Abnormal traffic identification method, medium and device based on multiple access destination IP

Abstract

The present invention relates to the field of abnormal traffic detection, and in particular to an abnormal traffic identification method, medium and device based on multiple access destination IPs. It includes: obtaining multiple connection session traffic; clustering the destination IPs of all the acquired request data packets, and if there are multiple IP groups, performing fourth feature encoding processing on the multiple connection session traffic in the second monitoring period to generate a fourth target access feature graph; and obtaining the identification result through a fourth capsule neural network. The present invention configures two feature rows for each IP group. In order to reflect the characteristics of changes in access service types in the vertical space. Then, the session feature vectors corresponding to the same IP group are filled in respectively. In the vertical space, the characteristics of changes in access service types are reflected. Thus, the access behavior habits are converted into the spatial features of the feature graph, so as to more accurately and effectively identify and predict the behavior traffic for implementing network anonymity and proxy technology to access global Internet resources.

Description

Background Art

[0002] VPN (Virtual Private Network) is a technology that creates a secure encrypted connection through a less secure network (such as the Internet). It can be used and managed as a private network and has the same security and manageability as a private network. Its main function is to establish a private network on a public network for encrypted communication. This allows users to remotely access the server resources of the corresponding intranet through this technology. Of course, based on VPN technology, there have also been related networks that "implement network anonymity and proxy technology to access global Internet resources."

[0003] like Figure 6 As shown, the behavior of implementing network anonymity and proxy technology to access global Internet resources is usually that users download and install various "network accelerators" or "VPN applications" and other behavioral tools for implementing network anonymity and proxy technology to access global Internet resources on PC terminals, encrypt and encapsulate the original access data packet into a new data packet for accessing the VPN server, and send it to the VPN server. The VPN server then performs corresponding access to the corresponding external target website and transmits the received response data packet back to the PC terminal to complete the behavior of implementing network anonymity and proxy technology to access global Internet resources.

[0004] Since, in actual use, the VPN server is usually one or more of a VPN server cluster. Specifically, which VPN servers provide the connection service of the corresponding service type for the PC terminal needs to be determined according to the server management policy in the VPN server cluster. And it will also be determined whether to communicate with a short connection or a long connection according to the current server busy status and communication traffic type.

[0005] Therefore, under this complex communication state, it is more difficult to accurately and effectively identify abnormal behavioral traffic that implements network anonymity and proxy technology to access global Internet resources. Summary of the invention

[0006] In view of the above technical problems, the technical solution adopted by the present invention is:

[0007] According to one aspect of the present invention, a method for identifying abnormal traffic based on multiple access destination IPs is provided, the method comprising the following steps:

[0008] In response to the target terminal's instruction to open the browser, a plurality of connection session flows within the second monitoring period are obtained; the connection session flows include a plurality of long connection session flows and a plurality of short connection session flows; each long connection session flow includes a plurality of session groups, each short connection session flow includes a session group, and the session group includes a request data packet and a corresponding response data packet;

[0009] Cluster the destination IP addresses of all acquired request packets to generate at least one IP group; each IP group uniquely corresponds to one destination IP address;

[0010] If there are multiple IP groups, a fourth feature encoding process is performed on multiple connection session traffic within the second monitoring period to generate a fourth target access feature graph;

[0011] Inputting the fourth target access feature graph into the trained fourth capsule neural network to obtain a recognition result corresponding to the fourth target access feature graph;

[0012] The fourth feature encoding process includes:

[0013] According to the size and generation time of the request data packet and the response data packet in each conversation group, a conversation feature vector corresponding to each conversation group is generated; wherein A a b is the session feature vector corresponding to the bth session group in the ath connection session traffic, A a b =(Q a b , X a b , T a b );Q a b A a b The size of the request packet; X a b A a b The size of the response data packet; T a b A a b The time interval between the request packet and the response packet;

[0014] According to the earliest request time of the request data packets contained in each IP group, each IP group is sorted from early to late to generate a group sequence;

[0015] According to the group sequence, two feature rows in the fourth initial access feature map are sequentially configured for each IP group; wherein the fourth initial access feature map includes a plurality of feature rows arranged vertically in sequence, and each feature row includes a plurality of pixel units arranged horizontally in sequence;

[0016] Fill the session feature vectors corresponding to the corresponding number of short connection session traffic in each IP group into the first row of the two feature rows corresponding to each IP group in the order of request time from early to late;

[0017] The session feature vectors corresponding to the long connection session traffic in each IP group are filled into the second row of the two feature rows corresponding to each IP group in order from early to late, so as to generate a fourth target access feature graph.

[0018] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, which stores a computer program. When the computer program is executed by a processor, the above-mentioned method for identifying abnormal traffic based on multiple access destination IPs is implemented.

[0019] According to a third aspect of the present invention, there is provided an electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for identifying abnormal traffic based on multiple access destination IPs when executing the computer program.

[0020] The present invention has at least the following beneficial effects:

[0021] In the present invention, the destination IPs of all the acquired request data packets are first clustered to confirm whether the multiple connection session flows within the second monitoring period are communications between the PC terminal and the same VPN server. If there are multiple IP groups, it means that the PC terminal communicates with multiple VPN servers at the same time. Usually in a server cluster, different VPN servers will be responsible for forwarding communications for different access services. And different types of methods will be used for communication for different communication scenarios. In scenarios where frequent data exchange is required, such as chat rooms and real-time games, which require continuous communication, long connections are used for communication. In scenarios where the frequency of data refresh is low, such as web browsing scenarios. Due to the huge number of users, it is difficult for the server to withstand too many long connections, so short connections are usually used.

[0022] Based on the above characteristics, the fourth feature encoding process in the present invention will first configure two feature rows for each IP group according to the group sequence. As a result, the characteristics of changes in the access service type can be roughly reflected in the vertical space of the fourth target access feature graph. Then, the two feature rows corresponding to the same IP group are filled with the session feature vectors corresponding to the short connection session traffic and the long connection session traffic generated by the same destination IP in the order of request time from early to late. Further, in the vertical space of the fourth target access feature graph, the characteristics of changes in the access service type corresponding to the same destination IP are roughly reflected.

[0023] In addition, in the process of browsing external target information by implementing network anonymity and proxy technology to access global Internet resources, most users will query and browse related information through several commonly used external target browsers or corresponding applications. In this process, when users initially use external target browsers or corresponding applications, the similarity of the first few access requests will be higher. For example, when using a browser to query corresponding information, you first need to visit the homepage of the corresponding browser, and then choose to enter the corresponding subpage according to the type of data being accessed. Even in this process, preliminary preparation operations such as account login verification will be involved. As a result, the similarity of access traffic of these early implementations of network anonymity and proxy technology to access global Internet resources using the same service will be higher.

[0024] Based on the above characteristics, the information of the unencrypted request header part in the request data packet and the response data packet in the connection session traffic can be encoded to generate a fourth target access feature graph that can reflect the user's access behavior characteristics. Among them, the order of the session groups in the same feature row can reflect the user's behavior characteristics when using the same service; the order of different feature rows can reflect the user's behavior characteristics when using different services. Therefore, the user's access behavior habits can be converted into the spatial characteristics of the feature graph, and the feature graph can better reflect the characteristics of the user's behavior when implementing network anonymity and proxy technology to access global Internet resources. So that the capsule neural network can more accurately and effectively identify these abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 A flowchart of an abnormal traffic identification method based on a capsule neural network provided in Example 1 of the present invention;

[0027] Figure 2 A flowchart of a method for identifying unauthorized access traffic provided by Embodiment 2 of the present invention;

[0028] Figure 3 A flowchart of a method for identifying abnormal traffic based on a single access destination IP provided in Example 3 of the present invention;

[0029] Figure 4 A flowchart of a method for identifying abnormal traffic based on multiple access destination IPs provided in Example 4 of the present invention;

[0030] Figure 5 A flowchart of a common access path determination method provided in Embodiment 5 of the present invention;

[0031] Figure 6 The present invention is a principle structural diagram of the behavior of implementing network anonymity and proxy technology through VPN in related technologies to access global Internet resources. DETAILED DESCRIPTION

[0032] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0033] The overall design concept of the abnormal traffic identification scheme provided in the present invention is to perform feature encoding on the behavioral traffic that implements network anonymity and proxy technology to access global Internet resources, based on the approximate behavioral habits of users that can be reflected in the behavioral traffic that implements network anonymity and proxy technology to access global Internet resources, so that the behavioral features of users carried in the traffic are converted into spatial features between each pixel unit in the feature map. Then, the corresponding trained capsule neural network is used for identification and judgment.

[0034] Since the capsule neural network can better process the spatial information between the feature points in the feature map, including other information such as relative position and angle, the recognition effect is improved. At the same time, since the capsule neural network collects the posture information, it can learn a good representation effect through a small amount of data. Therefore, the use of the capsule neural network is more in line with the use scenario of the present invention where it is difficult to obtain training samples, and can more accurately and effectively identify and predict abnormal access traffic for the implementation of network anonymity and proxy technology to access global Internet resources.

[0035] The training of the capsule neural network in the present invention can be performed using the existing training method for the capsule neural network. The encoding method of the feature graph of the training sample is respectively the same as one of the first feature encoding process, the second feature encoding process, the third feature encoding process and the fourth feature encoding process provided in the present invention. Correspondingly, the sample labels are abnormal and normal.

[0036] Specifically, the present invention can be mainly used to identify and determine abnormal traffic in the behavior of using VPN to implement network anonymity and proxy technology to access global Internet resources. Based on the working principle of the behavior of implementing network anonymity and proxy technology to access global Internet resources and the situation that the request header in the behavior traffic of implementing network anonymity and proxy technology to access global Internet resources is not encrypted, but the request data is encrypted, the following embodiments of abnormal traffic identification are set:

[0037] Example 1

[0038] like Figure 1 As shown, a method for identifying abnormal traffic based on a capsule neural network is provided, and the method comprises the following steps:

[0039] A100: In response to a browser opening instruction issued by a target terminal during an idle access period, a first feature encoding process is performed on multiple long connection session flows during a first monitoring period to generate a first target access feature graph. Each long connection session flow includes multiple session groups, each of which includes a request data packet and a corresponding response data packet.

[0040] The idle access period in the present invention can be determined according to the specific usage scenario. For example, the corresponding idle access period can be determined according to the generation time corresponding to the behavior flow of implementing network anonymity and proxy technology to access global Internet resources in the past. And since there are various services used after implementing network anonymity and proxy technology to access global Internet resources, it is possible to use a browser to query corresponding information, play games or chat, etc. Therefore, in the present invention A100, the response to the target terminal's browser opening instruction during the idle access period can also be a response to the opening instruction of other corresponding applications (such as youtube). In addition, before VPN implements network anonymity and proxy technology to access global Internet resources, it is often necessary to set the network proxy accordingly, so the network setting operation of the target terminal during the idle access period can also be monitored. When a network proxy setting operation instruction is detected, the first feature encoding process is performed on the multiple long connection session flows in the first monitoring period to generate a first target access feature map.

[0041] Since a persistent connection contains multiple session groups, that is, multiple consecutive access operations of a user to a certain application service within a continuous time period (such as 10 minutes), a persistent connection can usually contain the user's complete operating habits for a certain service. Therefore, it is easier to extract the user's usage habits in a persistent connection.

[0042] Although long connections have the characteristics of timely communication and higher efficiency, they also require more server resources to maintain. Therefore, during the off-peak access period (off-peak access period), the server has enough resources to maintain long connections, so it is easier to obtain long connection session traffic during the off-peak access period.

[0043] In the present invention, the acquired long connection session traffic or short connection session traffic is the communication traffic between the PC terminal and the VPN server, including the request traffic for the relevant external target service issued by the PC terminal and the response traffic of the relevant external target server forwarded by the VPN server. Specifically, the above traffic can be acquired by the existing packet capture tool. Usually, in order to ensure the security of data, the communication traffic between the PC terminal and the VPN server will use an encrypted transmission protocol to encrypt the data body part.

[0044] For example, when data is transmitted using the HTTPS protocol, in the HTTPS message, the request line, request header, and part of the request body (i.e., data header) are in plain text, while sensitive information in the request body (i.e., data body), such as passwords, personal information, etc., are encrypted to protect data security.

[0045] A200: Input the first target access feature map into the trained first capsule neural network to obtain a recognition result corresponding to the first target access feature map.

[0046] The first feature encoding process includes:

[0047] A101: Generate a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group. a b is the session feature vector corresponding to the bth session group in the ath long connection session traffic, A a b =(Q a b , X a b , T a b ). Q a b A a b The size of the request packet. ab A a b The size of the response packet. a b A a b The time interval between the request packet and the response packet.

[0048] Since, in the usage scenario of the present invention, the data body parts in the request data packet and the response data packet are encrypted, the session feature vector capable of representing the corresponding features of the session group can only be generated through some unencrypted information.

[0049] Among them, the size of the request data packet and the size of the response data packet can reflect the different characteristics of the amount of data corresponding to the services required by the current session. Generally speaking, the sizes of the request data packets and the corresponding response data packets required by different types of services are different, so the type of requested service can be roughly reflected by the size of the request data packet and the response data packet. For example, requesting static resources (such as HTML pages, pictures, CSS files, etc.) usually requires a smaller request data packet, because the size of these resources is relatively small, and the corresponding response data packet is also small. Requesting dynamic content (such as responses generated through API or database interaction) may require a larger data packet, because these responses usually contain more data and complex processing logic, and the corresponding response data packet will also be larger.

[0050] In addition, the time interval between the request data packet and the response data packet is the data response interval. The data response interval can reflect the following characteristics of the server providing the corresponding resource:

[0051] Geographic location: The geographic location of the server also affects the response time. The longer the distance, the greater the delay in data transmission, which increases the response time. For example, for transoceanic communications, the longer distance may result in a longer response time.

[0052] Server performance: Server performance also affects the response interval. A high-performance server can process requests and return responses faster, thus shortening the response interval.

[0053] Cache strategy: The cache strategy on the server will also affect the response interval. If the server uses a cache to store commonly used data, it may return a response faster for the same request because the data is already in the cache.

[0054] Since users need different services after implementing network anonymity and proxy technology to access global Internet resources, the servers they access are also different. On this basis, there will be differences in the data response intervals corresponding to different services, so the data response interval can also be used as a feature that can reflect the corresponding service type.

[0055] Prior to A101, the first feature encoding process also included:

[0056] A111: Determine whether the traffic data is traffic data in a persistent connection session traffic according to the connection identifier in the data header of each traffic data acquired.

[0057] The traffic data obtained in the present invention is the communication data between the PC terminal and the VPN server. The data body part of the data is encrypted, and the data in the data body is the communication data between the VPN server and the corresponding external target server. The data in the data header part is not encrypted. The data header is used to help the system correctly route and forward data and ensure the integrity and accuracy of the data. It generally includes: source address, destination address, data type, data length, checksum, connection identifier, sequence number or message ID, timestamp, protocol version, encryption method and other parameters.

[0058] Therefore, it is possible to determine whether the traffic data is traffic data in a persistent connection session based on the above information, such as by using a connection identifier. In a persistent connection, a connection identifier is usually added to the data header in order to track and manage the connection. These connection identifiers can be custom fields or parameters used to identify a specific connection. If the data header contains a connection identifier, it can be compared with a known persistent connection identifier to determine whether the traffic data belongs to traffic in a persistent connection.

[0059] A121: Determine the persistent connection session traffic to which each traffic data item corresponds based on the five-tuple in the data header of each traffic data item obtained.

[0060] A131: According to each request data packet, determine a response data packet corresponding to each request data packet to generate a corresponding session group.

[0061] Specifically, A131 includes:

[0062] A1310: Determine a size identifier corresponding to the request data packet according to the data volume interval to which the size of the request data packet belongs.

[0063] In order to ensure the accuracy of the data, before A1310, it is necessary to remove the heartbeat packets used to maintain the online connection in the long connection. Specifically, the session group that appears in a fixed period in the long connection session traffic can be removed, thereby achieving the removal of the heartbeat packets.

[0064] A1311: Determine the size identifier corresponding to the response data packet according to the data volume interval to which the size of the response data packet belongs.

[0065] A1312: Generate the size of the request data packet and the size of the response data packet corresponding to the session feature vector according to the size identifiers corresponding to the request data packet and the response data packet respectively.

[0066] In the present invention, since the size of the request data packet and the size of the response data packet in the session feature vector exist as identifiers representing data packet characteristics, these two parameters are required to more clearly represent the commonalities between identical or similar data packets and to more clearly distinguish the differences between different data packets.

[0067] Usually, the sizes of request packets and response packets corresponding to different types of services are different, while the sizes of request packets and response packets corresponding to the same type of services are similar. Therefore, based on this feature, the sizes of request packets and response packets can be divided into different data size intervals, and corresponding size identifiers can be configured.

[0068] Therefore, if the service is the same, the size of the request data packet and the size of the response data packet in the feature vector can be made more consistent, and if the service is different, the size of the request data packet and the size of the response data packet in the feature vector can be made more different, so that the features can be made clearer to improve the accuracy of subsequent recognition and judgment.

[0069] A102: Sort the traffic of each persistent connection session from early to late according to the establishment time to generate a persistent connection sequence.

[0070] A103: Sort the session groups in each persistent connection session flow from earliest to latest according to the establishment time, and generate a session sequence in each persistent connection session flow.

[0071] A104: Add each session feature vector to the first initial access feature map in the order of the long connection sequence and the session sequence to generate a first target access feature map. The first initial access feature map includes D feature rows arranged vertically in sequence, and each feature row includes E pixel units arranged horizontally in sequence. D and E are positive integers greater than 1.

[0072] A105: configure the feature rows of the corresponding row sequence for the persistent connection session flows ranked in the first D positions in the persistent connection sequence according to the ranking number corresponding to each persistent connection session flow.

[0073] Specifically, A105 includes:

[0074] A115: If the amount of persistent session traffic is greater than D, the subsequent redundant persistent session traffic is discarded.

[0075] A125: If the amount of long connection session traffic is less than D, fill the extra feature rows with zero feature vectors (0,0,0).

[0076] A106: Fill the session feature vectors ranked in the top E positions in each long connection session flow into the corresponding order of pixel units in sequence according to the session sequence in each long connection session flow to generate a first target access feature graph.

[0077] Specifically, A106 includes:

[0078] A116: If the number of session groups in the persistent connection session traffic is greater than E, the session feature vectors corresponding to the subsequent redundant session groups are discarded.

[0079] A126: If the number of session groups in the persistent session traffic is less than E, zero feature vectors (0, 0, 0) are filled in the redundant pixel units.

[0080] The encoding method of the feature map in this embodiment 1 is: based on each feature line in the first target access feature map, a feature row in the first target access feature map is configured for each long connection session traffic, and then the session feature vector included in the long connection session traffic is filled into the pixel unit of the corresponding feature row.

[0081] Usually, each long connection session flow corresponds to a type of service, and the similarity of the behavior access flow of the same service in the early stage of implementing network anonymity and proxy technology to access global Internet resources will be higher. Based on this feature, the first target access feature graph constructed in this embodiment 1 can reflect the characteristics of users accessing different types of services in the vertical space. In the horizontal space, it can reflect the characteristics of the first few access operations when users access the same type of service.

[0082] In the present embodiment 1, usually E pixel units are used to include the feature vectors of the previous access traffic as much as possible. Therefore, E will be much smaller than the number of session groups in the long connection session traffic. In order to more accurately reflect the similarity of the user's previous access operations, E=F can be made.

[0083] Example 2

[0084] like Figure 2 As shown, a method for identifying unauthorized access traffic is provided, the method comprising the following steps:

[0085] B100: In response to the target terminal's browser opening instruction during the off-peak access period, a second feature encoding process is performed on multiple long connection session flows during the first monitoring period to generate a second target access feature graph. Each long connection session flow includes multiple session groups, and the session group includes a request data packet and a corresponding response data packet.

[0086] B200: Input the second target access feature graph into the trained second capsule neural network to generate access identification results of multiple long connection session flows within the first monitoring period.

[0087] The implementation methods of B100 to B200 in this embodiment 2 are basically the same as the implementation methods of A100 to A200 in embodiment 1, and the only difference is that the method of making the second target access feature map in the second feature encoding process is different to generate different second target access feature maps. Therefore, in this embodiment, only the method of making the second target access feature map is described in detail, and the other steps can refer to the implementation methods of the corresponding steps in embodiment 1, which will not be repeated here.

[0088] The second feature encoding process includes:

[0089] B101: Generate a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group. a b is the session feature vector corresponding to the bth session group in the ath long connection session traffic, A a b =(Q a b , X a b , T a b ). Q a b A a b The size of the request packet. a b A a b The size of the response packet. a b A a b The time interval between the request packet and the response packet.

[0090] B102: Sort the traffic of each persistent connection session from early to late according to the establishment time to generate a persistent connection sequence.

[0091] B103: Sort the session groups in each persistent connection session flow from earliest to latest according to the establishment time, and generate a session sequence in each persistent connection session flow.

[0092] Steps B101 to B103 in Example 2 are the same as steps A101 to A103 in Example 1 and are not repeated here. The difference lies in the specific form of the subsequent target access feature map, that is, the content in B104 to B106.

[0093] B104: All session feature vectors in each long connection session flow are sequentially filled into the pixel units of the corresponding order of the second initial access feature map according to the long connection sequence. The second initial access feature map includes multiple feature rows arranged vertically in sequence, each feature row includes multiple pixel units arranged horizontally in sequence, and a continuous identification column is set at the front end of the multiple feature rows, and the continuous identification column includes multiple continuous identification units with the same number as the feature rows.

[0094] Specifically, B104 includes:

[0095] B114: If the number of feature rows that need to be filled in all session feature vectors is greater than the number of feature rows in the second initial access feature map, the session feature vectors in the subsequent redundant feature rows are discarded.

[0096] B124: If the number of feature rows that need to be filled in all session feature vectors is less than the number of feature rows in the second initial access feature map, then fill the pixel units of the remaining feature rows with zero feature vectors (0, 0, 0).

[0097] B134: If the number of current remaining session groups in the long connection session traffic is greater than the number of corresponding pixel units in the current feature row, the session feature vectors corresponding to the subsequent remaining session groups are filled into the pixel units of the next feature row adjacent to the current feature row.

[0098] B144: If the number of session groups to be filled in the end feature row in the long connection session traffic is less than the number of pixel units in the end feature row, zero feature vectors (0,0,0) are filled in the excess pixel units.

[0099] B105: Add a start identifier in the continuous identifier unit corresponding to the start feature row of each long connection session traffic in the second initial access feature graph.

[0100] B106: Add an end marker to the continuous marker unit corresponding to the end feature row of each persistent connection session traffic in the second initial access feature graph to generate a second target access feature graph.

[0101] The encoding method of the feature graph in the second embodiment is: based on the number of session feature vectors contained in each persistent connection session flow, the entire persistent connection session flow is completely filled into the second target access feature graph. And a corresponding start mark and end mark are configured for each persistent connection to mark the entire persistent connection.

[0102] Since the session traffic obtained in the present invention is the communication data between the PC terminal and the VPN server, and the VPN server needs to forward the response data packets of various types of services, and different types of response data packets usually have different communication characteristics. Therefore, the VPN server will transmit the communication data of services with high similarity in communication characteristics through the same long connection. For example, a video type response data packet will correspond to a long connection, a web page type response data packet will correspond to a long connection, and a chat type response data packet will correspond to a long connection. This can further improve communication efficiency and reduce VPN resource occupancy.

[0103] Therefore, in this communication mode, at least one long connection session flow can usually be obtained within the first monitoring period, and the flow will include at least one response data packet corresponding to the same type of service application. Taking the response data packet of the video type as an example, in order to reduce the jamming caused by video buffering, the buffering work of the next episode of the video will be started in the background while watching the current episode of the video. As a result, there will be a situation where two tasks are online at the same time, that is, the same long connection session flow includes both the response data packet of video A and the response data packet of video A. At the same time, request packets to start viewing and start buffering will appear at approximately the same intervals, that is, the same type of data packets will appear periodically.

[0104] Based on the above scenario, in this embodiment 2, the entire persistent session traffic is put into the feature graph, and the features of sessions of the same type of service can all be included in one persistent session traffic. At the same time, the second target access feature graph constructed in this embodiment 2 can still reflect the features of users accessing different types of services in the vertical space. This makes it easier to identify abnormal traffic in the above scenario.

[0105] Example 3

[0106] like Figure 3 As shown, a method for identifying abnormal traffic based on a single access destination IP includes the following steps:

[0107] C100: In response to the target terminal's instruction to open the browser, multiple connection session flows within the second monitoring period are obtained. The connection session flows include multiple long connection session flows and multiple short connection session flows. Each long connection session flow includes multiple session groups, each short connection session flow includes a session group, and the session group includes a request data packet and a corresponding response data packet.

[0108] The first monitoring period and the second monitoring period in the present invention can be determined according to specific usage scenarios.

[0109] C200: cluster the destination IP addresses of all acquired request packets to generate at least one IP group. Each IP group uniquely corresponds to one destination IP address.

[0110] The current clustering method can be used to cluster the same destination IP into the same IP group, and different destination IP into different IP groups. The destination IP can be determined based on the five-tuple in the data header of the acquired communication traffic.

[0111] In actual use, the VPN server is usually one or more of a VPN server cluster. Specifically, which VPN servers provide connection services of corresponding service types for PC terminals needs to be determined according to the server management policy in the VPN server cluster. In addition, it is also determined whether to communicate with a short connection or a long connection based on the current server busy status and communication traffic type.

[0112] In scenarios where data needs to be exchanged frequently, such as chat rooms and real-time games, where continuous communication is required, long connections are used for communication. In scenarios where data refresh frequency is low, such as web browsing, due to the huge number of users, the server cannot bear too many long connections, so short connections are usually used.

[0113] Moreover, the VPNs used on different PC terminals in the same area (such as the same corporate office area or the same community) to implement network anonymity and proxy technology to access global Internet resources have high similarity in behavior tools, so the VPN server clusters that provide services for the later implementation of network anonymity and proxy technology to access global Internet resources are also roughly the same, so when providing VPN services, the communication strategies adopted are also roughly the same. After processing by the clustering method in this embodiment, the communication characteristics of the VPN cluster can be extracted, and the feature graph is correspondingly encoded according to the corresponding communication characteristics to obtain a higher recognition and determination result.

[0114] C300: If the IP group is one, perform third feature encoding processing on multiple connection session traffic within the second monitoring period to generate a third target access feature graph.

[0115] C400: Input the third target access feature map into the trained third capsule neural network to obtain a recognition result corresponding to the third target access feature map.

[0116] The third feature encoding process includes:

[0117] C301: Generate a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group. a b is the session feature vector corresponding to the bth session group in the ath connection session traffic, A a b =(Q a b , X a b , T a b ). Q a b A a b The size of the request packet. a b A a b The size of the response packet. a b A a b The time interval between the request packet and the response packet.

[0118] C302: sort each connection session flow from early to late according to the earliest request time of the request data packet in each connection session flow to generate a connection sequence.

[0119] C303: Sort the session groups in each persistent connection session flow from earliest to latest according to the establishment time, and generate a session sequence in each persistent connection session flow.

[0120] Steps C301 to C303 in Example 2 are the same as steps A101 to A103 in Example 1 and are not repeated here. The difference lies in the specific form of the subsequent target access feature graph, that is, the content in C304 to C306.

[0121] C304: According to the connection sequence and the conversation sequence, the conversation feature vector corresponding to each conversation group is sequentially filled into the pixel units of the corresponding order of the third initial access feature map. The third initial access feature map includes a plurality of feature rows arranged vertically in sequence, each feature row includes a plurality of pixel units arranged horizontally in sequence, and a connection type identification column is set at the front end of the plurality of feature rows, and the connection type identification column includes a plurality of type identification units having the same number as the feature rows.

[0122] Specifically, C304 includes:

[0123] C314: If the number of feature rows that need to be filled in all session feature vectors is greater than the number of feature rows in the third initial access feature map, the session feature vectors in the subsequent redundant feature rows are discarded.

[0124] C324: If the number of feature rows that need to be filled in all session feature vectors is less than the number of feature rows in the third initial access feature map, then fill the pixel units of the remaining feature rows with zero feature vectors (0, 0, 0).

[0125] C334: If the session connection type to which the current session feature vector belongs is the same as the session connection type to which the previous adjacent session feature vector belongs, the current session feature vector is filled into the pixel unit after the pixel unit to which the previous adjacent session feature vector belongs. The starting session feature vector of the new long connection session traffic is configured in the first pixel unit in the new feature row.

[0126] C344: If the number of current remaining session groups in the long connection session traffic is greater than the number of corresponding pixel units in the current feature row, the session feature vectors corresponding to the subsequent remaining session groups are filled into the pixel units of the next feature row adjacent to the current feature row.

[0127] C354: If the number of session groups to be filled in the end feature row in the persistent session traffic is less than the number of pixel units in the end feature row, zero feature vectors (0,0,0) are filled in the excess pixel units.

[0128] C305: If the session connection type to which the current session feature vector belongs is different from the session connection type to which the previous adjacent session feature vector belongs, the current session feature vector is filled into the pixel unit of the new feature row.

[0129] C306: According to the session connection type to which the session feature vector in each feature row belongs, configure a corresponding connection identifier for a corresponding type identification unit to generate a third target access feature graph.

[0130] In this embodiment 3, the received long connection session traffic and short connection session traffic are sequentially set in different feature rows according to the connection sequence. When the connection type changes, a new feature row is configured to fill in the corresponding session feature vector. The same long connection session traffic is sequentially filled in the feature graph, and different long connection session traffics are independently set in new feature rows to fill in.

[0131] Therefore, the third feature coding process can arrange short connections and long connections in different feature rows according to the time of their appearance. Usually a long connection corresponds to an access service, and there may be at least one access service in a short connection. When the long and short connections are switched, it indicates that the user's access service has changed. Therefore, the third feature coding process can arrange short connections and long connections in different feature rows and configure corresponding connection identifiers, so that the characteristics of changes in access service types can be reflected in the vertical space of the third target access feature graph.

[0132] Example 4

[0133] like Figure 4 As shown, a method for identifying abnormal traffic based on multiple access destination IPs includes the following steps:

[0134] D100: In response to the target terminal's instruction to open the browser, multiple connection session flows within the second monitoring period are obtained. The connection session flows include multiple long connection session flows and multiple short connection session flows. Each long connection session flow includes multiple session groups, each short connection session flow includes a session group, and the session group includes a request data packet and a corresponding response data packet.

[0135] D200: cluster the destination IP addresses of all acquired request packets to generate at least one IP group. Each IP group uniquely corresponds to one destination IP address.

[0136] D300: If there are multiple IP groups, perform fourth feature encoding processing on multiple connection session traffic within the second monitoring period to generate a fourth target access feature graph.

[0137] D400: Input the fourth target access feature map into the trained fourth capsule neural network to obtain a recognition result corresponding to the fourth target access feature map.

[0138] The only difference between Example 4 and Example 3 is that in the feature encoding process, there is a difference in the encoding method of the feature map.

[0139] The fourth feature encoding process includes:

[0140] D301: Generate a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group. a b is the session feature vector corresponding to the bth session group in the ath connection session traffic, A a b =(Q a b , X a b , Ta b ). Q a b A a b The size of the request packet. a b A a b The size of the response packet. a b A a b The time interval between the request packet and the response packet.

[0141] D302: Sort each IP group from early to late according to the earliest request time of the request data packet contained in each IP group to generate a group sequence.

[0142] D303: according to the group sequence, two feature rows in the fourth initial access feature map are sequentially configured for each IP group. The fourth initial access feature map includes a plurality of feature rows sequentially arranged vertically, and each feature row includes a plurality of pixel units sequentially arranged horizontally.

[0143] D304: Fill the session feature vectors corresponding to the corresponding number of short connection session traffic in each IP group into the first row of the two feature rows corresponding to each IP group in the order of request time from early to late.

[0144] D305: Fill the session feature vectors corresponding to the long connection session traffic in each IP group into the second row of the two feature rows corresponding to each IP group in order from early to late, so as to generate a fourth target access feature graph.

[0145] Specifically, the same IP group includes multiple long connection session flows.

[0146] D305 includes:

[0147] D315: According to the generation time of multiple persistent session flows contained in the IP group, multiple persistent session flows are sorted from early to late to generate an IP flow sequence.

[0148] D325: Sort the session groups in each persistent connection session flow from early to late according to the establishment time, and generate a session sequence in each persistent connection session flow.

[0149] D335: Determine the number G of long connection session traffic to be filled in according to the number E of pixel units in each feature row and the similarity request coefficient F. G satisfies the following conditions:

[0150]

[0151] D345: fill the first F session feature vectors in the session sequence corresponding to the first G long connection session flows in the IP flow sequence into the pixel units in the second row of the two feature rows corresponding to the IP group in sequence. Preferably, F is 3 or 4 or 5.

[0152] Specifically, D345 includes:

[0153] D3451: If G×F>E, fill the excess pixel cells with zero eigenvectors (0,0,0).

[0154] The fourth feature encoding process in this embodiment 4 will first configure two feature rows for each IP group according to the group sequence. As a result, the characteristics of changes in the access service type can be roughly reflected in the vertical space of the fourth target access feature graph. Then, the two feature rows corresponding to the same IP group are filled with the session feature vectors corresponding to the short connection session traffic and the long connection session traffic generated by the same destination IP in the order of request time from early to late. Further, in the vertical space of the fourth target access feature graph, the characteristics of changes in the access service type corresponding to the same destination IP are roughly reflected.

[0155] Usually, each long connection session flow corresponds to a type of service, and the similarity of the behavioral access flow of the same service that implements network anonymity and proxy technology in the early stage to access global Internet resources will be higher. In Example 4 of this city, when filling the session feature vectors in the long connection session flow into the feature row, only the first F session feature vectors in each feature row are filled in. In this way, the first few access flows with higher similarity in the long connection can be better screened out and filled in the same feature row. Therefore, in the horizontal space of the fourth target access feature graph, the characteristics of the first few access operations when the user accesses each type of service can be reflected.

[0156] Example 5

[0157] like Figure 5 As shown, a common access path determination method is provided to determine F, and the specific steps are as follows:

[0158] S100: Generate an abnormal request vector corresponding to each historical abnormal long connection session flow according to the URL (Uniform Resource Locator) of each request data packet in each historical abnormal long connection session flow. i =(h i 1 、h i 2 、h i 3 ,…,h ir ,…,h i f(i) ). Among them, h i r is the element code of the URL contained in the rth request data packet generated in the i-th historical abnormal long connection session traffic. f(i) is the total number of request data packets generated in the i-th historical abnormal long connection session traffic. r=1, 2, ..., f(i).

[0159] The historical abnormal long connection session traffic can be obtained from the behavior traffic of the implementation of network anonymity and proxy technology to access global Internet resources that has been determined in history. For example, the URL of each request data packet in the historical abnormal long connection session traffic can be obtained through a PC terminal that has been determined to have the behavior of "implementing network anonymity and proxy technology to access global Internet resources".

[0160] Specifically, the browser developer tool on the PC terminal can be used to extract the URL of the request data packet in the history of the behavior period of implementing network anonymity and proxy technology to access global Internet resources. Most modern browsers provide developer tools that can be used to view the history and extract the URL. For example, in the Chrome browser, press "Ctrl+Shift+H" to open the history, and then use the element inspector in the developer tool to extract the URL. Or some third-party tools can be used to obtain the URL, such as, in the Windows system, you can use "CCleaner" and other cleaning tools to view the history and extract the URL. Alternatively, the existing packet capture tool is used to capture the network packet and decrypt the corresponding content to obtain the URL. For example, Wireshark is used to capture the packet and decrypt the HTTPS packet, but when decrypting the HTTPS packet, corresponding security information such as permissions and certificates is required. Therefore, through the above steps, the URL of the request data included in each historical abnormal long connection session traffic can be determined, and then the corresponding abnormal request vector is formed.

[0161] Generally, the same service application will correspond to a corresponding long connection. The long connection includes multiple session data, which can roughly reflect the user's access characteristics to the service. In the actual access process, when the client (such as a browser) needs to obtain resources from the server, it will send an access request (such as an HTTP request) to the server and include the URL of the resource in the request. In this way, the server can locate and return the corresponding resource based on the URL. For example, when entering the homepage of an application, the URL of the corresponding request is different from the URL requested during login and verification. Therefore, each access request can usually be characterized by the corresponding URL. Correspondingly, the abnormal request vector is also the user's access behavior path.

[0162] S200: Obtain the similarities S2, ..., S between all abnormal request vectors with different vector lengths. p ,…,S t Among them, S p is the similarity between all abnormal request vectors when the vector length is p. t is the maximum vector length value among all abnormal request vectors. p = 2, 3, ... t. i = 1, 2, ..., u.

[0163] S p The following conditions must be met:

[0164]

[0165] Where u is the total number of abnormal request vectors. is the vector value of the i-th exception request vector when the vector length is p. is the vector mean of multiple abnormal request vectors when the vector length is p.

[0166] In this step, the variance is used to represent the similarity between multiple abnormal request vectors of a fixed length. If the variance is small, it indicates that the similarity between multiple abnormal request vectors of a fixed length is high; if the variance is large, it indicates that the similarity between multiple abnormal request vectors of a fixed length is low.

[0167] The similarity in this embodiment can be a similarity calculation performed on a request data packet generated when accessing a certain type of service. This calculation method is more targeted and has higher accuracy when used in corresponding scenarios. It is more suitable for use in scenarios where the purpose of implementing network anonymity and proxy technology to access global Internet resources can be determined. For example, in a certain group of people, the purpose of implementing network anonymity and proxy technology to access global Internet resources is to use a certain game application. Then, the similarity calculation performed on the request data packet generated when accessing the corresponding game application can be specifically collected to determine the corresponding F.

[0168] It is also possible to directly perform similarity calculation on a large number of collected request data packets without distinguishing service types. This calculation method is more generalizable and has wider applicability. It is possible to directly use it without distinguishing the service types needed after implementing network anonymity and proxy technology to access global Internet resources, and the usage scenarios are more extensive.

[0169] S300: Max(S2, ..., S p ,…,S t ) is the length of the vector corresponding to , as F.

[0170] Furthermore, after determining the corresponding common access path F, the method further includes:

[0171] S301: Based on the access behavior vector corresponding to each historical abnormal long connection communication data and Max (S2, ..., S p ,…,S t ), generate the encoding vector length g; g satisfies the following conditions:

[0172]

[0173] Among them, V Max is Max(S2,…,S p ,…,S t ) corresponding to the vector length; is the average length of the access behavior vector corresponding to all historical abnormal long connection communication data; K2 is the second assignment adjustment coefficient.

[0174] In this step, the length of the common access path is adaptively increased to a certain extent according to the average length of the access behavior vector corresponding to all historical abnormal long connection communication data. p ,…,S t All historical data are used in the process, so the final calculated result will be affected by the data that accounts for a large proportion of the data set. Therefore, this step uses the average length of the access behavior vector corresponding to all historical abnormal long connection communication data to lengthen F to a certain extent, further increasing the generalization ability of the final F.

[0175] In this embodiment, the similarity calculation method between all access behavior vectors under different vector lengths is used to determine the length of the corresponding access behavior vector when the similarity is the highest, and then the corresponding common access path can be determined. The common access path can more accurately reflect the commonality of access behaviors of the previous several access operations when the user accesses a certain service, and then the accuracy of subsequent abnormal traffic identification and judgment can be improved.

[0176] Example 6

[0177] Prior to A1312, the method also included:

[0178] A132: Perform K-Means clustering on all request data packets according to the size of the request data packets in each session group to generate m request groups, where m is a positive integer greater than or equal to 1.

[0179] A133: Sort all first data volume nodes to generate multiple first data volume intervals. The first data volume nodes include the maximum value and the minimum value in the request group and the minimum value and the maximum value in all request data packet sizes. The endpoints of the first data volume interval are any two adjacent first data volume nodes.

[0180] A134: sequentially configure a corresponding first size identifier for each first data volume interval. The data volume interval includes the first data volume interval, and the size identifier includes the first size identifier.

[0181] A135: According to the size of the response data packets in each conversation group, perform K-Means clustering on all the response data packets to generate n response groups, where n is a positive integer greater than or equal to 1.

[0182] A136: Sort all the second data volume nodes to generate multiple second data volume intervals. The second data volume nodes include the maximum value and the minimum value in the response group and the minimum value and the maximum value in all response data packet sizes. The endpoints of the second data volume interval are any two adjacent second data volume nodes.

[0183] A137: sequentially configure a corresponding second size identifier for each second data volume interval. The data volume interval includes the second data volume interval, and the size identifier includes the second size identifier. Wherein, m>n.

[0184] In this embodiment, steps A132 to A134 are for dividing the data interval of the request data packet to determine the first size identifier corresponding to the request data packet. Steps A135 to A137 are for dividing the data interval of the response data packet to determine the first size identifier corresponding to the response data packet. Both use K-Means clustering to perform interval division, and the difference is that m>n, that is, the data interval corresponding to the request data packet is larger than the data interval corresponding to the request data packet.

[0185] The data content in the response data packet is generally determined based on the request content in the request data packet, and the size of the response data packet mainly depends on the actual application scenario and protocol. Generally speaking, for some applications with high real-time requirements, such as games or real-time communications, the size of the data packet may be relatively small to reduce transmission delays. For downloading or uploading large files, the size of the data packet may be relatively large to fully utilize the bandwidth and improve transmission efficiency. Therefore, the types of response data packet sizes are relatively fixed.

[0186] The data content in the request data packet is determined based on the user's actual access needs. It is more random, and the size distribution of the request data packet is more flexible and extensive than that of the response data packet.

[0187] Therefore, based on the above, when dividing the data intervals, it is necessary to make the data intervals corresponding to the request data packets more numerous and denser, so that the request data packets can be divided more finely, so as to distinguish different request data packets more accurately. The data intervals corresponding to the response data packets are fewer and sparser, so as to divide the same type of response data packets into the same interval.

[0188] Example 7

[0189] Prior to A1312, the method also included:

[0190] B132: Based on the maximum value of the request data packets in all conversation groups B max and minimum value B min , generating multiple third data quantum nodes. Among them, the cth third data quantum node C c The following conditions must be met:

[0191] C c =Min(B min +K1×e c-1 ,Y1)

[0192] Among them, K1 is the first amplitude adjustment coefficient, Y1 is the upper limit node value, Y1<B min . c is a positive integer greater than or equal to 1.

[0193] A133: Sort all third data volume nodes in ascending order to generate multiple third data volume intervals. The third data volume nodes include B min , B max and each third data sub-node. The endpoints of the third data volume interval are any two adjacent third data volume nodes.

[0194] A134: sequentially configure a corresponding third size identifier for each third data volume interval. The data volume interval includes the third data volume interval. The size identifier includes the third size identifier.

[0195] The present embodiment provides a method for dividing the intervals of the request data packet size, so as to more accurately classify the request data packets of the same type into the same data interval, and classify the request data packets of different types into different data intervals. Specifically, since most of the request data packets are usually concentrated in a smaller size interval, and usually the request data packets of the same type are distributed in a more concentrated interval, the request data packets of different types will have a certain size difference.

[0196] In addition, only a few request packets corresponding to special requests will contain more content, which makes the request packets larger and scattered in a larger data interval. Based on this feature, when dividing the data intervals of the request data size, it is necessary to divide more finely within a smaller data range, so that different types of request data in conventional requests can be distinguished and separated. Therefore, the series of interval nodes obtained by the calculation method of the third data quantum node provided in this embodiment are more densely distributed in a smaller data range, and more sparsely distributed in a larger data range, so as to facilitate more accurate interval division of the request data packet according to the characteristics of the packet size.

[0197] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0198] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0199] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0200] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0201] The electronic device according to this embodiment of the present invention is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0202] The electronic device is presented in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: the at least one processor mentioned above, the at least one storage device mentioned above, and a bus connecting different system components (including storage devices and processors).

[0203] The storage stores program codes, which can be executed by the processor, so that the processor executes the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification.

[0204] The memory may include readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory, and may further include read only memory (ROM).

[0205] The storage may also include a program / utility having a set (at least one) of program modules, such program modules including but not limited to: an operating system, one or more application programs, other program modules and program data, each of which or some combination may include the implementation of a network environment.

[0206] The bus may represent one or more of several types of bus structures including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures.

[0207] The electronic device may also communicate with one or more external devices (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may communicate with one or more devices that enable a user to interact with the electronic device, and / or may communicate with any device (e.g., routers, modems, etc.) that enables the electronic device to communicate with one or more other computing devices. Such communication may be performed through an input / output (I / O) interface. Furthermore, the electronic device may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter. The network adapter communicates with other modules of the electronic device through a bus. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0208] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0209] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0210] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0211] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0212] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0213] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0214] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0215] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0216] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A method for identifying abnormal traffic based on multiple access destination IPs, characterized in that: The method comprises the following steps: In response to the target terminal's instruction to open the browser, a plurality of connection session flows within a second monitoring period are obtained; the connection session flows include a plurality of long connection session flows and a plurality of short connection session flows; Each long connection session flow includes a plurality of session groups, and each short connection session flow includes a session group, wherein the session group includes a request data packet and a corresponding response data packet; Clustering the destination IP addresses of all acquired request packets to generate at least one IP group; Each IP group uniquely corresponds to one destination IP; If there are multiple IP groups, perform fourth feature coding processing on multiple connection session traffic within the second monitoring period to generate a fourth target access feature graph; Inputting the fourth target access feature graph into the trained fourth capsule neural network to obtain a recognition result corresponding to the fourth target access feature graph; The fourth feature encoding process includes: According to the size and generation time of the request data packet and the response data packet in each conversation group, a conversation feature vector corresponding to each conversation group is generated; wherein A a b is the session feature vector corresponding to the bth session group in the ath connection session traffic, A a b =(Q a b , X a b , T a b );Q a b A a b The size of the request packet; X a b A a b The size of the response packet in T a b A a b The time interval between the request packet and the response packet; According to the earliest request time of the request data packets contained in each IP group, each IP group is sorted from early to late to generate a group sequence; According to the group sequence, two feature rows in the fourth initial access feature map are sequentially configured for each IP group; wherein the fourth initial access feature map includes a plurality of feature rows arranged vertically in sequence, and each feature row includes a plurality of pixel units arranged horizontally in sequence; Fill the session feature vectors corresponding to the corresponding number of short connection session traffic in each IP group into the first row of the two feature rows corresponding to each IP group in the order of request time from early to late; The session feature vectors corresponding to the long connection session traffic in each IP group are filled into the second row of the two feature rows corresponding to each IP group in order from early to late, so as to generate a fourth target access feature graph.

2. The method according to claim 1, characterized in that: The same IP group includes multiple long connection session traffic; The session feature vectors corresponding to the long connection session traffic in each IP group are filled into the second row of the two feature rows corresponding to each IP group in order from early to late, so as to generate a fourth target access feature graph, including: According to the generation time of multiple persistent session traffic included in the IP group, multiple persistent session traffic is sorted from early to late to generate an IP traffic sequence; According to the establishment time of the session groups in each persistent connection session flow, the session groups are sorted from early to late to generate a session sequence in each persistent connection session flow; According to the number of pixel units E in each feature row and the similarity request coefficient F, the number of persistent connection session traffic G to be filled is determined; G satisfies the following conditions: The first F session feature vectors in the session sequence corresponding to the first G long connection session flows in the IP flow sequence are sequentially filled into the pixel units of the second row of the two feature rows corresponding to the IP group.

3. The method according to claim 1, characterized in that F is obtained as follows: According to the URL of each request data packet in each historical abnormal long connection session flow, an abnormal request vector corresponding to each historical abnormal long connection session flow is generated; the i-th abnormal request vector H i =(h i 1 、h i 2 、h i 3 ,…,h i r ,…,h i f(i) ), where h i r is the element encoding of the URL contained in the rth request data packet generated in the i-th historical abnormal long connection session traffic; f(i) is the total number of request data packets generated in the i-th historical abnormal long connection session traffic; r=1, 2, ..., f(i); Get the similarities S2,…,S between all abnormal request vectors with different vector lengths p ,…,S t ; Among them, S p is the similarity between all abnormal request vectors when the vector length is p; t is the maximum vector length value among all abnormal request vectors; p=2, 3, …t; i=1, 2, …, u; S p The following conditions must be met: Where, u is the total number of abnormal request vectors; is the vector value of the i-th exception request vector when the vector length is p; is the vector mean of multiple abnormal request vectors when the vector length is p; Max(S2,…,S p ,…,S t ) is the length of the vector corresponding to , as F.

4. The method according to claim 3, characterized in that F is 3 or 4 or 5.

5. The method according to claim 1, characterized in that Before generating a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group, the method further includes: Remove the session groups that appear at a fixed period in the persistent session traffic.

6. The method according to claim 2, characterized in that The first F session feature vectors in the session sequence corresponding to the first G long connection session flows in the IP flow sequence are sequentially filled into the pixel units of the second row of the two feature rows corresponding to the IP group, including: If G×F>E, fill the redundant pixel units with zero eigenvectors (0,0,0).

7. The method according to claim 1, characterized in that Before generating a session feature vector corresponding to each session group according to the size and generation time of the request data packet and the response data packet in each session group, the fourth feature encoding process further includes: Determine, according to the connection identifier in the data header of each acquired flow data, whether the flow data is flow data in the persistent connection session flow; Determine the persistent session traffic to which each traffic data corresponds based on the five-tuple in the data header of each traffic data obtained; According to each request data packet, a response data packet corresponding to each request data packet is determined to generate a corresponding session group.

8. The method according to claim 7, characterized in that According to the size and generation time of the request data packet and the response data packet in each conversation group, a conversation feature vector corresponding to each conversation group is generated, including: Determine a size identifier corresponding to the request data packet according to the data volume interval to which the size of the request data packet belongs; Determine a size identifier corresponding to the response data packet according to the data volume interval to which the size of the response data packet belongs; According to the size identifiers respectively corresponding to the request data packet and the response data packet, the sizes of the request data packet and the response data packet respectively corresponding to the session feature vector are generated.

9. A non-transitory computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method for identifying abnormal traffic based on multiple access destination IPs as described in any one of claims 1 to 8 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method for identifying abnormal traffic based on multiple access destination IPs as described in any one of claims 1 to 8 is implemented.

Images