Method, apparatus, electronic device and medium for detecting anomaly in network

Abstract

Embodiments of the present disclosure provide methods, apparatuses, electronic devices and media for detecting anomaly in a network. The method for detecting anomaly in a network comprises obtaining a reference tensor and a target tensor representing traffic within the network, the reference tensor and the target tensor having at least dimensions of source and destination of the traffic and time. The method further comprises determining a target core tensor of the target tensor based on a reference decomposition factor of the reference tensor related to the dimensions of source and destination of the traffic. The method further comprises determining that there is an anomaly in the network if a difference between the target core tensor of the target tensor and a reference core tensor of the reference tensor is greater than a preset value. In this way, the anomaly in the network is dynamically detected with network data in the form of tensor, which is more effective and robust since the tensor preserves the intrinsic structure information of high-dimensional data.

Description

TECHNICAL FIELD

[0001] Embodiments of the present disclosure relate to the field of computer networks, and more particularly, to methods, apparatuses, electronic devices, media, and computer program products for detecting anomalies in a network. BACKGROUND

[0002] Software Defined Network (SDN) is a new type of network architecture, which is an implementation of network virtualization. SDN separates the programmable control plane from the data plane of network devices, thereby realizing flexible control of network traffic and making the network more intelligent. In SDN, network intelligence logic is located in the control plane, and network devices are used as data packet forwarding units of the data plane.

[0003] The security of SDN is an important factor limiting the use and promotion of SDN. Traditional methods use algorithms based on machine learning and statistical models to detect whether the network is attacked or abnormal. However, these methods only use low-dimensional data, ignoring the geometric connection information of network devices, and it is difficult to meet the requirements of network security. SUMMARY

[0004] According to embodiments of the present disclosure, a solution for detecting anomalies in a network is provided.

[0005] According to a first aspect of the present disclosure, a method for detecting anomalies in a network is provided. The method includes obtaining a reference tensor and a target tensor representing traffic within the network, the reference tensor and the target tensor having at least dimensions of source and destination of the traffic and time. The method further includes determining a target core tensor of the target tensor based on a reference decomposition factor of the reference tensor related to the dimensions of source and destination of the traffic. The method further includes determining that there is an anomaly in the network if a difference between the target core tensor of the target tensor and a reference core tensor of the reference tensor is greater than a preset value.

[0006] According to a second aspect of the present disclosure, an apparatus for detecting anomalies in a network is also provided. The apparatus includes a tensor obtaining unit, a core tensor determining unit, and an anomaly determining unit. The tensor obtaining unit is configured to obtain a reference tensor and a target tensor representing traffic within the network, the reference tensor and the target tensor having at least dimensions of source and destination of the traffic and time. The core tensor determining unit is configured to determine a target core tensor of the target tensor based on a reference decomposition factor of the reference tensor related to the dimensions of source and destination of the traffic. The anomaly determining unit is configured to determine that there is an anomaly in the network if a difference between the target core tensor of the target tensor and a reference core tensor of the reference tensor is greater than a preset value.

[0007] According to a third aspect of the disclosure, there is provided an electronic device. The electronic device comprises at least one processing unit and at least one memory. The at least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, which when executed by the at least one processing unit, causes the electronic device to perform the method according to the first aspect of the disclosure.

[0008] According to a fourth aspect of the disclosure, there is provided a computer- readable storage medium comprising machine executable instructions that, when executed by a device, cause the device to perform the method according to the first aspect of the disclosure.

[0009] According to a fifth aspect of the disclosure, there is provided a computer program product tangibly stored on a computer-readable medium and comprising machine executable instructions that, when executed by a device, cause the device to perform the method according to the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0010] The above and other features, aspects, and advantages of embodiments of the disclosure will become more apparent from the following detailed description, taken in conjunction with the accompanying drawings, in which like reference numerals represent like elements throughout the several views. In the drawings:

[0011] Figure 1 A block diagram illustrating an example environment in accordance with some embodiments of the disclosure is shown;

[0012] Figure 2A A schematic diagram illustrating tensor decomposition in accordance with some embodiments of the disclosure is shown;

[0013] Figure 2B A schematic diagram illustrating a tensor representing traffic in a network in accordance with some embodiments of the disclosure is shown;

[0014] Figure 3 A schematic flow diagram illustrating a method for detecting anomalies in a network in accordance with some embodiments of the disclosure is shown;

[0015] Figure 4 A schematic diagram illustrating the generation of tensors over time in accordance with some embodiments of the disclosure is shown;

[0016] Figure 5 A schematic flow diagram illustrating a method of updating a reference tensor in accordance with some embodiments of the disclosure is shown;

[0017] Figure 6 A schematic block diagram illustrating an apparatus for detecting anomalies in a network in accordance with some embodiments of the disclosure is shown; and

[0018] Figure 7A schematic block diagram of an example device that can be used to implement some embodiments in accordance with the present disclosure is shown. DETAILED DESCRIPTION

[0019] Embodiments of the present disclosure will be described in more detail with reference to the drawings. While certain embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be interpreted in a limited sense as set forth in the embodiments set forth herein, but rather the embodiments are provided to more thoroughly and completely understand the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for exemplary purposes only and are not intended to limit the scope of protection of the present disclosure.

[0020] In the description of embodiments of the present disclosure, the term "comprising" and its conjugations are to be understood to be open-ended, i.e., not limiting to an embodiment having only those functionalities recited. The term "based on" is to be understood as "based, at least in part, on". The term "one embodiment" or "an embodiment" are to be understood not to refer to one and the same embodiment; rather, they refer to "at least one". The terms "first", "second" and the like can refer to different or identical objects. Other definitions can be found in the description below.

[0021] In addition, all specific numerical values are examples and are only used to help understanding, and are not intended to limit the scope.

[0022] As mentioned above, the control plane and the data plane are separated in an SDN network. The controller located in the control plane can generate flow tables based on policies and issue them to the network devices (e.g., switches) in the data plane, whereby the network devices forward traffic or packets (in this document, traffic or packets can be used interchangeably) based on the flow tables. In an SDN network, the flow tables are the most important data, including all network devices and their topology information, e.g., source Internet Protocol (IP) address, source port, routing information, destination IP address, protocol, etc. Therefore, the traffic statistics data in an SDN network is a multi-modal, multi-dimensional data. Such multi-dimensional data can be organized as a tensor.

[0023] Traditional methods use machine learning and statistical model based methods, e.g., deep learning, support vector machine, hidden Markov model, etc. to detect whether there is an anomaly in the network. However, these methods do not take advantage of the high-dimensional characteristics of SDN network data, and ignore the network device geometric connection information.

[0024] In view of this, a scheme for detecting anomalies in a network is provided. The scheme is based on the concept of dynamic tensor filter, which continuously compares the current traffic statistics data in tensor form to be detected and the previous network data over time, thereby determining whether there is an anomaly in the network.

[0025] According to embodiments of the present disclosure, first, a reference tensor and a target tensor representing traffic within a network are obtained. Both the reference tensor and the target tensor are multi-dimensional data, and are generated from traffic statistics of the network at different time periods over time. The reference tensor and the target tensor have dimensions of source address, destination address and time of the traffic. Through tensor decomposition, the reference tensor and the target tensor have respective core tensors and decomposition factors corresponding to the respective dimensions. Then, the core tensor of the target tensor is determined based on the decomposition factors of the reference tensor that are related to dimensions other than the time dimension. If the core tensor of the target tensor has a large difference compared to the core tensor of the reference tensor, it can mean that the network has received an attack, and thus it can be determined that there is an anomaly in the network.

[0026] As will be appreciated through the following description, compared to known conventional schemes, the scheme according to embodiments of the present disclosure utilizes network data in the form of tensors to dynamically detect anomalies in a network, and is more effective and robust since tensors preserve the intrinsic structure information of high-dimensional data.

[0027] Some example embodiments of the present disclosure will be hereinafter described with continuous reference to the drawings.

[0028] Figure 1 A block diagram of an example environment 100 is shown, in accordance with some embodiments of the present disclosure. The example environment 100 can generally relate to a software defined network, SDN.

[0029] In the environment 100, network control functions and data forwarding functions are decoupled. Thus, the environment 100 can be composed of three different hierarchical planes or layers, including an application plane 104, a control plane 106 and a data plane 108. The application plane 104 can include a plurality of service applications, e.g., SDN application 103, SDN application 105 and SDN application 107, which are programs that communicate their requirements for network services and desired network behavior to an SDN controller 110 in the control plane 106 through respective application programming interfaces (APIs) 112. The SDN applications can work on an abstraction of the underlying network infrastructure (e.g., network devices in the data plane 108), thus treating the network as a single logical or virtual entity. The APIs 112 can enable business enterprises / entities, operators or network operators to implement public network services, such as routing, multicast, security, access control, bandwidth management, traffic engineering, QoS configuration, storage optimization, policy management, etc.

[0030] As mentioned before, in the SDN architecture, network intelligence can be logically centralized in the control plane 106, which can be composed of one or more SDN controllers. In the control plane 106, the SDN controller 110 can be responsible for making decisions about how to forward traffic in the network, and can be implemented as a software program that runs on one or more servers or computers. Figure 1In the environment 100, one such SDN controller 110 is shown. However, in other embodiments, the control plane 106 can include more SDN controllers and can operate in a distributed processing environment. The SDN controller 110 can maintain a global view of the underlying network, translating requirements from the SDN application plane 104 down to the network devices 114-117 in the data plane 108, as well as providing an abstract view of the network (possibly including network-related traffic statistics and events) to the SDN applications 103, 105, and 107. The SDN controller 110 can allow network operators and administrators to detect the state of the network, change network behavior in real time, and deploy new applications and network services within hours or days. Thus, according to embodiments of the present disclosure, the SDN controller 110 can provide network administrators with services regarding the security of the SDN network through dynamic and automated SDN programs such as the anomaly detection tool. In some embodiments, the SDN controller 110 itself can be an information handling system, and the program code of the anomaly detection tool 102 can be stored in a storage unit or memory in the SDN controller 110. Other exemplary architectural details of the SDN controller 110 are shown in Figure 7 and discussed below. In some embodiments, the SDN controller 110 can be implemented in an electronic device having computing functionality such as a personal computer, workstation, server, etc.

[0031] The anomaly detection tool 102 can be a software application including program code that, when executed by a processor in the SDN controller 110 or other suitable information handling system implementing the functionality of the SDN controller 110, can cause the SDN controller 110 or the information handling system to perform various operational tasks discussed below with reference to Figures 3 to 6 In some embodiments, the anomaly detection tool 102 can be implemented in the control plane 106, but not as part of the SDN controller 110. In this case, the program code of the anomaly detection tool 102 can be executed by the SDN controller 110 or other suitable information handling system in the control plane 106 to enable the SDN controller 110 or the information handling system to perform various operational tasks discussed below with reference to Figures 3 to 6

[0032] The data plane 108 can represent the infrastructure layer of the underlying communication network having the SDN architecture 100. As shown, in one embodiment, the data plane 108 can include network devices 114-117 for forwarding data packets within and outside the network. For ease of illustration, Figure 1 ​Only four network devices are shown in this document; however, it is understood that hundreds or even more network devices may constitute the actual data forwarding platform of the network. In this document, the terms "routing device" and "network device" are sometimes used interchangeably. Exemplary routing or network devices may include network switches, routers, or any device with packet forwarding capabilities, and may be physical devices or virtual devices based on virtual machines.

[0033] like Figure 1 As shown, network devices 114 to 117 can be interconnected and also communicate with control plane 106 to perform network traffic forwarding. Figure 1 The connections between network devices shown are merely exemplary and do not imply that the connections depicted are the only possible connections for network devices 114 to 117. In some embodiments, network devices 114 to 117 may communicate with the SDN controller 110 in control plane 106 via their respective control-data plane interfaces (also known as southbound interfaces). Figure 1 In this context, these control-data plane interfaces 120 are uniformly referred to as Control-Data Plane Interface 120. Each interface 120 can be defined between the control plane 106 and the data plane 108, and can provide at least the following functions: control over all data forwarding operations, network device capability announcements, network device traffic statistics reported to the control plane, and notifications of network devices reporting events to the control plane and receiving events from the control plane.

[0034] In some embodiments, to report traffic statistics, a traffic detector or traffic detection program can be deployed on one or more of network devices 114 to 117 as a data sensing module. The data sensing module continuously monitors the network status of its network device over time and generates traffic statistics about the packets it receives, processes, and forwards. Traffic statistics may include information from flow table data, the source address (e.g., IP address) of the packets, the destination address, duration, source port, destination port, protocol, network topology data, number of bytes, number of packets, etc. These traffic statistics can be sent to the controller 110 in the control plane 106 to generate corresponding tensors, which are then used to determine if any anomalies exist in the network.

[0035] Although example environment 100 is shown as an SDN network, embodiments of this disclosure can also be implemented in different environments. For example, embodiments of this disclosure may be implemented in other environments capable of collecting and analyzing network traffic data.

[0036] Figure 2AA schematic diagram of tensor decomposition is shown according to some embodiments of the present disclosure. As mentioned above, multi-dimensional data can be represented as a tensor. For ease of understanding, in this document, a vector is one-dimensional data, a matrix is two-dimensional data, and a tensor is three-dimensional and above data.

[0037] For a matrix, singular value decomposition is known. Using a form of tensor-matrix product, singular value decomposition can be expressed as:

[0038] M = ∑ x 1 U x 2 V (1)

[0039] where matrix ∑ is a diagonal matrix, and matrices U and V are orthogonal matrices, where operators x 1 and x 2 represent matrix product with respect to the first dimension (row) and the second dimension (column) of the matrix, respectively. The diagonal matrix ∑ obtained by singular value decomposition can be understood as a summary description of the original M, which can be used for data compression and feature extraction for the original matrix M, for example. In this document, singular value decomposition for a two-dimensional matrix is generalized to a decomposition for a higher-dimensional tensor (also known as higher-order singular value decomposition, HOSVD). Referring to Figure 2A , the decomposition can be expressed as:

[0040]

[0041] where τ is the original tensor to be decomposed, is a diagonal tensor, U 1, U 2, U 3 are the decomposition factors of the decomposed tensor, and operators x {1，2，3} mean performing matrix multiplication with respect to the first dimension, the second dimension, and the third dimension of the tensor in sequence, U {1，2，3} U 1, U 2, U 3 are combined. As shown in FIG. 2, a core tensor 220 of the original tensor τ 210 can be generated by intercepting a portion of the three dimensions of the diagonal tensor 230. In some embodiments, as a non-limiting example, the ratio of the length of each dimension of the core tensor 230 to the length of the corresponding dimension of the original tensor τ 210 can be in the range of 20% to 50%.

[0042] It is noted that in equation (2), the decomposition factor U 1 is the decomposition factor related to the first dimension, specifically, U 1 includes orthogonal bases for the second dimension space and the third dimension space. The decomposition factor U 2 is the decomposition factor related to the second dimension, specifically, U 2 includes orthogonal bases for the first dimension space and the third dimension space. The decomposition factor U 3 is the decomposition factor related to the third dimension, specifically, U 3 includes orthogonal bases for the first dimension space and the second dimension space.

[0043] According to embodiments of the present disclosure, the core tensor The features of the original tensor can be considered, and thus, by comparing the differences between the core tensors of two tensors, it is determined whether the two tensors are significantly different. When there is a significant difference, it can be considered that there is an abnormal situation in the tensor data. The dynamic tensor filter according to embodiments of the present disclosure is implemented based on the comparison of the core tensors of the tensors, which will be described below with reference to Figures 3 to 6 to illustrate the process thereof.

[0044] Figure 2B A schematic diagram of a tensor representing traffic in a network is shown according to some embodiments of the present disclosure.

[0045] As described above, a data sensing module is deployed at one or more network devices 114-117 of the data plane 108. The data sensing module can continuously send traffic sensing data to the SDN controller 110 in the control plane 106 over time. In some embodiments, the traffic statistics can include source addresses (e.g., IP addresses), destination addresses, times, source ports, destination ports, protocols, network topology data, byte counts, packet counts, etc. of the data packets.

[0046] Over time, the SDN controller 110 can continuously generate a three-dimensional data based on the source addresses, destination addresses, and times of the data packets in the received traffic statistics, for example, Figure 2B The tensor 212 shown. According to the time dimension, the tensor includes a series of time slices 211. The duration of a single time slice can be, for example, 5 seconds, 10 seconds, 30 seconds, 1 minute, 3 minutes, 5 minutes, etc. It should be understood that the above description of the duration of a single time slice is for illustrative purposes only and is not limiting the scope of the present disclosure. The time slices 211 in the tensor 212 can include a two-dimensional matrix with respect to the source address dimension and the destination address dimension. In this matrix, the numerical value of each cell can be the number of data packets sent from the network device of the corresponding source address to the network device of the corresponding destination address in this time slice. However, it can be understood that the numerical value of the cell in the matrix can be other traffic statistics, such as byte counts or other similar statistics. In addition, in the tensor 212, the cells in the matrix 211 form a vector 213 over time. Each component in the vector 213 indicates the number of data packets or byte counts, etc. sent by the network device of the corresponding source address to the network device of the corresponding destination address in a time slice.

[0047] Referring to Figures 3 to 6 A scheme for detecting anomalies in a network according to embodiments of the present disclosure is described. Before that, a dynamic filter according to embodiments of the present disclosure is outlined.

[0048] Considering that the features of the traffic statistics can change over time, a reference tensor is obtained for the traffic statistics should be updated accordingly over time. To model the dynamic characteristics of tensor data, a state-observation model is provided, including:

[0049] State Model

[0050]

[0051] Observation Model

[0052]

[0053] wherein is a tensor obtained at time f characteristics of the tensor, which can be represented by the core tensor of the tensor (refer to Figure 2A described); U {1，2，3} (t) is a decomposition factor of the tensor f {i} (), i = 0, 1, 2, 3 is a transformation function, which can be linear or nonlinear. i = 0, 1, 2, 3 and are state noise and observation noise, respectively,

[0054] It should be understood that although it is difficult to determine a specific transformation function to capture all characteristics of SDN traffic data, it is noted that detecting anomalies in traffic data does not require accurate prediction of traffic data, but only needs to find statistical regularities of traffic data. In addition, it is also noted that the tensors obtained from traffic statistics by moving time windows can be overlapping in time, and the characteristic difference between adjacent tensors should be relatively small. That is, if the characteristics of the target tensor after change significantly than the characteristics of the reference tensor before, there can be an anomaly in the network.

[0055] Figure 3 A schematic flowchart of a method 300 for detecting anomalies in a network according to some embodiments of the present disclosure is shown. The method 300 can be implemented in, for example, the SDN controller 110. Figure 1

[0056] At block 310, the SDN controller 110 obtains a reference tensor and a target tensor In some embodiments, the SDN controller 110 can generate the reference tensor and the target tensor based on traffic statistics from a data sensing module in the data plane. The generated reference tensor and the target tensor ​The tensor can have the form of a three-dimensional tensor as described with reference to FIG. 2, with dimensions of source, destination, and time of the traffic. Here, the source of the traffic can be represented by the source IP address of the data packet transmitted in the SDN network. The destination of the traffic can be represented by the destination IP address of the data packet. The time can be represented by the time slice to which the data packet belongs. The values of the elements in the reference tensor and the target tensor may represent the number of corresponding data packets or the number of bytes, etc., which is not limited by the present disclosure.

[0057] It should be appreciated that the tensors used to detect anomalies in the network, i.e., the reference tensor and the target tensor, are not limited to three-dimensional data, and can have more dimensions, e.g., can have, for example, source port, destination port, network topology information, etc., as additional dimensions.

[0058] The target tensor may be obtained based on the reference tensor Figure 4 A schematic diagram showing the generation of tensors over time is shown in accordance with some embodiments of the present disclosure.

[0059] As shown in Figure 4 , an exemplary tensor has three dimensions of source, destination, and time, where a series of tensors representing the traffic in the network can be obtained over time. That is, the tensors are generated based on moving time windows. For example, the traffic statistics of time window 1 is used to generate the 1sttensor, the traffic statistics within time window t-1 is used to generate the t-1sttensor, and the traffic statistics within time window t is used to generate the tthtensor. Here, these time windows can have the same number of time slices, e.g., have 10, 20, 30, 50 time slices. In this context, the duration of the time window, i.e., the number of time slices it includes, can also be referred to as the slice length. In addition, as shown in Figure 4 , adjacent two tensors can have overlapping time slices. For example, one or more of the trailing time slices of the t-1sttensor also belong to the tthtensor.

[0060] The SDN controller 110 can obtain the traffic statistics within a time period, e.g., window t-1, and generate the reference tensor Similarly, the SDN controller 110 can also obtain the traffic statistics within the next time period, window t, and thereby generate the target tensor

[0061] As mentioned above, the reference tensor and the target tensor Overlapping time slices are possible. Therefore, to obtain the target tensor more easily... To reduce the amount of data transmitted between the data plane 108 and the control plane 106, the SDN controller 110 can acquire data immediately following the reference vector. The system collects traffic statistics for another time period (also known as the "step") following the first time period and generates an incremental tensor. Considering the reference tensor and target tensor The two time units overlap, therefore, the length of the other time unit is shorter than that of the reference tensor. The length of the time window. Then, the SDN controller 110 can base its decisions on the reference tensor. and increment tensor To generate the target tensor For example, through merging.

[0062] Continue to refer to Figure 3 In box 320, the SDN controller 110 is based on reference vectors. The reference decomposition factor, which is related to the source and destination dimensions of the traffic, determines the target tensor. Target core tensor Target Core Tensor Represents the characteristics of the target tensor.

[0063] First, obtain the reference tensor through tensor decomposition. The decomposition factor U related to each dimension {1，2，3} and core tensor As an example, suppose the first, second, and third dimensions of the tensor are source, destination, and time, respectively, and then refer to... Figure 2A Reference tensor The decomposition factor related to the source dimension can be U1, the decomposition factor related to the destination dimension can be U2, and the decomposition factor related to the time dimension can be U3.

[0064] In some embodiments, based on tensor decomposition, a reference decomposition factor U is used. {1，2} and the target tensor Determine the target tensor The decomposition factor U3(t) is related to the time dimension. Here, refer to the decomposition factor U. {1，2} The reference decomposition factor U has already been obtained. {1，2，3} The decomposition factor is related to the dimensions of the source and destination. Then, based on the target tensor... The target core tensor is determined by the time-dependent decomposition factor U3(t) and the reference decomposition factors U1 and U2.

[0065] In box 330, determine the target core tensor. and reference core tensor The difference between them ||ε|| F Is it greater than a preset value Q? In some embodiments, this difference ||ε|| F It could be the target core tensor. Subtract the reference core tensor The Frobenius norm of the resulting tensor. The Frobenius norm is the square root of the sum of squares of all elements in the tensor. In some embodiments, the preset value Q can be based on the obtained target tensor. The historical differences over a previous period are determined. In other words, the preset value Q used as the criterion can be dynamically changing. For example, assuming the differences follow a Gaussian distribution, the preset value Q could be the value corresponding to three times the variance of the average difference over a past period.

[0066] If the difference is ||ε|| F If the value is greater than the preset value Q, then in box 340, the SDN controller 110 determines that there is an anomaly in the network, for example, the network has been attacked.

[0067] If the exception is ||ε|| F If the value is not greater than the preset value Q, then in box 350, SDN controller 110 updates the reference tensor. and reference decomposition factor U {1，2} .

[0068] Figure 5 A schematic flowchart of a method 500 for updating a reference tensor and a reference decomposition factor according to some embodiments of the present disclosure is shown.

[0069] In box 510, using the target core tensor To update the reference core tensor If no anomalies are detected, the target core tensor can then be used. As the new reference core tensor Therefore, the core tensor of the next target tensor is compared with the target core tensor.

[0070] In box 520, obtain the target tensor. The target decomposition factor U is related to the source and destination dimensions of the traffic. {1，2} (t). In some embodiments, tensor decomposition is performed based on the target tensor. Updated reference core tensor The time-dependent decomposition case U3(t) of the target tensor is used to determine the target decomposition factor U. {1，2} (t).

[0071] In box 530, the target decomposition factor U is used. {1，2} (t) to update the reference decomposition factor U {1，2} In some embodiments, the target decomposition factor U can be utilized. {1，2} (t) and reference decomposition factor U {1，2} The weighted sum is used to update the reference decomposition factor U. {1，2} For example, the weights can be determined based on the number of corresponding time slices. In this embodiment, the target tensor... Including reference tensor Overlapping data and incremental data Furthermore, the weights can be proportional to the slice lengths of the overlapping data and the incremental data. Therefore, the weight of the original reference decomposition factor can be (1 - step size / slice length), while the weight of the target decomposition factor U... {1，2} The weight of (t) can be (step size / slice length).

[0072] After method 500 completes, the process returns to step 310 of method 300, thus allowing the SDN controller 100 to repeatedly detect anomalies in the network over time. (See above for reference.) Figures 3 to 5 The process described can be concisely represented by the following pseudocode.

[0073]

[0074] Through the above combination Figures 1 to 5 As can be seen from the description, the scheme according to the embodiments of this disclosure utilizes network data in tensor form to dynamically detect anomalies in the network. Since tensors preserve the inherent structural information of high-dimensional data, this scheme is more effective and robust. Furthermore, this scheme can also be applied to data analysis in many scenarios with multi-dimensional data, such as traffic prediction and malicious device detection, and is not limited to anomaly detection in SDN networks.

[0075] Figure 6 A schematic block diagram of a file management apparatus 600 according to an embodiment of the present disclosure is shown. The apparatus 600 includes a tensor acquisition unit 610, a core tensor determination unit 620, and an anomaly determination unit 630. The apparatus 600 can be implemented to perform tasks such as... Figure 1 The SDN controller is shown in the electronic device.

[0076] Tensor acquisition unit 610 is configured to acquire a reference tensor and a destination tensor representing traffic within the network. The reference tensor and the destination tensor have at least the dimensions of the source and destination of the traffic, as well as time.

[0077] In some embodiments, the tensor obtaining unit 610 can be further configured to generate a reference tensor based on traffic statistics of the network in a first time period, wherein the traffic statistics comprise at least source and destination addresses of data packets. In some embodiments, the tensor obtaining unit 610 can be further configured to generate a delta tensor based on traffic statistics of the network in a second time period immediately after the first time period, wherein the second time period has a length smaller than the first time period; and generate the target tensor based on the reference tensor and the delta tensor.

[0078] The core tensor determining unit 620 is configured to determine a target core tensor of the target tensor based on reference decomposition factors of the reference tensor related to dimensions of sources and destinations of traffic.

[0079] In some embodiments, the core tensor determining unit 620 can be further configured to decompose the target tensor using the reference decomposition factors to determine decomposition factors of the target tensor related to the dimension of time; and determine the target core tensor based on the target tensor, the determined decomposition factors related to the dimension of time, and the reference decomposition factors.

[0080] The anomaly determining unit 630 is configured to determine that there is an anomaly in the network if a difference between the target core tensor of the target tensor and a reference core tensor of the reference tensor is greater than a preset value.

[0081] In some embodiments, the apparatus 600 can further comprise an updating unit (not shown). The updating unit is configured to update the reference core tensor using the target core tensor if the difference between the target core tensor and the reference core tensor is not greater than the preset value. In some embodiments, the updating unit can be further configured to decompose the target tensor using the updated reference core tensor and decomposition factors of the target tensor related to the dimension of time to obtain target decomposition factors of the target tensor related to the dimensions of sources and destinations of traffic; and update the reference decomposition factors using the target decomposition factors.

[0082] In some embodiments, the updating unit can be further configured to update the reference decomposition factors using a weighted sum of the target decomposition factors and the reference decomposition factors.

[0083] In some embodiments, the difference is a Frobenius norm of a tensor resulting from subtracting the reference core tensor from the target core tensor.

[0084] In some embodiments, the preset value is determined based on a history of the difference in a period of time before the target tensor is obtained.

[0085] Figure 7 A schematic block diagram of an example apparatus 700 that can be used to implement some embodiments consistent with the present disclosure is shown. As Figure 7As shown, the device 700 includes a central processing unit (CPU) 701, which can perform various suitable actions and processes according to computer program instructions stored in a read-only memory (ROM) 702 or computer program instructions loaded into a random access memory (RAM) 703 from a storage unit 708. Various programs and data required by the device 700 for operation can also be stored in the RAM 703. The CPU 701, the ROM 702, and the RAM 703 are connected to each other by a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0086] Various components in the device 700 are connected to the I / O interface 705, including an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a magnetic disk, a magneto-optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0087] The various processes and processes described above, such as the methods 300 and 500, can be performed by the processing unit 701. For example, in some embodiments, the methods 300 and 500 can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the CPU 701, one or more actions of the methods 300 and 500 described above can be performed.

[0088] The present disclosure can be a method, an apparatus, a system, and / or a computer program product. The computer program product can include a computer readable storage medium having computer readable program instructions embodied therewith, wherein the computer readable program instructions are used to perform various aspects of the present disclosure.

[0089] Computer readable storage media can be tangible storage media which can retain and store instructions for use by an instruction execution device. Computer readable storage media can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer readable storage media include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0090] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0091] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0092] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0093] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0094] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0095] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0096] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative, and not restrictive, of the disclosed embodiments. Many modifications and variations of the described embodiments are possible, and all such modifications and variations are intended to be within the scope of the described embodiments. The description used herein is intended to be illustrative, and not restrictive, of the described embodiments. The scope of the described embodiments is not limited to the examples and / or embodiments described herein but only by the claims and their equivalents.

Claims

1. A method for detecting anomalies in a software-defined network, comprising: In the control plane of the software-defined network, a reference tensor and a target tensor representing traffic in the data plane of the software-defined network are obtained. The control plane is arranged between the data plane and the application plane of the software-defined network. The reference tensor and the target tensor have at least the dimensions of source and destination of the traffic and time. The target tensor is determined based on the reference tensor and the incremental tensor. Based on the reference decomposition factor of the reference tensor related to the dimensions of the source and destination of the traffic, a target core tensor of the target tensor is determined in the control plane, the target core tensor comprising a portion of the target tensor; as well as If the difference between the target core tensor of the target tensor and the reference core tensor of the reference tensor is greater than a preset value, an anomaly is determined in the control plane, wherein the reference core tensor includes a portion of the reference tensor. as well as In response to the difference between the target core tensor of the target tensor and the reference core tensor of the reference tensor being less than the preset value, at least the reference tensor and the reference decomposition factor used to determine the target core tensor of the target tensor are updated.

2. The method according to claim 1, wherein obtaining the reference tensor comprises: The reference tensor is generated based on the traffic statistics of the software-defined network during a first time period, wherein the traffic statistics include at least the source address and destination address of the data packets.

3. The method according to claim 2, wherein obtaining the target tensor comprises: Based on the traffic statistics of the software-defined network in the second time period immediately following the first time period, an incremental tensor is generated, wherein the length of the second time period is shorter than that of the first time period. as well as The target tensor is generated based on the reference tensor and the incremental tensor.

4. The method of claim 1, wherein determining the target core tensor of the target tensor comprises: The target tensor is decomposed using the reference decomposition factor to determine the decomposition factor of the target tensor in relation to the time dimension. as well as The target core tensor is determined based on the target tensor, the determined decomposition factor related to the time dimension, and the reference decomposition factor.

5. The method according to claim 1, further comprising: In response to the fact that the difference between the target core tensor and the reference core tensor is not greater than a preset value, the reference core tensor is updated using the target core tensor.

6. The method of claim 5, further comprising: Using the updated reference core tensor and the time-related decomposition factor of the target tensor, the target tensor is decomposed to obtain the target decomposition factor of the target tensor related to the source and destination dimensions of the traffic. as well as The target decomposition factor is used to update the reference decomposition factor.

7. The method of claim 6, wherein updating the reference decomposition factor comprises: The reference decomposition factor is updated using a weighted sum of the target decomposition factor and the reference decomposition factor.

8. The method of claim 1, wherein the difference is the Frobenius norm of the tensor obtained by subtracting the reference core tensor from the target core tensor.

9. The method of claim 1, wherein the preset value is determined based on a history of the differences over a period of time prior to acquiring the target tensor.

10. An apparatus for detecting anomalies in a software-defined network, comprising: Tensor acquisition unit is configured to acquire a reference tensor and a target tensor representing traffic in the data plane of the software-defined network in the control plane of the software-defined network, the control plane being arranged between the data plane and the application plane of the software-defined network, the reference tensor and the target tensor having at least the dimensions of source and destination and time of the traffic, the target tensor being determined based on the reference tensor and the incremental tensor; A core tensor determination unit is configured to determine a target core tensor of the target tensor in the control plane based on a reference decomposition factor of the reference tensor relating to the dimensions of the source and destination of the traffic, the target core tensor comprising a portion of the target tensor; as well as An anomaly determination unit is configured to determine, in the control plane, that an anomaly exists in the software-defined network in response to a difference between the target core tensor of the target tensor and the reference core tensor of the reference tensor being greater than a preset value, wherein the reference core tensor includes a portion of the reference tensor. as well as The update unit is configured to, in response to the difference between the target core tensor of the target tensor and the reference core tensor of the reference tensor being less than the preset value, update at least the reference tensor and the reference decomposition factor used to determine the target core tensor of the target tensor.

11. The apparatus of claim 10, wherein the tensor acquisition unit is further configured to: The reference tensor is generated based on the traffic statistics of the software-defined network during a first time period, wherein the traffic statistics include at least the source address and destination address of the data packets.

12. The apparatus of claim 11, wherein the tensor acquisition unit is further configured to: Based on the traffic statistics of the software-defined network during a second time period immediately following the first time period, an incremental tensor is generated, wherein the length of the second time period is shorter than that of the first time period; and The target tensor is generated based on the reference tensor and the incremental tensor.

13. The apparatus of claim 10, wherein the core tensor determination unit is further configured to: Using the reference decomposition factor, the target tensor is decomposed to determine the decomposition factor of the target tensor in relation to the time dimension; and The target core tensor is determined based on the target tensor, the determined decomposition factor related to the time dimension, and the reference decomposition factor.

14. The apparatus of claim 10, wherein the updating unit is further configured to: In response to the fact that the difference between the target core tensor and the reference core tensor is not greater than a preset value, the reference core tensor is updated using the target core tensor.

15. The apparatus of claim 14, wherein the updating unit is configured to: Using the updated reference core tensor and the time-related decomposition factor of the target tensor, the target tensor is decomposed to obtain a target decomposition factor of the target tensor related to the source and destination dimensions of the traffic; and The target decomposition factor is used to update the reference decomposition factor.

16. The apparatus of claim 15, wherein the updating unit is further configured to: The reference decomposition factor is updated using a weighted sum of the target decomposition factor and the reference decomposition factor.

17. The apparatus of claim 10, wherein the difference is the Frobenius norm of the tensor obtained by subtracting the reference core tensor from the target core tensor.

18. The apparatus of claim 10, wherein the preset value is determined based on a history of the differences over a period of time prior to acquiring the target tensor.

19. An electronic device comprising: At least one processing unit; as well as At least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the electronic device to perform the method according to any one of claims 1 to 9.

20. A computer-readable storage medium comprising machine-executable instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 9.

21. A computer program product comprising machine-executable instructions that, when executed by a device, cause the device to perform the method according to any one of claims 1 to 9.

Images