A network traffic anomaly detection method and device, a terminal and a medium

Abstract

The application discloses a network traffic anomaly detection method and device, a terminal and a medium. The method comprises the following steps: collecting network traffic data in real time, performing discrete wavelet transform on the network traffic data, calculating the variance and expectation of wavelet coefficients at each scale, calculating the Hurst coefficient of the network traffic, dynamically adjusting the Hurst coefficient reference value based on the fluctuation variable control value of the network traffic, judging whether the network traffic is abnormal according to the difference between the Hurst coefficient and the Hurst coefficient reference value, and if the network traffic is abnormal, searching for the abnormal time of the network traffic and performing network attack tracing. Therefore, the embodiment of the application can measure the wavelet coefficient variance at each scale and the wavelet coefficient expectation at each scale, calculate the fluctuation variable control value of the network traffic, and dynamically update the Hurst coefficient reference value, so that the false positive rate of network traffic anomaly is reduced.

Description

Technical Field

[0001] This invention relates to the field of network traffic technology, and in particular to a method, device, terminal, and medium for detecting network traffic anomalies. Background Technology

[0002] Normal network traffic exhibits statistical self-similarity over a large time scale. However, once a network is attacked (DDoS, worms, etc.), the self-similarity of network traffic inevitably decreases significantly and tends towards a Poisson variation. This change causes the Hurst parameter, an important performance indicator for measuring the autocorrelation of network traffic time series, to approach 0.5. Therefore, some researchers compare the network traffic Hurst parameter with a baseline Hurst parameter value (usually set between 0.6 and 0.75). If the difference between the two is greater than a certain set threshold (0.1-0.15), then the network traffic is considered abnormal. This method does indeed have a high detection rate when network traffic fluctuations are small or the network size is small. However, with the changing scale of the network (currently increasing by a certain order of magnitude) and the impact of users' random behavior on network traffic, network traffic exhibits significant dynamic changes, and the Hurst parameter also changes considerably. Therefore, if the baseline value of the Hurst parameter is still set to a fixed value, it will inevitably lead to a high false alarm rate. Thus, in light of the increasingly changing network environment, it is crucial to adjust the baseline value of the Hurst parameter to reduce the false alarm rate of network traffic anomalies. Summary of the Invention

[0003] This invention provides a method, apparatus, terminal, and device for detecting network traffic anomalies. It uses normal wavelet transformation to solve the Hurst parameter and introduces a correction factor with a network traffic fluctuation variable control value to update the Hurst parameter baseline value. When the fluctuation situation changes significantly, the fluctuation variable control value will be adjusted according to the network change fluctuation rules, thereby realizing the dynamic adjustment of the Hurst parameter baseline value and reducing the false alarm rate of network traffic anomalies.

[0004] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a method for detecting abnormal network traffic, comprising:

[0005] Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of network traffic;

[0006] The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value.

[0007] Based on the difference between the Hurst coefficient and the Hurst coefficient baseline value, it is determined whether the network traffic is abnormal;

[0008] If the network traffic is abnormal, the time of the abnormal network traffic will be identified to trace the network attack.

[0009] As an improvement to the above scheme, the real-time acquisition of network traffic data, the performance of discrete wavelet transform on the network traffic data, and the calculation of the variance and expectation of the wavelet coefficients at each scale to calculate the Hurst coefficients of the network traffic specifically include:

[0010] Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients;

[0011] The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform.

[0012] Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales.

[0013] Based on the relationship between the Hurst coefficient and the fitting slope, the Hurst coefficient of network traffic is obtained;

[0014] The expressions for the wavelet coefficients at each scale are as follows:

[0015]

[0016] In the formula, d j,k Let be the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j; and x(t) is the network traffic data at time t. It is the Haar wavelet function;

[0017] The expectation expression for the wavelet coefficients is:

[0018]

[0019] In the formula, E[d j,k [x(t)] represents the expectation of the wavelet coefficients at scale j, and E[x(t)] represents the expectation of the network traffic data at time t.

[0020] The correlation expectation expression for the wavelet coefficients is as follows:

[0021]

[0022] In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. Let ω be the variance of the network traffic data, and ω be the frequency. γ ψ(2) is the slope of the straight line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance. j ω) is the Haar wavelet function after Fourier transform at the j-th scale. The Haar wavelet function after Fourier transform at the j1 scale;

[0023] The variance expression of the wavelet coefficients is as follows:

[0024]

[0025] In the formula, Let be the variance of the wavelet coefficients at the j-th scale;

[0026] The standard deviation expression for the wavelet coefficients is as follows:

[0027] var[d j,k ]=σ x 2 jγ ,

[0028] In the formula, var[d j,k ] represents the standard deviation of the wavelet coefficients at the j-th scale, σ x The standard deviation of the network traffic data;

[0029] The formula for calculating the fitting slope is as follows:

[0030] log2var[d j,k ]=log2σ x +jγ,

[0031] The expression for the Hurst coefficient of network traffic is as follows:

[0032]

[0033] In the formula, H(t) is the Hurst coefficient at time t.

[0034] As an improvement to the above scheme, the step of calculating the control value of the network traffic fluctuation variable based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjusting the Hurst coefficient benchmark value based on the control value of the fluctuation variable, specifically includes:

[0035] The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value.

[0036] The network traffic fluctuation variable control value is...

[0037]

[0038] The expression for the Hurst coefficient benchmark value is as follows:

[0039] H 0,t+1 =H 0,t ξ,

[0040] In the formula, H 0,t+1 Here, H represents the baseline value of the Hurst coefficient at time t+1. 0,t ε is the baseline value of the Hurst coefficient at time t, and ε is the correction factor.

[0041] As an improvement to the above solution, the step of determining whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value specifically involves:

[0042] The network traffic is determined to be abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value. If the difference is greater than a preset threshold, the network traffic is abnormal. If the difference is less than or equal to the preset threshold, the network traffic is not abnormal.

[0043] As an improvement to the above solution, if the network traffic is abnormal, the step of finding the time of the abnormal network traffic and tracing the network attack specifically includes:

[0044] If the network traffic is abnormal, the maximum points of the network traffic data at different scales are obtained, the maximum points are connected in pairs to obtain the maximum line, the slope of the maximum line is calculated, and the time when the network traffic is abnormal is determined based on the slope of the maximum line and a set threshold.

[0045] By sorting all the times when network traffic was abnormal in chronological order, the time when network traffic was abnormal at different locations is obtained, thus obtaining a spatiotemporal distribution map of the entire network attack behavior, for network attack tracing.

[0046] Secondly, embodiments of the present invention provide a network traffic anomaly detection device, comprising:

[0047] The real-time acquisition module is used to acquire network traffic data in real time, perform discrete wavelet transform on the network traffic data, and calculate the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of the network traffic.

[0048] The calculation and adjustment module is used to calculate the control value of the fluctuation variable of the network traffic based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjust the Hurst coefficient benchmark value based on the control value of the fluctuation variable.

[0049] The anomaly detection module is used to determine whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value.

[0050] The lookup and tracing module is used to find the time of the abnormal network traffic if there is an anomaly in the network traffic, and to trace the network attack.

[0051] As an improvement to the above solution, the real-time acquisition module is specifically used for:

[0052] Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients;

[0053] The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform.

[0054] Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales.

[0055] Based on the relationship between the Hurst coefficient and the fitting slope, the Hurst coefficient of network traffic is obtained;

[0056] The expressions for the wavelet coefficients at each scale are as follows:

[0057]

[0058] In the formula, d j,k Let be the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j; and x(t) is the network traffic data at time t. It is the Haar wavelet function;

[0059] The expectation expression for the wavelet coefficients is:

[0060]

[0061] In the formula, E[d j,k[x(t)] represents the expectation of the wavelet coefficients at scale j, and E[x(t)] represents the expectation of the network traffic data at time t.

[0062] The correlation expectation expression for the wavelet coefficients is as follows:

[0063]

[0064] In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. Let ω be the variance of the network traffic data, and ω be the frequency. γ ψ(2) is the slope of the straight line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance. j ω) is the Haar wavelet function after Fourier transform at the j-th scale. The Haar wavelet function after Fourier transform at the j1 scale;

[0065] The variance expression of the wavelet coefficients is as follows:

[0066]

[0067] In the formula, Let be the variance of the wavelet coefficients at the j-th scale;

[0068] The standard deviation expression for the wavelet coefficients is as follows:

[0069] var[d j,k ]=σ x 2 jγ ,

[0070] In the formula, var[d j,k ] represents the standard deviation of the wavelet coefficients at the j-th scale, σ x The standard deviation of the network traffic data;

[0071] The formula for calculating the fitting slope is as follows:

[0072] log2var[d j,k ]=log2σ x +jγ,

[0073] The expression for the Hurst coefficient of network traffic is as follows:

[0074]

[0075] In the formula, H(t) is the Hurst coefficient at time t.

[0076] As an improvement to the above solution, the calculation and adjustment module is specifically used for:

[0077] The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value.

[0078] The network traffic fluctuation variable control value is...

[0079]

[0080] The expression for the Hurst coefficient benchmark value is as follows:

[0081] H 0,t+1 =H 0,t ξ,

[0082] In the formula, H 0,t+1 Here, H represents the baseline value of the Hurst coefficient at time t+1. 0,t ε is the baseline value of the Hurst coefficient at time t, and ε is the correction factor.

[0083] Thirdly, embodiments of the present invention provide a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the above-described network traffic anomaly detection method.

[0084] Furthermore, embodiments of the present invention also provide a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the above-described network traffic anomaly detection method.

[0085] Compared with existing technologies, the network traffic anomaly detection method, device, terminal, and medium disclosed in this invention collect network traffic data in real time, perform discrete wavelet transform on the network traffic data, and calculate the variance and expectation of wavelet coefficients at each scale to calculate the network traffic Hurst coefficient. The method then calculates the fluctuation variable control value of the network traffic, dynamically adjusts the Hurst coefficient benchmark value based on the fluctuation variable control value, determines whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient benchmark value, and if the network traffic is abnormal, identifies the time of the abnormal network traffic and traces the network attack. Therefore, the embodiments of the present invention can measure the variance of wavelet coefficients at various scales and the expected value of wavelet coefficients at various scales to calculate the control value of network traffic fluctuation variables, thereby realizing the dynamic updating of the baseline value of Hurst coefficients and reducing the false alarm rate of network traffic anomalies. Furthermore, after performing wavelet transform on network traffic, the maximum points of wavelet transform at different scales are extracted, and then the maximum points are connected to calculate the maximum line. The slope of the maximum line is used to determine the time of occurrence of abnormal network traffic. By sorting the time of occurrence of abnormal network traffic, the entire attack behavior is reproduced in time and space, thereby obtaining the spatiotemporal distribution map of the entire network attack behavior, thus realizing the tracing of network attacks. Attached Figure Description

[0086] Figure 1 This is a flowchart illustrating a method for detecting network traffic anomalies provided in an embodiment of the present invention;

[0087] Figure 2 This is a schematic diagram of the structure of a network traffic anomaly detection device provided in an embodiment of the present invention. Detailed Implementation

[0088] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0089] It should be noted that the terms "comprising" and "specific" in this invention, and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product, or device.

[0090] Please see Figure 1 , Figure 1 This is a flowchart illustrating a network traffic anomaly detection method provided in an embodiment of the present invention. The network traffic anomaly detection method includes steps S11 to S14:

[0091] S11: Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of the network traffic.

[0092] S12: Calculate the control value of the fluctuation variable of the network traffic based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjust the Hurst coefficient benchmark value based on the control value of the fluctuation variable.

[0093] S13: Determine whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value;

[0094] S14: If the network traffic is abnormal, find the time of the abnormal network traffic and trace the network attack.

[0095] Specifically, step S11 includes:

[0096] Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients;

[0097] The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform.

[0098] Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales.

[0099] Based on the relationship between the Hurst coefficient and the fitting slope, the Hurst coefficient of network traffic is obtained;

[0100] The expressions for the wavelet coefficients at each scale are as follows:

[0101]

[0102] In the formula, d j,k Let be the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j; and x(t) is the network traffic data at time t. It is the Haar wavelet function;

[0103] The expectation expression for the wavelet coefficients is:

[0104]

[0105] In the formula, E[d j,k [x(t)] represents the expectation of the wavelet coefficients at scale j, and E[x(t)] represents the expectation of the network traffic data at time t.

[0106] The correlation expectation expression for the wavelet coefficients is as follows:

[0107]

[0108] In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. Let ω be the variance of the network traffic data, and ω be the frequency. γ ψ(2) is the slope of the straight line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance. j ω) is the Haar wavelet function after Fourier transform at the j-th scale. The Haar wavelet function after Fourier transform at the j1 scale;

[0109] Based on the expected correlation of the wavelet coefficients, let j = j1, k = k1, and obtain the variance expression of the wavelet coefficients as follows:

[0110]

[0111] In the formula, Let be the variance of the wavelet coefficients at the j-th scale;

[0112] The standard deviation expression for the wavelet coefficients is as follows:

[0113] var[d j,k ]=σ x 2 jγ ,

[0114] In the formula, var[d j,k ] represents the standard deviation of the wavelet coefficients at the j-th scale, σ x The standard deviation of the network traffic data;

[0115] The formula for calculating the fitting slope is as follows:

[0116] log2var[d j,k ]=log2σ x +jγ,

[0117] The expression for the Hurst coefficient of network traffic is as follows:

[0118]

[0119] In the formula, H(t) is the Hurst coefficient at time t.

[0120] It should be noted that the expected value of the wavelet coefficients is zero, and the standard deviation of the wavelet coefficients is related to the scaling factor, the variance of the network traffic data, and the slope of the linear fitting of the wavelet transform coefficients in the sense of minimum variance.

[0121] Specifically, step S12 includes:

[0122] The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value.

[0123] The network traffic fluctuation variable control value is...

[0124]

[0125] The expression for the Hurst coefficient benchmark value is as follows:

[0126] H 0,t+1 =H 0,t ξ,

[0127] In the formula, H 0,t+1 Here, H represents the baseline value of the Hurst coefficient at time t+1. 0,t The Hurst coefficient reference value is given at time t.

[0128] It's important to note that in practice, the baseline value of the Hurst coefficient should not be fixed. This is because network traffic is influenced by many random factors, and setting it to a fixed value could easily lead to false alarms. Therefore, a control value for the network traffic fluctuation variable is calculated by measuring the variance and expected value of the wavelet coefficients at various scales. Based on this control value, the baseline value of the Hurst coefficient at time t is dynamically adjusted to reduce the false alarm rate of network traffic anomalies. The greater the network traffic fluctuation, the smaller the control value of the fluctuation variable should be. When the network traffic Hurst coefficient is between 0.6 and 0.7 (the smaller the network traffic fluctuation, the larger the Hurst coefficient), ε is set between 0.5 and 0.9; when the network traffic Hurst coefficient is less than 0.6 (the greater the network traffic fluctuation, the smaller the Hurst coefficient), ε is set between 0 and 0.5. The principle behind this implementation is to set a dynamic correction factor based on network traffic fluctuations; this dynamic correction factor is essentially a control value for the fluctuation variable.

[0129] Specifically, step S13 includes:

[0130] The network traffic is determined to be abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value. If the difference is greater than a preset threshold, the network traffic is abnormal. If the difference is less than or equal to the preset threshold, the network traffic is not abnormal.

[0131] For example, the difference between the Hurst coefficient of network traffic and the baseline value of the Hurst coefficient is calculated to determine if there is an anomaly in the network traffic.

[0132] θ(t)=H(t)-H 0,t ,

[0133] If θ(t) is greater than 0.12, then the network traffic is considered abnormal; otherwise, the network traffic is considered normal.

[0134] Specifically, step S14 includes:

[0135] If the network traffic is abnormal, the maximum points of the network traffic data at different scales are obtained, the maximum points are connected in pairs to obtain the maximum line, the slope of the maximum line is calculated, and the time when the network traffic is abnormal is determined based on the slope of the maximum line and a set threshold.

[0136] By sorting all the times when network traffic was abnormal in chronological order, the time when network traffic was abnormal at different locations is obtained, thus obtaining a spatiotemporal distribution map of the entire network attack behavior, for network attack tracing.

[0137] In practice, once an anomaly in network traffic is detected, wavelet transforms of the network traffic data x(t) at various scales are performed on it in step S11 to obtain different scales (j1,j2,...,j...). n The maximum points of ) are respectively Connecting the pairwise discrete points yields a maximum line. The slope *k* of this maximum line is calculated and compared to 0.5. If *k - 0.5* is less than a set threshold *λ* (set to 1), then an anomaly in network traffic is considered to exist at that moment. By sorting the abnormal network traffic chronologically, the times when network anomalies occurred at different locations can be identified. Correlation between time and location yields a spatiotemporal distribution map of the entire network attack behavior, thus enabling the tracing of network attacks.

[0138] Figure 2 This is a schematic diagram of a network traffic anomaly detection device provided in an embodiment of the present invention. The network traffic anomaly detection device includes:

[0139] The real-time acquisition module 21 is used to acquire network traffic data in real time, perform discrete wavelet transform on the network traffic data, and calculate the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of the network traffic.

[0140] The calculation and adjustment module 22 is used to calculate the fluctuation variable control value of the network traffic based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjust the Hurst coefficient benchmark value based on the fluctuation variable control value.

[0141] The anomaly detection module 23 is used to determine whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value;

[0142] The lookup and tracing module 24 is used to look up the time of the abnormal network traffic if there is an anomaly in the network traffic, and to trace the network attack.

[0143] Specifically, the real-time acquisition module 21 is used for:

[0144] Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients;

[0145] The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform.

[0146] Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales.

[0147] Based on the relationship between the Hurst coefficient and the fitting slope, the Hurst coefficient of network traffic is obtained;

[0148] The expressions for the wavelet coefficients at each scale are as follows:

[0149]

[0150] In the formula, d j,k Let be the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j; and x(t) is the network traffic data at time t. It is the Haar wavelet function;

[0151] The expectation expression for the wavelet coefficients is:

[0152]

[0153] In the formula, E[d j,k[x(t)] represents the expectation of the wavelet coefficients at scale j, and E[x(t)] represents the expectation of the network traffic data at time t.

[0154] The correlation expectation expression for the wavelet coefficients is as follows:

[0155]

[0156] In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. Let ω be the variance of the network traffic data, and ω be the frequency. γ ψ(2) is the slope of the straight line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance. j ω) is the Haar wavelet function after Fourier transform at the j-th scale. The Haar wavelet function after Fourier transform at the j1 scale;

[0157] The variance expression of the wavelet coefficients is as follows:

[0158]

[0159] In the formula, Let be the variance of the wavelet coefficients at the j-th scale;

[0160] The standard deviation expression for the wavelet coefficients is as follows:

[0161] var[d j,k ]=σ x 2 jγ ,

[0162] In the formula, var[d j,k ] represents the standard deviation of the wavelet coefficients at the j-th scale, σ x The standard deviation of the network traffic data;

[0163] The formula for calculating the fitting slope is as follows:

[0164] log2var[d j,k ]=log2σ x +jγ,

[0165] The expression for the Hurst coefficient of network traffic is as follows:

[0166]

[0167] In the formula, H(t) is the Hurst coefficient at time t.

[0168] Specifically, the calculation and adjustment module 22 is used for:

[0169] The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value.

[0170] The network traffic fluctuation variable control value is...

[0171]

[0172] The expression for the Hurst coefficient benchmark value is as follows:

[0173] H 0,t+1 =H 0,t ξ,

[0174] In the formula, H 0,t+1 Here, H represents the baseline value of the Hurst coefficient at time t+1. 0,t ε is the baseline value of the Hurst coefficient at time t, and ε is the correction factor.

[0175] The network traffic anomaly detection device provided in this embodiment of the invention can implement all the processes of the network traffic anomaly detection method in the above embodiments. The functions and technical effects of each module in the device are the same as those of the network traffic anomaly detection method in the above embodiments, and will not be repeated here.

[0176] This invention provides a terminal device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps described in the network traffic anomaly detection method embodiment. Alternatively, when the processor executes the computer program, it implements the functions of each module described in the network traffic anomaly detection device embodiment.

[0177] The terminal device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the schematic diagram is merely an example of a terminal device and does not constitute a limitation on the terminal device. It may include more or fewer components than illustrated, or combine certain components, or different components. For example, the terminal device may also include input / output devices, network access devices, buses, etc.

[0178] The processor can be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field-programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting various parts of the terminal device via various interfaces and lines.

[0179] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the terminal device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart memory card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0180] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0181] This invention also provides a computer-readable storage medium, which includes a stored computer program, wherein the computer program, when running, controls the device where the computer-readable storage medium is located to execute the network traffic anomaly detection method as described in the above embodiments.

[0182] In summary, the network traffic anomaly detection method, device, terminal, and medium disclosed in this embodiment of the invention collect network traffic data in real time, perform discrete wavelet transform on the network traffic data, and calculate the variance and expectation of the wavelet coefficients at each scale to calculate the network traffic Hurst coefficient. The method then calculates the fluctuation variable control value of the network traffic, dynamically adjusts the Hurst coefficient benchmark value based on the fluctuation variable control value, and determines whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient benchmark value. If the network traffic is abnormal, the method identifies the time of the abnormal network traffic and performs network attack tracing. Therefore, the embodiments of the present invention can measure the variance of wavelet coefficients at various scales and the expected value of wavelet coefficients at various scales to calculate the control value of network traffic fluctuation variables, thereby realizing the dynamic updating of the baseline value of Hurst coefficients and reducing the false alarm rate of network traffic anomalies. Furthermore, after performing wavelet transform on network traffic, the maximum points of wavelet transform at different scales are extracted, and then the maximum points are connected to calculate the maximum line. The slope of the maximum line is used to determine the time of occurrence of abnormal network traffic. By sorting the time of occurrence of abnormal network traffic, the entire attack behavior is reproduced in time and space, thereby obtaining the spatiotemporal distribution map of the entire network attack behavior, thus realizing the tracing of network attacks.

[0183] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for detecting network traffic anomalies, characterized in that, include: Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of network traffic; The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value. Based on the difference between the Hurst coefficient and the Hurst coefficient baseline value, it is determined whether the network traffic is abnormal; If the network traffic is abnormal, the time of the abnormal network traffic will be found to trace the network attack. Specifically, the real-time acquisition of network traffic data, the performance of discrete wavelet transform on the network traffic data, and the calculation of the variance and expectation of the wavelet coefficients at each scale to obtain the Hurst coefficients of the network traffic data include: Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients; The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform. Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales. Based on the relationship between the Hurst coefficient and the fitted slope, the Hurst coefficient of network traffic is obtained.

2. The network traffic anomaly detection method as described in claim 1, characterized in that, The expressions for the wavelet coefficients at each scale are as follows: ， In the formula, Here, represents the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j. The network traffic data at time t, It is the Haar wavelet function; The expectation expression for the wavelet coefficients is: ， In the formula, Let j be the expectation of the wavelet coefficients at the j-th scale. Let be the expected value of the network traffic data at time t. The correlation expectation expression for the wavelet coefficients is as follows: ， In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. The variance of the network traffic data. It's frequency. The slope of the fitted line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance is given. Let J be the Haar wavelet function after Fourier transform at scale j. The Haar wavelet function after Fourier transform at the j1 scale; The variance expression of the wavelet coefficients is as follows: ， In the formula, Let be the variance of the wavelet coefficients at the j-th scale; The standard deviation expression for the wavelet coefficients is as follows: ， In the formula, Let j be the standard deviation of the wavelet coefficients at the j-th scale. The standard deviation of the network traffic data; The formula for calculating the fitting slope is as follows: ， The expression for the Hurst coefficient of network traffic is as follows: ， In the formula, Let be the Hurst coefficient at time t.

3. The network traffic anomaly detection method as described in claim 1, characterized in that, The process of calculating the control value of the network traffic fluctuation variable based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjusting the Hurst coefficient benchmark value based on the control value of the fluctuation variable, specifically includes: The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value. The control value for the network traffic fluctuation variable is... ， The expression for the Hurst coefficient benchmark value is as follows: ， In the formula, This refers to the control value for the fluctuation variable of the network traffic. Let j be the standard deviation of the network traffic data, and j be the scaling factor used to reduce or increase the wavelet function. The slope of the fitted line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance is given. Let be the expected value of the network traffic data at time t. The network traffic data at time t, It is the Haar wavelet function. The baseline value of the Hurst coefficient at time t+1. The Hurst coefficient reference value at time t is given. This is a correction factor.

4. The network traffic anomaly detection method as described in claim 1, characterized in that, The step of determining whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value specifically involves: The network traffic is determined to be abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value. If the difference is greater than a preset threshold, the network traffic is abnormal. If the difference is less than or equal to the preset threshold, the network traffic is not abnormal.

5. The network traffic anomaly detection method as described in claim 1, characterized in that, If the network traffic is abnormal, the process involves identifying the time of the abnormal network traffic and tracing the network attack, specifically including: If the network traffic is abnormal, the maximum points of the network traffic data at different scales are obtained, the maximum points are connected in pairs to obtain the maximum line, the slope of the maximum line is calculated, and the time when the network traffic is abnormal is determined based on the slope of the maximum line and a set threshold. By sorting all the times when network traffic was abnormal in chronological order, the time when network traffic was abnormal at different locations is obtained, thus obtaining a spatiotemporal distribution map of the entire network attack behavior, for network attack tracing.

6. A network traffic anomaly detection device, characterized in that, include: The real-time acquisition module is used to acquire network traffic data in real time, perform discrete wavelet transform on the network traffic data, and calculate the variance and expectation of the wavelet coefficients at each scale, thereby calculating the Hurst coefficient of the network traffic. The calculation and adjustment module is used to calculate the control value of the fluctuation variable of the network traffic based on the variance and expectation of the wavelet coefficients at each scale, and dynamically adjust the Hurst coefficient benchmark value based on the control value of the fluctuation variable. The anomaly detection module is used to determine whether the network traffic is abnormal based on the difference between the Hurst coefficient and the Hurst coefficient baseline value. The lookup and tracing module is used to find the time of the abnormal network traffic if the network traffic is abnormal, and to trace the network attack. The real-time acquisition module is specifically used for: Real-time acquisition of network traffic data, performing discrete wavelet transform on the network traffic data and calculating wavelet coefficients at each scale to obtain the expected value of the wavelet coefficients; The correlation expectation of the wavelet coefficients is obtained by performing correlation processing on wavelet coefficients at any two different scales and then performing Fourier transform. Calculate the variance and standard deviation of the wavelet coefficients, and then calculate the slope of the line obtained by linear fitting of the wavelet coefficients at the two different scales. Based on the relationship between the Hurst coefficient and the fitted slope, the Hurst coefficient of network traffic is obtained.

7. The network traffic anomaly detection device as described in claim 6, characterized in that, The expressions for the wavelet coefficients at each scale are as follows: ， In the formula, Here, represents the wavelet coefficients at scale j, where j is the scale factor used to reduce or enlarge the wavelet function; k represents the translation parameter of the discrete wavelet transform at scale j. The network traffic data at time t, It is a Haar wavelet function; The expectation expression for the wavelet coefficients is: ， In the formula, Let j be the expectation of the wavelet coefficients at the j-th scale. Let be the expected value of the network traffic data at time t. The correlation expectation expression for the wavelet coefficients is as follows: ， In the formula, The correlation expectation of the wavelet coefficients at scales j and j1 is given. Here, k1 represents the wavelet coefficients at the j1 scale, and k1 represents the translation parameter of the discrete wavelet transform at the j1 scale. The variance of the network traffic data. It's frequency. The slope of the fitted line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance is given. Let J be the Haar wavelet function after Fourier transform at scale j. The Haar wavelet function after Fourier transform at the j1 scale; The variance expression of the wavelet coefficients is as follows: ， In the formula, Let be the variance of the wavelet coefficients at the j-th scale; The standard deviation expression for the wavelet coefficients is as follows: ， In the formula, Let j be the standard deviation of the wavelet coefficients at the j-th scale. The standard deviation of the network traffic data; The formula for calculating the fitting slope is as follows: ， The expression for the Hurst coefficient of network traffic is as follows: ， In the formula, Let be the Hurst coefficient at time t.

8. The network traffic anomaly detection device as described in claim 6, characterized in that, The calculation and adjustment module is specifically used for: The fluctuation variable control value of the network traffic is calculated based on the variance and expectation of the wavelet coefficients at each scale, and the Hurst coefficient benchmark value is dynamically adjusted based on the fluctuation variable control value. The control value for the network traffic fluctuation variable is... ， The expression for the Hurst coefficient benchmark value is as follows: ， In the formula, This refers to the control value for the fluctuation variable of the network traffic. Let j be the standard deviation of the network traffic data, and j be the scaling factor used to reduce or increase the wavelet function. The slope of the fitted line obtained by linearly fitting the wavelet coefficients of the network traffic in the sense of minimum variance is given. Let be the expected value of the network traffic data at time t. The network traffic data at time t, It is the Haar wavelet function. The baseline value of the Hurst coefficient at time t+1. The Hurst coefficient reference value at time t is given. This is a correction factor.

9. A terminal device, characterized in that, The method includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the network traffic anomaly detection method as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the network traffic anomaly detection method as described in any one of claims 1-5.

Images