Methods, devices, electronic equipment and storage media for processing traffic data

Abstract

This disclosure provides methods, apparatus, electronic devices, and storage media for processing traffic data, relating to the field of computer technology, particularly to the fields of the Internet and big data. The specific implementation scheme is as follows: when the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, the traffic to be tested is extracted, wherein the target identifier dimension is obtained from historical traffic of the target that was misjudged based on the detection results; the time-series information of the traffic to be tested is detected to obtain a first detection result; based on the first detection result, reporting information of the traffic to be tested is generated, and the reporting information is sent to a rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information. The technical solution provided by this disclosure can improve the accuracy of traffic detection.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to the fields of the Internet and big data. Background Technology

[0002] In existing technologies, traffic detection is typically based on rule engines to identify abnormal traffic such as web crawler traffic. However, when using rule engines for traffic detection, misjudgments may occur, such as misclassifying abnormal traffic as normal traffic. Therefore, improving the accuracy of traffic detection becomes a problem that needs to be solved. Summary of the Invention

[0003] This disclosure provides a method, apparatus, electronic device, and storage medium for processing traffic data.

[0004] According to a first aspect of this disclosure, a method for processing traffic data is provided, comprising:

[0005] If the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, the traffic to be tested is extracted, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection results;

[0006] The timing information of the traffic to be tested is detected to obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal;

[0007] Based on the first detection result, a reporting information for the traffic to be tested is generated, and the reporting information is sent to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information.

[0008] According to a second aspect of this disclosure, a traffic data processing apparatus is provided, comprising:

[0009] The test traffic acquisition module is used to extract the test traffic when the identifier corresponding to the test traffic belongs to the target identifier dimension, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection result;

[0010] A first timing detection module is used to detect the timing information of the traffic to be tested and obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal;

[0011] The reporting information generation module is used to generate reporting information for the traffic to be tested based on the first detection result, and send the reporting information to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information.

[0012] According to a third aspect of this disclosure, an electronic device is provided, comprising:

[0013] At least one processor; and

[0014] A memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the aforementioned method for processing traffic data in the first aspect.

[0016] According to a fourth aspect of this disclosure, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing the computer to perform the aforementioned method for processing traffic data of the first aspect.

[0017] According to a fifth aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the traffic data processing method of the first aspect described above.

[0018] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description.

[0019] The technical solution provided in this embodiment can extract the test traffic that is prone to misjudgment based on the target identifier dimension. For the test traffic that is prone to misjudgment, a time-series detection is performed before the rule engine detection, and a reporting information is generated based on the first detection result obtained from the time-series detection. This allows the rule engine to detect the test traffic more accurately based on the reporting information. In this way, by performing time-series detection on the test traffic that is prone to misjudgment in advance, and then generating reporting information based on the results of the time-series detection, the rule engine can detect the test traffic based on the reporting information, which can reduce the probability of misjudgment by the rule engine and thus improve the accuracy of the test traffic detection. Attached Figure Description

[0020] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0021] Figure 1 This is a flowchart illustrating a method for processing traffic data according to an embodiment of the present disclosure;

[0022] Figure 2 This is a normal time series trend chart provided according to an embodiment of the present disclosure;

[0023] Figure 3This is an abnormal time series trend chart provided according to an embodiment of the present disclosure;

[0024] Figure 4 This is a schematic diagram of the processing flow of the flow to be tested according to an embodiment of the present disclosure;

[0025] Figure 5 This is a schematic block diagram of a traffic data processing apparatus provided according to an embodiment of the present disclosure;

[0026] Figure 6 This is another schematic block diagram of a traffic data processing apparatus provided according to an embodiment of the present disclosure;

[0027] Figure 7 This is a block diagram of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0028] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0029] The first aspect of this disclosure provides a method for processing traffic data, such as... Figure 1 As shown, it includes:

[0030] S101, if the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, extract the traffic to be tested, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection result;

[0031] S102, the timing information of the traffic to be tested is detected to obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal;

[0032] S103, Based on the first detection result, generate reporting information for the traffic to be tested, and send the reporting information to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information.

[0033] The aforementioned method for processing traffic data can be implemented by an electronic device. For example, the electronic device may be a terminal or server with computing and / or processing capabilities.

[0034] By adopting the above scheme, it is possible to extract the test traffic that is prone to misjudgment based on the target identifier dimension. For the test traffic that is prone to misjudgment, a time-series detection is performed before the rule engine detection, and a reporting information is generated based on the first detection result obtained from the time-series detection. This allows the rule engine to detect the test traffic more accurately based on the reporting information. In this way, by performing time-series detection on the test traffic that is prone to misjudgment in advance, and then generating reporting information based on the results of the time-series detection, the rule engine can detect the test traffic based on the reporting information, which can reduce the probability of misjudgment by the rule engine and thus improve the accuracy of the test traffic detection.

[0035] In some possible implementations, before determining that the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, the method further includes: detecting the temporal information of the candidate historical traffic to obtain the temporal detection result of the candidate historical traffic, wherein the detection result of the candidate historical traffic is abnormal; if it is determined based on the temporal detection result of the candidate historical traffic that the detection result of the candidate historical traffic has been misjudged, the candidate historical traffic is taken as the target historical traffic, and the target identifier dimension is obtained based on the identifier dimension to which the identifier corresponding to the target historical traffic belongs.

[0036] Before detecting the time-series information of the candidate historical traffic and obtaining the time-series detection result of the candidate historical traffic, the process may include: obtaining the detection results of multiple historical traffic flows from the rule engine; if any historical traffic flow is abnormal, obtaining that historical traffic flow and using it as a candidate historical traffic flow. Each historical traffic flow among one or more historical traffic flows with abnormal detection results can be treated as a candidate historical traffic flow and subjected to the same analysis and processing, which will not be elaborated here.

[0037] Before obtaining the detection results of multiple historical traffic from the rule engine, the process may include: generating multiple historical traffic streams and sending them to the rule engine. Generating multiple historical traffic streams may include: standardizing a first portion of logs from the target business line to obtain standardized logs for the target business line; aggregating the standardized logs based on an identifier to obtain the multiple historical traffic streams. Each historical traffic stream generated by aggregation corresponds to an identifier, and different historical traffic streams correspond to different identifiers. The standardization process may include at least one of the following: data cleaning, field extraction, database storage, etc., without exhaustive or limited examples.

[0038] The identifier corresponding to any one of the multiple historical traffic flows can be any one of the following: a first IP (Internet Protocol) address, a second IP address, a third IP address, a first IPC address, a second IPC address, a third IPC address, a first UA (user agent), a second UA, a third UA, a first JA3 fingerprint, a second JA3 fingerprint, a third JA3 fingerprint, etc. Here, the IPC address refers to the first three segments of an IP address; for example, if the IP address is 1.2.3.4, then the first three segments of the IP address are 1.2.3. JA3 fingerprinting is a method for fingerprinting transport layer security applications, and a JA3 fingerprint can uniquely identify the corresponding browser. It should be understood that the identifier corresponding to any one of the historical traffic flows can also include other identifiers known in the art besides the above-mentioned identifiers, and this is not limited. Correspondingly, the identifier dimension to which the identifier of any one of the historical traffic flows belongs can be any one of the following: IP-related dimension, UA dimension, fingerprint identifier dimension. It should be understood that the identifier dimension to which the identifier corresponding to any one of the historical traffic flows belongs can also include other identifier dimensions known in the art besides the above-mentioned dimensions, and this is not limited. The IP-related dimension can be either an IP address dimension or an IPC address dimension. The fingerprint identification dimension can be, but is not limited to, the JA3 fingerprint dimension.

[0039] It should be noted that the above-mentioned identifier dimensions are equivalent to identifier categories, and there can be one or more identifiers under any identifier dimension.

[0040] The step of detecting the time-series information of the candidate historical traffic to obtain the time-series detection result of the candidate historical traffic may specifically include: obtaining the time-series information of the candidate historical traffic; detecting the time-series information of the candidate historical traffic to obtain the time-series detection result of the candidate historical traffic.

[0041] The time-series information of the candidate historical traffic can be a time-series sequence, which can be the time-series sequence of the identifier corresponding to the candidate historical traffic within a target time period. The target time period can include multiple sub-time periods. For example, if the target time period is 1 day and each sub-time period within the target time period is 1 minute, the time-series information of the candidate historical traffic has 24*60=1440 dimensions of features. Each value in these 24*60=1440 dimensions of features can represent the number of requests made by the identifier corresponding to the candidate historical traffic to the target business line within the corresponding 1 minute. Accordingly, obtaining the time-series information of the candidate historical traffic can be achieved by counting the number of requests made by the identifier corresponding to the candidate historical traffic to the target business line every minute within a day, resulting in 1440 request counts. These 1440 request counts constitute the time-series information of the candidate historical traffic. The above statistical processing can be performed using a big data computing engine, such as the Spark platform.

[0042] The time windows corresponding to the target time period and sub-time periods can be set according to specific scenarios and needs. For example, the target time period can be 1 day, 2 days, 3 days, etc., and the sub-time periods can be 1 minute, 5 minutes, 10 minutes, 30 minutes, 60 minutes, etc. There are no restrictions here.

[0043] There are various methods for detecting the time-series information of the candidate historical traffic to obtain the time-series detection result of the candidate historical traffic, and no limitation is made here. In a preferred example, detecting the time-series information of the candidate historical traffic to obtain the time-series detection result of the candidate historical traffic may specifically include: calculating multiple similarities between the time-series information of the candidate historical traffic and multiple first reference data, wherein the multiple first reference data includes multiple first normal time-series reference data and one or more first abnormal time-series reference data, the number of the multiple first normal time-series reference data is greater than the number of the one or more first abnormal time-series reference data, and different similarities among the multiple similarities correspond to different first reference data; selecting the largest first number of target similarities from the multiple similarities to determine the first number of target similarities. The target reference data corresponding to the target similarity scores are defined as follows: the first number is less than the number of the plurality of similarities; if the number of first normal time-series target reference data is greater than the number of first abnormal time-series target reference data among the target reference data corresponding to the first number of target similarities, the time-series information of the candidate historical traffic is determined to be normal; if the number of first abnormal time-series target reference data is greater than the number of first normal time-series target reference data among the target reference data corresponding to the first number of target similarities, the time-series detection result of the candidate historical traffic is obtained, and the time-series detection result is used to indicate that the time-series information of the candidate historical traffic is abnormal.

[0044] The number of similarities is equal to the sum of the number of the multiple first normal time-series reference data and the number of the one or more first abnormal time-series reference data. The first number is an integer, and its value can be flexibly set according to requirements, without limitation. In a preferred embodiment, the first number is an odd number.

[0045] Each of the plurality of first normal time-series reference data can be typical normal time-series data in a business scenario, and each of the one or more first abnormal time-series reference data can be typical abnormal time-series data in a business scenario. In some examples, the trend of any one of the plurality of first normal time-series reference data can be similar. Figure 2 Any one of the trends in the normal time series shown. In some examples, the trend of any one of the one or more first anomalous time series reference data can be similar to... Figure 3 Any one of the anomalous time series trends shown. It should be understood that any first time series reference data can also be similarly excluded. Figure 2 The trend of any first anomalous time series reference data can be similar to the trend of normal time series data other than those of normal time series data. Figure 3 Other than abnormal time series trends, no restrictions are imposed here. Figure 2 and Figure 3 The horizontal axis represents time, which can be in minutes; the vertical axis represents the normalized number of requests.

[0046] In the above technical solution, the number of the plurality of first normal time-series reference data is greater than the number of the one or more first abnormal time-series reference data. By utilizing the unbalanced characteristics of the plurality of first reference data, it is beneficial to increase the probability that the time-series information of the candidate historical traffic is detected as normal time-series, thereby facilitating the detection of target historical traffic that has been misjudged, and further facilitating the accurate acquisition of the target identification dimension in the subsequent process.

[0047] The aforementioned process of detecting the time-series information of the candidate historical traffic can be completed by a first preset time-series detection model. Specifically, it can include: inputting the time-series information of the candidate historical traffic into the first preset time-series detection model to obtain the time-series detection result of the candidate historical traffic output by the first preset time-series detection model. The time-series detection result can be either abnormal or normal, and the first preset time-series detection model may use at least one of the one or more algorithms employed, including the K-Nearest Neighbor (KNN) algorithm.

[0048] The first preset timing detection model is determined in the following way:

[0049] The first step is to obtain the detection results of multiple traffic samples from the target business line over one or more days by the rule engine, and obtain a normal traffic set and an abnormal traffic set. The detection results of multiple traffic samples contained in the normal traffic set are normal, and the detection results of multiple traffic samples contained in the abnormal traffic set are abnormal.

[0050] The second step involves obtaining multiple candidate positive samples based on the normal traffic set. Specifically, this may include: (1) obtaining the time-series information of each traffic sample within the normal traffic set to obtain multiple normal time-series samples. The acquisition method can be the same as the method described above for obtaining the time-series information of the candidate historical traffic, and will not be elaborated here. (2) counting the number of requests and the number of users for each normal time-series sample in the multiple normal time-series samples; if the number of requests for any normal time-series sample is greater than a first threshold and the number of users is greater than a second threshold, the normal time-series sample is determined to be a candidate positive sample. Based on this processing, multiple candidate positive samples can be obtained from the multiple normal time-series samples. The first threshold and the second threshold can be flexibly set according to the actual scenario, and are not restricted here. For example, the first threshold can be 5000 and the second threshold can be 30. Then, for any normal time-series sample, if the number of requests for the normal time-series sample is greater than 5000 and the number of users is greater than 30, the normal time-series sample is taken as a candidate positive sample. In one specific implementation, the multiple normal time-series samples are filtered by using a request count greater than 5000 and a user count greater than 30 to obtain 182 candidate positive samples.

[0051] Similarly, based on the abnormal traffic set, multiple candidate negative samples are obtained, which may specifically include: (1) For multiple traffic samples in the abnormal traffic set, obtain the time series information of each traffic sample to obtain multiple abnormal time series samples. The acquisition method can be the same as the aforementioned method for obtaining the time series information of the candidate historical traffic, and will not be elaborated here. (2) Count the number of requests and the number of users of each abnormal time series sample in the multiple abnormal time series samples; if the number of requests of any abnormal time series sample is greater than the third threshold and the number of users is less than the fourth threshold, determine that the abnormal time series sample as a candidate negative sample. Based on this processing, multiple candidate negative samples can be obtained from the multiple abnormal time series samples. The third threshold and the fourth threshold can be flexibly set according to the actual scenario, and are not restricted here. For example, the third threshold can be 5000 and the fourth threshold can be 10. Then, for any abnormal time series sample, if the number of requests of the abnormal time series sample is greater than 5000 and the number of users is less than 10, the abnormal time series sample is taken as a candidate negative sample. In one specific implementation, the multiple abnormal time series samples are filtered by using a request count greater than 5000 and a user count less than 10, resulting in 103 candidate negative samples.

[0052] The third step involves obtaining a first validation set based on multiple candidate positive samples and multiple candidate negative samples. Specifically, this may include: randomly selecting multiple first target candidate positive samples from the multiple candidate positive samples; randomly selecting multiple first target candidate negative samples from the multiple candidate negative samples; and constructing the first validation set using the multiple first target candidate positive samples and the multiple first target candidate negative samples. The number of first target candidate positive samples can be greater than the number of first target candidate negative samples. For example, 40 first target candidate positive samples can be randomly selected from the 182 candidate positive samples; 20 first target candidate negative samples can be randomly selected from the 103 candidate negative samples; these 40 first target candidate positive samples and 20 first target candidate negative samples constitute the first validation set.

[0053] The fourth step is to select a first preset number of first reference negative samples from multiple candidate negative samples. The selection method can be: sorting the multiple candidate negative samples in descending order of the number of requests, and selecting the first preset number of first reference negative samples with the highest number of requests. The value of the first preset number can be determined based on user experience, etc., and is not limited here. For example, when the value of the first preset number is 15, the above process can be: sorting the 103 candidate negative samples in descending order of the number of requests, and selecting the 15 first reference negative samples with the highest number of requests.

[0054] The fifth step involves determining the first target number of first reference positive samples and the value of the aforementioned first number based on the first preset number of first reference negative samples. Specifically, this may include: (1) constructing multiple first intermediate models. In each of the multiple first intermediate models, the first preset number of first reference negative samples and X first reference positive samples are used when calculating similarity, and the number of target similarities selected is K, where X is greater than the first preset number and X is less than or equal to the sum of the first preset number and the second preset number, the second preset number is greater than 1, and K is an odd number. The X first reference positive samples and / or the value of K used by different first intermediate models in the multiple first intermediate models are different. It should be noted that for any first intermediate model, when it uses X first reference positive samples, the X first reference positive samples used can be obtained in the following way: sort the multiple candidate positive samples in descending order of the number of requests, and select the X first reference positive samples with the largest number of requests. (2) Input the first validation set constructed above into each of the first intermediate models for detection, and obtain the first detection accuracy of each first intermediate model on the first validation set, so as to obtain multiple first detection accuracies corresponding to the multiple first intermediate models respectively. (3) Take the first target intermediate model corresponding to the highest first detection accuracy among the multiple first detection accuracies as the first preset time series detection model. The first preset number of first reference negative samples and X first reference positive samples used in the first target intermediate model are the multiple first reference data involved in the first preset time series detection model; the value of K used in the first target intermediate model is the value of the first number.

[0055] For example, in the fifth step, the first preset quantity is set to 15, the second preset quantity is set to 10, and 15 first reference negative samples are determined. X is sequentially selected from 16 to 25, and K is sequentially selected from 1, 3, 5, 7, and 9. It can be determined that when X is 16 and K is 1, the corresponding first intermediate model is determined when X is 17 and K is 1, the corresponding first intermediate model is determined when X is 19 and K is 3, and so on, without enumeration, to obtain 50 first intermediate models. The validation set is tested using these 50 first intermediate models to obtain the detection accuracy of each first intermediate model, so as to obtain 50 first detection accuracies. The first target intermediate model corresponding to the highest first detection accuracy among the 50 first detection accuracies is taken as the first preset time-series detection model. Assuming that X equals 19 and K equals 3 for the first target intermediate model, then the 15 first reference negative samples and 19 first reference positive samples used by the first target intermediate model are the multiple first reference data involved in the first preset time series detection model; the 3 used in the first target intermediate model is the value of the first quantity.

[0056] The training method described above, which uses traversal of X and K, can obtain a first preset temporal detection model with high accuracy.

[0057] The determination that the detection result of the candidate historical traffic has been misjudged based on the time-series detection result of the candidate historical traffic can specifically include: determining that the detection result of the candidate historical traffic has been misjudged when the time-series detection result of the candidate historical traffic indicates that the time-series information of the candidate historical traffic is normal; or, when the time-series detection result of the candidate historical traffic indicates that the time-series information of the candidate historical traffic is normal, re-judging the candidate historical traffic manually or by other means, and determining that the detection result of the candidate historical traffic has been misjudged when the candidate historical traffic is judged to be normal traffic again.

[0058] It should be noted that there can be one or more candidate historical traffic (i.e., target historical traffic) that are misjudged. When there are multiple target historical traffic, if each of the multiple target historical traffic belongs to the same identifier dimension, a single target identifier dimension can be obtained; if each of the multiple target historical traffic belongs to a different identifier dimension, multiple target identifier dimensions can be obtained.

[0059] By adopting the above scheme, it is possible to determine whether the detection results of candidate historical traffic have been misjudged based on the time-series detection results of candidate historical traffic. If a misjudgment occurs, the candidate historical traffic is taken as the target historical traffic. Then, the target identifier dimension is obtained based on the identifier dimension to which the identifier corresponding to the target historical traffic belongs. Finally, the traffic to be tested can be extracted based on the target identifier dimension. Therefore, the above technical solution can provide the target identifier dimension for target historical traffic that is prone to misjudgment, ensuring accurate extraction of the traffic to be tested that is prone to misjudgment.

[0060] In some possible implementations, extracting the traffic to be tested when the identifier corresponding to the traffic to be tested belongs to the target identifier dimension may specifically include: for any one of multiple traffic flows, if the identifier corresponding to that traffic belongs to the target identifier dimension, that traffic is taken as the traffic to be tested.

[0061] The generation method of the multiple traffic flows is similar to that of the aforementioned multiple historical traffic flows, including: standardizing the second part of the logs of the target business line to obtain the second part of the standardized logs of the target business line; aggregating the second part of the standardized logs based on an identifier to obtain the multiple traffic flows. Each of the multiple traffic flows generated by aggregation corresponds to an identifier, and different traffic flows correspond to different identifiers. The second part of the standardized logs differs from the aforementioned first part of the standardized logs in that the second part of the standardized logs is generated after the first part of the standardized logs.

[0062] As can be seen, there can be one or more traffic samples to be tested. Based on the foregoing description, there can also be one or more target identifier dimensions and one or more target historical traffic samples. Since the processing methods involved in each of the multiple traffic samples to be tested are the same, the processing methods involved in each of the multiple target identifier dimensions are the same, and the processing methods involved in each of the multiple target historical traffic samples are the same, for clarity and to save space, this embodiment will only describe the traffic samples to be tested, target identifier dimensions, target historical traffic, etc., from the perspective of one of them.

[0063] In some possible implementations, detecting the time-series information of the traffic to be tested to obtain a first detection result includes: calculating multiple first similarities between the time-series information of the traffic to be tested and multiple first reference data, wherein the multiple first reference data includes multiple first normal time-series reference data and one or more first abnormal time-series reference data, the number of the multiple first normal time-series reference data is greater than the number of the one or more first abnormal time-series reference data, and different first similarities among the multiple first similarities correspond to different first reference data; selecting the largest first number of first target similarities from the multiple first similarities, and determining the first target reference data corresponding to the first number of first target similarities respectively, wherein the first number is less than the number of the multiple first similarities; when the number of first normal time-series target reference data is greater than the number of first abnormal time-series target reference data among the first target reference data corresponding to the first number of first target similarities respectively, obtaining a first detection result, wherein the first detection result is used to indicate that the time-series information of the traffic to be tested is normal.

[0064] The number of the plurality of first similarities is equal to the sum of the number of the plurality of first normal time-series reference data and the number of the one or more first abnormal time-series reference data. The first number is an integer, and its value can be flexibly set according to requirements, without limitation herein. In a preferred embodiment, the first number is an odd number.

[0065] As can be seen from the foregoing description, the representation method of the time-series information of the traffic to be tested is the same as that of the time-series information of the candidate historical traffic; the processing procedure for detecting the time-series information of the traffic to be tested to obtain the first detection result is the same as the aforementioned processing procedure for detecting the time-series information of the candidate historical traffic to obtain the time-series detection result of the candidate historical traffic, therefore, it will not be repeated here. It should be noted that the detection of the time-series information of the traffic to be tested can also adopt the aforementioned first preset time-series detection model.

[0066] In the above technical solution, the number of the plurality of first normal time-series reference data is greater than the number of the one or more first abnormal time-series reference data. This utilizes the unbalanced characteristic of the plurality of first reference data, which is beneficial to increasing the probability that the time-series information of the traffic under test is detected as normal time-series. This, in turn, is beneficial to generating a first detection result indicating that the traffic under test is normal. Subsequently, the rule engine can more accurately detect whether the traffic under test is abnormal based on the reported information, reducing the probability of misjudgment by the rule engine and thus improving the accuracy of the detection of the traffic under test.

[0067] In some possible implementations, generating reporting information for the traffic to be tested based on the first detection result and sending the reporting information to the rule engine includes: when the first detection result indicates that the timing information of the traffic to be tested is normal, filtering the attribute features of the identifier among multiple features corresponding to the traffic to be tested to obtain one or more reporting features of the traffic to be tested, adding the one or more reporting features to the reporting information, and sending the reporting information to the rule engine.

[0068] The attribute characteristics of the identifier can be described as abnormal or normal, or as black or white. The various characteristics corresponding to the traffic to be tested include the attribute characteristics of the identifier. The attribute characteristics of the identifier are not included in the one or more pieces of information to be reported, but may include other characteristics of the traffic to be tested. These other characteristics may be statistical characteristics and / or behavioral characteristics. Statistical characteristics may include, for example, the number of requests within one minute. Behavioral characteristics may include, for example, click intervals, mouse trajectories, touch screen trajectories, etc.

[0069] When using a rule engine to detect traffic, it was found that some traffic rule engines misclassified certain traffic because the attribute characteristics of these traffic identifiers matched the target strategy used by the rule engine to determine that the traffic was abnormal. For example, the target strategy is to determine that the traffic to be tested is abnormal when the target identifier dimension to which the identifier belongs is black, and other characteristics meet a certain condition. For example, multiple traffic samples that were misclassified all belong to the JA3 dimension, and the online engine used a strategy that included the JA3 fingerprint dimension being black when detecting these multiple traffic samples. Therefore, for traffic samples corresponding to identifiers belonging to the JA3 dimension, the online engine could reduce the probability of misclassification by not relying on the attribute characteristics of the identifier when detecting them.

[0070] Through the above technical solution, when the first detection result indicates that the timing information of the traffic to be tested is normal, the attribute features of the identifier are not added to the reporting information. As a result, when the rule engine detects whether the traffic to be tested is abnormal based on the reporting information, it will not rely on the attribute features of the identifier, thereby reducing the probability of misjudgment by the online engine and improving the accuracy of detection of the traffic to be tested.

[0071] In some other possible implementations, generating reporting information for the traffic to be tested based on the first detection result and sending the reporting information to the rule engine includes: when the first detection result indicates that the timing information of the traffic to be tested is abnormal, adding multiple features corresponding to the traffic to be tested to the reporting information and sending the reporting information to the rule engine.

[0072] Since the rule engine misclassifies normal traffic as abnormal traffic, if the first detection result indicates that the timing information of the traffic under test is abnormal, the multiple features corresponding to the traffic under test can be added directly to the reported information without filtering, allowing the rule engine to detect whether the traffic under test is abnormal based on the reported information. These multiple features may include the attribute features of the identifier corresponding to the traffic under test.

[0073] In some possible implementations, after sending the reported information to the rule engine, the method further includes: obtaining a second detection result of the traffic to be tested from the rule engine, wherein the second detection result is obtained by detecting the traffic to be tested based on the reported information; if the traffic to be tested is determined to be normal based on the second detection result, detecting the time sequence information of the traffic to be tested to obtain a third detection result; if the third detection result indicates that the time sequence information of the traffic to be tested is abnormal, determining that the traffic to be tested is abnormal traffic.

[0074] In the case where the third detection result indicates that the timing information of the traffic to be tested is abnormal, in addition to determining that the traffic to be tested is abnormal traffic, it can also determine that the second detection result is incorrect, and determine that the traffic to be tested is abnormal traffic that the rule engine missed detecting.

[0075] In some possible implementations, detecting the time-series information of the traffic to be tested to obtain a third detection result includes: calculating multiple second similarities between the time-series information of the traffic to be tested and multiple second reference data, wherein the multiple second reference data includes one or more second normal time-series reference data and multiple second abnormal time-series reference data, the number of the one or more second normal time-series reference data is less than the number of the multiple second abnormal time-series reference data, and different second similarities among the multiple second similarities correspond to different second reference data; selecting the largest second number of second target similarities from the multiple second similarities, determining the second target reference data corresponding to the second number of second target similarities respectively, wherein the second number is less than the number of the multiple second similarities; and obtaining a third detection result when the number of second normal time-series target reference data is less than the number of second abnormal time-series target reference data among the second target reference data corresponding to the second number of second target similarities respectively, wherein the third detection result is used to indicate that the traffic to be tested is abnormal traffic.

[0076] The number of the plurality of second similarities is equal to the sum of the number of the one or more second normal time-series reference data and the number of the plurality of second abnormal time-series reference data. The second number is an integer, and its value can be flexibly set according to requirements, without limitation here. In a preferred example, the second number is an odd number.

[0077] As can be seen, the process of detecting the time-series information of the traffic to be tested and obtaining the third detection result is similar to the aforementioned process of detecting the time-series information of the candidate historical traffic and obtaining the time-series detection result of the candidate historical traffic. Therefore, it will not be described in detail here.

[0078] The detection process of detecting the time-series information of the traffic to be tested and obtaining the third detection result can also be completed by a time-series detection model, such as by a second time-series detection model. The method for determining the second time-series detection model can be similar to the method for determining the first preset time-series detection model, the only difference being the differences in steps three, four, and five of the determination steps for the second time-series detection model compared to the determination steps for the first time-series detection model. Therefore, the following description only focuses on steps three, four, and five of the determination steps for the second time-series detection model. Specifically:

[0079] The third step involves obtaining a second validation set based on multiple candidate positive samples and multiple candidate negative samples. Specifically, this may include: randomly selecting multiple second target candidate positive samples from the multiple candidate positive samples; randomly selecting multiple second target candidate negative samples from the multiple candidate negative samples; and constructing the second validation set using the multiple second target candidate positive samples and the multiple second target candidate negative samples. The number of second target candidate positive samples can be less than the number of second target candidate negative samples. For example, 20 second target candidate positive samples can be randomly selected from the 182 candidate positive samples; 40 second target candidate negative samples can be randomly selected from the 103 candidate negative samples; these 20 second target candidate positive samples and 40 second target candidate negative samples constitute the second validation set.

[0080] The fourth step is to select a third preset number of second reference positive samples from multiple candidate positive samples. The selection method can be: sorting the multiple candidate positive samples in descending order of the number of requests, and selecting the third preset number of second reference positive samples with the highest number of requests. The value of the third preset number can be determined based on user experience, etc., and is not limited here. For example, when the value of the third preset number is 15, the above process can be: sorting the 182 candidate positive samples in descending order of the number of requests, and selecting the 15 second reference positive samples with the highest number of requests.

[0081] The fifth step, based on the third preset number of second reference positive samples, determines the second target number of second reference negative samples and the value of the aforementioned second number, which may specifically include: (1) constructing multiple second intermediate models. In each of the multiple second intermediate models, the third preset number of second reference positive samples and x second reference negative samples are used when calculating similarity, and the number of selected second target similarities is k, where x is greater than the third preset number, and x is less than or equal to the sum of the third preset number and the fourth preset number, the fourth preset number is greater than 1, and k is an odd number. The x second reference negative samples and / or the value of k used by different second intermediate models in the multiple second intermediate models are different. It should be noted that for any second intermediate model, when it uses x second reference negative samples, the x second reference negative samples used can be obtained in the following way: sort the multiple candidate negative samples in descending order of the number of requests, and select the x second reference negative samples with the largest number of requests. (2) Input the constructed second validation set into each of the second intermediate models for detection, and obtain the second detection accuracy of each second intermediate model on the second validation set, so as to obtain multiple second detection accuracies corresponding to the multiple second intermediate models respectively. (3) Take the second target intermediate model corresponding to the highest second detection accuracy among the multiple second detection accuracies as the second preset time series detection model. The third preset number of second reference positive samples and x second reference negative samples used in the second target intermediate model are the multiple second reference data involved in the second preset time series detection model; the value of k used in the second target intermediate model is the value of the second number.

[0082] For example, in the fifth step, the third preset quantity is set to 15, the fourth preset quantity is set to 10, and 15 second reference positive samples are determined. x is sequentially selected from 16 to 25, and k is sequentially selected from 1, 3, 5, 7, and 9. It can be determined that when x is 16 and k is 1, the corresponding second intermediate model is determined when x is 17 and k is 1, the corresponding second intermediate model is determined when x is 19 and k is 3, and so on, without enumeration, to obtain 50 second intermediate models. The validation set is tested using these 50 second intermediate models to obtain the detection accuracy of each second intermediate model, resulting in 50 second detection accuracies. The second target intermediate model corresponding to the highest second detection accuracy among the 50 second detection accuracies is used as the second preset time-series detection model. Assuming that x equals 19 and k equals 3 for the intermediate model of the second target, then the 15 second reference positive samples and 19 second reference negative samples used by the intermediate model of the second target are the multiple second reference data involved in the second preset time series detection model; the 3 used in the intermediate model of the second target is the value of the second quantity.

[0083] The training method described above, which iterates through x and k, can obtain a second preset time-series detection model with high accuracy.

[0084] Through the above technical solution, when the traffic to be tested is determined to be normal based on the second detection result, the time sequence information of the traffic to be tested is detected again to obtain a third detection result. If the third detection result indicates that the time sequence information of the traffic to be tested is abnormal, the traffic to be tested is determined to be abnormal traffic. This avoids the traffic to be tested from not being detected as abnormal by the rule engine, that is, it avoids the rule engine from missing the detection of the traffic to be tested, and improves the detection accuracy of the traffic to be tested.

[0085] Furthermore, the number of the one or more second normal time-series reference data is less than the number of the multiple second abnormal time-series reference data. By utilizing the unbalanced characteristics of the multiple second reference data, it is beneficial to increase the probability that the time-series information of the traffic under test is detected as abnormal time-series, which is beneficial to detect the missed traffic under test and improve the detection accuracy of the traffic under test.

[0086] like Figure 4 As shown, exemplarily, the processing of the flow rate to be measured using the aforementioned method includes:

[0087] S401, aggregate the standardized logs from the second part based on identifiers to obtain multiple traffic streams. These identifiers can be IP addresses, IPC addresses, JA3 fingerprints, UAs, etc. The aggregation process employs a big data computing engine for statistical analysis, which can be the Spark platform.

[0088] S402: For any one of the multiple traffic flows, if the identifier corresponding to the traffic flow belongs to the target identifier dimension, then the traffic flow is taken as the traffic to be tested.

[0089] S403, Obtain the time-series information of the traffic to be tested. This can be done by identifying the traffic to be tested and statistically analyzing the time-series sequence of that identifier within each sub-period of the target time period. If the target time period is 1 day and each sub-period within the target time period is 1 minute, the time-series information of the traffic to be tested has 24*60 = 1440 dimensions of features. Each value in these 24*60 = 1440 dimensions represents the number of requests made by the identifier corresponding to the traffic to be tested to the target business line within the corresponding 1 minute. The target time period can be 1 day, 2 days, etc., and the sub-periods can be 1 minute, 5 minutes, 10 minutes, etc. Statistical processing is performed using a big data computing engine, such as the Spark platform.

[0090] S404, input the timing information of the traffic to be tested into the first preset timing detection model, and obtain the first detection result output by the first preset timing detection model.

[0091] S405, Based on the first detection result, generate the reporting information for the traffic to be tested, and send the reporting information to the rule engine.

[0092] S406, Obtain the second detection result of the traffic to be tested from the rule engine, wherein the second detection result is obtained by detecting the traffic to be tested based on the reported information.

[0093] S407, if the test flow is determined to be abnormal based on the second detection result, the test flow is determined to be abnormal flow.

[0094] S408, if the traffic to be tested is determined to be normal based on the second detection result, the timing information of the traffic to be tested is detected to obtain a third detection result.

[0095] S409, if the third detection result indicates that the timing information of the traffic to be tested is abnormal, the traffic to be tested is determined to be abnormal traffic.

[0096] S410, if the third detection result indicates that the timing information of the flow to be tested is normal, the flow to be tested is determined to be normal flow.

[0097] A second aspect of this disclosure provides a device for processing traffic data, such as... Figure 5 As shown, it includes:

[0098] The test traffic acquisition module 501 is used to extract the test traffic when the identifier corresponding to the test traffic belongs to the target identifier dimension, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection result;

[0099] The first timing detection module 502 is used to detect the timing information of the traffic to be tested and obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal.

[0100] The reporting information generation module 503 is used to generate reporting information for the traffic to be tested based on the first detection result, and send the reporting information to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information.

[0101] In some possible implementations, the reporting information generation module 503 is used to filter the attribute features of the identifier among multiple features corresponding to the traffic under test when the first detection result indicates that the timing information of the traffic under test is normal, to obtain one or more reporting features of the traffic under test, to add the one or more reporting features to the reporting information, and to send the reporting information to the rule engine.

[0102] like Figure 6 As shown, in some possible implementations, the device further includes: a target identifier dimension determination module 504, used to detect the time-series information of candidate historical traffic to obtain the time-series detection result of the candidate historical traffic, wherein the detection result of the candidate historical traffic is abnormal; if it is determined based on the time-series detection result of the candidate historical traffic that the detection result of the candidate historical traffic has been misjudged, the candidate historical traffic is taken as the target historical traffic, and the target identifier dimension is obtained based on the identifier dimension to which the identifier corresponding to the target historical traffic belongs.

[0103] In some possible implementations, Figure 5 or Figure 6 The first timing detection module 502 is used to calculate multiple first similarities between the timing information of the traffic to be tested and multiple first reference data, wherein the multiple first reference data includes multiple first normal timing reference data and one or more first abnormal timing reference data, the number of the multiple first normal timing reference data is greater than the number of the one or more first abnormal timing reference data, and different first similarities among the multiple first similarities correspond to different first reference data; select the largest first number of first target similarities from the multiple first similarities to determine the first target reference data corresponding to the first number of first target similarities, wherein the first number is less than the number of the multiple first similarities; when the number of first normal timing target reference data is greater than the number of first abnormal timing target reference data among the first target reference data corresponding to the first number of first target similarities, a first detection result is obtained, and the first detection result is used to indicate that the timing information of the traffic to be tested is normal.

[0104] Please refer to it again. Figure 6 In some possible implementations, the device further includes:

[0105] The detection result acquisition module 505 is used to acquire a second detection result of the traffic to be tested from the rule engine, wherein the second detection result is obtained by detecting the traffic to be tested based on the reported information;

[0106] The second timing detection module 506 is used to detect the timing information of the traffic under test when the traffic under test is determined to be normal based on the second detection result, and obtain a third detection result; and to determine that the traffic under test is abnormal traffic when the third detection result indicates that the timing information of the traffic under test is abnormal.

[0107] In some possible implementations, the second timing detection module 506 is used to calculate multiple second similarities between the timing information of the traffic to be tested and multiple second reference data, wherein the multiple second reference data includes one or more second normal timing reference data and multiple second abnormal timing reference data, the number of the one or more second normal timing reference data is less than the number of the multiple second abnormal timing reference data, and different second similarities among the multiple second similarities correspond to different second reference data; select the largest second number of second target similarities from the multiple second similarities, and determine the second target reference data corresponding to the second number of second target similarities respectively, wherein the second number is less than the number of the multiple second similarities; if the number of second normal timing target reference data is less than the number of second abnormal timing target reference data among the second target reference data corresponding to the second number of second target similarities respectively, a third detection result is obtained, the third detection result being used to indicate that the traffic to be tested is abnormal traffic.

[0108] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0109] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0110] like Figure 7As shown, the electronic device 700 includes a computing unit 701, which can perform various appropriate actions and processes based on a computer program stored in a read-only memory (ROM) 702 or a computer program loaded from a storage unit 708 into a random access memory (RAM) 703. The RAM 703 may also store various programs and data required for the operation of the electronic device 700. The computing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0111] Multiple components in electronic device 700 are connected to I / O interface 705, including: input unit 706, such as keyboard, mouse, etc.; output unit 707, such as various types of displays, speakers, etc.; storage unit 708, such as disk, optical disk, etc.; and communication unit 709, such as network card, modem, wireless transceiver, etc. Communication unit 709 allows electronic device 700 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0112] The computing unit 701 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above. For example, in some embodiments, the various methods described above can be implemented as computer software programs tangibly contained in a machine-readable medium, such as storage unit 708. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 700 via ROM 702 and / or communication unit 709. When the computer program is loaded into RAM 703 and executed by the computing unit 701, one or more steps of the various methods described above can be performed. Alternatively, in other embodiments, the computing unit 701 can be configured to perform the various methods described above by any other suitable means (e.g., by means of firmware).

[0113] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0114] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0115] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0116] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0117] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0118] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0119] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0120] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for processing traffic data, comprising: If the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, the traffic to be tested is extracted, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection results; The timing information of the traffic to be tested is detected to obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal; Based on the first detection result, a reporting information for the traffic to be tested is generated, and the reporting information is sent to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information; The step of generating reporting information for the traffic to be tested based on the first detection result and sending the reporting information to the rule engine includes: when the first detection result indicates that the timing information of the traffic to be tested is normal, filtering the attribute features of the identifier among the multiple features corresponding to the traffic to be tested to obtain one or more reporting features of the traffic to be tested, adding the one or more reporting features to the reporting information, and sending the reporting information to the rule engine.

2. The method according to claim 1, further comprising: The temporal information of the candidate historical traffic is detected to obtain the temporal detection result of the candidate historical traffic, wherein the detection result of the candidate historical traffic is abnormal; If, based on the time-series detection results of the candidate historical traffic, it is determined that the detection result of the candidate historical traffic has been misjudged, the candidate historical traffic is taken as the target historical traffic, and the target identifier dimension is obtained based on the identifier dimension to which the identifier corresponding to the target historical traffic belongs.

3. The method according to claim 1, wherein, The step of detecting the time-series information of the traffic to be tested to obtain a first detection result includes: Calculate multiple first similarities between the time-series information of the traffic to be measured and multiple first reference data, wherein the multiple first reference data includes multiple first normal time-series reference data and one or more first abnormal time-series reference data, the number of the multiple first normal time-series reference data is greater than the number of the one or more first abnormal time-series reference data, and different first similarities in the multiple first similarities correspond to different first reference data; From the plurality of first similarities, select the largest first number of first target similarities, and determine the first target reference data corresponding to the first number of first target similarities respectively, wherein the first number is less than the number of the plurality of first similarities; If, among the first target reference data corresponding to the first number of first target similarities, the number of first normal time-series target reference data is greater than the number of first abnormal time-series target reference data, a first detection result is obtained. The first detection result is used to indicate that the time-series information of the traffic to be tested is normal.

4. The method according to claim 1, wherein, After sending the reported information to the rule engine, the method further includes: The second detection result of the traffic to be tested is obtained from the rule engine, wherein the second detection result is obtained by detecting the traffic to be tested based on the reported information; If the traffic to be tested is determined to be normal based on the second detection result, the timing information of the traffic to be tested is detected to obtain a third detection result; If the third detection result indicates that the timing information of the traffic to be tested is abnormal, then the traffic to be tested is determined to be abnormal traffic.

5. The method according to claim 4, wherein, The step of detecting the time-series information of the traffic to be tested to obtain a third detection result includes: Calculate multiple second similarities between the time-series information of the traffic to be measured and multiple second reference data, wherein the multiple second reference data includes one or more second normal time-series reference data and multiple second abnormal time-series reference data, the number of the one or more second normal time-series reference data is less than the number of the multiple second abnormal time-series reference data, and different second similarities in the multiple second similarities correspond to different second reference data; From the plurality of second similarities, select the largest second number of second target similarities, and determine the second target reference data corresponding to the second number of second target similarities respectively, wherein the second number is less than the number of the plurality of second similarities; If, among the second target reference data corresponding to the second number of second target similarities, the number of second normal time-series target reference data is less than the number of second abnormal time-series target reference data, a third detection result is obtained. The third detection result is used to indicate that the traffic to be tested is abnormal traffic.

6. A device for processing traffic data, comprising: The traffic acquisition module is used to extract the traffic to be tested when the identifier corresponding to the traffic to be tested belongs to the target identifier dimension, wherein the target identifier dimension is obtained based on the target historical traffic that was misjudged in the detection result; A first timing detection module is used to detect the timing information of the traffic to be tested and obtain a first detection result, wherein the first detection result is used to indicate whether the timing information of the traffic to be tested is normal; The reporting information generation module is used to generate reporting information for the traffic to be tested based on the first detection result, and send the reporting information to the rule engine, wherein the rule engine is used to detect the traffic to be tested based on the reporting information; The reporting information generation module is used to filter the attribute features of the identifier among the multiple features corresponding to the traffic under test when the first detection result indicates that the time sequence information of the traffic under test is normal, to obtain one or more reporting features of the traffic under test, add the one or more reporting features to the reporting information, and send the reporting information to the rule engine.

7. The apparatus according to claim 6, further comprising: The target identifier dimension determination module is used to detect the time-series information of candidate historical traffic and obtain the time-series detection result of the candidate historical traffic, wherein the detection result of the candidate historical traffic is abnormal; if it is determined that the detection result of the candidate historical traffic has been misjudged based on the time-series detection result of the candidate historical traffic, the candidate historical traffic is taken as the target historical traffic, and the target identifier dimension is obtained based on the identifier dimension to which the identifier corresponding to the target historical traffic belongs.

8. The apparatus according to claim 6, wherein, The first timing detection module is used to calculate multiple first similarities between the timing information of the traffic to be tested and multiple first reference data, wherein the multiple first reference data includes multiple first normal timing reference data and one or more first abnormal timing reference data, the number of the multiple first normal timing reference data is greater than the number of the one or more first abnormal timing reference data, and different first similarities correspond to different first reference data; selects the largest first number of first target similarities from the multiple first similarities to determine the first target reference data corresponding to the first number of first target similarities, wherein the first number is less than the number of the multiple first similarities; when the number of first normal timing target reference data is greater than the number of first abnormal timing target reference data among the first target reference data corresponding to the first number of first target similarities, a first detection result is obtained, and the first detection result is used to indicate that the timing information of the traffic to be tested is normal.

9. The apparatus according to claim 6, further comprising: The detection result acquisition module is used to acquire a second detection result of the traffic to be tested from the rule engine, wherein the second detection result is obtained by detecting the traffic to be tested based on the reported information; The second timing detection module is used to detect the timing information of the traffic under test when the traffic under test is determined to be normal based on the second detection result, and obtain a third detection result; when the third detection result indicates that the timing information of the traffic under test is abnormal, the traffic under test is determined to be abnormal traffic.

10. The apparatus according to claim 9, wherein, The second timing detection module is used to calculate multiple second similarities between the timing information of the traffic to be tested and multiple second reference data, wherein the multiple second reference data includes one or more second normal timing reference data and multiple second abnormal timing reference data, the number of the one or more second normal timing reference data is less than the number of the multiple second abnormal timing reference data, and different second similarities correspond to different second reference data; the module selects the largest second number of second target similarities from the multiple second similarities to determine the second target reference data corresponding to the second number of second target similarities, wherein the second number is less than the number of the multiple second similarities; if the number of second normal timing target reference data is less than the number of second abnormal timing target reference data among the second target reference data corresponding to the second number of second target similarities, a third detection result is obtained, and the third detection result is used to indicate that the traffic to be tested is abnormal traffic.

11. An electronic device, comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5.

12. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-5.

13. A computer program product comprising a computer program that, when executed by a processor, implements the method according to any one of claims 1-5.

Images