Traffic anomaly evaluation method and device, electronic equipment and storage medium

Abstract

This application discloses a traffic anomaly assessment method, apparatus, electronic device, and storage medium, relating to the field of computer technology. It can automatically filter out potentially abnormal traffic, reducing manual costs and improving traffic detection efficiency and accuracy. The specific scheme includes: acquiring traffic data to be assessed, first sample traffic data, timestamps of the traffic data to be assessed, and timestamps of the first sample traffic data; calculating a first similarity and a second similarity based on the traffic data to be assessed, the first sample traffic data, the timestamps of the traffic data to be assessed, and the timestamps of the first sample traffic data; and determining the anomaly result of the traffic data to be assessed based on the first similarity and the second similarity.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of computers, and particularly relates to a traffic anomaly evaluation method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the development of Internet technology, network malicious attack behaviors such as DDoS (distributed denial of service attack) are increasing, and the security and operation challenges faced by operators such as Internet service providers, Internet content providers and Internet data centers are intensifying. In order to protect network security, it is necessary to detect the traffic data of the network to determine whether it is abnormal traffic when the network is attacked. In addition, the server may cause abnormal reduction of traffic due to link failure and other reasons, which brings inconvenience to enterprises or users.

[0003] In related technologies, whether the traffic is abnormal traffic subjected to attack is usually determined by manually detecting the traffic data. In the case of detecting that the traffic data contains abnormal traffic data, it is determined that the abnormal traffic data is traffic data generated by network malicious attack behavior, so that the traffic generated by the object is identified as abnormal traffic. However, since the traffic data in the network is usually relatively large, if all manual determination is adopted, it will lead to low efficiency and high cost, and manual determination of abnormal traffic may result in misjudgment, and the accuracy cannot be guaranteed. SUMMARY

[0004] The embodiments of the present application provide a traffic anomaly evaluation method, which can automatically screen out traffic that may be abnormal, and improve the traffic detection efficiency and accuracy.

[0005] To achieve the above object, the embodiments of the present application adopt the following technical solutions:

[0006] In a first aspect, a traffic anomaly evaluation method is provided. The method comprises: obtaining to-be-evaluated traffic data, first sample traffic data, a timestamp of the to-be-evaluated traffic data, and a timestamp of the first sample traffic data; wherein the to-be-evaluated traffic data is traffic data of a first traffic period, the first sample traffic data is traffic data of a second traffic period before the first traffic period, the first sample traffic data is normal, and the to-be-evaluated traffic data and the first sample traffic data are from the same data source; calculating a first similarity and a second similarity based on the to-be-evaluated traffic data, the first sample traffic data, the timestamp of the to-be-evaluated traffic data, and the timestamp of the first sample traffic data; wherein the first similarity is used to represent a similarity between the to-be-evaluated traffic data and the first sample traffic data, and the second similarity is used to represent a similarity between a change trend of the to-be-evaluated traffic data and the first sample traffic data; and determining an anomaly result of the to-be-evaluated traffic data based on the first similarity and the second similarity; wherein the anomaly result includes anomaly, normal, and uncertainty.

[0007] With reference to the first aspect, in another possible implementation manner, the first similarity and the second similarity are calculated based on the to-be-evaluated traffic data, the first sample traffic data, the timestamp of the to-be-evaluated traffic data, and the timestamp of the first sample traffic data, including: determining a first multi-dimensional vector based on the to-be-evaluated traffic data and the timestamp of the to-be-evaluated traffic data; determining a second multi-dimensional vector based on the first sample traffic data and the timestamp of the first sample traffic data; wherein the first multi-dimensional vector and the second multi-dimensional vector have the same dimension; and calculating the first similarity and the second similarity based on the first multi-dimensional vector and the second multi-dimensional vector.

[0008] With reference to the first aspect, in another possible implementation manner, the first similarity and the second similarity are calculated based on the first multi-dimensional vector and the second multi-dimensional vector, including: calculating a Euclidean distance between the first multi-dimensional vector and the second multi-dimensional vector; calculating a cosine value of an included angle between the first multi-dimensional vector and the second multi-dimensional vector; determining the first similarity based on the Euclidean distance; and determining the second similarity based on the cosine value.

[0009] With reference to the first aspect, in another possible implementation manner, the anomaly result of the to-be-evaluated traffic data is determined based on the first similarity and the second similarity, including: in a case where the first similarity is greater than or equal to a first threshold, determining that the anomaly result of the to-be-evaluated traffic data is normal; in a case where the first similarity is less than the first threshold and the second similarity is greater than or equal to a second threshold, determining that the anomaly result of the to-be-evaluated traffic data is uncertainty; and in a case where the first similarity is less than the first threshold and the second similarity is less than the second threshold, determining that the anomaly result of the to-be-evaluated traffic data is anomaly.

[0010] With reference to the first aspect, in a possible implementation manner, after determining that the abnormal result of the to-be-evaluated traffic data is uncertain, the method further includes: sending the to-be-evaluated traffic data to a detection terminal; receiving a detection suggestion returned by the detection terminal; wherein the detection suggestion includes that the to-be-evaluated traffic data is normal data or the to-be-evaluated traffic data is abnormal data; and updating the abnormal result according to the detection suggestion.

[0011] With reference to the first aspect, in a possible implementation manner, before the abnormal result of the to-be-evaluated traffic data is evaluated according to the first similarity and the second similarity, a first threshold value and a second threshold value are calculated, and the method further includes: obtaining second sample traffic data of at least one third traffic period and a time stamp of the second sample traffic data; wherein the third traffic period is a traffic period between the first traffic periods, and the second sample traffic data is normal; calculating at least one third similarity and at least one fourth similarity according to the first sample traffic data, the time stamp of the first sample traffic data, the second sample traffic data and the time stamp of the second sample traffic data; wherein the third similarity is used to represent the similarity between the first sample traffic data and the second sample traffic data, and the fourth similarity is used to represent the similarity of the change trend between the first sample traffic data and the second sample traffic data; calculating an average value of the at least one third similarity as the first threshold value; and calculating an average value of the at least one fourth similarity as the second threshold value.

[0012] With reference to the first aspect, in a possible implementation manner, before the to-be-evaluated traffic data, the first sample traffic data, the time stamp of the to-be-evaluated traffic data and the time stamp of the first sample traffic data are obtained, the method further includes: obtaining a preset filtering rule; wherein the preset filtering rule is used to obtain the to-be-evaluated traffic data from initial traffic data, and the preset filtering rule includes at least one of non-empty check, repeated elimination, format inconsistency abandonment, association verification and logical error abandonment; obtaining the initial traffic data; and filtering the initial traffic data according to the preset filtering rule to obtain the to-be-evaluated traffic data.

[0013] The second aspect provides a traffic anomaly evaluation device having a function of implementing the method of the first aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0014] Thirdly, a traffic anomaly assessment device is provided. This device includes a data acquisition module for acquiring traffic data to be assessed, first sample traffic data, a timestamp of the traffic data to be assessed, and a timestamp of the first sample traffic data. The traffic data to be assessed is traffic data from a first traffic cycle, and the first sample traffic data is traffic data from a second traffic cycle preceding the first traffic cycle. The first sample traffic data is free of anomalies. The data source for the traffic data to be assessed is the same as the data source for the first sample traffic data. A similarity calculation module is used to calculate a first similarity and a second similarity based on the traffic data to be assessed, the first sample traffic data, the timestamp of the traffic data to be assessed, and the timestamp of the first sample traffic data acquired by the data acquisition module. The first similarity characterizes the degree of similarity between the traffic data to be assessed and the first sample traffic data, and the second similarity characterizes the degree of similarity in the changing trends of the traffic data to be assessed and the first sample traffic data. An anomaly assessment module is used to determine the anomaly result of the traffic data to be assessed based on the first similarity and the second similarity calculated by the similarity calculation module. The anomaly result includes anomalies, normality, and uncertainty.

[0015] Fourthly, a traffic anomaly assessment device is provided, comprising: a processor and a memory; the memory is used to store computer execution instructions, and when the first device is running, the processor executes the computer execution instructions stored in the memory to cause the first device to perform the traffic anomaly assessment method provided in any of the first aspects above.

[0016] Fifthly, a computer-readable storage medium is provided that stores instructions which, when executed on a computer, enable the computer to perform the traffic anomaly assessment method provided in any of the first aspects above.

[0017] In a sixth aspect, a computer program product containing instructions is provided, which, when run on a traffic anomaly assessment device, enables the traffic anomaly assessment device to execute the traffic anomaly assessment method provided in any of the first aspects above.

[0018] In a seventh aspect, an apparatus (e.g., a system-on-a-chip) is provided, comprising a processor for supporting a traffic anomaly assessment device in implementing the functions described in the first aspect above. In one possible design, the apparatus further comprises a memory for storing program instructions and data necessary for the traffic anomaly assessment device. When the apparatus is a system-on-a-chip, it may be composed of chips or may include chips and other discrete devices.

[0019] Based on the technical solution provided in the embodiments of this application, firstly, the traffic data to be evaluated, the timestamp of the traffic data to be evaluated, the sample traffic data without anomalies, and the timestamp of the sample traffic data are obtained; secondly, a first similarity and a second similarity are calculated based on the traffic data to be evaluated, the timestamp of the traffic data to be evaluated, the sample traffic data, and the timestamp of the sample traffic data; finally, the abnormal results of the traffic data to be evaluated are determined based on the first similarity and the second similarity.

[0020] In summary, the technical solution provided in this application can automatically filter out traffic that may be abnormal, reduce the cost of manually detecting abnormal traffic, and improve the efficiency and accuracy of traffic detection. Attached Figure Description

[0021] Figure 1 A schematic diagram of the software architecture of a traffic anomaly assessment device provided in this application embodiment;

[0022] Figure 2 This application provides a flowchart of a traffic anomaly assessment method. Figure 1 ;

[0023] Figure 3 This application provides a flowchart of a traffic anomaly assessment method. Figure 2 ;

[0024] Figure 4 This application provides a flowchart of a traffic anomaly assessment method. Figure 3 ;

[0025] Figure 4 This application provides a flowchart of a traffic anomaly assessment method. Figure 6 ;

[0026] Figure 5 This application provides a flowchart of a traffic anomaly assessment method. Figure 7 ;

[0027] Figure 6 This application provides a flowchart of a traffic anomaly assessment method. Figure 8 ;

[0028] Figure 7 This application provides a flowchart of a traffic anomaly assessment method. Figure 9 ;

[0029] Figure 10 A schematic diagram illustrating another traffic anomaly assessment method provided in this application embodiment;

[0030] Figure 11 A schematic diagram of traffic data to be evaluated provided in an embodiment of this application;

[0031] Figure 1 A sample flow data illustration provided for an embodiment of this application. Figure 12 ;

[0032] Figure 2 A sample flow data illustration provided for an embodiment of this application. Figure 13 ;

[0033] Figure 14 A schematic diagram of another flow anomaly assessment device provided in this application embodiment;

[0034] Figure 1 This is a schematic diagram of the structure of another flow anomaly assessment device provided in an embodiment of this application. Detailed Implementation

[0035] To make the objectives and implementation methods of this application clearer, exemplary implementation methods of this application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0036] It should be noted that the brief descriptions of terms in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0037] The terms "first," "second," "third," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar or related objects or entities, and do not necessarily imply a specific order or sequence, unless otherwise specified. It should be understood that such terms are interchangeable where appropriate.

[0038] The terms “comprising” and “having” and any variations thereof in this application are intended to cover but not exclude inclusion, for example, a product or device that includes a series of components is not necessarily limited to all the components that are clearly listed, but may include other components that are not clearly listed or that are inherent to such product or device.

[0039] In this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, in this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0040] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0041] Based on the embodiments described in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the appended claims. Furthermore, although the disclosure in this application is based on one or more exemplary examples, it should be understood that each aspect of these disclosures can constitute a complete implementation on its own. It should be noted that the brief descriptions of terminology in this application are only for the convenience of understanding the embodiments described below, and are not intended to limit the implementation of this application. Unless otherwise stated, these terms should be understood in their ordinary and common meaning.

[0042] First, the terms used in this application are explained as follows:

[0043] DDoS: Distributed Denial of Service, is a type of network attack that uses a large number of legitimate distributed servers to send requests to a target, thereby preventing normal, legitimate users from obtaining services.

[0044] Port scanning: A type of network attack in which an attacker sends a set of port scanning messages to a computer or server to obtain the computer's network service type for each port, thereby understanding which ports can be compromised and attacking the host.

[0045] Session: refers to the process of communication between one terminal and another terminal.

[0046] Links: These include physical links and logical links. A physical link refers to a physical line formed under the action of physical layer devices (including transmission media, physical interfaces, and transceivers, etc.) and corresponding physical layer communication protocols. It is permanent and cannot be deleted (unless physically dismantled). A logical link, on the other hand, is a logical link established by two communicating parties under the action of data link layer devices and corresponding communication protocols when data communication is required. It can be permanent (such as an Ethernet link in a local area network) or non-permanent (such as a link in a wide area network). Whether it is permanent depends on the specific data link layer service type. Unless otherwise specified, all links mentioned in this application are logical links.

[0047] Euclidean distance, also known as Euclidean distance, is the distance between two points in n-dimensional space. Generally, in n-dimensional space, point A(x1, x2, ..., xn) is the distance between two points. n ) and point B(y1, y2, ... y n The Euclidean distance d between the two points can be calculated using the following formula:

[0048]

[0049] Where, x i Let y be the coordinates of point A in the i-th dimension of n-dimensional space. i Let A be the coordinates of point B in the i-th dimension of n-dimensional space, and d be the Euclidean distance between points A and B.

[0050] Cosine similarity: This measures the difference between two vectors by using the cosine of the angle between them in a vector space. Generally, in n-dimensional space, vectors a(x1, x2, ... x...) are similar. n ) and vector b(y1, y2, ... y n The cosine similarity cosθ between the two pairs of pairs can be calculated using the following formula:

[0051]

[0052] Where, x i Let y be the basis coefficient of vector a in the i-th dimension of n-dimensional space. i Let θ be the basis coefficient of point b in the i-th dimension of n-dimensional space, and cosθ be the cosine similarity between vectors a and b.

[0053] With the development of Internet technology, malicious network attacks such as DDoS and port scanning are increasing, and the network security challenges faced by Internet service providers, Internet data centers and users are constantly intensifying.

[0054] To ensure network security, related technologies typically involve manual inspection of network traffic to determine whether it contains abnormal traffic indicating malicious network attacks. Taking DDoS attacks as an example, attackers send a large number of access requests to the attacked device to occupy or even exhaust the server's service resources. When a large number of access requests are detected on the attacked device's server within a short period, it can be determined that the traffic generating this abnormal traffic data has been subjected to a DDoS attack, thus identifying the attacked device's traffic as abnormal.

[0055] In addition to the above, link failures may occur between Internet service providers, Internet data centers, and users during the service provision and reception process. Link failures can cause abnormally reduced network traffic, potentially leading to packet loss, congestion, and other problems during interactions between Internet service providers, Internet data centers, and users, causing inconvenience to both businesses and users. Link failures can also be detected manually.

[0056] However, the rapid development of the internet has led to increasingly larger network scales. In high-traffic scenarios, relying solely on manual inspection of traffic data for anomalies becomes time-consuming, inefficient, and problematic. On one hand, manual inspection demands high technical skills from operations and maintenance personnel, increasing the cost of traffic anomaly detection. On the other hand, in high-traffic scenarios, manual inspection inevitably leads to false positives and incorrect detections, compromising the accuracy of traffic anomaly detection.

[0057] Typically, for the same analytical object (e.g., a server), its traffic trend exhibits a relatively stable and cyclical pattern over time (e.g., traffic begins to rise at 8 AM and decreases at midnight, related to user schedules). Therefore, analyzing whether traffic is abnormal based on its time-varying trend has statistical regularity. Based on this, and addressing the aforementioned issues, this application proposes a traffic anomaly assessment method. This method involves acquiring the traffic data to be assessed, the timestamp of the traffic data to be assessed, and the timestamps of sample traffic data and samples that are determined to be anomaly-free. A first similarity and a second similarity are calculated based on the traffic data to be assessed, the timestamp of the traffic data to be assessed, and the timestamps of the sample traffic data and samples. The anomaly result of the traffic data to be assessed is then determined based on the first similarity and the second similarity.

[0058] Figure 1 A schematic diagram of a system architecture for an exemplary application environment in which a traffic anomaly assessment method and apparatus according to embodiments of this application can be applied is shown.

[0059] like Figure 1 As shown, the system architecture 100 applied in the technical solution provided in this application may include at least one terminal device, the Internet 104, and a server 105.Figure 1 The following explanation uses terminal devices 101, 102, and 103 as examples; in practice, there may be more or fewer terminal devices. The Internet 104 serves as the medium providing a communication link between terminal devices 101, 102, 103, and server 105. The Internet 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables. Terminal devices 101, 102, and 103 can be various electronic devices with displays, including but not limited to desktop computers, laptops, smartphones, and tablets. It should be understood that... Figure 2 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, networks, and servers. For example, server 105 could be a server cluster composed of multiple servers.

[0060] The traffic anomaly assessment method provided in this application embodiment can be executed on server 105. For example, server 105 can obtain the traffic data to be assessed, the timestamp of the traffic data to be assessed, the timestamp of sample traffic data determined to be without anomalies, and the timestamp of the sample traffic data. Based on the traffic data to be assessed, the timestamp of the traffic data to be assessed, and the timestamps of the sample traffic data, a first similarity and a second similarity are calculated. Based on the first similarity and the second similarity, the anomaly result of the traffic data to be assessed is determined. The traffic anomaly assessment method provided in this application embodiment can also be executed by a terminal device. Furthermore, the traffic anomaly assessment method provided in this application embodiment can also be executed jointly by a terminal device and server 105; this embodiment does not impose any special limitations on this.

[0061] The video data involved in this application may be data authorized by the user or fully authorized by all parties.

[0062] The methods described in the following embodiments can be implemented in a traffic anomaly assessment device having the above-described hardware and software structures. The traffic anomaly assessment method provided in the embodiments of this application will be described below.

[0063] Reference Figure 1 As shown in the embodiments of this application, a traffic anomaly assessment method is provided, applied to a traffic anomaly assessment device. The traffic anomaly assessment device has the function of determining whether there is abnormal traffic data in the received traffic data. The traffic anomaly assessment device can be the server 105 in the above embodiments or a part thereof. The method can include S210-S230:

[0064] S210. Obtain the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data.

[0065] The traffic data to be evaluated is the traffic data of the first traffic period, the first sample traffic data is the traffic data of the second traffic period before the first traffic period, and the first sample traffic data has no anomalies; the data source of the traffic data to be evaluated is the same as the data source of the first sample traffic data.

[0066] In some examples, the first sample traffic data can be traffic data that has been manually determined to be free of anomalies, or it can be traffic data that has been determined to be free of anomalies by the method provided in this application. In the initial implementation of this application's embodiments, the first sample traffic data can only be traffic data that has been manually determined to be free of anomalies.

[0067] In some examples, the traffic anomaly assessment device obtains traffic data to be assessed and first sample traffic data from the same data source. The data source can be a port under the same IP address or a link. The traffic data can include one or more of the following: number of sessions, traffic size, packet rate, TCP retransmission rate, and average TCP round-trip latency.

[0068] In some examples, the traffic data to be evaluated contains traffic data from multiple sampling points, each with a corresponding timestamp indicating the sampling time of the traffic data to be evaluated at that sampling point. Similarly, the first sample traffic data contains traffic data from multiple sampling points, each with a corresponding timestamp indicating the sampling time of the first sample traffic data at that sampling point. The second traffic period includes all timestamps corresponding to the first sample traffic data, and the first traffic period includes all timestamps corresponding to the traffic data to be evaluated.

[0069] In some examples, combined Figure 1 As shown, S210 can specifically involve the server 105 obtaining the traffic data to be evaluated and the first sample traffic data determined to be without anomalies from the terminal device via the Internet 104, and obtaining the timestamp of each traffic data to be evaluated and the timestamp of each first sample traffic data.

[0070] Due to the user group's daily routines, traffic data exhibits periodicity under normal circumstances. For example, traffic volume typically increases starting at 8:00 AM and decreases at midnight, with a 24-hour cycle. Since the data source for the traffic data to be evaluated is the same as that for the first sample traffic data, it can be determined whether the traffic data to be evaluated is abnormal by comparing its variation characteristics with those of the first sample traffic data. Based on this, S220 and S230 are executed after S210.

[0071] S220. Calculate the first similarity and the second similarity based on the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data.

[0072] The first similarity is used to characterize the degree of similarity between the traffic data to be evaluated and the first sample traffic data, and the second similarity is used to characterize the degree of similarity between the changing trends of the traffic data to be evaluated and the first sample traffic data.

[0073] In some examples, the first sample traffic data consists of traffic data without anomalies within one traffic cycle, while the changes in the traffic data without anomalies over multiple traffic cycles exhibit periodicity. Furthermore, the data source for the first sample traffic data is the same as the data source for the traffic data to be evaluated. Therefore, by calculating a first similarity score representing the degree of similarity between the traffic data to be evaluated and the first sample traffic data, and a second similarity score representing the degree of similarity in the trend of change between the traffic data to be evaluated and the first sample traffic data, it can be determined whether the traffic data to be evaluated has similar or equal change characteristics to the first sample traffic data. If the change characteristics of the traffic data to be evaluated are not similar to those of the first sample traffic data, then the traffic data to be evaluated may be anomalous.

[0074] In some examples, traffic data is used as the number of sessions, combined with Figure 3 As shown, S220 can specifically be that the server 105 calculates the Euclidean similarity (first similarity) and cosine similarity (second similarity) between the number of sessions to be evaluated and the number of first sample sessions in time, based on the number of sessions to be evaluated, the number of first sample sessions, the timestamp of the number of sessions to be evaluated, and the timestamp of the number of first sample sessions.

[0075] In some examples, combined with 2, reference Figure 1 As shown, S220 includes S310 to S330.

[0076] S310. Determine the first multidimensional vector based on the timestamps of the traffic data to be evaluated.

[0077] In some examples, the traffic data to be evaluated includes traffic data from multiple sampling points, each with a corresponding timestamp. The traffic anomaly assessment device can determine a multi-dimensional vector containing the values ​​of the traffic data to be evaluated based on the number of sampling points and the timestamps. For example, firstly, the dimension of the vector is determined based on the number of sampling points; each sampling point of the traffic data to be evaluated corresponds to one dimension, and N sampling points can determine N dimensions. Secondly, the position of the value of the traffic data to be evaluated in the multi-dimensional vector is determined based on the timestamp corresponding to each sampling point; the earlier the timestamp, the earlier the value of the traffic data to be evaluated is in the first multi-dimensional vector. Finally, the value of the traffic data to be evaluated collected at the timestamp corresponding to each sampling point is used as the basis coefficient of the dimension corresponding to that sampling point, resulting in the first multi-dimensional vector determined based on the traffic data to be evaluated and its timestamps.

[0078] In some examples, combined Figure 10 As shown, taking the number of sessions as an example, S310 can specifically be, as referred to Figure 1 As shown, after obtaining the number of sessions to be evaluated (traffic data to be evaluated) and the timestamps of the sessions to be evaluated (timestamps corresponding to the traffic data to be evaluated), server 105 first plots a trend line graph of the number of sessions to be evaluated changing over time based on the number of sessions to be evaluated and the timestamps of the sessions to be evaluated. The horizontal axis of the line graph represents the time corresponding to the timestamp of the sessions to be evaluated, with a total of N timestamps corresponding to N times. The vertical axis represents the numerical value of the number of sessions at that time, for example, 10,000 sessions at 0:00 on the 5th. Second, the coordinates of N points are determined on the line graph, where the horizontal coordinate of these N points is the time corresponding to the timestamp of the sessions to be evaluated, and the vertical coordinate is the numerical value of the number of sessions at that time. Finally, an N-dimensional vector consisting of traffic data sampled from N sampling points is determined based on the coordinates of these N points.

[0079] For example, take 6 points on the line chart of the number of sessions to be evaluated, with coordinates of (February 5, 2021, 0:00, 10000), (February 5, 2021, 4:00, 2000), (February 5, 2021, 8:00, 10000), (February 5, 2021, 12:00, 14000), (February 5, 2021, 16:00, 10000), and (February 5, 2021, 20:00, 10000), respectively indicating 2 The data source has 10,000 sessions at 0:00 on February 5, 2021; 2,000 sessions at 4:00 on February 5, 2021; 10,000 sessions at 8:00 on February 5, 2021; 14,000 sessions at 12:00 on February 5, 2021; 10,000 sessions at 16:00 on February 5, 2021; and 10,000 sessions at 20:00 on February 5, 2021. Based on the coordinates of these six points, the first six-dimensional vector a = (10,000, 2,000, 14,000, 10,000, 10,000, 10,000).

[0080] S320. Determine the second multidimensional vector based on the timestamp of the first sample flow data.

[0081] The first multidimensional vector and the second multidimensional vector have the same dimension.

[0082] In some examples, the first sample traffic data contains traffic data from multiple sampling points, each with a corresponding timestamp. The traffic anomaly assessment device can determine a multi-dimensional vector containing the values ​​of the first sample traffic data based on the number of sampling points and the timestamps. For example, firstly, the dimension of the vector is determined based on the number of sampling points; each sampling point of the first sample traffic data corresponds to one dimension, and N sampling points of the first sample traffic data can determine N dimensions. Secondly, the position of the value of the first sample traffic data in the multi-dimensional vector is determined based on the timestamp corresponding to each sampling point; the earlier the timestamp, the earlier the value of the first sample traffic data corresponding to that timestamp appears in the second multi-dimensional vector. Finally, the value of the first sample traffic data collected at the timestamp corresponding to each sampling point is used as the basis coefficient of the dimension corresponding to that sampling point, ultimately obtaining the second multi-dimensional vector determined based on the first sample traffic data and its timestamps.

[0083] In some examples, combined Figure 11As shown, taking the number of sessions as traffic data as an example, S320 can specifically be as follows: After obtaining the first sample number of sessions (first sample traffic data) and the timestamp of the first sample number of sessions (the timestamp corresponding to the first sample traffic data), and determining the first multidimensional vector, the server 105 firstly plots a trend line graph of the first sample number of sessions changing over time based on the first sample number of sessions and the timestamp of the first sample number of sessions; secondly, it determines the coordinates of N points on the line graph based on the dimension of the first multidimensional vector (taking N as an example), where the horizontal coordinate of the N points is the time corresponding to the timestamp of the first sample number of sessions, which corresponds one-to-one with the time corresponding to the timestamp of the N sessions to be evaluated in S310, and the vertical coordinate is the value of the sample number of sessions at that time; finally, it determines an N-dimensional vector (i.e., the second multidimensional vector) consisting of traffic data sampled from N sampling points based on the coordinates of these N points.

[0084] For example, refer to Figure 1 As shown, six points were selected on the line graph of the trend of the number of sessions in the first sample over time, with coordinates as follows: (0:00, 10000), (4:00, 2000), (8:00, 10000), (12:00, 10000), (16:00, 10000), and (20:00, 10000). The data source sessions at 0:00 on February 4, 2021, are respectively set to 10,000, 2,000, 10,000, 12:00, 16:00, and 20:00. Based on the coordinates of these six points, the first six-dimensional vector a = (10,000, 2,000, 10,000, 10,000, 10,000, 10,000).

[0085] S330. Calculate the first similarity and the second similarity based on the first multidimensional vector and the second multidimensional vector.

[0086] In some examples, combined Figure 3As shown, after obtaining the first multidimensional vector and the second multidimensional vector, the server 105 calculates a first similarity and a second similarity based on the first multidimensional vector and the second multidimensional vector. The first similarity indicates the degree of similarity between the first vector and the second vector, and the second similarity indicates the positional relationship between the first vector and the second vector. In practical applications, the calculation methods for the first and second similarities can be any feasible methods, and this application does not impose specific restrictions on them.

[0087] In some examples, the first similarity between the first and second multidimensional vectors can be calculated using Euclidean distance, and the second similarity can be calculated based on the cosine of the angle between the two vectors. Based on this, combined with... Figure 4 , refer to Figure 1 As shown, S330 includes S410 to S440.

[0088] S410. Calculate the Euclidean distance between the first multidimensional vector and the second multidimensional vector.

[0089] In some examples, combined Figure 1 As shown, the first multidimensional vector a = (x1, x2, ... x... n ) and the second multidimensional vector b(y1, y2, ... y n Taking both as N-dimensional vectors, S410 can specifically be, and server 105 can calculate the Euclidean distance between the first multidimensional vector and the second multidimensional vector using the following formula:

[0090]

[0091] Where, x i Let y be the basis coefficients of the first multidimensional vector a in the i-th dimension of n-dimensional space. i Let be the basis coefficients of the second multidimensional vector b in the i-th dimension of the n-dimensional space, and d be the Euclidean distance between points A and B.

[0092] S420. Calculate the cosine of the angle between the first multidimensional vector and the second multidimensional vector.

[0093] In some examples, combined Figure 1 As shown, the first multidimensional vector a = (x1, x2, ... x... n ) and the second multidimensional vector b(y1, y2, ... y n Taking N-dimensional vectors as an example, S420 can specifically be calculated by server 105 using the following formula:

[0094]

[0095] Where, xi Let y be the basis coefficients of the first multidimensional vector a in the i-th dimension of n-dimensional space. i Let θ be the basis coefficient of the second multidimensional vector b in the i-th dimension of the n-dimensional space, and let cosθ be the cosine of the angle between the first multidimensional vector a and the second multidimensional vector b.

[0096] It is understood that S410 and S420 have no logical order. The traffic anomaly assessment device can execute S410 first and then S420, or it can execute S420 first and then S410, or it can execute S410 and S420 simultaneously. This application embodiment does not make any special restrictions on the execution order of S410 and S420.

[0097] S430. Determine the first similarity based on Euclidean distance.

[0098] In some examples, combined Figure 1 As shown, S430 can specifically be that after calculating the Euclidean distance between the first multidimensional vector and the second multidimensional vector, the server 105 can calculate the first similarity between the first multidimensional vector and the second multidimensional vector using the following formula:

[0099]

[0100] Where, d 第一相似度 Let be the first similarity between the first multidimensional vector and the second multidimensional vector, and d be the Euclidean distance between the first multidimensional vector and the second multidimensional vector.

[0101] It is understandable that, in practical applications, a formula for determining the first similarity based on Euclidean distance can be determined as needed, for example, the reciprocal of the Euclidean distance d can be used as the first similarity. This application does not limit the formula for determining the first similarity based on Euclidean distance in its embodiments.

[0102] S440. Determine the second similarity based on the cosine value of the included angle.

[0103] In some examples, combined Figure 3 As shown, S440 can specifically be that after calculating the cosine value of the angle between the first multidimensional vector and the second multidimensional vector, the server 105 can calculate the second similarity between the first multidimensional vector and the second multidimensional vector using the following formula:

[0104] d 第二相似度 =cosθ

[0105] Where, d 第二相似度 Let θ be the second similarity between the first multidimensional vector and the second multidimensional vector, and let cosθ be the cosine of the angle between the first multidimensional vector and the second multidimensional vector.

[0106] It is understandable that, in practical applications, a formula for determining the second similarity based on the cosine value of the included angle can be determined as needed. This application does not limit the formula for determining the second similarity based on the cosine value of the included angle.

[0107] It is understood that S430 and S440 have no logical order. The traffic anomaly assessment device can execute S430 first and then S440, or S440 first and then S430, or both S430 and S440 can be executed simultaneously. This application embodiment does not impose any special restrictions on the execution order of S430 and S440.

[0108] In the technical solutions corresponding to S310 to S330 above, the traffic data to be evaluated and the first sample traffic data are quantized into multi-dimensional vectors, and the similarity between the multi-dimensional vectors is calculated. It can be seen that this technical solution transforms the calculation of the similarity between the traffic data to be evaluated and the first sample traffic data into the calculation of the similarity between the first multi-dimensional vector and the second multi-dimensional vector. The calculation result is more accurate and provides data support for subsequent determination of abnormal results in the traffic data to be evaluated.

[0109] In the technical solutions corresponding to S410 to S440 above, the Euclidean distance between the first multidimensional vector and the second multidimensional vector is calculated. A first similarity between the first and second multidimensional vectors is then calculated based on this Euclidean distance. The cosine value of the angle between the first and second multidimensional vectors is also calculated, and a second similarity is calculated based on this cosine value. It can be seen that this technical solution can determine the first similarity by calculating the Euclidean distance between the first and second multidimensional vectors, which more accurately reflects the similarity between the traffic data to be evaluated and the first sample traffic data. Furthermore, determining the second similarity by calculating the cosine value of the angle between the first and second multidimensional vectors more accurately reflects the similarity between the trend of change in the traffic data to be evaluated and the trend of change in the first sample traffic data.

[0110] S230. Determine the abnormal results of the traffic data to be evaluated based on the first similarity and the second similarity.

[0111] Abnormal results include abnormal, normal, and uncertain results.

[0112] In some examples, the abnormal results of the traffic data to be evaluated can be determined by judging whether the first similarity is within a first range and whether the second similarity is within a second range. For example, if the first similarity is within a first range and the second similarity is within a second range, the abnormal result of the traffic data to be evaluated is determined to be normal; if the first similarity is not within a first range and the second similarity is not within a second range, the abnormal result of the traffic data to be evaluated is determined to be abnormal; if the first similarity is within a first range and the second similarity is not within a second range, or if the second similarity is within a second range and the first similarity is not within a first range, the abnormal result of the traffic data to be evaluated is determined to be uncertain.

[0113] In some examples, the first range may be specifically determined by a first threshold, and the second range may be specifically determined by a second threshold. For example, the first range may be from the first threshold to 1, and the second range may be from the second threshold to 1. If the first similarity is greater than the first preset threshold and less than 1, and the second similarity is greater than the second preset threshold and less than 1, the abnormal result of the traffic data to be evaluated is determined to be normal. If the first similarity is less than the first preset threshold and the second similarity is less than the second preset threshold, the abnormal result of the traffic data to be evaluated is determined to be abnormal. If the first similarity is greater than the first preset threshold and less than 1, and the second similarity is less than the second preset threshold, or if the first similarity is less than the first preset threshold and the second similarity is greater than the second preset threshold and less than 1, the abnormal result of the traffic data to be evaluated is determined to be uncertain.

[0114] Abnormal results in the traffic data to be evaluated can be determined by analyzing the relationship between the first and second similarities and preset thresholds. Based on this, combined with... Figure 5 , refer to Figure 5 As shown, S230 includes S510 to S530.

[0115] S510. If the first similarity is greater than or equal to the first threshold, the abnormal results of the traffic data to be evaluated are determined to be normal.

[0116] In some examples, since the first similarity is used to indicate the degree of similarity between the traffic data to be evaluated and the first sample traffic data, the higher the first similarity, the higher the degree of similarity between the traffic data to be evaluated and the first sample traffic data. The minimum first similarity that can determine the abnormal results of the traffic data to be evaluated as normal is set as a first preset threshold. If the first similarity is greater than or equal to the first preset threshold, the abnormal results of the traffic data to be evaluated are determined to be normal.

[0117] S520. If the first similarity is less than the first threshold and the second similarity is greater than or equal to the second threshold, the abnormal result of the traffic data to be evaluated is determined to be uncertain.

[0118] In some examples, since the second similarity is used to indicate the degree of similarity between the trend of change of the traffic data to be evaluated and the trend of change of the first sample traffic data, the higher the second similarity, the higher the degree of similarity between the trend of change of the traffic data to be evaluated and the trend of change of the first sample traffic data. Based on this, the lowest second similarity that can determine that the trend of change of the traffic data to be evaluated is the same as the trend of change of the first sample traffic data is set as the second preset threshold.

[0119] In some examples, the data source of the traffic to be evaluated may experience natural growth or decline in traffic, such as natural growth or decline in user visits. This manifests as the traffic data to be evaluated exhibiting the same trend as the first sample traffic data, but the overall traffic data to be evaluated is greater or less than the first sample traffic data. In such cases, it is impossible to directly determine whether the traffic data to be evaluated is abnormal. Therefore, if the first similarity is less than the first threshold and the second similarity is greater than or equal to the second threshold, the abnormal result of the traffic data to be evaluated is determined to be uncertain.

[0120] In some embodiments, if the abnormal results of the traffic data to be evaluated are determined to be uncertain, it is necessary to further determine the abnormal results of the traffic data to be evaluated. Based on this, combined with Figure 6 , refer to Figure 1 As shown, after S520, S610 to S630 are executed.

[0121] S610: Send the traffic data to be evaluated to the detection terminal.

[0122] Combination Figure 1 As shown, S610 can specifically refer to the server 105 sending the traffic data to be evaluated to the detection terminal after determining that the abnormal result of the traffic data to be evaluated is uncertain. The detection terminal can be one or more of terminal devices 101, 102, and 103, or it can be the server 105 itself or a part of the server 105.

[0123] S620: Receive detection suggestions returned by the detection terminal.

[0124] The detection recommendations include whether the traffic data to be evaluated is normal or abnormal.

[0125] Combination Figure 1 As shown, S620 can specifically be that server 105 receives a detection suggestion from the detection terminal, which includes whether the traffic data to be evaluated is normal data or abnormal data.

[0126] S630. Update abnormal results based on detection recommendations.

[0127] CombinationFigure 2 As shown, S630 can specifically involve the server 105 receiving a detection suggestion from the detection terminal and then updating the abnormal result based on the detection suggestion. For example, if the detection terminal returns a detection suggestion that the traffic data to be evaluated is abnormal data, the server 105 updates the abnormal result of the traffic data to be evaluated from uncertain to abnormal based on this detection suggestion.

[0128] In the technical solutions corresponding to S610 to S630 above, the traffic anomaly assessment device sends the traffic data to be assessed with an uncertain anomaly result to the detection terminal. The detection terminal determines the final anomaly result of the traffic data to be assessed. After receiving the detection suggestion from the detection terminal, the traffic anomaly assessment device updates the traffic anomaly result according to the detection suggestion. It is evident that this technical solution can determine the final anomaly result of the traffic data to be assessed in all situations, ensuring the integrity of the solution.

[0129] S530. If the first similarity is less than the first threshold and the second similarity is less than the second threshold, the abnormal results of the traffic data to be evaluated are determined to be abnormal.

[0130] In some examples, the first similarity is less than the first threshold, and the second similarity is less than the second threshold, indicating that the similarity between the data to be evaluated and the first sample traffic data is low, and the similarity between the trend of change of the data to be evaluated and the trend of change of the first sample traffic data is low. In this case, it can be determined that the overall characteristics of the traffic data to be evaluated do not conform to the overall characteristics of the first sample traffic data, that is, the abnormal results of the traffic data to be evaluated are determined to be abnormal.

[0131] In the technical solutions corresponding to S510 to S530 above, if the first similarity is greater than the first threshold, it indicates that the traffic data to be evaluated is highly similar to the first sample traffic data, and the abnormal result of the traffic data to be evaluated can be determined to be normal. If the first similarity is less than the first threshold and the second similarity is less than the second threshold, it indicates that the traffic data to be evaluated is less similar to the first sample traffic data, and the trend of change of the traffic data to be evaluated is less similar to the trend of change of the first sample traffic data, and the abnormal result of the traffic data to be evaluated can be determined to be abnormal. If the first similarity is less than the first threshold and the second similarity is greater than the second threshold, it indicates that the similarity of the evaluated traffic data is low, but the trend of change of the traffic data to be evaluated is highly similar to the trend of change of the first sample traffic data. This situation may be due to natural growth or decay of the traffic data, and the abnormal result of the traffic data to be evaluated cannot be directly determined. Therefore, this technical solution can determine the abnormal result of the traffic data to be evaluated by machine, improving the efficiency of traffic anomaly assessment and reducing the cost of traffic anomaly assessment.

[0132] In some examples, before S230 begins, combined Figure 7 , refer to Figure 1 As shown, determining the first preset threshold and the second preset threshold specifically includes steps S710 to S740.

[0133] S710, Obtain at least one third flow period of second sample flow data and the timestamp of the second sample flow data.

[0134] The third flow cycle is the flow cycle between the first flow cycles, and the second sample flow data shows no abnormalities.

[0135] In some examples, the traffic anomaly assessment device acquires second sample traffic data from the same data source as the traffic data to be assessed and the first sample traffic data. The data type of the second sample traffic data is the same as that of the traffic data to be assessed and the first sample traffic data, and may include one or more of the following: number of sessions, traffic size, packet rate, TCP retransmission rate, TCP average round-trip latency, etc.

[0136] In some examples, the second sample flow data contains flow data from multiple sampling points, each with a corresponding timestamp indicating the sampling time of the second sample flow data at that point. The variation characteristics of the second sample flow data are the same as those of the first sample flow data, and the third flow period includes the timestamps of all second sample flow data.

[0137] In some examples, combined Figure 1 As shown, S710 can specifically be that server 105 obtains the second sample traffic data from the terminal device through Internet 104, and obtains the timestamp of each second sample traffic data.

[0138] S720. Calculate at least one third similarity and at least one fourth similarity based on the first sample flow data, the timestamp of the first sample flow data, the timestamp of the second sample flow data and the timestamp of the second sample flow data.

[0139] The third similarity is used to characterize the similarity between the first sample flow data and the second sample flow data, and the fourth similarity is used to characterize the similarity between the changing trends of the first sample flow data and the second sample flow data.

[0140] In some examples, traffic data is used as the number of sessions, combined with Figure 1 As shown, S720 can specifically be that the server 105 calculates the Euclidean similarity (third similarity) and cosine similarity (fourth similarity) of the first sample session number and the second sample session number in time based on the first sample session number, the second sample session number, the timestamp of the first sample session number and the timestamp of the second sample session number.

[0141] S730. Calculate the average of at least one third similarity as the first threshold.

[0142] In some examples, combined Figure 1 As shown, S730 can specifically be that after the server 105 calculates at least one third similarity based on the first sample traffic data, the timestamp of the first sample traffic data, the timestamp of the second sample traffic data, and the timestamp of the second sample traffic data, it calculates the average value of at least one third similarity as a first threshold.

[0143] It is understandable that in practical applications, the method of obtaining the first threshold based on at least one third similarity can be adjusted as needed. For example, the traffic anomaly assessment device can also use the weighted average of at least one third similarity as the first threshold, or half of the average of at least one third similarity as the first threshold, depending on the actual needs. This application does not impose any special limitations on the method of obtaining the first threshold based on at least one third similarity.

[0144] S740. Calculate the average of at least one fourth similarity as the second threshold.

[0145] In some examples, combined Figure 2 As shown, S740 can specifically be that after the server 105 calculates at least one fourth similarity based on the first sample traffic data, the timestamp of the first sample traffic data, the second sample traffic data, and the timestamp of the second sample traffic data, it calculates the average value of at least one fourth similarity as a second threshold.

[0146] It is understandable that in practical applications, the method of obtaining the second threshold based on at least one fourth similarity can be adjusted as needed. For example, the traffic anomaly assessment device can also use the weighted average of at least one fourth similarity as the second threshold, or half of the average of at least one fourth similarity as the second threshold, depending on the actual needs. This application does not impose any special limitations on the method of obtaining the second threshold based on at least one fourth similarity.

[0147] It is understood that S730 and S740 have no logical order. The traffic anomaly assessment device can execute S730 first and then S740, or S740 first and then S730, or both S730 and S740 can be executed simultaneously. This application embodiment does not impose any special restrictions on the execution order of S410 and S420.

[0148] In the technical solutions corresponding to S710 to S740 above, firstly, the traffic anomaly assessment device acquires the second sample traffic data and its timestamp, and the third traffic period of the second sample traffic data is the traffic period preceding the first traffic period; secondly, the traffic anomaly assessment device calculates at least one third similarity and at least one fourth similarity based on the first sample traffic data, the timestamp of the first sample traffic data, and the timestamps of the second sample traffic data; finally, the traffic anomaly assessment device calculates the average value of at least one third similarity as a first threshold, and the average value of at least one fourth similarity as a second threshold. It is evident that this technical solution reasonably determines the first and second thresholds, providing a standard for determining the anomaly results of the traffic data to be assessed, and improving the accuracy of traffic anomaly assessment.

[0149] In some examples, the traffic anomaly assessment device may directly acquire erroneous data such as blank data, duplicate data, spiked data, formatted errors, and logical errors in the traffic anomaly assessment data. To eliminate the impact of these erroneous data on traffic anomaly assessment and improve its accuracy, this paper combines... Figure 8 , refer to Figure 1 As shown, S810 to S830 are executed before S210 begins.

[0150] S810, Get preset filtering rules.

[0151] The preset filtering rules are used to obtain the traffic data to be evaluated from the initial traffic data. The preset filtering rules include at least one of the following: non-empty check, duplicate removal, incorrect format rejection, correlation verification, and logical error rejection.

[0152] In some examples, preset filtering rules can be data filtering rules formulated by traffic anomaly assessment devices or other terminal devices based on the type of traffic data to be assessed.

[0153] S820, Obtain initial traffic data.

[0154] The initial traffic data consists of all unfiltered traffic data within the first traffic cycle. The initial traffic data includes traffic data to be evaluated, as well as erroneous data such as blank data, duplicate data, glitch data, abnormal formatting, and logical errors.

[0155] S830: Filter the initial traffic data according to the preset filtering rules to obtain the traffic data to be evaluated.

[0156] In some examples, combined Figure 9As shown, taking the preset filtering rule of duplicate removal as an example, after obtaining the initial traffic data and the duplicate removal rule, server 105 performs a consistency check on the initial traffic data. If it detects traffic data with timestamps in the initial traffic data, it can be determined that the initial traffic data contains duplicate data. According to the duplicate removal rule, server 105 deletes or merges the traffic data with the same timestamp in the initial traffic data to obtain the traffic data to be evaluated after duplicate removal.

[0157] In the technical solutions corresponding to S810 to S830 above, the traffic anomaly assessment device acquires preset filtering rules and initial traffic data, and filters the initial traffic data according to the preset filtering rules to obtain the traffic data to be assessed. It is evident that this technical solution can filter out a large amount of data that is useless for traffic anomaly assessment, eliminating the interference of this useless data on traffic anomaly assessment, which is beneficial to improving the efficiency and accuracy of traffic anomaly assessment.

[0158] In the technical solutions corresponding to S210 to S230 above, the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data are obtained. Based on the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data, a first similarity and a second similarity are calculated. Based on the first similarity and the second similarity, abnormal results of the traffic data to be evaluated are determined. It can be seen that this technical solution can automatically filter out potentially abnormal traffic, reduce manual costs, and improve traffic detection efficiency and accuracy.

[0159] In one example embodiment of this application, taking traffic data as the number of sessions, traffic data source as the communication link, first similarity as Euclidean similarity, second similarity as cosine similarity, first threshold as Euclidean standard similarity, second threshold as cosine similarity, and traffic period as 1 day, the traffic anomaly assessment method provided in this application may include, for example: Figure 10 The process shown may specifically include:

[0160] 1. Data acquisition and preprocessing.

[0161] For example, the traffic anomaly assessment device collects the number of sessions on the communication links within the previous day, and after data preprocessing, uses this data as the traffic data to be assessed. The traffic anomaly assessment device also collects the number of sessions on the communication links over the past few days as sample traffic data, which is traffic data confirmed to be without anomalies. The data preprocessing process is described in S810 to S830, and will not be repeated here.

[0162] 2. Draw a line graph.

[0163] For example, the traffic anomaly assessment device plots a first line graph based on the traffic data to be assessed and the corresponding collection time (timestamp of the traffic data to be assessed), referring to... Figure 11 As shown in the diagram. The horizontal axis of the first line graph represents the time interval from 00:00 on the 5th to 00:00 on the 6th when the number of communication link sessions was collected. The vertical axis of the first line graph represents the number of communication link sessions. A point on the first line graph represents the number of communication link sessions at that specific moment between 00:00 on the 5th and 00:00 on the 6th. The number of sessions at 12:00 on the 5th was 14,000. The example in S310 above can be used as a reference for drawing the first line graph; it will not be repeated here.

[0164] The flow anomaly assessment device plots a second line graph based on the sample flow data and the corresponding acquisition time (timestamp of the sample flow data), referring to... Figure 10 As shown in the diagram. In the second line graph, the horizontal axis represents the time between 00:00 on the 4th and 00:00 on the 5th when the number of communication link sessions was collected, and the vertical axis represents the number of communication link sessions. A point on the second line graph represents the number of communication link sessions at a certain moment between 00:00 on the 4th and 00:00 on the 5th. The number of sessions at 12:00 on the 4th is 10000. The example in S320 above can be used as a reference for drawing the second line graph, and will not be repeated here.

[0165] 3. Calculate the Euclidean similarity.

[0166] For example, refer to Figure 11 As shown, the traffic anomaly assessment device takes 9 points on the first line graph, and obtains the first multidimensional vector a = (10000, 2000, 2000, 10000, 10000, 14000, 10000, 10000, 10000, 10000) based on the coordinates of these 9 points. (Refer to...) Figure 12 As shown, the corresponding traffic anomaly assessment device takes 9 points on the second line graph. Based on the coordinates of these 9 points, it obtains the second multidimensional vector b = (10000, 2000, 2000, 10000, 10000, 10000, 10000, 10000, 10000). The traffic anomaly assessment device calculates the Euclidean similarity between the first and second multidimensional vectors. The calculation process and formula are as described in S410 and S430 above, and will not be repeated here.

[0167] 4. Calculate the cosine similarity.

[0168] For example, the traffic anomaly assessment device selects 9 points on the first line graph and obtains a first multidimensional vector a = (10000, 2000, 2000, 10000, 10000, 14000, 10000, 10000, 10000, 10000). Correspondingly, the traffic anomaly assessment device selects 9 points on the second line graph and obtains a second multidimensional vector b = (10000, 2000, 2000, 10000, 10000, 10000, 10000, 10000, 10000). The traffic anomaly assessment device calculates the cosine similarity between the first and second multidimensional vectors. The calculation process and formulas are described in S420 and S440, and will not be repeated here.

[0169] 5. Calculate the Euclidean standard similarity.

[0170] For example, refer to Figure 12 As shown, Figure 10 The third line graph, plotted by the traffic anomaly assessment device based on sample traffic data and their corresponding acquisition times, represents the number of sessions (10,000) at 12:00 on the 3rd day. The vertical axis represents the number of sessions on the communication link. Neither the second nor third line graphs showed any abnormal sample traffic data. The traffic anomaly assessment device selected 9 points on the third line graph and derived a third multidimensional vector c = (10000, 2000, 2000, 10000, 10000, 10000, 10000, 10000, 10000, 10000). The traffic anomaly assessment device calculated the Euclidean similarity between the second and third multidimensional vectors as the standard Euclidean similarity. The calculation process is not detailed here.

[0171] 6. Calculate the cosine standard similarity.

[0172] The traffic anomaly assessment device calculates the cosine similarity between the second and third multidimensional vectors as the cosine standard similarity. The calculation process will not be described here.

[0173] 7. Determine abnormal results in traffic data based on similarity and standard similarity.

[0174] For example, if the Euclidean similarity is greater than the standard Euclidean similarity, it indicates a high degree of similarity between the traffic data to be evaluated and the sample traffic data. The traffic data to be evaluated conforms to the periodicity of the sample traffic data, and the abnormal results of the traffic data to be evaluated can be determined to be normal. The traffic data to be evaluated that is determined to be normal can be stored as sample traffic data in the memory of the traffic data anomaly assessment device.

[0175] If the Euclidean similarity is less than the standard Euclidean similarity and the cosine similarity is less than the standard cosine similarity, it indicates a low degree of similarity between the traffic data to be evaluated and the sample traffic data. Furthermore, the trend of change in the traffic data to be evaluated is also low compared to the trend of change in the sample traffic data. The traffic data to be evaluated does not conform to the periodicity of the sample traffic data, thus confirming that the abnormal results in the traffic data to be evaluated are abnormal. Figure 11 , Figure 12 and Figure 13 In the example, it can be seen that the traffic increased abnormally around 12:00 on the 5th. Understandably, in other examples, the traffic may also have decreased abnormally.

[0176] If the Euclidean similarity is less than the standard Euclidean similarity and the cosine similarity is greater than the standard cosine similarity, it indicates that the similarity between the assessed flow data and the sample flow data is low. However, the trend of change of the flow data to be assessed is highly similar to the trend of change of the sample flow data. This situation may be due to the natural growth or decay of the flow data. It is not possible to directly determine the abnormal result of the flow data to be assessed. Proceed to step 8.

[0177] 8. Manual inspection.

[0178] For example, data to be evaluated that has an Euclidean similarity lower than the Euclidean standard similarity but a cosine similarity higher than the cosine standard similarity can be sent to a manual detection system for further evaluation.

[0179] The foregoing mainly describes the solutions provided by the embodiments of this application from a methodological perspective. To achieve the above functions, it includes corresponding hardware structures and / or software modules for executing each function. Those skilled in the art should readily recognize that, based on the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0180] This application embodiment can divide the traffic anomaly assessment device into functional modules according to the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0181] ReferenceFigure 14 As shown in the figure, this application provides a traffic anomaly assessment device, which may include a data acquisition module 131, a similarity calculation module 132, and an anomaly assessment module 133.

[0182] Specifically, the data acquisition module 131 is used to acquire the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data; wherein, the traffic data to be evaluated is the traffic data of the first traffic period, the first sample traffic data is the traffic data of the second traffic period before the first traffic period, and the first sample traffic data has no anomalies; the data source of the traffic data to be evaluated is the same as the data source of the first sample traffic data; the similarity calculation module 132 is used to calculate a first similarity and a second similarity based on the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data acquired by the data acquisition module; wherein, the first similarity is used to characterize the degree of similarity between the traffic data to be evaluated and the first sample traffic data, and the second similarity is used to characterize the degree of similarity between the traffic data to be evaluated and the first sample traffic data in terms of their changing trends; the anomaly assessment module 133 is used to determine the abnormal results of the traffic data to be evaluated based on the first similarity and the second similarity calculated by the similarity calculation module; wherein, the abnormal results include abnormal, normal, and uncertain.

[0183] In one possible implementation, a first similarity and a second similarity are calculated based on the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data. The similarity calculation module 132 is specifically used to: determine a first multidimensional vector based on the timestamp of the traffic data to be evaluated; determine a second multidimensional vector based on the timestamp of the first sample traffic data; wherein the first multidimensional vector and the second multidimensional vector have the same dimension; and calculate the first similarity and the second similarity based on the first multidimensional vector and the second multidimensional vector.

[0184] In one possible implementation, a first similarity and a second similarity are calculated based on a first multidimensional vector and a second multidimensional vector. The similarity calculation module 132 is specifically used to: calculate the Euclidean distance between the first multidimensional vector and the second multidimensional vector; calculate the cosine value of the angle between the first multidimensional vector and the second multidimensional vector; determine the first similarity based on the Euclidean distance; and determine the second similarity based on the cosine value of the angle.

[0185] In one possible implementation, the abnormal results of the traffic data to be evaluated are determined based on the first similarity and the second similarity. The abnormality evaluation module 133 is specifically used to: determine that the abnormal results of the traffic data to be evaluated are normal when the first similarity is greater than or equal to the first threshold; determine that the abnormal results of the traffic data to be evaluated are uncertain when the first similarity is less than the first threshold and the second similarity is greater than or equal to the second threshold; and determine that the abnormal results of the traffic data to be evaluated are abnormal when the first similarity is less than the first threshold and the second similarity is less than the second threshold.

[0186] In one possible implementation, after determining that the abnormal result of the traffic data to be evaluated is uncertain, the abnormality evaluation module 133 is specifically used to: send the traffic data to be evaluated to the detection terminal; receive the detection suggestion returned by the detection terminal; wherein the detection suggestion includes whether the traffic data to be evaluated is normal data or abnormal data; and update the abnormal result according to the detection suggestion.

[0187] In one possible implementation, before assessing the abnormal results of the traffic data to be assessed based on the first similarity and the second similarity, a first threshold and a second threshold are calculated. The traffic anomaly assessment device further includes: acquiring the timestamps of the second sample traffic data and the second sample traffic data for at least one third traffic cycle; wherein the third traffic cycle is the traffic cycle between the first traffic cycles, and the second sample traffic data is anomaly-free; calculating at least one third similarity and at least one fourth similarity based on the first sample traffic data, the timestamps of the first sample traffic data, the second sample traffic data, and the timestamps of the second sample traffic data; wherein the third similarity is used to characterize the degree of similarity between the first sample traffic data and the second sample traffic data, and the fourth similarity is used to characterize the degree of similarity in the changing trends of the first sample traffic data and the second sample traffic data; calculating the average of the at least one third similarity as the first threshold; and calculating the average of the at least one fourth similarity as the second threshold.

[0188] In one possible implementation, before acquiring the traffic anomaly assessment device, the first sample traffic data, the timestamp of the traffic data to be assessed, and the timestamp of the first sample traffic data, the traffic anomaly assessment device further includes: acquiring preset filtering rules; wherein the preset filtering rules are used to acquire the traffic data to be assessed from the initial traffic data, and the preset filtering rules include at least one of non-empty check, duplicate removal, incorrect format rejection, correlation verification, and logical error rejection; acquiring the initial traffic data; and filtering the initial traffic data according to the preset filtering rules to obtain the traffic data to be assessed.

[0189] It should be understood that the division of units or modules (hereinafter referred to as units) in the above device is only a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, all units in the device can be implemented in software through processing element calls; all units can be implemented in hardware; or some units can be implemented in software through processing element calls, and some units can be implemented in hardware.

[0190] For example, each unit can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored in memory as a program, and its function can be called and executed by a processing element within the device. Furthermore, these units can be integrated together in whole or in part, or they can be implemented independently. The processing element here can also be called a processor, which can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each of the above units can be implemented through integrated logic circuits in the processor element or through software calls by the processing element.

[0191] In one example, the unit in the above device may be one or more integrated circuits configured to implement the above methods, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0192] For example, when the units in the device can be implemented through a processing element scheduler, the processing element can be a general-purpose processor, such as a CPU or other processor capable of calling programs. Alternatively, these units can be integrated together to form a system-on-a-chip (SoC).

[0193] In one implementation, the units that implement the corresponding steps in the above method can be implemented in the form of a processing element scheduler. For example, the device may include a processing element and a storage element, wherein the processing element calls a program stored in the storage element to execute the traffic anomaly assessment method of the above method embodiments. The storage element may be a storage element located on the same chip as the processing element, i.e., an on-chip storage element.

[0194] In another implementation, the program used to perform the above method can be located on a storage element on a different chip than the processing element, i.e., an off-chip storage element. In this case, the processing element calls or loads the program from the off-chip storage element onto the on-chip storage element to call and execute the traffic anomaly assessment method of the above method embodiment.

[0195] Reference ​As shown in the illustration, this application embodiment also provides a traffic anomaly assessment device, including a communicator 141 configured to acquire traffic data to be assessed, first sample traffic data, timestamps of the traffic data to be assessed, and timestamps of the first sample traffic data; wherein, the traffic data to be assessed is traffic data of a first traffic cycle, the first sample traffic data is traffic data of a second traffic cycle preceding the first traffic cycle, and the first sample traffic data is free of anomalies; the data source of the traffic data to be assessed is the same as the data source of the first sample traffic data; a processor 142, coupled to the communicator, configured to calculate a first similarity and a second similarity based on the traffic data to be assessed, the first sample traffic data, the timestamps of the traffic data to be assessed, and the timestamps of the first sample traffic data; wherein, the first similarity characterizes the degree of similarity between the traffic data to be assessed and the first sample traffic data, and the second similarity characterizes the degree of similarity in the changing trends of the traffic data to be assessed and the first sample traffic data; and an anomaly result of the traffic data to be assessed is determined based on the first similarity and the second similarity; wherein, the anomaly result includes anomaly, normal, and uncertain.

[0196] In one possible implementation, a first similarity and a second similarity are calculated based on the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data. The processor 142 is configured to determine a first multidimensional vector based on the timestamp of the traffic data to be evaluated; determine a second multidimensional vector based on the timestamp of the first sample traffic data; wherein the first multidimensional vector and the second multidimensional vector have the same dimension; and calculate the first similarity and the second similarity based on the first multidimensional vector and the second multidimensional vector.

[0197] In one possible implementation, a first similarity and a second similarity are calculated based on a first multidimensional vector and a second multidimensional vector. The processor 142 is configured to calculate the Euclidean distance between the first multidimensional vector and the second multidimensional vector; calculate the cosine value of the angle between the first multidimensional vector and the second multidimensional vector; determine the first similarity based on the Euclidean distance; and determine the second similarity based on the cosine value of the angle.

[0198] In one possible implementation, the processor 142 is configured to determine the abnormal result of the traffic data to be evaluated as normal if the first similarity is greater than or equal to a first threshold; determine the abnormal result of the traffic data to be evaluated as uncertain if the first similarity is less than the first threshold and the second similarity is greater than or equal to a second threshold; and determine the abnormal result of the traffic data to be evaluated as abnormal if the first similarity is less than the first threshold and the second similarity is less than the second threshold.

[0199] In one possible implementation, after determining that the abnormal result of the traffic data to be evaluated is uncertain, the processor 142 is configured to send the traffic data to be evaluated to the detection terminal; receive the detection suggestion returned by the detection terminal; wherein the detection suggestion includes whether the traffic data to be evaluated is normal data or abnormal data; and update the abnormal result according to the detection suggestion.

[0200] In one possible implementation, before assessing the abnormal results of the traffic data to be evaluated based on the first similarity and the second similarity, a first threshold and a second threshold are calculated. The processor 142 is configured to acquire the timestamps of the second sample traffic data and the second sample traffic data for at least one third traffic cycle; wherein the third traffic cycle is the traffic cycle between the first traffic cycles, and the second sample traffic data is anomaly-free; at least one third similarity and at least one fourth similarity are calculated based on the first sample traffic data, the timestamps of the first sample traffic data, the second sample traffic data, and the timestamps of the second sample traffic data; wherein the third similarity is used to characterize the degree of similarity between the first sample traffic data and the second sample traffic data, and the fourth similarity is used to characterize the degree of similarity in the changing trends of the first sample traffic data and the second sample traffic data; the average of the at least one third similarity is calculated as the first threshold; and the average of the at least one fourth similarity is calculated as the second threshold.

[0201] In one possible implementation, before acquiring the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data, the processor 142 is configured to acquire preset filtering rules; wherein the preset filtering rules are used to acquire the traffic data to be evaluated from the initial traffic data, and the preset filtering rules include at least one of non-empty check, duplicate removal, incorrect format rejection, association verification, and logical error rejection; acquire the initial traffic data; filter the initial traffic data according to the preset filtering rules to obtain the traffic data to be evaluated.

[0202] This application also provides a traffic anomaly assessment device, which may include a display screen, a memory, and one or more processors. The display screen, memory, and processors are coupled. The memory stores computer program code, which includes computer instructions. When the processor executes the computer instructions, the traffic anomaly assessment device can perform various functions or steps performed by the traffic anomaly assessment device (such as a television) in the above method embodiments.

[0203] For example, this application also provides a chip that can be applied to the aforementioned traffic anomaly assessment device or server. The chip includes one or more interface circuits and one or more processors; the interface circuits and processors are interconnected via lines; the processor receives and executes computer instructions from the memory of the traffic anomaly assessment device through the interface circuits to implement the methods described in the above method embodiments.

[0204] This application also provides a computer-readable storage medium storing computer program instructions (or instructions). When the computer program instructions are executed by a traffic anomaly assessment device, the traffic anomaly assessment device can implement the traffic anomaly assessment method described above.

[0205] This application also provides a computer program product, including computer instructions for running the traffic anomaly assessment device as described above. When the computer program product runs in the traffic anomaly assessment device, the traffic anomaly assessment device can implement the traffic anomaly assessment method as described above.

[0206] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0207] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another apparatus, or some features may be ignored or not executed. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0208] The units described as separate components may or may not be physically separate. A component shown as a unit can be one or more physical units; that is, it can be located in one place or distributed in multiple different locations. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0209] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0210] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product, such as a program. This software product is stored in a program product, such as a computer-readable storage medium, and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0211] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for assessing traffic anomalies, characterized in that, The method includes: The process involves acquiring traffic data to be evaluated, first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data; wherein the traffic data to be evaluated is traffic data of a first traffic period, the first sample traffic data is traffic data of a second traffic period preceding the first traffic period, and the first sample traffic data is free of anomalies; the data source of the traffic data to be evaluated is the same as the data source of the first sample traffic data. A first multidimensional vector is determined based on the traffic data to be evaluated and the timestamp of the traffic data to be evaluated. A second multidimensional vector is determined based on the timestamps of the first sample traffic data; wherein the first multidimensional vector and the second multidimensional vector have the same dimension. Based on the first multidimensional vector and the second multidimensional vector, a first similarity and a second similarity are calculated; wherein, the first similarity is used to characterize the degree of similarity between the traffic data to be evaluated and the first sample traffic data, and the second similarity is used to characterize the degree of similarity between the changing trends of the traffic data to be evaluated and the first sample traffic data; The abnormal results of the traffic data to be evaluated are determined based on the first similarity and the second similarity; wherein, the abnormal results include abnormal, normal and uncertain.

2. The flow anomaly assessment method according to claim 1, characterized in that, The calculation of the first similarity and the second similarity based on the first multidimensional vector and the second multidimensional vector includes: Calculate the Euclidean distance between the first multidimensional vector and the second multidimensional vector; Calculate the cosine of the angle between the first multidimensional vector and the second multidimensional vector; The first similarity is determined based on the Euclidean distance; The second similarity is determined based on the cosine value of the included angle.

3. The flow anomaly assessment method according to claim 1, characterized in that, The step of determining the abnormal results of the traffic data to be evaluated based on the first similarity and the second similarity includes: If the first similarity is greater than or equal to the first threshold, the abnormal result of the traffic data to be evaluated is determined to be normal; If the first similarity is less than the first threshold and the second similarity is greater than or equal to the second threshold, the abnormal result of the traffic data to be evaluated is determined to be uncertain; If the first similarity is less than the first threshold and the second similarity is less than the second threshold, the abnormal result of the traffic data to be evaluated is determined to be abnormal.

4. The flow anomaly assessment method according to claim 3, characterized in that, After determining that the abnormal result of the traffic data to be evaluated is uncertain, the method further includes: The traffic data to be evaluated is sent to the detection terminal; Receive detection suggestions returned by the detection terminal; wherein, the detection suggestions include whether the traffic data to be evaluated is normal data or the traffic data to be evaluated is abnormal data; Update the abnormal results according to the detection recommendations.

5. The flow anomaly assessment method according to claim 3, characterized in that, Before determining the abnormal results of the traffic data to be evaluated based on the first similarity and the second similarity, the method further includes calculating the first threshold and the second threshold. Obtain at least one third traffic cycle of second sample traffic data and the timestamp of the second sample traffic data; wherein, the third traffic cycle is the traffic cycle between the first traffic cycles, and the second sample traffic data is normal; At least one third similarity and at least one fourth similarity are calculated based on the first sample traffic data, the timestamp of the first sample traffic data, the second sample traffic data, and the timestamp of the second sample traffic data; wherein, the third similarity is used to characterize the degree of similarity between the first sample traffic data and the second sample traffic data, and the fourth similarity is used to characterize the degree of similarity between the changing trends of the first sample traffic data and the second sample traffic data; Calculate the average value of the at least one third similarity as the first threshold; The average value of the at least one fourth similarity is calculated as the second threshold.

6. The flow anomaly assessment method according to claim 1, characterized in that, Before acquiring the traffic data to be evaluated, the first sample traffic data, the timestamp of the traffic data to be evaluated, and the timestamp of the first sample traffic data, the method further includes: Obtain preset filtering rules; wherein, the preset filtering rules are used to obtain the traffic data to be evaluated from the initial traffic data, and the preset filtering rules include at least one of non-empty check, duplicate removal, incorrect format rejection, correlation verification, and logical error rejection; Obtain initial traffic data; The initial traffic data is filtered according to the preset filtering rules to obtain the traffic data to be evaluated.

7. A flow anomaly assessment device, characterized in that, The device includes: The data acquisition module is used to acquire traffic data to be evaluated, first sample traffic data, timestamps of the traffic data to be evaluated, and timestamps of the first sample traffic data; wherein, the traffic data to be evaluated is traffic data of a first traffic period, the first sample traffic data is traffic data of a second traffic period prior to the first traffic period, and the first sample traffic data is free of anomalies; the data source of the traffic data to be evaluated is the same as the data source of the first sample traffic data. A similarity calculation module is used to determine a first multi-dimensional vector based on the timestamps of the traffic data to be evaluated and the traffic data to be evaluated; and to determine a second multi-dimensional vector based on the timestamps of the first sample traffic data and the first sample traffic data; wherein the first multi-dimensional vector and the second multi-dimensional vector have the same dimension; and to calculate a first similarity and a second similarity based on the first multi-dimensional vector and the second multi-dimensional vector; wherein the first similarity is used to characterize the degree of similarity between the traffic data to be evaluated and the first sample traffic data, and the second similarity is used to characterize the degree of similarity between the changing trends of the traffic data to be evaluated and the first sample traffic data. An anomaly assessment module is used to determine the anomaly result of the traffic data to be assessed based on the first similarity calculated by the similarity calculation module and the second similarity; wherein, the anomaly result includes anomaly, normal, and uncertain.

8. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the traffic anomaly assessment method according to any one of claims 1-6 by executing the executable instructions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed by the processor of the traffic anomaly assessment device, enable the traffic anomaly assessment device to perform the traffic anomaly assessment method as described in any one of claims 1-6.

Images