting a total number of target traffics placed in a plurality of anomaly intervals in which the number of traffics is less than the number of traffics in the target anomaly interval, and counting a total number of traffics placed in the plurality of anomaly intervals; calculating a ratio of the total number of target traffics to the total number of traffics, and mapping the ratio according to a preset rule; determining a value obtained after the mapping as the anomaly score.

4. The method of claim 3, wherein, The mapping the ratio according to the preset rule comprises mapping the ratio into a logarithm corresponding to the ratio.

5. The method according to any one of claims 1 to 4, characterized in that, The feature value comprises information entropy obtained based on a statistical language model algorithm.

6. The method according to any one of claims 1 to 4, characterized in that, The method further comprises: updating the anomaly detection model based on the to-be-detected traffic.

7. An abnormal traffic detection device characterized by comprising: The method comprises: A computing module is configured to input a to-be-detected traffic into an anomaly detection model to obtain an anomaly score corresponding to the to-be-detected traffic; wherein the anomaly detection model is configured to calculate the anomaly score based on a feature value of the to-be-detected traffic and pre-determined anomaly interval information; wherein the anomaly detection model is established based on an unsupervised manner; and the anomaly interval information is determined based on the following steps: extracting feature values corresponding to a plurality of historical traffics respectively, and dividing a plurality of intervals according to the largest feature value; placing each of the historical traffics in a matching interval according to the feature value corresponding thereto; for each interval, calculating a frequency of a number of historical traffics placed in the interval in a total number of the historical traffics; and merging the plurality of intervals according to the frequency corresponding to each interval to obtain the anomaly interval information. A judging module is configured to judge an anomaly degree of the to-be-detected traffic according to the anomaly score.

8. An electronic device, comprising: A computer program product comprising a processor and a memory, the memory storing computer readable instructions which, when executed by the processor, perform any of the methods of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program product, when executed by the processor, performs any of the methods of claims 1-6.

Images