Network traffic detection method, apparatus, device, medium, and product
By generating a two-dimensional array model based on Bloom Filter, classifying nodes using a hash function, and generating a Blossom Filter matrix, the problem of low accuracy and efficiency in network traffic detection in existing technologies is solved, achieving more efficient network traffic detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHINA MOBILE INFORMATION TECHNOLOGY CO LTD
- Filing Date
- 2022-12-28
- Publication Date
- 2026-06-05
AI Technical Summary
Existing technologies cannot detect network traffic data with high accuracy and efficiency in large-scale complex network environments.
A two-dimensional array based on Bloom Filter is used as the traffic detection model to generate the target network traffic topology. The nodes are classified using a hash function and a two-dimensional Bloom Filter matrix is generated. The network traffic is detected through this matrix.
It improves the accuracy and efficiency of network traffic detection, enabling more accurate detection of traffic and traffic direction between nodes.
Smart Images
Figure CN116248604B_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of Internet technology, and in particular relates to a method, device, equipment, medium and product for network traffic detection. Background Technology
[0002] With the rapid development of mobile communication networks, the mobile internet has entered a stage of vigorous development. However, as internet technology matures and the market expands, a large amount of network traffic data has been generated, which is characterized by high value and high dimensionality.
[0003] In today's large-scale and complex network environment, the volume of network traffic data is becoming increasingly massive, and modern network traffic data has obvious time-dependent characteristics. As a result, network traffic detection methods in related technologies cannot achieve high-precision and high-efficiency detection. Summary of the Invention
[0004] This application provides a network traffic detection method, apparatus, device, medium, and product that can improve the accuracy and efficiency of network traffic detection.
[0005] In a first aspect, embodiments of this application provide a network traffic detection method, including:
[0006] Obtain the target network traffic topology, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction.
[0007] Based on the target network traffic topology, a traffic detection model for traffic detection is generated, wherein the traffic detection model is a two-dimensional array based on a Bloom filter;
[0008] Based on the traffic detection model, the traffic of nodes in the target network traffic topology is detected.
[0009] Secondly, embodiments of this application provide a network traffic detection device, comprising:
[0010] The acquisition module is used to acquire the target network traffic topology, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction.
[0011] The first generation module is used to generate a traffic detection model for traffic detection based on the target network traffic topology, wherein the traffic detection model is a two-dimensional array based on Bloom Filter;
[0012] The detection module is used to detect the traffic of nodes in the target network traffic topology based on the traffic detection model.
[0013] Thirdly, embodiments of this application provide an electronic device, which includes: a processor and a memory storing computer program instructions; the processor executes the computer program instructions to implement the network traffic detection method of the first aspect.
[0014] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the network traffic detection method of the first aspect.
[0015] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform the network traffic detection method as described in the first aspect.
[0016] In this embodiment, a target network traffic topology is obtained, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction. Based on the target network traffic topology, a traffic detection model for traffic detection is generated, wherein the traffic detection model is a two-dimensional array based on a Bloom filter. Based on the traffic detection model, the traffic of nodes in the target network traffic topology is detected. Thus, since a two-dimensional array based on a Bloom filter is generated for traffic detection, using this Bloom filter-based two-dimensional array for network traffic detection can improve the accuracy and efficiency of network traffic detection. Attached Figure Description
[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 This is a flowchart illustrating the network traffic detection method provided in the embodiments of this application;
[0019] Figure 2 This is a schematic diagram of the target network traffic topology provided in the embodiments of this application;
[0020] Figure 3 This is a schematic diagram of a two-dimensional matrix corresponding to the target network traffic topology provided in the embodiments of this application;
[0021] Figure 4 This is a schematic diagram of the network traffic detection topology corresponding to the target network traffic topology provided in the embodiments of this application;
[0022] Figure 5This is a schematic diagram of the network traffic detection device provided in the embodiments of this application;
[0023] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation
[0024] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.
[0025] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.
[0026] The network traffic detection method, apparatus, device, medium, and product provided in this application will be described in detail below with reference to the accompanying drawings and through specific embodiments and application scenarios.
[0027] Figure 1 This is a flowchart illustrating the network traffic detection method provided in an embodiment of this application. Figure 1 As shown, network traffic detection methods may include:
[0028] Step 101: Obtain the target network traffic topology, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction.
[0029] Step 102: Based on the target network traffic topology, generate a traffic detection model for traffic detection, wherein the traffic detection model is a two-dimensional array based on Bloom Filter;
[0030] Step 103: Based on the traffic detection model, detect the traffic of nodes in the target network traffic topology.
[0031] The specific implementation methods of each of the above steps will be described in detail below.
[0032] In this embodiment, a target network traffic topology is obtained, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction. Based on the target network traffic topology, a traffic detection model for traffic detection is generated, wherein the traffic detection model is a two-dimensional array based on a Bloom filter. Based on the traffic detection model, the traffic of nodes in the target network traffic topology is detected. Thus, since a two-dimensional array based on a Bloom filter is generated for traffic detection, using this Bloom filter-based two-dimensional array for network traffic detection can improve the accuracy and efficiency of network traffic detection.
[0033] In some possible implementations of the embodiments of this application, the two-dimensional array based on Bloom Filter used for traffic detection will be referred to as BlossomFilter.
[0034] A Bloom filter is an efficient probabilistic data structure used to test whether an element is a member of a set. It is space- and time-efficient and is used to determine if an element is a member of a set. It treats each element as an atomic value. However, in practical applications, an element often contains multiple atomic values rather than a single atomic value, which limits the Bloom filter's ability to support such applications. The Blossom Filter in this embodiment is a two-dimensional array that supports elements with two-dimensional attributes and allows for arbitrary filtering from one-dimensional to two-dimensional elements.
[0035] In some possible implementations of this application's embodiments, for n multi-valued elements in a set S = {Xi, ..., Xn}, each element Xi in S has two attributes (or dimensions) to be labeled, namely x and y. For the target network traffic topology in this application's embodiments, x and y can be the traffic and traffic direction of nodes in the target network traffic topology, respectively. The Blossom Filter in this application's embodiments represents the set S using a two-dimensional array, with M representing the weights. The i-th dimension weight, i.e., the traffic between two Xs, is Mi, i∈[x,y], and its initial value is set to 0. The Blossom Filter assigns a weight to each dimension (h1...). i ..., hk iFor each i ∈ [x, y], an independent hash function k is used, and the range of hash keys is [1, mi]. It uses 2^k hash functions. For each multi-valued element Xi = {Xi1, ..., Xi...} in S... d}, the bit values in the two-dimensional array M[H1j(Xi1), ..., Hdj(Xi)] d The flag is set to 1 and 1≤j≤k. Similar to the Bloom Filter algorithm, each element affects k bits in the filter, and the flag bits in the Bloom Filter can be set multiple times. This allows for the projection of the X element using a hash algorithm, projecting a complex element into a finite space, similar to the Bloom Filter algorithm, and then using the M value to mark the relationship after the element projection.
[0036] Based on this, in some possible implementations of the embodiments of this application, step 102 may include: classifying multiple nodes using four hash functions to obtain four types of nodes; initializing a four-row, four-column two-dimensional matrix, wherein each value in the two-dimensional matrix is zero; for each edge in the target network traffic topology, adding the traffic corresponding to the edge to the corresponding cell of the two-dimensional matrix according to the node and traffic direction of the edge.
[0037] For example, the target network traffic topology is as follows: Figure 2 As shown, Figure 2 This is a schematic diagram of the target network traffic topology provided in an embodiment of this application. Figure 2 In the diagram, the target network traffic topology consists of 7 nodes, designated a, b, c, d, e, f, and g. The numbers on the connecting lines between nodes represent traffic flow, and the arrows indicate the direction of the flow.
[0038] for Figure 2 The target network traffic topology shown can be divided into four categories using four hash functions: category I (a,e) including nodes a and e, category II (b,f) including nodes b and f, category III (c,g) including nodes c and g, and category IV (d) including node d.
[0039] Initialize a 4x4 2D matrix, with each value in the matrix being 0.
[0040] Assign values to each cell in the two-dimensional matrix. Specifically, perform a global scan. Figure 2 The target network traffic topology is shown, organized by edge. For each edge, its corresponding cell in the matrix is calculated using a predefined hash function. Then, the traffic for that edge is added to the corresponding cell. After adding the traffic for all edges to their respective cells, a Blossom Filter is generated. Figure 3 As shown, Figure 3This is a schematic diagram of a two-dimensional matrix corresponding to the target network traffic topology provided in the embodiments of this application.
[0041] In some possible implementations of the embodiments of this application, step 103 may include: determining the first flow between the first node and the second node, and the second flow between the third node and the fourth node, according to the flow detection model, wherein the first node, the second node, the third node and the fourth node are nodes among a plurality of nodes; comparing the first flow and the second flow to obtain a comparison result of the first flow and the second flow.
[0042] For example, let's take nodes a, b, c, and d as the first, second, third, and fourth nodes, respectively. Through... Figure 3 It can be determined that the flow between nodes a and b is greater than the flow between nodes c and d.
[0043] In some possible implementations of the embodiments of this application, step 103 may include: determining the third traffic entering the fifth node and the fourth traffic entering the sixth node according to the traffic detection model, wherein the fifth node and the sixth node are nodes among a plurality of nodes; comparing the third traffic and the fourth traffic to obtain the comparison result of the third traffic and the fourth traffic.
[0044] For example, let's take the fifth node and the sixth node as nodes a and d respectively. Through... Figure 3 It can be determined that the flow into node a is greater than the flow into node d.
[0045] In some possible implementations of the embodiments of this application, the target network traffic topology in the embodiments of this application can be a social network topology, and the nodes in the social network topology can be users. Each user can have two attributes, namely the number of chats with other users. Accordingly, through the embodiments of this application, it is possible to detect the number of chats between two users in the social network, and also to detect which user in the social network has a higher level of attention.
[0046] In some possible implementations of the embodiments of this application, the network traffic detection method provided in the embodiments of this application may further include: generating a network traffic detection topology corresponding to the target network traffic topology based on the traffic detection model.
[0047] For example, such as Figure 4 As shown. Figure 4 This is a schematic diagram of the network traffic detection topology corresponding to the target network traffic topology provided in the embodiments of this application.
[0048] In some possible implementations of the embodiments of this application, when a network traffic topology G is given, a network traffic detection topology SG corresponding to the network traffic topology can be generated based on G.
[0049] SG is much smaller than G and this reduction is exponential; constructing SG from G is less costly and takes only linear time; updating SG is a constant time for each insertion or deletion of an edge in G; SG is a graph.
[0050] In some possible implementations of this application's embodiments, the Bloom Filter uses a one-dimensional array whose join index can be used to improve the performance of joins in complex queries, but its join index is an index built on a given set of attributes. In contrast, the Blossom Filter in this application's embodiments uses a two-dimensional array, which provides a new index type that can support arbitrary combinations of attributes, rather than fixed combinations.
[0051] This application also provides a network traffic detection device, such as... Figure 5 As shown. Figure 5 This is a schematic diagram of the network traffic detection device 500 provided in the embodiments of this application. The network traffic detection device 500 may include:
[0052] The acquisition module 501 is used to acquire the target network traffic topology, wherein the target network traffic topology includes multiple nodes, traffic between nodes, and traffic direction between nodes, and each node has two attributes: traffic and traffic direction.
[0053] The first generation module 502 is used to generate a traffic detection model for traffic detection based on the target network traffic topology, wherein the traffic detection model is a two-dimensional array based on Bloom Filter;
[0054] The detection module 503 is used to detect the traffic of nodes in the target network traffic topology according to the traffic detection model.
[0055] In this embodiment, a target network traffic topology is obtained, which includes multiple nodes, traffic between nodes, and traffic direction between nodes. Each node has two attributes: traffic and traffic direction. Based on the target network traffic topology, a traffic detection model for traffic detection is generated, wherein the traffic detection model is a two-dimensional array based on a Bloom filter. Based on the traffic detection model, the traffic of nodes in the target network traffic topology is detected. Thus, since a two-dimensional array based on a Bloom filter is generated for traffic detection, using this Bloom filter-based two-dimensional array for network traffic detection can improve the accuracy and efficiency of network traffic detection.
[0056] In some possible implementations of the embodiments of this application, the detection module 503 is specifically used for:
[0057] Based on the traffic detection model, the first traffic between the first node and the second node, and the second traffic between the third node and the fourth node are determined, where the first node, the second node, the third node, and the fourth node are nodes among multiple nodes;
[0058] Compare the first flow rate and the second flow rate to obtain the comparison result.
[0059] In some possible implementations of the embodiments of this application, the detection module 503 is specifically used for:
[0060] Based on the traffic detection model, the third traffic entering the fifth node and the fourth traffic entering the sixth node are determined, where the fifth and sixth nodes are nodes among multiple nodes;
[0061] Compare the third flow rate and the fourth flow rate to obtain the comparison results.
[0062] In some possible implementations of the embodiments of this application, the first generation module 502 may specifically be used for:
[0063] Four hash functions are used to classify multiple nodes, resulting in four types of nodes;
[0064] Initialize a 4x4 2D matrix, where each value in the matrix is zero;
[0065] For each edge in the target network traffic topology, the traffic corresponding to the edge is added to the corresponding cell in the two-dimensional matrix according to the node and traffic direction of the edge.
[0066] In some possible implementations of the embodiments of this application, the network traffic detection device provided in the embodiments of this application may further include:
[0067] The second generation module is used to generate the network traffic detection topology corresponding to the target network traffic topology based on the traffic detection model.
[0068] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application.
[0069] The electronic device may include a processor 601 and a memory 602 storing computer program instructions.
[0070] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.
[0071] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where suitable, memory 602 may include removable or non-removable (or fixed) media. Where suitable, memory 602 may be internal or external to an electronic device. In some specific embodiments, memory 602 is a non-volatile solid-state memory.
[0072] In some specific embodiments, the memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the network traffic detection method according to this application.
[0073] The processor 601 reads and executes computer program instructions stored in the memory 602 to implement the network traffic detection method provided in this application embodiment.
[0074] In one example, the electronic device may also include a communication interface 603 and a bus 610. Wherein, as... Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 610 and complete communication with each other.
[0075] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.
[0076] Bus 610 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 610 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.
[0077] The electronic device can execute the network traffic detection method provided in the embodiments of this application, thereby achieving the corresponding technical effects of the network traffic detection method provided in the embodiments of this application.
[0078] In addition, in conjunction with the network traffic detection method in the above embodiments, this application also provides a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement the network traffic detection method provided in this application. Examples of computer-readable storage media include non-transitory computer-readable media, such as ROM, RAM, magnetic disks, or optical disks.
[0079] This application provides a computer program product. When the instructions in the computer program product are executed by the processor of an electronic device, the electronic device performs the network traffic detection method provided in this application and achieves the same technical effect. To avoid repetition, it will not be described again here.
[0080] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.
[0081] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.
[0082] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.
[0083] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.
[0084] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.
Claims
1. A network traffic detection method, characterized in that, The method includes: Obtain the target network traffic topology, wherein the target network traffic topology includes multiple nodes, traffic between nodes, and traffic direction between nodes, and each node has two attributes: traffic and traffic direction; Based on the target network traffic topology, a traffic detection model for traffic detection is generated, wherein the traffic detection model is a two-dimensional array based on a Bloom filter; Based on the traffic detection model, detect the traffic of nodes in the target network traffic topology; The step of generating a traffic detection model for traffic detection based on the target network traffic topology includes: The multiple nodes are classified using four hash functions to obtain four types of nodes; Initialize a 4x4 two-dimensional matrix, where each value in the matrix is zero; For each edge in the target network traffic topology, the traffic corresponding to the edge is added to the corresponding cell of the two-dimensional matrix according to the node and traffic direction of the edge.
2. The method according to claim 1, characterized in that, The step of detecting the traffic of nodes in the target network traffic topology according to the traffic detection model includes: Based on the traffic detection model, the first traffic between the first node and the second node, and the second traffic between the third node and the fourth node are determined, wherein the first node, the second node, the third node, and the fourth node are nodes among the plurality of nodes; The first flow rate and the second flow rate are compared to obtain the comparison result of the first flow rate and the second flow rate.
3. The method according to claim 1, characterized in that, The step of detecting the traffic of nodes in the target network traffic topology according to the traffic detection model includes: Based on the traffic detection model, the third traffic entering the fifth node and the fourth traffic entering the sixth node are determined, wherein the fifth node and the sixth node are nodes among the plurality of nodes; The third flow rate and the fourth flow rate are compared to obtain the comparison result of the third flow rate and the fourth flow rate.
4. The method according to claim 1, characterized in that, The method further includes: Based on the traffic detection model, a network traffic detection topology corresponding to the target network traffic topology is generated.
5. A network traffic detection device, characterized in that, The device includes: The acquisition module is used to acquire the target network traffic topology, wherein the target network traffic topology includes multiple nodes, traffic between nodes, and traffic direction between nodes, and each node has two attributes: traffic and traffic direction. The first generation module is used to generate a traffic detection model for traffic detection based on the target network traffic topology, wherein the traffic detection model is a two-dimensional array based on a Bloom filter; The detection module is used to detect the traffic of nodes in the target network traffic topology according to the traffic detection model; The first generation module is specifically used for: The multiple nodes are classified using four hash functions to obtain four types of nodes; Initialize a 4x4 two-dimensional matrix, where each value in the matrix is zero; For each edge in the target network traffic topology, the traffic corresponding to the edge is added to the corresponding cell of the two-dimensional matrix according to the node and traffic direction of the edge.
6. The apparatus according to claim 5, characterized in that, The detection module is specifically used for: Based on the traffic detection model, the first traffic between the first node and the second node, and the second traffic between the third node and the fourth node are determined, wherein the first node, the second node, the third node, and the fourth node are nodes among the plurality of nodes; The first flow rate and the second flow rate are compared to obtain the comparison result of the first flow rate and the second flow rate.
7. The apparatus according to claim 5, characterized in that, The detection module is specifically used for: Based on the traffic detection model, the third traffic entering the fifth node and the fourth traffic entering the sixth node are determined, wherein the fifth node and the sixth node are nodes among the plurality of nodes; The third flow rate and the fourth flow rate are compared to obtain the comparison result of the third flow rate and the fourth flow rate.
8. The apparatus according to claim 5, characterized in that, The device further includes: The second generation module is used to generate a network traffic detection topology corresponding to the target network traffic topology based on the traffic detection model.
9. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; The processor reads and executes the computer program instructions to implement the network traffic detection method as described in any one of claims 1-4.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the network traffic detection method as described in any one of claims 1-4.
11. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device performs the network traffic detection method as described in any one of claims 1-4.