Traffic anomaly detection method, device and equipment and readable storage medium

Abstract

The application relates to the field of traffic anomaly detection, and provides a traffic anomaly detection method, device and equipment and a readable storage medium. The traffic anomaly detection method comprises the following steps: determining a data collection step length according to device information and historical traffic data of a to-be-detected Internet of Things device; collecting data of each traffic feature of the to-be-detected Internet of Things device based on the data collection step length; determining the difference degree of each traffic feature according to the data of each traffic feature; and performing traffic anomaly detection on the to-be-detected Internet of Things device based on the difference degree. According to the historical traffic information and the device information of the Internet of Things device, the data collection step length is determined, the traffic data is collected by using a sliding window mechanism based on the data collection step length, and the data collection quality is ensured. The difference degree of each traffic feature is calculated according to the collected traffic feature data, and the traffic anomaly detection is performed based on the difference degree. The difference degree reflects the abnormal situation of the traffic feature, and the accuracy of the traffic anomaly detection is ensured.

Description

Technical Field

[0001] This application relates to the field of traffic anomaly detection, specifically to a traffic anomaly detection method, apparatus, device, and readable storage medium. Background Technology

[0002] Due to the dynamic, complex, and heterogeneous nature of IoT devices, they have exposed an increasing number of security issues. Furthermore, most intrusion attempts targeting IoT devices occur via network penetration, necessitating anomaly detection of IoT device traffic. However, current methods typically rely on firewalls for traffic detection. But due to the limited hardware resources of IoT devices, existing firewall technologies cannot effectively detect anomalies in their traffic. Summary of the Invention

[0003] This application provides a method, apparatus, device, and readable storage medium for detecting abnormal traffic, in order to solve the technical problem that existing firewall technologies cannot detect whether the traffic of IoT devices is abnormal.

[0004] In a first aspect, embodiments of this application provide a method for detecting abnormal traffic flow, including:

[0005] The data acquisition step size is determined based on the device information and historical traffic data of the IoT device to be tested;

[0006] Data on various traffic characteristics of the IoT device under test are collected based on the data acquisition step size;

[0007] Based on the data of each of the aforementioned flow characteristics, determine the degree of difference of each of the aforementioned flow characteristics;

[0008] Based on the difference, traffic anomaly detection is performed on the IoT device under test.

[0009] In one embodiment, determining the data acquisition step size based on the device information and historical traffic data of the IoT device to be detected includes:

[0010] Determine the duration adjustment coefficient based on the device information of the IoT device to be tested;

[0011] The base duration is determined based on the historical traffic data of the IoT device under test;

[0012] The data acquisition step size is determined based on the base duration and the duration adjustment coefficient.

[0013] In one embodiment, determining the duration adjustment coefficient based on the device information of the IoT device to be detected includes:

[0014] Based on the device information of the IoT device to be tested, determine the number of vulnerabilities and the maximum vulnerability impact factor;

[0015] The duration adjustment coefficient is determined based on the number of vulnerabilities and the maximum vulnerability impact coefficient.

[0016] In one embodiment, determining the base duration based on the historical traffic data of the IoT device to be detected includes:

[0017] Based on the historical traffic data of the IoT device under test, determine the traffic mean, traffic standard deviation, and traffic maximum.

[0018] The base duration is determined based on the mean flow rate, the standard deviation of the flow rate, and the maximum flow rate.

[0019] In one embodiment, the data acquisition of various traffic characteristics of the IoT device under test based on the data acquisition step size includes:

[0020] Starting from a preset initial time, the window is slid based on the window length and the data acquisition step size to collect data on each traffic characteristic within the time period corresponding to the window. The window length is a preset duration.

[0021] The window stops sliding when it reaches a preset termination time or when the number of window slides reaches a first preset threshold, and the data of the traffic characteristics of each window within the corresponding time period are obtained.

[0022] In one embodiment, determining the degree of difference of each of the traffic characteristics based on the data of each of the traffic characteristics includes:

[0023] When the traffic characteristic is a source port, the degree of difference of the source port in each window corresponding to the time period is determined based on the total number of times the source port appears in each window corresponding to the time period, the number of different source ports in each window corresponding to the time period, and the number of different source ports in all windows corresponding to the time period.

[0024] In one embodiment, the traffic anomaly detection of the IoT device under test based on the difference degree includes:

[0025] If the difference in the difference of each of the traffic features within the time period corresponding to the target window is greater than the second preset threshold, it is determined that the traffic of the IoT device to be detected is abnormal.

[0026] If the number of windows in which the difference in the target traffic characteristics shows a continuous upward trend falls within a preset range, the traffic of the IoT device to be detected is determined to be abnormal. The preset range is determined based on the total number of windows.

[0027] Secondly, embodiments of this application provide a flow anomaly detection device, comprising:

[0028] The data acquisition step size determination module is used to determine the data acquisition step size based on the device information and historical traffic data of the IoT device to be tested.

[0029] The traffic feature data acquisition module is used to acquire data on each traffic feature of the IoT device under test based on the data acquisition step size.

[0030] The traffic characteristic difference determination module is used to determine the difference of each traffic characteristic based on the data of each traffic characteristic.

[0031] The traffic anomaly detection module is used to detect traffic anomalies in the IoT device under test based on the difference.

[0032] Thirdly, embodiments of this application provide a device including a processor and a memory storing a computer program, wherein the processor executes the computer program to implement the traffic anomaly detection method described in the first aspect.

[0033] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the traffic anomaly detection method described in the first aspect.

[0034] The traffic anomaly detection method, apparatus, device, and readable storage medium provided in this application determine the data acquisition step size based on the historical traffic information and device information of IoT devices. Based on the data acquisition step size of each IoT device, a sliding window mechanism is used for traffic data acquisition, which ensures data acquisition quality while collecting less traffic data. The difference degree of each traffic feature is calculated based on the acquired traffic feature data, and traffic anomaly detection is performed based on the difference degree. The difference degree reflects the anomaly of the traffic features, ensuring the accuracy of traffic anomaly detection. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is one of the flowcharts illustrating the traffic anomaly detection method provided in the embodiments of this application;

[0037] Figure 2This is a second schematic flowchart of the traffic anomaly detection method provided in the embodiments of this application;

[0038] Figure 3 This is a flow graph in the flow anomaly detection method provided in the embodiments of this application;

[0039] Figure 4 This is a schematic diagram illustrating the determination of the continuous duration of each segment of the flow graph in the flow anomaly detection method provided in this application embodiment;

[0040] Figure 5 This is a schematic diagram of the flow anomaly detection device provided in the embodiments of this application;

[0041] Figure 6 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] Reference Figure 1 , Figure 1 This is one of the flowcharts illustrating the traffic anomaly detection method in the embodiments of this application. The traffic anomaly detection method provided in the embodiments of this application may include:

[0044] Step 100: Determine the data collection step size based on the device information and historical traffic data of the IoT device to be tested;

[0045] Specifically, the process of determining the data acquisition step size includes the following three steps:

[0046] 1. Determine the base duration of the IoT device under test based on its historical traffic data; 2. Determine the duration adjustment coefficient based on the device information of the IoT device under test; 3. Determine the data acquisition step size based on the base duration and the duration adjustment coefficient. Data acquisition step size = base duration × (1 - duration adjustment coefficient). The details of steps 1 and 2 above will be described below.

[0047] Step 200: Collect data on each traffic characteristic of the IoT device under test based on the data acquisition step size;

[0048] Specifically, this step uses a sliding window mechanism to collect traffic data based on the data acquisition step size of the IoT device under test, and finally obtains traffic characteristic data for multiple time periods.

[0049] Step 300: Determine the degree of difference of each of the traffic characteristics based on the data of each of the traffic characteristics;

[0050] Step 400: Perform traffic anomaly detection on the IoT device under test based on the difference.

[0051] Specifically, based on the traffic characteristic data collected over multiple time periods, the degree of difference of each traffic characteristic can be calculated, and finally, traffic anomaly detection is performed on the IoT device under test based on the degree of difference of each traffic characteristic.

[0052] This embodiment determines the data acquisition step size by using historical traffic information and device information of IoT devices. Based on the data acquisition step size of each IoT device, a sliding window mechanism is used to collect traffic data. This ensures data acquisition quality while collecting less traffic data. The difference degree of each traffic feature is calculated based on the collected traffic feature data, and traffic anomaly detection is performed based on the difference degree. The difference degree reflects the abnormality of traffic features, ensuring the accuracy of traffic anomaly detection.

[0053] Reference Figure 2 , Figure 2 This is a second flowchart illustrating the traffic anomaly detection method in this application. In one embodiment, the traffic anomaly detection method provided in this application may further include:

[0054] Step 110: Determine the duration adjustment coefficient based on the device information of the IoT device to be tested;

[0055] Step 120: Determine the base duration based on the historical traffic data of the IoT device to be tested;

[0056] Step 130: Determine the data acquisition step size based on the base duration and the duration adjustment coefficient.

[0057] The traffic anomaly detection method provided in this application embodiment may further include:

[0058] Step 111: Determine the number of vulnerabilities and the maximum vulnerability impact coefficient based on the device information of the IoT device to be tested;

[0059] Step 112: Determine the duration adjustment coefficient based on the number of vulnerabilities and the maximum vulnerability impact coefficient.

[0060] The traffic anomaly detection method provided in this application embodiment may further include:

[0061] Step 121: Determine the mean traffic, standard deviation of traffic, and maximum traffic based on the historical traffic data of the IoT device under test;

[0062] Step 122: Determine the base duration based on the mean flow rate, the standard deviation of the flow rate, and the maximum flow rate.

[0063] Specifically, the steps to determine the data collection step size based on the device information and historical traffic data of the IoT device to be tested are as follows:

[0064] 1. Determine the base duration of the IoT device to be tested;

[0065] 1.1 Obtain historical traffic data of the IoT device to be tested.

[0066] like Figure 3 As shown, historical traffic data is represented in the form of a traffic graph, recording the traffic values ​​of the IoT devices under test within a unit of time. This data is derived from the traffic logs stored on the IoT devices under test.

[0067] 1.2 Determine the mean μ and standard deviation σ of the flow rate, as well as the maximum flow rate values, based on historical flow data.

[0068] like Figure 3 As shown, the maximum flow rates include extreme values ​​1, 2, 3, and 4. The mean and standard deviation are calculated based on conventional calculation methods.

[0069] 1.3. Divide the flow graph into segments based on the maximum value.

[0070] like Figure 3 The flow chart shown can be divided into five segments: from the beginning to extreme value 1, from extreme value 1 to extreme value 2, from extreme value 2 to extreme value 3, from extreme value 3 to extreme value 4, and from extreme value 4 to the current value.

[0071] 1.4. Determine the value in each segment within the range [μ]. j -σ j μ j +σ j The continuous duration of ].

[0072] Where j is the j-th segment of the flow graph, μ j Let σ be the average flow rate of segment j. j Let be the standard deviation of the flow rate in segment j. For example... Figure 4 As shown, if the segment between extreme value 2 and extreme value 3 is j, the solid horizontal line is μ. j The upper and lower dashed horizontal lines are μ respectively. j +σ j and μ j -σ j .So Figure 4The duration between point 1 and point 2 in the range is the value within the range [μ]. j -σ j μ j +σ j The continuous duration of ].

[0073] 1.5 Determine whether there exists a segment whose mean is located in [μ-σ, μ+σ].

[0074] If it exists, determine the shortest continuous duration among the segments whose average value is located in [μ-σ, μ+σ], and use this duration as the base duration of the IoT device under test; if it does not exist, use the continuous duration of the segment closest to [μ-σ, μ+σ] as the base duration of the IoT device under test. If there are multiple segments that are closest to [μ-σ, μ+σ], use the shortest continuous duration among the multiple segments as the base duration of the IoT device under test.

[0075] 2. Determine the duration adjustment coefficient for the IoT device to be tested;

[0076] 2.1 Determine the number of vulnerabilities NB of the IoT device i to be tested. i and the maximum vulnerability impact factor EB i .

[0077] Vulnerabilities are inherent flaws in the configuration of IoT devices themselves and in subsequent upgrades, such as software vulnerabilities. The number of vulnerabilities can be obtained by comparing the factory parameters of the IoT device under test with subsequently released vulnerability information. If a vulnerability is later disclosed in the factory configuration, the vulnerability count for the IoT device under test is incremented by 1. When a vulnerability is disclosed, its impact is described, and the impact is determined (expressed as an impact coefficient).

[0078] 2.2 Determine the duration adjustment coefficient for the IoT device to be tested.

[0079] Where NB represents the maximum number of vulnerabilities across all IoT devices, and EB represents the maximum impact of vulnerabilities across all IoT devices.

[0080] In step 1 above, the base duration of the IoT device to be detected was determined. However, different IoT devices have different configurations, making them easier or harder to attack, which will lead to different attack probabilities in practical applications. Although the base duration can characterize the features of each IoT device to be detected, and the data collected based on the base duration can be used for anomaly detection, in order to improve collection efficiency, for IoT devices that are easily attacked, it is not necessary to collect the data for the entire base duration to obtain accurate analysis results. In this case, this embodiment will reflect the vulnerability of the IoT device itself to reflect its susceptibility to attack, and then adjust the actual collection duration to collect the least amount of data and obtain the most accurate detection results.

[0081] 3. Determine the data acquisition step size based on the base duration and duration adjustment coefficient.

[0082] Data acquisition step size = base duration × (1 - duration adjustment factor)

[0083] This embodiment determines the data collection step size by using the historical traffic data and device information of the IoT device under test, laying the foundation for subsequent traffic data collection.

[0084] In one embodiment, the traffic anomaly detection method provided in this application may further include:

[0085] Step 210: Starting from a preset initial time, slide the window based on the window length and the data acquisition step size to collect data on each traffic characteristic within the time period corresponding to the window. The window length is a preset duration.

[0086] Step 220: Stop sliding the window until the window reaches a preset termination time or the number of window slides reaches a first preset threshold, and obtain the data of each flow characteristic in the corresponding time period of each window.

[0087] Specifically, this embodiment employs a sliding window mechanism for data acquisition. A preset duration is used as the length of a window. Starting from a preset initial time, traffic data of the IoT device under test is collected within a time period corresponding to the window length. Then, the window is moved forward according to the data acquisition step size, and traffic data of the IoT device under test is collected again within a time period corresponding to the window length. This process of moving the window forward according to the data acquisition step size is repeated until the window reaches a preset termination time, or the number of window slides reaches a first preset threshold.

[0088] Based on the aforementioned window sliding mechanism, traffic characteristic data will be collected over n time periods. The duration of each time period is the same, and the offset between each time period and the previous time period is also the same (both are data collection step sizes). The collected traffic characteristics include source IP, destination IP, source port, destination port, and protocol type, etc.

[0089] This embodiment uses a sliding window mechanism to collect traffic characteristic data based on the data acquisition step size of the IoT device under test.

[0090] In one embodiment, the traffic anomaly detection method provided in this application may further include:

[0091] Step 310: When the traffic characteristic is a source port, determine the degree of difference of the source port in each window corresponding time period based on the total number of the source port appearing in each window corresponding time period, the number of different source ports in each window corresponding time period, and the number of different source ports in all windows corresponding time periods.

[0092] Specifically, we will take the traffic characteristic data source port as an example for explanation.

[0093] For the traffic characteristic data collected in each window, calculate the degree of difference for each collected content.

[0094] The source port traffic characteristic data collected by window w, and the source port difference Y are shown in Formula 1, where c is any one of the source ports. n represents the total amount of data appearing at source port c in the traffic characteristic data collected by window w of the IoT device i to be detected; iw (sourceD) represents the number of different source ports in the traffic characteristic data collected by window w of the IoT device i to be detected; n i (sourceD) represents the number of different source ports in the traffic feature data collected from all windows of the IoT device i to be detected.

[0095]

[0096] Similarly, the difference in source IP, destination IP, destination port, and protocol type can be calculated based on Formula 1 above.

[0097] This embodiment calculates the degree of difference of each flow characteristic by collecting data of each flow characteristic.

[0098] In one embodiment, the traffic anomaly detection method provided in this application may further include:

[0099] Step 410: If there is a difference greater than the second preset threshold among the differences of the traffic features within the time period corresponding to the target window, it is determined that the traffic of the IoT device to be detected is abnormal.

[0100] Step 420: If the number of windows in which the difference in the target traffic characteristics shows a continuous upward trend falls within a preset range, it is determined that the traffic of the IoT device to be detected is abnormal. The preset range is determined based on the total number of windows.

[0101] Specifically, based on the differences in traffic characteristics within the corresponding time periods of each window, traffic anomaly detection is performed on the IoT devices to be tested.

[0102] If the traffic characteristic difference exceeds a preset threshold (i.e., the second preset threshold in this embodiment), it indicates a significant difference, confirming abnormal traffic of the IoT device under test. For example, if the difference in source IPs within window w exceeds the preset threshold, it indicates the presence of numerous different source IPs within that window, suggesting the IoT device under test may be under attack.

[0103] If the traffic characteristic difference shows an upward trend for m consecutive windows, it indicates an anomaly in the traffic characteristic difference, and attack detection should be performed on the IoT device under test. Here, m belongs to min(NW, 5), and NW is one-third of the total number of data collection windows of the IoT device under test. That is, if the difference of 5 consecutive windows, or one-third of the total number of windows, shows an upward trend, then there may be an anomaly in the traffic.

[0104] This embodiment detects traffic anomalies by using the difference in various traffic characteristics. The difference reflects the abnormality of the traffic characteristics, thus ensuring the accuracy of traffic anomaly detection.

[0105] refer to Figure 5 , Figure 5 This is a schematic diagram of the flow anomaly detection device in the embodiments of this application. The flow anomaly detection device provided in the embodiments of this application is described below. The flow anomaly detection device described below can be referred to in correspondence with the flow anomaly detection method described above.

[0106] The data acquisition step size determination module 501 is used to determine the data acquisition step size based on the device information and historical traffic data of the IoT device to be detected.

[0107] The traffic feature data acquisition module 502 is used to acquire data of each traffic feature of the IoT device under test based on the data acquisition step size.

[0108] The traffic characteristic difference determination module 503 is used to determine the difference degree of each traffic characteristic based on the data of each traffic characteristic;

[0109] Traffic anomaly detection module 504 is used to detect traffic anomalies in the IoT device under test based on the difference.

[0110] Optionally, the data acquisition step size determination module includes:

[0111] The duration adjustment coefficient determination unit is used to determine the duration adjustment coefficient based on the device information of the IoT device to be tested.

[0112] The base duration determination unit is used to determine the base duration based on the historical traffic data of the IoT device under test;

[0113] The data acquisition step size determination unit is used to determine the data acquisition step size based on the base duration and the duration adjustment coefficient.

[0114] Optionally, the duration adjustment coefficient determination unit includes:

[0115] The vulnerability data determination unit is used to determine the number of vulnerabilities and the maximum vulnerability impact coefficient based on the device information of the IoT device to be tested.

[0116] The first determining unit is used to determine the duration adjustment coefficient based on the number of vulnerabilities and the maximum vulnerability impact coefficient.

[0117] Optionally, the basic duration determination unit includes:

[0118] The traffic correlation value determination unit is used to determine the traffic mean, traffic standard deviation, and traffic maximum value based on the historical traffic data of the IoT device under test.

[0119] The second determining unit is used to determine the base duration based on the mean flow rate, the standard deviation of the flow rate, and the maximum flow rate.

[0120] Optionally, the traffic characteristic data acquisition module includes:

[0121] A window sliding unit is used to slide the window based on the window length and the data acquisition step size, starting from a preset initial time, and to collect data on various traffic characteristics within the time period corresponding to the window, wherein the window length is a preset duration.

[0122] The traffic characteristic data acquisition unit is used to stop window sliding until the window reaches a preset termination time or the number of window slides reaches a first preset threshold, and to obtain the traffic characteristic data of each window within the corresponding time period.

[0123] Optionally, the traffic characteristic difference determination module includes:

[0124] The traffic characteristic difference determination unit is used to determine the difference of the source port in each window corresponding time period based on the total number of times the source port appears in each window corresponding time period, the number of different source ports in each window corresponding time period, and the number of different source ports in all windows corresponding time periods when the traffic characteristic is a source port.

[0125] Optionally, the traffic anomaly detection module includes:

[0126] The first traffic anomaly detection unit is used to determine that the traffic of the IoT device to be detected is abnormal when there is a difference greater than a second preset threshold among the differences of the traffic features within the time period corresponding to the target window.

[0127] The second traffic anomaly detection unit is used to determine that the traffic of the IoT device to be detected is abnormal when the number of windows in which the difference in the target traffic characteristics shows a continuous upward trend is within a preset range. The preset range is determined based on the total number of windows.

[0128] Figure 6 An example is a schematic diagram of the physical structure of a device, such as... Figure 6 As shown, the device may include a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call the computer program in the memory 630 to execute the steps of the traffic anomaly detection method.

[0129] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0130] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, the computer is able to perform the steps of the traffic anomaly detection method provided in the above embodiments.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0132] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the traffic anomaly detection method described in various embodiments or some parts of embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A traffic anomaly detection method, characterized by, The method comprises the following steps: According to the device information and historical traffic data of the to-be-detected Internet of Things device, determine the data collection step; Based on the data collection step, collect the data of each traffic feature of the to-be-detected Internet of Things device; According to the data of each traffic feature, determine the difference degree of each traffic feature; Based on the difference degree, perform traffic anomaly detection on the to-be-detected Internet of Things device; According to the device information and historical traffic data of the to-be-detected Internet of Things device, determine the data collection step, which comprises the following steps: According to the device information of the to-be-detected Internet of Things device, determine the time length adjustment coefficient; According to the historical traffic data of the to-be-detected Internet of Things device, determine the basic time length; Based on the basic time length and the time length adjustment coefficient, determine the data collection step; According to the device information of the to-be-detected Internet of Things device, determine the time length adjustment coefficient, which comprises the following steps: According to the device information of the to-be-detected Internet of Things device, determine the number of vulnerabilities and the maximum vulnerability influence coefficient; Based on the number of vulnerabilities and the maximum vulnerability influence coefficient, determine the time length adjustment coefficient.

2. The flow abnormality detection method according to claim 1, characterized by, According to the historical traffic data of the to-be-detected Internet of Things device, determine the basic time length, which comprises the following steps: According to the historical traffic data of the to-be-detected Internet of Things device, determine the traffic mean, traffic standard deviation, and traffic maximum value; Based on the traffic mean, traffic standard deviation, and traffic maximum value, determine the basic time length.

3. The flow abnormality detection method according to claim 1, characterized by, Based on the data collection step, collect the data of each traffic feature of the to-be-detected Internet of Things device, which comprises the following steps: Starting from a preset initial time, slide the window based on the window length and the data collection step, collect the data of each traffic feature in the time period corresponding to the window, and the window length is a preset time length; Until the window reaches a preset termination time, or the number of window sliding reaches a first preset threshold, stop window sliding, and obtain the data of each traffic feature in each window corresponding time period.

4. The flow abnormality detection method according to claim 3, characterized by, According to the data of each traffic feature, determine the difference degree of each traffic feature, which comprises the following steps: In the case that the traffic feature is a source port, based on the total amount of the source port appearing in each window corresponding time period, the number of different source ports in each window corresponding time period, and the number of different source ports in all window corresponding time periods, determine the difference degree of the source port in each window corresponding time period.

5. The flow abnormality detection method according to claim 4, characterized by, Based on the difference degree, perform traffic anomaly detection on the to-be-detected Internet of Things device, which comprises the following steps: In the case that there is a difference degree greater than a second preset threshold in the difference degree of each traffic feature in the time period corresponding to the target window, determine that the to-be-detected Internet of Things device is traffic abnormal; In the case that the number of windows in which the difference degree of the target traffic feature shows a continuous upward trend belongs to a preset interval, determine that the to-be-detected Internet of Things device is traffic abnormal, and the preset interval is determined based on the total number of windows.

6. A flow anomaly detection apparatus characterized by comprising: The method comprises the following steps: A data collection step determination module is configured to determine the data collection step according to the device information and historical traffic data of the to-be-detected Internet of Things device; A traffic feature data collection module is configured to collect the data of each traffic feature of the to-be-detected Internet of Things device based on the data collection step; The traffic feature difference degree determination module is configured to determine a difference degree of each traffic feature according to data of each traffic feature. The traffic anomaly detection module is configured to perform traffic anomaly detection on the to-be-detected Internet of Things device based on the difference degree. The determination of the data collection step length according to the device information and the historical traffic data of the to-be-detected Internet of Things device comprises: determining a time length adjustment coefficient according to the device information of the to-be-detected Internet of Things device; determining a basic time length according to the historical traffic data of the to-be-detected Internet of Things device; determining a data collection step length based on the basic time length and the time length adjustment coefficient; The determination of the time length adjustment coefficient according to the device information of the to-be-detected Internet of Things device comprises: determining a number of vulnerabilities and a maximum vulnerability influence coefficient according to the device information of the to-be-detected Internet of Things device; determining a time length adjustment coefficient based on the number of vulnerabilities and the maximum vulnerability influence coefficient.

7. An electronic device comprising a processor and a memory having a computer program stored therein, characterized in that The processor executes the computer program to implement the traffic anomaly detection method of any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the traffic anomaly detection method of any one of claims 1 to 5.

Images