A flow detection method, apparatus, device and storage medium

Abstract

This invention provides a traffic detection method, apparatus, device, and storage medium, relating to the field of network security technology, which can improve the accuracy of traffic detection. The method includes: acquiring traffic parameters of each of multiple data streams to be detected within a detection period, and determining the traffic characteristics of the detection period based on the traffic parameters of each data stream; determining whether the multiple data streams to be detected are abnormal data streams based on a pre-trained detection model and the traffic characteristics of the detection period; the detection model is trained based on training samples, which include multiple traffic feature components of the sample period, and the correlation between each traffic feature component and the traffic characteristics of the sample period is greater than a first threshold.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a traffic detection method and device, equipment and a storage medium. BACKGROUND

[0002] A distributed denial of service (DDoS) attack is a form of network attack that prevents users from normally accessing target services by consuming target resources. The most basic attack method is to use multiple clients to simultaneously send a large number of legitimate service requests, occupy a large number of server resources, and cause the server to be unable to provide normal services.

[0003] The prior art mainly uses machine learning classification and recognition to detect DDoS attack traffic, that is, by extracting the traffic characteristics of DDoS attack traffic within a period of time, a machine learning model is established, and the current traffic is analyzed by the machine learning module to determine whether it is DDoS attack traffic.

[0004] However, DDoS attack traffic has strong time sequence characteristics. The machine learning model established by using only the traffic characteristics of DDoS attack traffic within a period of time cannot accurately detect DDoS attack traffic because the traffic characteristics are not sufficient. SUMMARY

[0005] Embodiments of the present application provide a traffic detection method, device, equipment and storage medium, which can improve the accuracy of traffic detection.

[0006] To achieve the above purpose, the embodiments of the present application adopt the following technical solutions:

[0007] In a first aspect, a traffic detection method is provided, comprising: obtaining traffic parameters of each to-be-detected data stream in a plurality of to-be-detected data streams in a detection period, and determining traffic characteristics of the detection period according to the traffic parameters of each to-be-detected data stream; determining whether the plurality of to-be-detected data streams are abnormal data streams according to a pre-trained detection model and the traffic characteristics of the detection period; the detection model is trained based on training samples, and the training samples include a plurality of traffic characteristic components of a sample period, and the correlation degree of each traffic characteristic component with the traffic characteristics of the sample period is greater than a first threshold.

[0008] Based on the above scheme, since the detection model is trained based on training samples including a plurality of traffic characteristic components of a sample period, and the correlation degree of each traffic characteristic component with the traffic characteristics of the sample period is greater than a first threshold, compared with the machine learning model established by the prior art according to limited traffic characteristics, the traffic characteristics used by the detection model of the present application are more abundant and sufficient, and therefore the detection result obtained by using the detection model in the present application is more accurate.

[0009] Further optionally, the above-mentioned traffic detection method further includes: acquiring the traffic parameters of each sample data stream in multiple sample data streams within a sample period, and the sample label of the sample period, and determining the traffic characteristics of the sample period based on the traffic parameters of each sample data stream; the sample label is used to characterize whether multiple sample data streams are abnormal data streams; determining multiple traffic feature components based on the mode decomposition algorithm and the traffic parameters of each sample data stream; and training a detection model based on the traffic characteristics of the sample period, the multiple traffic feature components, and the sample label.

[0010] Based on the above scheme, the detection device determines multiple flow feature components according to the modal decomposition algorithm and the flow parameters of each sample data stream. This enriches the flow features and makes the trained detection model more accurate.

[0011] Optionally, the above-mentioned determination of multiple flow feature components based on the mode decomposition algorithm and the flow parameters of each sample data stream includes: performing mode decomposition on the flow parameters of each sample data stream based on the mode decomposition algorithm to obtain the flow parameter components of each sample data stream; and determining multiple flow feature components based on the flow parameter components of each sample data stream.

[0012] Further optionally, the above-mentioned determination of multiple flow feature components based on the modal decomposition algorithm and the flow parameters of each sample data stream includes: determining the flow characteristics of the sample period based on the flow parameters of each sample data stream; and performing modal decomposition on the flow characteristics of the sample period based on the modal decomposition algorithm to obtain multiple flow feature components.

[0013] Further optionally, the above-mentioned detection model is trained based on the traffic characteristics of the sample period, multiple traffic feature components, and sample labels; including: determining the traffic characteristics of the sample period and the weights corresponding to each traffic feature component; training the detection model based on the traffic characteristics of the sample period, the target features in each traffic feature component, and the sample labels; the weight corresponding to the target feature is greater than the second threshold.

[0014] Based on the above scheme, the detection device can filter the flow characteristics of the sample period and each flow characteristic component to obtain target features with weights greater than the second threshold; thus, the detection model trained based on the target features and sample labels is more accurate.

[0015] Optionally, the determination of the flow characteristics of the sample period and the weights corresponding to each flow characteristic component includes: inputting the flow characteristics of the sample period and each flow characteristic component into a preset decision tree model to obtain the flow characteristics of the sample period and the weights corresponding to each flow characteristic component.

[0016] Secondly, a flow detection device is provided, including an acquisition unit and a determination unit; the acquisition unit is used to acquire the flow parameters of each data stream to be detected in multiple data streams to be detected within a detection period; the determination unit is used to determine the flow characteristics of the detection period based on the flow parameters of each data stream to be detected acquired by the acquisition unit; the determination unit is also used to determine whether the multiple data streams to be detected are abnormal data streams based on a pre-trained detection model and the flow characteristics of the detection period; the detection model is trained based on training samples, the training samples include multiple flow feature components of the sample period, and the correlation between each flow feature component and the flow characteristics of the sample period is greater than a first threshold.

[0017] Optionally, the acquisition unit is further configured to acquire the flow parameters of each sample data stream in multiple sample data streams within a sample period, and the sample label of the sample period; the determination unit is further configured to determine the flow characteristics of the sample period based on the flow parameters of each sample data stream; the sample label is used to characterize whether multiple sample data streams are abnormal data streams, and to determine multiple flow feature components based on the mode decomposition algorithm and the flow parameters of each sample data stream; the flow detection device further includes a training unit; the training unit is configured to train a detection model based on the flow characteristics of the sample period, multiple flow feature components, and sample label.

[0018] Further optionally, the aforementioned determining unit is specifically used for: performing mode decomposition on the flow parameters of each sample data stream based on the mode decomposition algorithm to obtain the flow parameter components of each sample data stream; and determining multiple flow feature components based on the flow parameter components of each sample data stream.

[0019] Further optionally, the aforementioned determining unit is specifically used to: determine the flow characteristics of the sample period based on the flow parameters of each sample data stream; and perform mode decomposition on the flow characteristics of the sample period based on the mode decomposition algorithm to obtain multiple flow characteristic components.

[0020] Further optionally, the above training unit is specifically used to: determine the traffic characteristics of the sample period and the weights corresponding to each traffic characteristic component; train a detection model based on the traffic characteristics of the sample period, the target features in each traffic characteristic component, and the sample label; and the weights corresponding to the target features are greater than the second threshold.

[0021] Further optionally, the above training unit is specifically used to: input the flow characteristics of the sample period and each flow characteristic component into a preset decision tree model to obtain the flow characteristics of the sample period and the weights corresponding to each flow characteristic component.

[0022] Thirdly, an electronic device is provided, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to execute instructions to implement the flow detection method provided in the first aspect above.

[0023] Fourthly, a computer-readable storage medium is provided, including instructions that, when executed by a processor, cause the processor to perform the flow detection method provided in the first aspect.

[0024] The technical solution provided by this invention brings at least the following beneficial effects: The flow detection device acquires the flow parameters of each data stream to be detected in multiple data streams to be detected within a detection period, and determines the flow characteristics of the detection period based on the flow parameters of each data stream to be detected. Then, based on the pre-trained detection model and the flow characteristics of the detection period, it determines whether the multiple data streams to be detected are abnormal data streams. Since the detection model is trained based on training samples including multiple flow feature components of the sample period, and the correlation between each flow feature component and the flow characteristics of the sample period is greater than a first threshold, compared with the machine learning model established by the prior art based on limited flow features, the detection model of this invention uses richer and more sufficient flow features. Therefore, the detection results obtained by using the detection model of this invention are more accurate. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of the structure of a flow detection system provided in an embodiment of the present invention;

[0027] Figure 2 A flowchart illustrating a flow detection method provided in an embodiment of the present invention. Figure 1 ;

[0028] Figure 3 A flowchart illustrating a flow detection method provided in an embodiment of the present invention. Figure 2 ;

[0029] Figure 4 A schematic diagram of an EMD mode decomposition process provided in an embodiment of the present invention;

[0030] Figure 5 A flowchart illustrating a flow detection method provided in an embodiment of the present invention. Figure 3 ;

[0031] Figure 6 This is a schematic diagram of the structure of a flow detection device provided in an embodiment of the present invention;

[0032] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] It should be noted that in the embodiments of the present invention, the terms "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of the present invention should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0035] It should also be noted that in the embodiments of the present invention, "of", "corresponding", and "corresponding" can sometimes be used interchangeably. It should be pointed out that when the distinction is not emphasized, their meanings are consistent.

[0036] To facilitate a clear description of the technical solutions of the embodiments of the present invention, the terms "first" and "second" are used in the embodiments of the present invention to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0037] The traffic detection method provided in this embodiment of the invention (hereinafter referred to as the detection method for ease of description) can be applied to a traffic detection system, which is used to detect whether network traffic is abnormal. Figure 1 A schematic diagram of one structure of the flow detection system is shown. For example... Figure 1 As shown, the flow detection system 10 includes a flow detection device 11 (hereinafter referred to as the detection device for ease of description) and an electronic device 12. The detection device 11 is connected to the electronic device 12. The detection device 11 and the electronic device 12 can be connected via a wired connection or a wireless connection; this embodiment of the invention does not limit the connection in this way.

[0038] Electronic device 12 can be a network device, such as a base station, router, or switch. Electronic device 12 can also be a terminal device with Internet access capabilities, such as a mobile phone, personal computer, tablet computer, in-vehicle computer, wearable electronic device, or self-service terminal.

[0039] The detection device 11 is used to acquire the flow parameters of each data stream to be detected in multiple data streams to be detected within the detection period from the electronic device 12, and to determine the flow characteristics of the detection period based on the flow parameters of each data stream to be detected.

[0040] The detection device 11 is also used to determine whether multiple data streams to be detected are abnormal data streams based on the pre-trained detection model and the flow characteristics of the detection period.

[0041] It should be noted that the detection device 11 and the electronic device 12 can be independent devices or apparatuses, or they can be integrated into the same device or apparatus. The present invention does not make any specific limitation in this regard.

[0042] When the detection device 11 and the electronic device 12 are integrated into the same device or apparatus, the communication method between the detection device 11 and the electronic device 12 is the same as the communication between internal unit modules of the device or apparatus. In this case, the communication process between the two is the same as the communication process between the detection device 11 and the electronic device 12 when they are independent of each other.

[0043] In the following embodiments provided by the present invention, the detection device 11 and the electronic device 12 are described as being set up independently of each other.

[0044] The detection method provided by the embodiments of the present invention will be described below with reference to the accompanying drawings. The detection method provided by the embodiments of the present invention can be applied to the above-mentioned detection device, or to an electronic device including the above-mentioned detection device. The embodiments of the present invention will be described using the application of the detection method to a detection device as an example.

[0045] like Figure 2 As shown, the flow detection method provided in this embodiment of the invention includes the following steps S201-S203:

[0046] S201, The detection device acquires the flow parameters of each data stream to be detected in multiple data streams to be detected within the detection cycle.

[0047] As one possible implementation, the detection device obtains the flow parameters of each data stream to be detected from multiple data streams to be detected within the detection period from the electronic device.

[0048] It should be noted that traffic parameters include the duration of the data stream, the start time of the data stream, the length of the data stream, the Internet Protocol address (IP) of the data stream, and the IP offset.

[0049] The testing cycle is set in advance by the maintenance personnel in the testing device.

[0050] For example, the detection device obtains from the electronic device the duration, start time, length, IP address, and IP offset of each data stream to be detected in the electronic device within 60 seconds.

[0051] S202. The detection device determines the flow characteristics of the detection cycle based on the flow parameters of each data stream to be detected.

[0052] As one possible implementation, the detection device records various flow parameters of each data stream to be detected in chronological order of their generation time, performs data conversion on the recorded flow parameters to obtain the feature matrix or vector corresponding to each flow parameter, and determines the flow characteristics of the detection period using the feature matrix or vector corresponding to each flow parameter.

[0053] As another possible implementation, the detection device records various flow parameters of each data stream to be detected in chronological order of their generation time, performs feature operations on the recorded flow parameters to obtain various feature data, and then performs data transformation on the various feature data to obtain the feature matrix or vector corresponding to each feature data, and determines the feature matrix or vector corresponding to each feature data as the flow characteristics of the detection period.

[0054] For example, the detection device uses the duration of each data stream to be detected as a statistical flow parameter. The detection device will perform an arithmetic mean operation on the duration of each data stream to be detected to obtain the average duration of multiple data streams to be detected within the detection period, and then convert the average duration into a feature matrix.

[0055] S203. The detection device determines whether multiple data streams to be detected are abnormal data streams based on the pre-trained detection model and the flow characteristics of the detection period.

[0056] The detection model is trained based on training samples, which include multiple flow feature components of the sample period. The correlation between each flow feature component and the flow feature of the sample period is greater than the first threshold.

[0057] It should be noted that the first threshold is set in advance by the maintenance personnel in the detection device.

[0058] In this embodiment of the invention, the specific implementation methods for determining multiple traffic feature components and training the detection model based on training samples can be found in the subsequent descriptions of this embodiment, and will not be repeated here.

[0059] As one possible implementation, the detection device inputs the flow characteristics of the detection cycle into a pre-trained detection model to determine whether multiple data streams to be detected are abnormal data streams.

[0060] Optionally, after determining that multiple data streams to be detected are abnormal data streams, the detection device generates alarm information and sends the alarm information to the electronic device.

[0061] Correspondingly, after receiving the alarm information, the electronic device will perform operations such as discarding or intercepting multiple data streams to be detected according to the preset strategy.

[0062] The technical solution provided by the above embodiments brings at least the following beneficial effects: The flow detection device acquires the flow parameters of each data stream to be detected in multiple data streams to be detected within a detection period, and determines the flow characteristics of the detection period based on the flow parameters of each data stream to be detected. Then, based on the pre-trained detection model and the flow characteristics of the detection period, it determines whether the multiple data streams to be detected are abnormal data streams. Since the detection model is trained based on training samples including multiple flow feature components of the sample period, and the correlation between each flow feature component and the flow characteristics of the sample period is greater than a first threshold, compared with the machine learning model established by the prior art based on limited flow features, the flow features used by the detection model of the present invention are richer and more sufficient. Therefore, the detection results obtained by using the detection model of the present invention are more accurate.

[0063] like Figure 3 As shown, in order to train the above-mentioned detection model, the traffic detection method provided in this embodiment of the invention further includes the following steps S301-S304:

[0064] S301, The detection device acquires the flow parameters of each sample data stream in multiple sample data streams within the sample period, as well as the sample label of the sample period.

[0065] Among them, the sample label is used to characterize whether multiple sample data streams are abnormal data streams.

[0066] As one possible implementation, the detection device acquires the flow parameters of each sample data stream in multiple sample data streams from the electronic device according to the sample period, as well as the sample label of the sample period.

[0067] The sample period is set in advance by the maintenance personnel in the testing device; for example, the sample period can be 60 seconds.

[0068] For example, the detection device obtains the flow parameters of each sample data stream within 60 seconds from the electronic device, as well as the sample label for that sample period.

[0069] S302. The detection device determines the flow characteristics of the sample period based on the flow parameters of each sample data stream.

[0070] Similarly, the process of determining the flow characteristics of the sample period is the same as that of the detection period. For details, refer to S202 above and replace the flow parameters of the data stream to be detected with the flow parameters of the sample data stream. This will not be elaborated further here.

[0071] S303. The detection device determines multiple flow characteristic components based on the modal decomposition algorithm and the flow parameters of each sample data stream.

[0072] Among them, the correlation between each flow characteristic component and the flow characteristics of the sample period is greater than the first threshold.

[0073] As one possible approach, the detection device is based on a mode decomposition algorithm to perform mode decomposition on the flow characteristics of the sample period determined by the flow parameters of each sample data stream, and obtain multiple flow characteristic components with a correlation greater than a first threshold.

[0074] It should be noted that the mode decomposition algorithm is pre-set in the detection device by the maintenance personnel. For example, the mode decomposition algorithm can be the empirical mode decomposition (EMD) algorithm.

[0075] As another possible approach, the detection device performs mode decomposition on the flow parameters of each sample data stream based on the mode decomposition algorithm to obtain the flow parameter components of each sample data stream; then, the detection device determines multiple flow feature components based on the flow parameter components of each sample data stream.

[0076] S304. The detection device trains a detection model based on the flow characteristics of the sample period, multiple flow characteristic components, and sample labels.

[0077] As one possible implementation, the detection device uses the flow characteristics of the sample period and the multiple flow characteristic components determined in S303 as features, and the sample labels of the sample period obtained in S301 as labels to train a preset model to obtain a detection model.

[0078] The specific implementation of the detection model trained in this step can be found in the descriptions in existing technologies, and will not be repeated here.

[0079] As another possible implementation, the detection device can first determine the flow characteristics of the sample period and the weights corresponding to each flow characteristic component, and then train the detection model based on the target features with weights greater than the second threshold and the sample labels.

[0080] The specific implementation of this step can be found in the subsequent description in the embodiments of the present invention, and will not be repeated here.

[0081] The following section uses flow characteristics as an example to describe the EMD mode decomposition of flow characteristics.

[0082] Suppose the expression for the flow characteristics of a sample period is y = x(t), where t is the independent variable time and y is the dependent variable flow characteristics. For example... Figure 4 The diagram shown is a flowchart of EMD mode decomposition according to an embodiment of the present invention, including the following steps S401-S407:

[0083] S401. The detection device calculates the maximum and minimum values ​​of x(t).

[0084] Specifically, after the detection device acquires the flow characteristics x(t) of the sample period, it calculates the maximum and minimum values ​​of x(t) according to the extreme value calculation formula in the EMD algorithm.

[0085] S402. The detection device determines the upper envelope function x based on the maximum point of x(t). 上 (t), and the lower envelope function x is determined based on the minimum point of x(t). 下 (t).

[0086] Specifically, the detection device uses the cubic spline interpolation function in the EMD algorithm to fit the maximum points to form the upper envelope function; similarly, the inspection device fits the minimum points to form the lower envelope function.

[0087] S403, the detection device according to x 上 (t) and x 下 (t), determine the mean envelope function m(t).

[0088] Where m(t) is x 上 (t) and x 下 The average value of (t).

[0089] S404. The detection device determines the intermediate flow characteristic h(t).

[0090] Where h(t) = x(t) - m(t).

[0091] Understandably, the intermediate flow characteristic is any one of multiple flow characteristic components.

[0092] S405. The detection device determines whether h(t) meets the EMD algorithm termination condition.

[0093] The EMD algorithm terminates when the number of extreme points and zero-crossing points in h(t) are equal or differ by 1, and when the mean of the upper and lower envelope functions is 0.

[0094] S406. If h(t) satisfies the EMD algorithm termination condition, h(t) is determined as a flow characteristic component, and the flow characteristic component is removed from x(t) to form a new flow characteristic function. S401-S406 are then executed on the new flow characteristic function.

[0095] Specifically, when h(t) satisfies the EMD algorithm termination condition, the detection device determines h(t) as a flow characteristic component and continues to perform mode decomposition on x(t)-h(t) to continuously obtain new flow characteristic components.

[0096] S407. If h(t) does not meet the EMD algorithm termination condition, execute S401-S405 on h(t) until h(t) meets the EMD algorithm termination condition.

[0097] In one design, in order to improve the accuracy of the detection model, such as Figure 5 As shown, S304 provided in the embodiment of the present invention specifically includes the following S3041-S3042.

[0098] S3041, The detection device determines the flow characteristics of the sample period and the weights corresponding to each flow characteristic component.

[0099] As one possible approach, the detection device determines the flow characteristics of the sample period and the weights corresponding to each flow characteristic component based on a preset weighting algorithm.

[0100] It should be noted that the weighting algorithm is pre-set in the detection device by the maintenance personnel.

[0101] For example, the detection device inputs the flow characteristics of the sample period and each flow characteristic component into a preset decision tree model to obtain the flow characteristics of the sample period and the weights corresponding to each flow characteristic component.

[0102] The decision tree model can be pre-configured in the detection device by the operations and maintenance personnel.

[0103] S3042. The detection device trains a detection model based on the flow characteristics of the sample period, the target features in each flow characteristic component, and the sample label.

[0104] Among them, the weight corresponding to the target feature is greater than the second threshold.

[0105] It should be noted that the second threshold is set in advance by the maintenance personnel in the detection device.

[0106] As one possible implementation, the detection device inputs the target features and sample labels of the sample period into a preset training model to train the detection model.

[0107] The preset training model can be a neural network model or other models with similar functions; this embodiment of the invention does not limit this.

[0108] It should be noted that the second threshold is set in advance by the maintenance personnel in the detection device.

[0109] Understandably, because the target features have higher weights and are more representative, the detection model trained by the detection device based on the target features has higher accuracy.

[0110] The technical solution provided by the above embodiments brings at least the following beneficial effects: The flow detection device acquires the flow parameters of each data stream to be detected in multiple data streams to be detected within a detection period, and determines the flow characteristics of the detection period based on the flow parameters of each data stream to be detected. Then, based on the pre-trained detection model and the flow characteristics of the detection period, it determines whether the multiple data streams to be detected are abnormal data streams. Since the detection model is trained based on training samples including multiple flow feature components of the sample period, and the correlation between each flow feature component and the flow characteristics of the sample period is greater than a first threshold, compared with the machine learning model established by the prior art based on limited flow features, the flow features used by the detection model of the present invention are richer and more sufficient. Therefore, the detection results obtained by using the detection model of the present invention are more accurate.

[0111] The above embodiments mainly describe the solutions provided by the embodiments of the present invention from the perspective of an apparatus (device). It is understood that, in order to implement the above methods, the apparatus or device includes hardware structures and / or software modules corresponding to the execution of each method flow. These hardware structures and / or software modules corresponding to the execution of each method flow can constitute a material information determination device. Those skilled in the art should readily recognize that, in conjunction with the algorithm steps of the various examples described in the embodiments disclosed herein, the present invention can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software-driven hardware manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0112] In this embodiment of the invention, the device or equipment can be divided into functional modules according to the above method examples. For example, the device or equipment can be divided into functional modules corresponding to each function, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this embodiment of the invention is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0113] When dividing each function into modules according to its corresponding function. Figure 6 A schematic diagram of a possible structure for a flow detection device is shown. For example... Figure 6 As shown, the detection device 50 provided in this embodiment of the invention includes an acquisition unit 501 and a determination unit 502.

[0114] The acquisition unit 501 is used to acquire the flow parameters of each data stream to be detected among multiple data streams to be detected within the detection period. For example, such as... Figure 2 As shown, the acquisition unit 501 can be used to execute S201.

[0115] The determining unit 502 is used to determine the flow characteristics of the detection cycle based on the flow parameters of each data stream to be detected acquired by the acquisition device. For example, such as... Figure 2 As shown, the acquisition unit 501 can be used to execute S202.

[0116] The determining unit 502 is further configured to determine whether multiple data streams to be detected are abnormal data streams based on a pre-trained detection model and the traffic characteristics of the detection period; the detection model is trained based on training samples, which include multiple traffic feature components of the sample period, and the correlation between each traffic feature component and the traffic characteristics of the sample period is greater than a first threshold. For example, such as Figure 2 As shown, the determining unit 502 can be used to execute S203.

[0117] Optionally, the acquisition unit 501 is also used to acquire the flow parameters of each sample data stream in multiple sample data streams within the sample period, as well as the sample label of the sample period.

[0118] The determining unit 502 is also used to determine the flow characteristics of the sample period based on the flow parameters of each sample data stream; the sample label is used to characterize whether multiple sample data streams are abnormal data streams, and to determine multiple flow characteristic components based on the mode decomposition algorithm and the flow parameters of each sample data stream.

[0119] The flow detection device 50 also includes a training unit 503; the training unit 503 is used to train a detection model based on the flow characteristics of the sample period, multiple flow characteristic components and sample labels.

[0120] The determining unit 502 is specifically used to: perform mode decomposition on the flow parameters of each sample data stream based on the mode decomposition algorithm to obtain the flow parameter components of each sample data stream, and determine multiple flow feature components based on the flow parameter components of each sample data stream.

[0121] Optionally, the determining unit 502 is specifically used to: determine the flow characteristics of the sample period based on the flow parameters of each sample data stream; and perform mode decomposition on the flow characteristics of the sample period based on the mode decomposition algorithm to obtain multiple flow characteristic components.

[0122] Optionally, training unit 503 is specifically used to: determine the traffic characteristics of the sample period and the weights corresponding to each traffic characteristic component; train a detection model based on the traffic characteristics of the sample period, the target features in each traffic characteristic component, and the sample label; the weights corresponding to the target features are greater than the second threshold.

[0123] Optionally, the training unit 503 is specifically used to: input the flow characteristics of the sample period and each flow characteristic component into a preset decision tree model to obtain the flow characteristics of the sample period and the weights corresponding to each flow characteristic component.

[0124] Regarding the apparatus and equipment in the above embodiments, the specific methods of operation of each module and the corresponding beneficial effects have been described in detail in the embodiments of the method for determining material information, and will not be repeated here.

[0125] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0126] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. For example... Figure 7 The electronic device 60 may include at least one processor 601 and a memory 603 for storing processor-executable instructions. The processor 601 is configured to execute the instructions in the memory 603 to implement the detection method described in the above embodiments.

[0127] In addition, the electronic device 60 may also include a communication bus 602 and at least one communication interface 604.

[0128] Processor 601 may be a processor (central processing unit, CPU), microprocessor unit, ASIC, or one or more integrated circuits for controlling the execution of the program of the present invention.

[0129] The communication bus 602 may include a path for transmitting information between the aforementioned components.

[0130] Communication interface 604 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0131] The memory 603 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processing unit via a bus. The memory may also be integrated with the processing unit.

[0132] The memory 603 stores instructions for executing the present invention, and the processor 601 controls the execution of these instructions. The processor 601 executes the instructions stored in the memory 603 to implement the functions of the method of the present invention.

[0133] In a specific implementation, as one embodiment, the processor 601 may include one or more CPUs, for example... Figure 7 CPU0 and CPU1 in the CPU.

[0134] In a specific implementation, as one example, the electronic device 60 may include multiple processors, such as... Figure 7 Processors 601 and 607 are described herein. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0135] In a specific implementation, as one embodiment, the electronic device 60 may further include an output device 605 and an input device 606. The output device 605 communicates with the processor 601 and can display information in various ways. For example, the output device 605 may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device 606 communicates with the processor 601 and can accept user input in various ways. For example, the input device 606 may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0136] Those skilled in the art will understand that Figure 7 The structure shown does not constitute a limitation on the electronic device 60, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0137] In addition, the present invention also provides a computer-readable storage medium including instructions that, when executed by a processor, cause the processor to perform the detection method provided in the above embodiments.

[0138] In addition, the present invention also provides a computer program product, which includes computer instructions that, when executed on an electronic device, cause the electronic device to perform the detection method provided in the above embodiments.

[0139] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of the invention are indicated by the claims.

Claims

1. A method of flow detection, characterized by, The method comprises: obtaining flow parameters of each of a plurality of to-be-detected data streams in a detection period, and determining a flow feature of the detection period according to the flow parameters of each of the to-be-detected data streams; the flow parameters comprise a duration of a data stream, a start time of a data stream, a length of a data stream, an Internet Protocol (IP) address of a data stream, and an IP offset; determining whether the plurality of to-be-detected data streams are abnormal data streams according to a pre-trained detection model and the flow feature of the detection period; the detection model is trained based on training samples, the training samples comprise a plurality of flow feature components of a sample period, and a correlation degree of each of the flow feature components with the flow feature of the sample period is greater than a first threshold; the flow feature comprises a feature matrix corresponding to each type of flow parameter; obtaining flow parameters of each of a plurality of sample data streams in the sample period, and a sample label of the sample period, and determining a flow feature of the sample period according to the flow parameters of each of the sample data streams; the sample label is used to represent whether the plurality of sample data streams are abnormal data streams; the flow feature of the sample period is expressed as y = x (t), where t is an independent variable time, and y is a dependent variable flow feature; According to the extreme value calculation formula in the EMD algorithm, the maximum value points and the minimum value of x(t) are calculated, and according to the cubic spline interpolation function in the EMD algorithm, the maximum value points are fitted to form the upper envelope function x 上 (t), and the lower envelope function x 下 (t) is determined according to the minimum value points of x(t); According to x 上 (t) and x 下 (t), a mean envelope function m(t) is determined, wherein m(t) is the mean value of x 上 (t) and x 下 (t); determining an intermediate flow feature h (t), h (t) = x (t) - m (t); determining whether h (t) satisfies an EMD algorithm termination condition; the EMD algorithm termination condition is whether the number of extreme points and zero-crossing points in h (t) is equal or differs by 1, and whether the average of an upper envelope function and a lower envelope function is 0; in a case where h (t) satisfies the EMD algorithm termination condition, determining h (t) as a flow feature component, and continuing to perform modal decomposition on x (t) - h (t) to obtain a plurality of flow feature components; determining the flow feature of the sample period and weights corresponding to each of the flow feature components; training the detection model according to the flow feature of the sample period, a target feature in each of the flow feature components, and the sample label; the weight corresponding to the target feature is greater than a second threshold.

2. The flow detection method according to claim 1, wherein The determination of the flow feature of the sample period and the weights corresponding to each of the flow feature components comprises: inputting the flow feature of the sample period and each of the flow feature components into a preset decision tree model to obtain the weights corresponding to the flow feature of the sample period and each of the flow feature components.

3. A flow detection device, characterized by The method comprises an obtaining unit, a determining unit, and a training unit; the obtaining unit is configured to obtain flow parameters of each of a plurality of to-be-detected data streams in a detection period; the flow parameters comprise a duration of a data stream, a start time of a data stream, a length of a data stream, an Internet Protocol (IP) address of a data stream, and an IP offset; the determining unit is configured to determine a flow feature of the detection period according to the flow parameters of each of the to-be-detected data streams obtained by the obtaining device; The determination unit is further configured to determine, according to the pre-trained detection model and the traffic feature of the detection period, whether the plurality of to-be-detected data streams are abnormal data streams. The detection model is trained based on training samples, the training samples include a plurality of traffic feature components of a sample period, and a correlation degree of each traffic feature component with the traffic feature of the sample period is greater than a first threshold; the traffic feature includes a feature matrix corresponding to each type of traffic parameter; The obtaining unit is further configured to obtain traffic parameters of each sample data stream in a plurality of sample data streams in the sample period and a sample label of the sample period. The determination unit is further configured to determine the traffic feature of the sample period according to the traffic parameters of each sample data stream. The sample label is used to represent whether the plurality of sample data streams are abnormal data streams; an expression of the traffic feature of the sample period is y=x(t), where t is an independent variable time, and y is a dependent variable traffic feature; The determining unit is specifically configured to calculate the maximum value point and the minimum value of x(t) according to an extreme value calculation formula in the EMD algorithm, fit the maximum value point to form an upper envelope function x 上 (t) according to a cubic spline interpolation function in the EMD algorithm, and determine a lower envelope function x 下 (t) according to the minimum value point of x(t). The determining unit is specifically configured to determine a mean envelope function m(t) according to x 上 (t) and x 下 (t), wherein m(t) is a mean value of x 上 (t) and x 下 (t). An intermediate traffic feature h(t) is determined, h(t)=x(t)-m(t); The determination unit is specifically configured to determine whether h(t) satisfies an EMD algorithm termination condition; the EMD algorithm termination condition is whether the number of extreme points and zero-crossing points in h(t) are equal or differ by 1, and whether the average values of upper envelope line functions and lower envelope line functions are 0; The determination unit is specifically configured to, in a case where h(t) satisfies the EMD algorithm termination condition, determine h(t) as a traffic feature component, and continue to perform modal decomposition on x(t)-h(t) to obtain a plurality of traffic feature components. The training unit is specifically configured to determine the traffic feature of the sample period and weights corresponding to each traffic feature component; and train the detection model according to the traffic feature of the sample period, a target feature in each traffic feature component, and the sample label; the weight corresponding to the target feature is greater than a second threshold.

4. The flow detection device of claim 3, wherein, The training unit is specifically configured to: input the traffic feature of the sample period and each traffic feature component into a preset decision tree model to obtain the weights corresponding to the traffic feature of the sample period and each traffic feature component.

5. An electronic device, comprising: comprise: a processor and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement the traffic detection method in any one of claims 1-2.

6. A computer-readable storage medium, characterized in that, instructions, when executed by a processor, cause the processor to perform the traffic detection method in any one of claims 1-2.

Images