Network attack detection method and device, electronic equipment and storage medium

Abstract

The application provides a network attack detection method and device, electronic equipment and storage medium. The method comprises the following steps: obtaining network traffic data of a current network, and obtaining periodic characteristics of the network traffic data; based on the periodic characteristics, the network traffic data is decomposed to obtain periodic components, trend components and residual components of the network traffic data; the periodic components, the trend components and the residual components are subjected to anomaly detection to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is attacked. Thus, according to the periodic characteristics, the network traffic data is decomposed into periodic components, trend components and residual components, and then it is determined whether there is abnormal traffic in the network traffic data, so that the detection capability of abnormal traffic is enhanced. Through real-time detection of network attacks, the network attacks can be quickly and accurately responded to, and the security of the network is greatly improved.

Description

Technical Field

[0001] This application relates to the technical field of network security, and in particular to a method, apparatus, electronic device, and storage medium for detecting network attacks. Background Technology

[0002] In the evolution of denial-of-service attacks, distributed denial-of-service (DDoS) attacks utilize tens of thousands of hosts, forming a massive botnet that provides the enormous bandwidth and host resources needed for the attack. This large-scale attack results in a massive influx of network traffic into the target system, causing significant bandwidth consumption and system resource exhaustion, severely jeopardizing the normal operation of the attacked network. Summary of the Invention

[0003] This application aims to at least partially address one of the technical problems in the related art.

[0004] Therefore, the first objective of this application is to propose a method for detecting network attacks, so as to respond to network attacks quickly and accurately, thereby greatly improving network security.

[0005] The second objective of this application is to propose a device for detecting cyberattacks.

[0006] The third objective of this application is to propose an electronic device.

[0007] The fourth objective of this application is to provide a computer-readable storage medium.

[0008] The fifth objective of this application is to provide a computer program product.

[0009] To achieve the above objectives, a first aspect of this application proposes a method for detecting network attacks, comprising: acquiring network traffic data of the current network and acquiring periodic characteristics of the network traffic data; decomposing the network traffic data based on the periodic characteristics to obtain periodic components, trend components, and residual components of the network traffic data; performing anomaly detection on the periodic components, the trend components, and the residual components to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is under attack.

[0010] To achieve the above objectives, a second aspect of this application provides a network attack detection device, comprising: an acquisition module for acquiring network traffic data of the current network and acquiring periodic characteristics of the network traffic data; a decomposition module for decomposing the network traffic data based on the periodic characteristics to obtain periodic components, trend components, and residual components of the network traffic data; and a detection module for performing anomaly detection on the periodic components, the trend components, and the residual components to determine whether there is abnormal traffic in the network traffic data, thereby determining whether the current network is under attack.

[0011] To achieve the above objectives, a third aspect of this application provides an electronic device, including: a processor; and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to enable the processor to perform the network attack detection method described in the first aspect of the application.

[0012] To achieve the above objectives, a fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, the computer instructions being used to cause the computer to execute the network attack detection method described in the above aspect of the embodiment.

[0013] To achieve the above objectives, a fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the network attack detection method described in the above aspect of the embodiment.

[0014] The network attack detection method, apparatus, electronic device, and storage medium provided in this application improve the accuracy of identifying periodic and trend characteristics in network traffic data by acquiring the periodic features of network traffic data and decomposing the network traffic data based on these periodic features to determine the periodic, trend, and residual components of the network traffic data. Furthermore, based on the periodic, trend, and residual components, the presence of abnormal traffic in the network traffic data is determined, enhancing the detection capability of abnormal traffic. Through real-time detection of network attacks, network attacks can be responded to quickly and accurately, greatly improving network security.

[0015] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0016] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0017] Figure 1A flowchart illustrating a network attack detection method provided in an embodiment of this application;

[0018] Figure 2 A flowchart illustrating another method for detecting network attacks provided in this application embodiment;

[0019] Figure 3 A flowchart illustrating another method for detecting network attacks provided in this application embodiment;

[0020] Figure 4 This is a schematic diagram of the process for detecting network traffic data provided in an embodiment of this application;

[0021] Figure 5 This is a schematic diagram of the structure of a network attack detection device provided in an embodiment of this application. Detailed Implementation

[0022] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0023] The method and apparatus for detecting network attacks according to embodiments of this application are described below with reference to the accompanying drawings.

[0024] Figure 1 This is a flowchart illustrating a method for detecting network attacks according to an exemplary embodiment, such as... Figure 1 As shown, the network attack detection method of this application includes, but is not limited to, the following steps:

[0025] S101, Obtain the current network traffic data and the periodic characteristics of the network traffic data.

[0026] It should be noted that the execution subject of the network attack detection method provided in this application embodiment is an electronic device, which can be a terminal device. Optionally, the terminal device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, handheld computers, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be personal computers (PCs), etc. This application embodiment does not impose specific limitations.

[0027] In some implementations, web crawling techniques can be used to obtain current network traffic data. To ensure data quality and integrity, the network traffic data can be preprocessed, and features can be extracted from the processed data to determine its periodicity.

[0028] Optionally, network traffic data can be cleaned to identify and process invalid, missing, or abnormal data. Optionally, network traffic data can also be sampled to reduce the amount of data and improve the efficiency of subsequent detection.

[0029] In some implementations, frequency domain analysis techniques can be used to extract features from network traffic data and determine its periodicity. For example, Fourier transform can be used to determine the periodicity of network traffic data.

[0030] S102, based on periodic characteristics, decompose network traffic data to obtain periodic components, trend components and residual components of network traffic data.

[0031] In some implementations, the Density-Based Preprocessing Technique for Dominant-Node Detection (DBPTD) algorithm can be used to decompose network traffic data. Optionally, the DBPTD algorithm can employ time series decomposition techniques to decompose the time series of network traffic data into periodic components, trend components, and residual components.

[0032] In some implementations, periodic components in network traffic data can be identified and extracted as periodic components. These periodic components can be obtained based on frequency domain analysis methods. For example, Fourier transform or wavelet transform can be used.

[0033] Understandably, extracting trend components involves analyzing the time series of network traffic data using local linear trend or polynomial regression. In other words, local linear trend or polynomial regression methods can be used to decompose the trend components of network traffic data.

[0034] Understandably, the extraction of residual components involves removing trend and periodic components from the time series of network traffic data. In other words, the periodic and trend components in the network traffic data can be removed to obtain the residual components.

[0035] S103 performs anomaly detection on periodic components, trend components, and residual components to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is under attack.

[0036] In some implementations, the difference between network traffic data and normal network traffic data can be compared, and the presence of abnormal traffic in the network traffic data can be determined based on the difference. When abnormal traffic is found, it can be determined that the current network is under attack.

[0037] In some implementations, analysis can be performed based on periodic components, trend components, and residual components. By setting anomaly rules and thresholds, it can be determined whether abnormal traffic exists in the network traffic data. Optionally, the periodic components, trend components, and residual components of the current network traffic data can be compared with normal periodic components, trend components, and residual components to determine the differences. Based on whether the differences meet the set anomaly rules and thresholds, it can be determined whether abnormal traffic exists in the network traffic data.

[0038] The network attack detection method provided in this application improves the accuracy of identifying periodic and trend characteristics in network traffic data by acquiring the periodic features and decomposing the network traffic data according to these features. Furthermore, it enhances the detection capability of abnormal traffic by determining whether abnormal traffic exists in the network traffic data based on these components. Real-time detection of network attacks enables rapid and accurate responses, significantly improving network security.

[0039] Figure 2 This is a flowchart illustrating a method for detecting network attacks according to an exemplary embodiment, such as... Figure 2 As shown, the network attack detection method of this application includes, but is not limited to, the following steps:

[0040] S201, Obtain the current network traffic data and the periodic characteristics of the network traffic data.

[0041] In the embodiments of this application, step S201 can be implemented in any of the ways described in the embodiments of this application. This is not limited here and will not be described in detail.

[0042] S202, Determine the time series of network traffic data.

[0043] In some implementations, multiple timestamps in network traffic data are obtained and arranged in order to construct a time series of network traffic data. The time series can clearly show how network traffic changes over time.

[0044] S203, based on the density-based master node detection preprocessing DBPTD algorithm, perform trend extraction on network traffic data according to the time series, and extract the components in the network traffic data whose duration of the same trend exceeds a set duration as trend components.

[0045] Understandably, trend refers to the changing trend and tendency of data within a certain period. The Density-Based Preprocessing Technique for Dominant-Node Detection (DBPTD) algorithm can be used to extract the trend component of network traffic data.

[0046] Understandably, the application of local linear trends involves estimating the trend at each time point to capture trend changes across different points in the entire time series. This technique avoids simply applying a global trend, thus ensuring accurate analysis of time series data.

[0047] Multinomial regression, by selecting an appropriate multinomial degree, can better adapt to trend changes at different stages of a time series, thereby improving the adaptability of trend component extraction. This technique makes trend component extraction more accurate and reliable.

[0048] In other words, the DBPTD algorithm can use local linear trends or polynomial regression as trend decomposition methods to extract the long-term trend of network traffic data based on time series, that is, to extract the components in network traffic data whose duration of the same trend exceeds a set duration as trend components.

[0049] Alternatively, the Seasonal-Trend-Loess (STL) algorithm can be used to decompose the time series into seasonal, trend, and residual components. The STL algorithm can determine the seasonal and trend components through locally weighted regression. That is, for each time point t, its seasonal value S can be determined. t and trend value T t And thus from the time series y t Subtracting the seasonal and trend components yields the residual component R. t Then R t =y t -S t -T t .

[0050] S204, Identify components in network traffic data that exhibit periodic characteristics, and designate these components as periodic components.

[0051] In some implementations, the periodicity of network traffic is captured by identifying and extracting components with periodic characteristics, and these components are then designated as periodic components. Alternatively, frequency domain analysis methods, such as Fourier transform or wavelet transform, can be used to determine the periodic components.

[0052] Understandably, the Fourier transform is used to decompose a signal into sine and cosine waves of different frequencies, thereby obtaining the signal's spectral information. The wavelet transform, on the other hand, utilizes multi-scale analysis and time-frequency localization to better capture instantaneous frequency changes and time-localization features in a signal.

[0053] In other words, by determining the time-domain signal of network traffic data, and by identifying components with periodic characteristics in the network traffic data based on Fourier transform and wavelet transform.

[0054] For example, if the time-domain signal is a continuous signal, the formula for analyzing periodicity using Fourier transform is shown below:

[0055]

[0056] Where X(f) is the complex amplitude at frequency f, x(t) is the time-domain signal, and e -j2πft It is a complex exponential function.

[0057] If the time-domain signal is a discrete signal, the periodicity can be analyzed using the Fourier transform formula shown below:

[0058]

[0059] Where X[k] is the complex amplitude at frequency k, x[n] is the discrete-time signal, and e -j2πkn / N It is a discrete complex exponential function, where N is the length of the signal.

[0060] If the time-domain signal is a continuous signal, the periodicity can be analyzed using the wavelet transform formula shown below:

[0061]

[0062] Where W(a,b) is the result of the wavelet transform, a and b are two parameters: a is the scaling parameter, controlling the scaling of the wavelet function, and b is the translation parameter, controlling the translation of the wavelet function. x(t) is the time-domain signal, and ψ (a,b) (t) is the wavelet basis function.

[0063] S205 removes trend and periodic components from network traffic data to obtain residual components.

[0064] Understandably, residual components contain patterns of change that cannot be explained by trend and periodic models, and may reflect anomalous behavior or sudden events in network traffic.

[0065] In some implementations, information not explained by trends and periods can be extracted by removing trend and periodic components from network traffic data. In other words, the residual component is obtained by subtracting trend and periodic components from network traffic data.

[0066] Alternatively, the residual components can be calculated based on the Seasonal Autoregressive Integrated Moving Average (SARIMA) model, as shown in the following formula:

[0067]

[0068] Among them, e i Represents the residual components. y represents the model's predicted value. i This represents the actual value.

[0069] In some implementations, to improve the accuracy and reliability of network traffic data analysis, the parameters of the DBPTD algorithm can be dynamically adjusted based on periodic components, trend components, and residual components. The adjusted DBPTD algorithm then continues to perform the next traffic decomposition. The parameters include the periodic characteristics corresponding to the periodic components and the trend characteristics corresponding to the trend components.

[0070] Optionally, the weights of the DBPTD algorithm parameters can be adjusted to better adapt to different network environments and traffic types. For example, for rapidly changing traffic, the weight of the trend component can be increased to better capture its dynamic changes. The formula for calculating the weights is shown below:

[0071] w(n+1)=w(n)+μ·e(n)·x(n) (5)

[0072] Where w(n+1) represents the parameter weights for the next flow decomposition in the DBPTD algorithm, w(n) represents the parameter weights for the previous flow decomposition, μ represents a constant, e(n) represents the residual component, and x(n) represents the parameter.

[0073] S206 performs anomaly detection on periodic components, trend components, and residual components to determine whether there is abnormal traffic in the network traffic data, in order to determine whether the current network is under attack.

[0074] In the embodiments of this application, step S206 can be implemented in any of the ways described in the embodiments of this application. This is not limited here and will not be described in detail.

[0075] The network attack detection method provided in this application obtains the periodic characteristics of network traffic data and decomposes the network traffic data using the DBPTD algorithm based on these characteristics to determine the periodic, trend, and residual components of the network traffic data. This effectively identifies and isolates anomalies, thereby improving the accuracy and efficiency of data analysis. Furthermore, based on the periodic, trend, and residual components, it determines whether abnormal traffic exists in the network traffic data, enhancing the detection capability for abnormal traffic. Real-time detection of network attacks enables rapid and accurate responses, significantly improving network security.

[0076] Figure 3 This is a flowchart illustrating a method for detecting network attacks according to an exemplary embodiment, such as... Figure 3 As shown, the network attack detection method of this application includes, but is not limited to, the following steps:

[0077] S301, obtain the current network traffic data and the periodic characteristics of the network traffic data.

[0078] In the embodiments of this application, step S301 can be implemented in any of the ways described in the embodiments of this application. This is not limited here and will not be described in detail.

[0079] S302, based on periodic characteristics, decomposes network traffic data to obtain periodic components, trend components and residual components of network traffic data.

[0080] In the embodiments of this application, step S302 can be implemented in any of the ways described in the embodiments of this application. This is not limited here and will not be described in detail.

[0081] S303, based on multiple sample network traffic data, obtains the network's reference periodic component, reference trend component, and reference residual component.

[0082] In some implementations, abnormal traffic can be identified by comparing network traffic data with normal traffic data. Alternatively, normal network traffic data can be determined from a sample of network traffic data and used as reference traffic data, thereby determining the reference periodic component, reference trend component, and reference residual component of the reference traffic data.

[0083] Alternatively, the DBPTD algorithm can be used to decompose the reference flow data to determine the reference periodic component, the reference trend component, and the reference residual component.

[0084] For example, time series analysis methods can be used, employing seasonal decomposition and trend analysis algorithms to learn and analyze reference flow data. Through local linear trend analysis, linear regression is applied to each data point. Simultaneously, multinomial regression techniques are used to improve adaptability to non-linear trend changes, thereby obtaining the trend components of the reference flow data.

[0085] S304 detects whether there is abnormal traffic in network traffic data based on periodic components, trend components, and residual components, and reference periodic components, reference trend components, and reference residual components.

[0086] In some implementations, real-time data analysis techniques can be used, employing moving averages or exponential smoothing, to analyze the differences between periodic components, trend components, and residual components and reference periodic components, reference trend components, and reference residual components.

[0087] In other words, based on periodic components and normal periodic components, abnormal fluctuation information of periodic components can be determined; based on trend components and normal trend components, abrupt change information of trend components can be determined; and based on residual components and normal residual components, change information of residual components can be determined.

[0088] Furthermore, based on the abnormal fluctuation information of periodic components, the abrupt change information of trend components, and the change information of residual components, it is determined whether abnormal traffic exists in the network traffic data. Optionally, an anomaly detection strategy can be formulated, and the presence of abnormal traffic in the network traffic data can be determined according to the anomaly detection strategy. Optionally, pre-defined detection rules and anomaly threshold ranges can be used as the anomaly detection strategy.

[0089] In some implementations, the maximum and minimum signal values ​​of reference network traffic data are obtained, and the anomaly threshold range is determined based on these values. Alternatively, the dynamic range of the threshold can be determined based on the maximum and minimum signal values, and the threshold can be adjusted according to a proportional coefficient to obtain the anomaly threshold range.

[0090] Optionally, the formula for calculating the anomaly threshold range is as follows:

[0091] D = X max -X min (6)

[0092] T = k·D (7)

[0093] Where D represents the dynamic range of the threshold, X maxX represents the maximum value of the signal. min denoted by , k represents the minimum value of the signal, and T represents the abnormal threshold range.

[0094] Understandably, k can be a fixed constant or a parameter that is dynamically adjusted in real time based on changes in the signal. By setting a reasonable threshold, anomalies can be accurately identified while avoiding false alarms for normal traffic, thus improving the robustness of anomaly detection.

[0095] In some implementations, detection rules are pre-defined, and it is determined whether abnormal fluctuation information, mutation information, and change information meet the preset detection rules. If the detection rules are not met, it is determined that there is abnormal traffic in the network traffic data.

[0096] For example, anomaly detection rules can be traffic threshold rules, traffic change rate rules, etc. Traffic threshold rules: By setting an upper and lower limit for normal traffic, traffic exceeding the upper limit or falling below the lower limit is considered an anomaly. Traffic change rate rules: Monitor the rate of change of traffic; when the rate of change exceeds a certain preset value, it is considered an anomaly.

[0097] Optionally, if the detection rules are met, it is further determined whether the abnormal fluctuation information, mutation information and change information are within the abnormal threshold range. If they are within the abnormal threshold range, it is determined that there is no abnormal traffic in the network traffic data; otherwise, it is determined that there is abnormal traffic in the network traffic data.

[0098] Alternatively, the anomaly detection strategy can also be to consider a component as an anomaly when the difference exceeds its corresponding threshold range, or to summarize the differences of each component using a comprehensive scoring method, and if the comprehensive score exceeds the threshold range, it is judged as an anomaly.

[0099] In some implementations, a baseline model of the residual components can be established by comparing them with a reference residual component. Then, in anomaly detection, by comparing the real-time acquired residual components with the baseline model and using statistical detection methods, such as anomaly detection algorithms, traffic that deviates significantly from the reference network traffic can be identified as anomalous traffic, which helps improve the accuracy of network traffic analysis and prediction.

[0100] In some implementations, the presence of abnormal traffic in network traffic data indicates an attack on the network, triggering further security responses or protection mechanisms to safeguard network security and stable operation. In other words, in response to the determination that the network is under attack, security measures are implemented, such as attack mitigation, traffic redirection, or alert notifications, to quickly and effectively address potential threats and ensure network security and business continuity.

[0101] The network attack detection method provided in this application obtains the periodic characteristics of network traffic data and decomposes the network traffic data using the DBPTD algorithm based on these characteristics to determine the periodic, trend, and residual components of the network traffic data. This effectively identifies and isolates anomalies, thereby improving the accuracy and efficiency of data analysis. Furthermore, based on the periodic, trend, and residual components, it determines whether abnormal traffic exists in the network traffic data, enhancing the detection capability for abnormal traffic. When abnormal traffic is detected, it can be determined that the current network is under attack, allowing for appropriate protective measures to be taken. Real-time detection of network attacks enables rapid and accurate responses, significantly improving network security.

[0102] like Figure 4 The diagram shows a flowchart for detecting network traffic data. Network traffic data is collected and preprocessed, including data cleaning, anomaly handling, and data sampling. Frequency domain analysis is then performed on the processed network traffic data to determine its periodicity characteristics.

[0103] Furthermore, the DBPTD algorithm is employed to apply periodic features to network traffic data. By decomposing the time series of network traffic data, the DBPTD algorithm can extract periodic and trend components. After removing the periodic and trend components, residual components are obtained. When decomposing the trend components, a robust regression algorithm is introduced to improve the accuracy of fitting the overall trend of network traffic. The robust regression algorithm considers the impact of outliers.

[0104] Furthermore, after determining the periodic, trend, and residual components of network traffic data, the parameters of the DBPTD algorithm are dynamically adjusted to improve its adaptability and accuracy, making it more effective in adapting to different traffic characteristics and diverse network environments. The characteristics corresponding to the periodic and trend components can be used as parameters for dynamic adjustment.

[0105] Furthermore, by setting anomaly detection strategies, anomalies are detected in periodic, trend, and residual components. By comprehensively considering the changes in periodic, trend, and residual components, network traffic data is analyzed in real time to ensure timely monitoring of traffic changes. By setting detection rules and anomaly thresholds, more accurate judgments are made. Once an anomaly is detected, corresponding security responses or protection mechanisms are triggered to perform attack cleanup, traffic redirection, and alarm notifications, ensuring network security and business continuity.

[0106] To achieve the above embodiments, this application also proposes a network attack detection device.

[0107] Figure 5 This is a schematic diagram of the structure of a network attack detection device provided in an embodiment of this application.

[0108] like Figure 5 As shown, the network attack detection device 500 includes:

[0109] The acquisition module 501 is used to acquire network traffic data of the current network and acquire the periodic characteristics of the network traffic data;

[0110] The decomposition module 502 is used to decompose the network traffic data based on the periodic characteristics to obtain the periodic components, trend components and residual components of the network traffic data.

[0111] The detection module 503 is used to perform anomaly detection on the periodic component, the trend component and the residual component to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is under attack.

[0112] In one possible implementation of this application embodiment, the decomposition module 502 is further configured to: determine the time series of the network traffic data; perform trend extraction on the network traffic data according to the time series based on the density-based master node detection preprocessing (DBPTD) algorithm, extracting components in the network traffic data whose duration of the same trend exceeds a set duration as the trend component; identify components in the network traffic data that have the periodic characteristics, and designate the components with the periodic characteristics as the periodic component; remove the trend component and the periodic component from the network traffic data to obtain the residual component.

[0113] In one possible implementation of this application embodiment, the decomposition module 502 is further configured to: dynamically adjust the parameters of the DBPTD algorithm based on the periodic component, the trend component, and the residual component, and the adjusted DBPTD algorithm continues to perform the next flow decomposition.

[0114] In one possible implementation of this application embodiment, the detection module 503 is further configured to: obtain a reference periodic component, a reference trend component, and a reference residual component of the network based on multiple sample network traffic data; and detect whether there is abnormal traffic in the network traffic data based on the periodic component, trend component, and residual component and the reference periodic component, reference trend component, and reference residual component.

[0115] In one possible implementation of this application embodiment, the detection module 503 is further configured to: determine abnormal fluctuation information of the periodic component based on the periodic component and the normal periodic component; determine abrupt change information of the trend component based on the trend component and the normal trend component; determine change information of the residual component based on the residual component and the normal residual component; and determine whether there is abnormal traffic in the network traffic data based on the abnormal fluctuation information of the periodic component, the abrupt change information of the trend component, and the change information of the residual component.

[0116] In one possible implementation of this application embodiment, the detection module 503 is further configured to: acquire the maximum and minimum signal values ​​of reference network traffic data, and determine an abnormal threshold range based on the maximum and minimum signal values; determine whether the abnormal fluctuation information, the mutation information, and the change information meet preset detection rules; if the detection rules are not met, determine that there is abnormal traffic in the network traffic data; if the detection rules are met, continue to determine whether the abnormal fluctuation information, the mutation information, and the change information are within the abnormal threshold range; if they are within the abnormal threshold range, determine that there is no abnormal traffic in the network traffic data, otherwise determine that there is abnormal traffic in the network traffic data.

[0117] In one possible implementation of this application embodiment, the detection module 503 is further configured to: perform security protection measures on the current network in response to determining that the current network is under attack.

[0118] The network attack detection device provided in this application acquires the periodic characteristics of network traffic data and decomposes the network traffic data based on these characteristics to determine the periodic, trend, and residual components of the network traffic data. This improves the accurate identification of periodic and trend characteristics in the network traffic data. Furthermore, based on the periodic, trend, and residual components, it determines whether abnormal traffic exists in the network traffic data, enhancing the detection capability of abnormal traffic. Through real-time detection of network attacks, it can respond to network attacks quickly and accurately, greatly improving network security.

[0119] It should be noted that the explanation of the aforementioned embodiment of the network attack detection method also applies to the network attack detection device of this embodiment, and will not be repeated here.

[0120] To implement the above embodiments, this application also proposes an electronic device, including: a processor and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0121] To implement the above embodiments, this application also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0122] To implement the above embodiments, this application also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0123] The collection, storage, use, processing, transmission, provision, and application of user personal information involved in this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0124] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0125] This application is intended to provide an implementation scheme for users to selectively prevent the use or access to their personal information data. Specifically, this application is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information is de-identified to protect user privacy.

[0126] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0127] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0128] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0129] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0130] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0131] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0132] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0133] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A method for detecting network attacks, characterized in that, The method includes: Obtain current network traffic data and the periodic characteristics of the network traffic data; Based on the periodicity, the network traffic data is decomposed to obtain the periodic component, trend component, and residual component of the network traffic data. Anomaly detection is performed on the periodic component, the trend component, and the residual component to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is under attack. The step of performing anomaly detection on the periodic component, the trend component, and the residual component to determine whether there is abnormal traffic in the network traffic data includes: Based on multiple sample network traffic data, the reference periodic component, reference trend component, and reference residual component of the network are obtained. Based on the periodic component, trend component, and residual component, and the reference periodic component, reference trend component, and reference residual component, detect whether there is abnormal traffic in the network traffic data; The step of detecting whether there is abnormal traffic in the network traffic data based on the periodic component, trend component, and residual component and the reference periodic component, reference trend component, and reference residual component includes: Based on the periodic component and the normal periodic component, the abnormal fluctuation information of the periodic component is determined. Based on the trend component and the normal trend component, the mutation information of the trend component is determined; Based on the residual components and the normal residual components, determine the change information of the residual components; Based on the abnormal fluctuation information of the periodic component, the abrupt change information of the trend component, and the change information of the residual component, it is determined whether there is abnormal traffic in the network traffic data.

2. The method according to claim 1, characterized in that, Based on the periodic characteristics, the network traffic data is decomposed to obtain periodic components, trend components, and residual components, including: Determine the time series of the network traffic data; According to the density-based master node detection preprocessing (DBPTD) algorithm, the network traffic data is trend extracted according to the time series. The components in the network traffic data whose duration of the same trend exceeds a set duration are extracted as the trend components. Identify the components in the network traffic data that exhibit the periodic characteristics, and designate the components that exhibit the periodic characteristics as the periodic components; The residual component is obtained by removing the trend component and the periodic component from the network traffic data.

3. The method according to claim 2, characterized in that, After obtaining the periodic component, trend component, and residual component of the network traffic data, the method further includes: Based on the periodic component, the trend component, and the residual component, the parameters of the DBPTD algorithm are dynamically adjusted, and the adjusted DBPTD algorithm continues to perform the next flow decomposition.

4. The method according to claim 1, wherein determining whether there is abnormal traffic in the network traffic data based on the abnormal fluctuation information of the periodic component, the abrupt change information of the trend component, and the change information of the residual component includes: Obtain the maximum and minimum signal values ​​of reference network traffic data, and determine the abnormal threshold range based on the maximum and minimum signal values; Determine whether the abnormal fluctuation information, the mutation information, and the change information meet the preset detection rules; If the detection rules are not met, it is determined that there is abnormal traffic in the network traffic data; If the detection rules are met, continue to determine whether the abnormal fluctuation information, the mutation information, and the change information are within the abnormal threshold range; If the network traffic data falls within the abnormal threshold range, it is determined that there is no abnormal traffic; otherwise, it is determined that there is abnormal traffic in the network traffic data.

5. The method according to any one of claims 1-3, characterized in that, The method further includes: In response to the determination that the current network is under attack, security protection measures are implemented for the current network.

6. A network attack detection device, characterized in that, The device includes: The acquisition module is used to acquire network traffic data of the current network and to acquire the periodic characteristics of the network traffic data; The decomposition module is used to decompose the network traffic data based on the periodic characteristics to obtain the periodic components, trend components and residual components of the network traffic data. The detection module is used to perform anomaly detection on the periodic component, the trend component, and the residual component to determine whether there is abnormal traffic in the network traffic data, so as to determine whether the current network is under attack. The detection module is also used for: Based on multiple sample network traffic data, the reference periodic component, reference trend component, and reference residual component of the network are obtained. Based on the periodic component, trend component, and residual component, and the reference periodic component, reference trend component, and reference residual component, detect whether there is abnormal traffic in the network traffic data; The detection module is also used for: Based on the periodic component and the normal periodic component, the abnormal fluctuation information of the periodic component is determined. Based on the trend component and the normal trend component, the mutation information of the trend component is determined; Based on the residual components and the normal residual components, determine the change information of the residual components; Based on the abnormal fluctuation information of the periodic component, the abrupt change information of the trend component, and the change information of the residual component, it is determined whether there is abnormal traffic in the network traffic data.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-5.

Images