Traffic anomaly detection method and device, readable storage medium, program product

Abstract

The application discloses a traffic anomaly detection method and device, a readable storage medium and a program product. Traffic data corresponding to each access request of a target website is obtained. Key network information in the traffic data of each access request is encoded respectively to obtain encoded features corresponding to each access request. The key network information includes an IP address, an access time, a URL, request header information and a response status code of the access request. Graphs constructed by the encoded features are respectively input into a graph neural network model for classification. The graph neural network model is trained by taking graphs constructed by encoded features corresponding to traffic data of historical access requests as samples and taking state types corresponding to the traffic data as labels. The state types include anomaly and normal. The graphs take the encoded features corresponding to the traffic data of each access request as nodes and take correlations between the nodes as edges. Based on a classification result output by the graph neural network model, abnormal traffic of the target website is detected.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method and apparatus for detecting abnormal traffic, a readable storage medium, and a program product. Background Technology

[0002] With the rapid development of internet technology, network traffic has experienced explosive growth. This has also led to an increase in abnormal traffic, posing a significant challenge to network security. Abnormal traffic can take various forms, including malicious attacks, unauthorized access, and data breaches. If not effectively detected and controlled, it can severely impact the stability and security of network systems.

[0003] Current methods for detecting abnormal traffic include rule-based matching, which primarily matches traffic data against pre-defined rules. While this method is simple to operate, rule creation and updating become extremely difficult in complex network environments and with ever-changing attack methods. Furthermore, rule-based matching often only identifies known abnormal traffic and is ineffective against unknown, novel attacks.

[0004] How to propose a traffic anomaly detection method to accurately detect various types of traffic anomalies on websites, thereby improving network security, is a problem that needs to be solved. Summary of the Invention

[0005] The purpose of this application is to provide a traffic anomaly detection method and apparatus, a readable storage medium, and a program product to solve the problem of low accuracy in existing website traffic anomaly detection.

[0006] To solve the above-mentioned technical problems, this specification is implemented as follows:

[0007] Firstly, a method for detecting abnormal traffic flow is provided, including:

[0008] Obtain traffic data corresponding to each access request to the target website;

[0009] The key network information in the traffic data of each access request is encoded to obtain the encoding features corresponding to each access request. The key network information includes the IP address, access time, URL, request header information and response status code of the access request.

[0010] The graphs constructed from each encoding feature are input into the graph neural network model for classification. The graph neural network model is trained using the graphs constructed from the encoding features corresponding to the traffic data of historical access requests as samples and the state types corresponding to the traffic data as labels. The state types include abnormal and normal. The graphs use the encoding features corresponding to the traffic data of each access request as nodes and the correlations between the nodes as edges.

[0011] Based on the classification results output by the graph neural network model, abnormal traffic of the target website is detected.

[0012] Optionally, the step of encoding the key network information in the traffic data of each access request to obtain the encoding features corresponding to each access request includes:

[0013] Based on the traffic data of the target access request, determine the key network information in the target access request, including the IP address, access time, URL, request header information and response status code of the target access request;

[0014] The IP address, access time, URL, request header information, and response status code of the target access request are encoded one by one;

[0015] The encodings corresponding to the IP address, access time, URL, request header information, and response status code are merged to obtain the encoding features corresponding to the target access request.

[0016] Optionally, the step of encoding the IP address, access time, URL, request header information, and response status code of the target access request in a one-to-one correspondence includes:

[0017] Encode the numeric sequence in the IP address as a first dimension value;

[0018] Based on the time difference between the access time and the first preset time and the second preset time, the second dimension value corresponding to the access time is encoded, wherein the first preset time and the second preset time are different;

[0019] The third dimension value corresponding to the URL is obtained by quantizing and encoding the URL.

[0020] By quantizing the request header information, the fourth dimension value corresponding to the request header information is encoded;

[0021] By quantizing the request response status code, the fifth dimension value corresponding to the response status code is encoded.

[0022] Optionally, encoding the second dimension value corresponding to the access time based on the time difference between the access time and the first preset time and the second preset time respectively includes:

[0023] Determine the first time difference between the access time and the first preset time, and the second time difference between the access time and the second preset time, respectively;

[0024] The first time difference is encoded as a first value and the second time difference is encoded as a second value;

[0025] By concatenating the first value and the second value, the second dimension value corresponding to the access time is obtained.

[0026] Optionally, before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the method further includes:

[0027] Based on the access time and IP address, the access frequency index corresponding to the target IP address is determined. The access frequency index is the sum of the number of times the target IP address accesses the target website in a first time interval within a preset time period and the number of times it accesses the target website in a second time interval within the preset time period. The first time interval and the second time interval are different.

[0028] If the access frequency index is greater than a preset threshold, then it is determined that there is abnormal traffic in each access request corresponding to the target IP address; or

[0029] If the access frequency index is not greater than the preset threshold, the graph constructed from the encoding features of the traffic data of each access request corresponding to the target IP address is input into the graph neural network model to determine whether there is traffic anomaly in the access requests corresponding to the target IP address.

[0030] Optionally, before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the method further includes:

[0031] The corresponding graph is constructed by taking the encoding features corresponding to the traffic data of each historical access request as nodes and the correlation between the corresponding nodes of each historical access request as edges.

[0032] Using the aforementioned graph as a sample and the state type corresponding to the traffic data as a label, the graph neural network model is trained.

[0033] Optionally, the step of constructing a corresponding graph by using the encoding features corresponding to the traffic data of each historical access request as nodes and the correlation between the corresponding nodes of each historical access request as edges includes:

[0034] Using the encoded features corresponding to the traffic data of each historical access request as nodes, and the correlations between the nodes corresponding to each historical access request as edges, construct an undirected graph G = {V, A}, where V represents the set of nodes, A represents the adjacency matrix corresponding to the nodes, and a i,j =corr(x i ,x j ), a i,j Corr(x) represents the element in the i-th row and j-th column of the adjacency matrix A. i ,x j) is x i and x j The correlation coefficient between them, i,j∈[1,t], where t represents the number of historical access requests, x i and x j These are the encoding features of the nodes;

[0035] By setting each element in the adjacency matrix to remain unchanged during the training of the graph neural network model, a static undirected graph corresponding to each historical access request is obtained.

[0036] By setting each element in the adjacency matrix to change dynamically during the training of the graph neural network model, a dynamic undirected graph corresponding to each historical access request is obtained.

[0037] The static undirected graph and the dynamic undirected graph are parallelized to obtain the constructed graph.

[0038] Optionally, the graph neural network model includes graph convolutional layers, graph attention layers, and feature fusion layers.

[0039] The process of training the graph neural network model using the graph as samples and the state type corresponding to the traffic data as labels includes:

[0040] The static undirected graph is input into the graph convolutional layer to obtain the first feature;

[0041] The dynamic undirected graph is input into the graph attention layer to obtain the second feature;

[0042] The first feature and the second feature are input into the feature fusion layer to obtain the fused feature;

[0043] Calculate the loss between the classification result of the traffic data corresponding to the fusion feature and the corresponding label;

[0044] The parameters of the graph neural network model are adjusted based on the loss until the classification result and the loss of the corresponding label of the graph neural network model converge, so as to train the graph neural network model.

[0045] In a second aspect, a traffic anomaly detection device is provided, comprising a processor and a memory, wherein the memory stores a program or instructions executable on the processor, and the program or instructions, when executed by the processor, implement the steps of the method described in the first aspect.

[0046] Thirdly, a readable storage medium is provided that stores a program or instructions which, when executed by a processor, implement the steps of the method described in the first aspect.

[0047] Fourthly, a computer program product is provided, comprising a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform the steps of the method described in the first aspect.

[0048] In this embodiment, traffic data corresponding to each access request of the target website is obtained; key network information in the traffic data of each access request is encoded to obtain the encoding features corresponding to each access request. The key network information includes the IP address, access time, URL, request header information, and response status code of the access request; the graphs constructed from each encoding feature are input into a graph neural network model for classification. The graph neural network model is trained using the graphs constructed from the encoding features corresponding to the traffic data of historical access requests as samples and the status types corresponding to the traffic data as labels. The status types include abnormal and normal. The graphs use the encoding features corresponding to the traffic data of each access request as nodes and the correlations between nodes as edges; based on the classification results output by the graph neural network model, abnormal traffic of the target website is detected. This adopts a multi-dimensional data fusion encoding method, which makes full use of the complementarity of data to comprehensively and integratedly analyze the characteristics of network traffic, improves the sensitivity and specificity of traffic anomaly detection, and can more accurately identify different types of abnormal traffic. This achieves comprehensiveness and efficiency in traffic anomaly detection, providing strong technical support for network security maintenance. Attached Figure Description

[0049] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0050] Figure 1 This is a flowchart illustrating the traffic anomaly detection method according to an embodiment of this application.

[0051] Figure 2 This is a schematic diagram of the overall flow of the traffic anomaly detection method according to an embodiment of this application.

[0052] Figure 3 This is a flowchart illustrating the training steps of a graph neural network model according to an embodiment of this application.

[0053] Figure 4 This is a structural block diagram of the flow anomaly detection device according to an embodiment of this application. Detailed Implementation

[0054] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. The drawing numbers in this application are only used to distinguish the various steps in the solution and are not used to limit the execution order of the various steps. The specific execution order is subject to the description in the specification.

[0055] To address the problems existing in the prior art, embodiments of this application provide a method for detecting abnormal traffic flow, such as... Figure 1 As shown, the process includes steps 102 to 108.

[0056] Step 102: Obtain the traffic data corresponding to each access request of the target website.

[0057] Data collection is the first step in abnormal traffic detection. At this stage, it is necessary to obtain website traffic data from multiple sources to ensure the comprehensiveness and accuracy of the data.

[0058] The target website is the one whose traffic needs to be monitored for anomalies. Traffic data for each access request on the target website can be obtained from its server logs, which record all access activities. Analyzing these logs can yield a large amount of traffic data. Additionally, web analytics tools and dedicated traffic monitoring tools can be used to collect traffic data, providing more detailed and in-depth information. During data collection, it's crucial to ensure the real-time nature and accuracy of the data. By properly configuring collection tools and monitoring strategies, the latest traffic data can be obtained in real time, and potential abnormal traffic can be detected promptly.

[0059] Step 104: Encode the key network information in the traffic data of each access request to obtain the encoding features corresponding to each access request. The key network information includes the IP address, access time, URL, request header information, and response status code of the access request.

[0060] After obtaining the traffic data for each access request in step 102, it is necessary to identify the key network information that reflects whether the traffic is normal or abnormal. This information includes the IP address, access time, URL, request header information, and response status code of the access request. Traffic data including the IP address, access time, and URL of the access request can be obtained from server logs; traffic data including the request header information and response status code can be obtained from web analytics tools and dedicated traffic monitoring tools. The key network information obtained above can help to gain a more comprehensive understanding of the characteristics and behavior of the target website's traffic.

[0061] Since the raw traffic data is obtained from different sources and has different formats and units, it is necessary to standardize the various types of data in the critical network information. This can be achieved through encoding to uniformly format the data, making it comparable and consistent. This includes standardizing the time format, converting data types, and standardizing units.

[0062] Before standardizing the data, preprocessing can be performed on the collected traffic data to ensure the accuracy and reliability of the data analysis. This stage involves cleaning the raw traffic data. Data cleaning removes invalid data, including erroneous requests, thereby eliminating noise and interference and improving the accuracy of the analysis.

[0063] Then, data standardization processing is performed. Specifically, the key network information in the traffic data of each access request is encoded to obtain the encoding features corresponding to each access request, including: determining the key network information in the target access request based on the traffic data of the target access request, including the IP address, access time, URL, request header information, and response status code of the target access request; encoding the IP address, access time, URL, request header information, and response status code of the target access request one-to-one; and fusing the encodings corresponding to the IP address, access time, URL, request header information, and response status code to obtain the encoding features corresponding to the target access request.

[0064] During encoding, each type of data in the key network information needs to be encoded separately, and then spliced ​​and merged to obtain the encoding features corresponding to an access request.

[0065] Optionally, the step of encoding the IP address, access time, URL, request header information, and response status code of the target access request one-to-one includes: encoding the numerical sequence in the IP address as a first dimension value; encoding a second dimension value corresponding to the access time based on the time difference between the access time and a first preset time and a second preset time, wherein the first preset time and the second preset time are different; encoding a third dimension value corresponding to the URL by quantizing the URL; encoding a fourth dimension value corresponding to the request header information by quantizing the request header information; and encoding a fifth dimension value corresponding to the response status code by quantizing the response status code.

[0066] Specifically, for the IP address of the access request, such as an IPv4 address, it is typically represented by a 32-bit binary value. This information is one of the core data used for abnormal traffic detection. First, the IP addresses are standardized in format, and then the IP addresses are represented in a preset base format, such as decimal.

[0067] The dots in the IP address are removed, and the IP address is encoded based on the string of values ​​corresponding to the remaining number sequence. For example, the 32-bit binary representation of an IPv4 address is divided into four 8-bit binary numbers, and the IP address is represented in dotted decimal notation as (abcd), where a, b, c, and d are decimal integers between 0 and 255. Further, to standardize the number of bits, values ​​between 0000 and 0255 are used. For example, 01100100.00000100.00000101.00000110 is represented as decimal 0100.0004.0005.0006. However, to accommodate the subsequent IPv6 encoding (16 8-bit binary numbers), leading zeros are added to the end of the IPv4 encoding until it reaches 64 bits.

[0068] For example, 01100100.00000100.00000101.00000110 can be actually encoded as: 01000004000500060000000000000000000000000000000000000000000000000000000. Thus, the IP address is encoded as the first dimension value.

[0069] For access time, encoding can be performed based on the time difference between different preset times and the access time. Specifically, the step of encoding the second dimension value corresponding to the access time based on the time difference between the access time and a first preset time and a second preset time includes: determining a first time difference between the access time and the first preset time and a second time difference between the access time and the second preset time; encoding the first time difference as a first value and the second time difference as a second value; and obtaining the second dimension value corresponding to the access time by concatenating the first value and the second value.

[0070] The first preset time is a selected start date, such as January 1, 2000; the second preset time is another selected start date, such as 0:00 on the date when the traffic anomaly detection needs to be performed, for example, 10:00:01 on January 31, 2000.

[0071] The decimal value of the difference between the access time and the first preset time is used as the first time code for the access time. For example, if January 1, 2000 is selected as the first start date, and the number of days between the access time and the first start date is 30, it is represented by a 4-digit decimal number as 0030. When the first time code overflows, for example, if the interval of days is greater than 9999, the first start date is changed. For example, the date of the current moment is used as the updated first start date.

[0072] Similar to the first time encoding, the second time encoding uses the decimal value of the difference between the access time and the second preset time. For example, if the current time's date is selected as 0:00 AM as the second start date, the second time encoding uses the decimal value of the difference between the access time and the second start time, accurate to the second. For example, if the difference is 10 hours and 1 second, it would be represented as 36001 with 5 decimal digits.

[0073] Then, the first and second time codes corresponding to the access time are concatenated to obtain the final time code. For example, for a 9-bit decimal value, the first 4 bits are the first time code, and the last 5 bits are the second time code. Thus, the access time is encoded as the second dimension value.

[0074] For request URLs, they can be quantized as a 3-digit decimal value. For example, OPTIONS, HEAD, GET, POST, PUT, DELETE, TRACE, and CONNECT can be encoded as 001 to 008 respectively, and other forms can be encoded as 009. Thus, the URL is encoded as a third-dimensional value.

[0075] For request header information, the header information can be standardized and quantified into a 3-digit decimal value. For example, User-Agent, Content-Type, and others can be encoded as 001, 010, and 100, respectively. This encodes the request header information as a fourth-dimensional value.

[0076] For response status codes, the response status code information can be standardized and quantified into a 2-digit decimal value. For example, the correspondence between decimal values ​​and response status codes is as follows: 20: OK; 21: Created; 24: NoContent; 31: Moved Permanently; 32: Found; 40: Bad Request; 41: Unauthorized; 43: Forbidden; 44: Not Found; 50: Internal Server Error; 52: Bad Gateway; 53: Service Unavailable; 60: Other. Thus, the response status code is encoded as a fifth-dimensional value.

[0077] Then, by fusing the dimension values ​​of the IP address, access time, URL, request header information, and response status code corresponding to each access request, the encoding features corresponding to each access request are obtained.

[0078] Combination Figure 2 For each access request, key network information including IP address, access time, URL, request header information, and response status code is encoded one by one to obtain corresponding encoded information, namely Encoding 1, Encoding 2, Encoding 3, Encoding 4, and Encoding 5. For the same access request, the corresponding bits of Encoding 1, Encoding 2, Encoding 3, Encoding 4, and Encoding 5 are merged or concatenated to obtain a merged encoding with a length of 81 bits.

[0079] By encoding, key network information in the original complex and diverse traffic data is transformed into a standardized form suitable for model processing, laying the foundation for subsequent abnormal traffic classification.

[0080] Step 106: Input the graphs constructed from each encoding feature into the graph neural network model for classification. The graph neural network model is trained using the graphs constructed from the encoding features corresponding to the traffic data of historical access requests as samples and the state types corresponding to the traffic data as labels. The state types include abnormal and normal. The graphs use the encoding features corresponding to the traffic data of each access request as nodes and the correlations between nodes as edges.

[0081] After obtaining the encoding characteristics of the traffic data corresponding to each access request of the target website, a graph is further constructed based on the encoding characteristics. The graph is constructed based on the encoding characteristics corresponding to the traffic data of all the access requests. For example, if there are 100 access requests, the encoding characteristics corresponding to the 100 access requests are used as nodes, and the correlation between the encoding characteristics is used as edges to construct the corresponding graph.

[0082] In this embodiment, the graph corresponding to the traffic data of access requests is used as input, and a graph neural network model is used as the traffic anomaly detection model to output the classification result of the traffic data of each access request: abnormal or normal. The graph neural network model is trained using the graph constructed from the encoded features corresponding to the traffic data of historical access requests as samples and the state type corresponding to the traffic data as labels.

[0083] Specifically, before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the method further includes: constructing corresponding graphs using the encoded features corresponding to the traffic data of each historical access request as nodes and the correlations between the corresponding nodes of each historical access request as edges; and training the graph neural network model using the graphs as samples and the state types corresponding to the traffic data as labels.

[0084] The method for obtaining the encoding characteristics corresponding to the traffic data of historical access requests is as described in step 104 above, and will not be repeated here. Each node in the constructed graph includes the encoding characteristics of the corresponding access request. The correlation between nodes is determined by whether there is an association relationship among one or more of the following in different access requests: IP address, access time, URL, request header information, and response status code. For example, if the IP address of one access request is the same as the IP address of another access request, and the corresponding encoding is the same, then there is a correlation between the two nodes.

[0085] Specifically, the step of constructing the corresponding graph by using the encoding features corresponding to the traffic data of each historical access request as nodes and the correlations between the corresponding nodes of each historical access request as edges includes: constructing an undirected graph G = {V, A} using the encoding features corresponding to the traffic data of each historical access request as nodes and the correlations between the corresponding nodes of each historical access request as edges, where V represents the set of nodes, A represents the adjacency matrix corresponding to the nodes, and a i,j =corr(x i ,x j ), a i,j Corr(x) represents the element in the i-th row and j-th column of the adjacency matrix A. i ,x j ) is x i and x j The correlation coefficient between them, i,j∈[1,t], where t represents the number of historical access requests, x i and x jThe encoding features of the nodes are used to obtain a static undirected graph corresponding to each historical access request by setting each element in the adjacency matrix to remain unchanged during the training of the graph neural network model. A dynamic undirected graph corresponding to each historical access request is obtained by setting each element in the adjacency matrix to change dynamically during the training of the graph neural network model. The static undirected graph and the dynamic undirected graph are then processed in parallel to obtain the graph structure.

[0086] Graph neural networks (GNNs) can directly process graph-structured data, including nodes, edges, and the relationships between them. This gives GNNs a natural advantage when dealing with complex graph data, such as those used for anomaly detection. In GNNs, nodes can propagate and interact with their neighbors through edges, allowing nodes to aggregate information from their neighbors and update their own representations. This helps capture both local and global information within the graph structure, improving the representational power of the GNN model. Furthermore, GNNs possess powerful representation learning capabilities, learning complex representations of nodes, edges, and the entire graph. This enables GNNs to process various complex graph-structured data and extract useful information from them.

[0087] In this embodiment, the traffic data of access requests are used to construct the corresponding graph, specifically represented by an undirected graph G = {V, A}, where V is a set of nodes consisting of traffic data of access requests from different websites obtained at different times. For example, for t access requests, the number of corresponding nodes is t, and V = [V1, V2, V3, ..., V]. i ,…V t ].

[0088] The encoding feature matrix X corresponding to the node is X = [x1, x2, x3, ... x i ,…x t ], i∈[1,t], x i It is node V i The encoding features of each node. The feature code x = [P1, P2, P3, ..., P... 81 As mentioned above, after encoding and fusing the five types of traffic data from an access request, an 81-bit encoded feature is obtained. Therefore, P1 represents the value of the first bit of the encoded feature, P2 represents the value of the second bit, and so on, with P81 representing the value of the 81st bit.

[0089] In this application, each node of the graph is a vector composed of the encoded features of an access request. Its content consists of the IP address, URL, request header information, access time and response status code of the access request, which are concatenated in order. The length of the vector is 64+3+3+9+2=81 bits.

[0090] A∈Rs×s Represents the adjacency matrix.

[0091] a i，j =Corr(x i x j )

[0092] Among them, a i,j Let element a represent the element in the i-th row and j-th column of adjacency matrix A. i,j It is a component of the adjacency matrix, corr(x) i ,x j ) is x i and x j The Pearson correlation coefficient between them, i,j∈[1,t].

[0093] After collecting normal and abnormal traffic data, each traffic data point is assigned a corresponding label to indicate whether it is normal or abnormal. Normal traffic data is labeled 0, and known abnormal traffic data is labeled 1. For example, approximately 10,000 traffic data points are manually labeled for training the graph neural network model, providing data support for subsequent traffic anomaly detection tasks.

[0094] In this embodiment of the application, the classification model is constructed as a parallel graph neural network model. That is, based on the above undirected graph G={V,A}, static undirected graphs and dynamic undirected graphs are constructed based on the encoding features corresponding to the traffic data of historical access requests.

[0095] When constructing a static undirected graph, the undirected graph remains unchanged during network training; that is, each element of the adjacency matrix of the undirected graph is constant. The purpose is to better utilize prior knowledge from log data. Conversely, when constructing a static undirected graph, the undirected graph is dynamically changed during network training. This construction method is learned through a graph attention mechanism, aiming to learn the relationships between nodes and improve message passing.

[0096] Its structure is as follows Figure 3 As shown, by parallelizing the static graph G1 and the dynamic graph G2 and providing them as inputs to the subsequent graph neural network for training, a parallel graph neural network model can be trained.

[0097] Optionally, the graph neural network model includes a graph convolutional layer, a graph attention layer, and a feature fusion layer. The step of training the graph neural network model using the constructed graph as samples and the state type corresponding to the traffic data as labels includes: inputting the static undirected graph into the graph convolutional layer to obtain a first feature; inputting the dynamic undirected graph into the graph attention layer to obtain a second feature; inputting the first feature and the second feature into the feature fusion layer to obtain a fused feature; calculating the loss between the classification result of the traffic data corresponding to the fused feature and the corresponding label; and adjusting the parameters of the graph neural network model based on the loss until the classification result and the loss of the corresponding label of the graph neural network model converge, thereby training the graph neural network model.

[0098] After obtaining the graph corresponding to each historical access request, the graph neural network model is trained by combining the labels of each node. The graph neural network model includes graph convolutional layers, graph attention layers, and feature fusion layers.

[0099] Combination Figure 3 The training method for the graph neural network is as follows: First, the dataset containing the encoded features corresponding to historical access requests is divided into a training set and a test set. Then, a static graph G1 and a dynamic graph G2 are constructed using all the data. The graph neural network model includes parallel graph convolutional layers and graph attention layers. The static graph G1 is input to the graph convolutional layer, while the dynamic graph G2 is input to the graph attention layer. The graph after the graph convolutional layer of the static graph G1 has the same number of nodes and edges as the static graph G1, and the encoded features of the nodes are new encoded features learned by the graph convolutional layer. Similarly, the graph after the graph attention layer of the dynamic graph G2 has the same number of nodes and edges as the dynamic graph G2, and the edge weights are learned by the graph attention layer, and the encoded features of the nodes are new encoded features learned by the graph attention layer.

[0100] Next, the graph features output from the graph convolutional layer and the graph attention layer are simultaneously input into the feature fusion layer for fusion, resulting in fused features. Optionally, the fused features can be further input into a multilayer perceptron (not shown in the figure) to reduce their dimensionality, which is beneficial for subsequent classification. Finally, as... Figure 3 As shown, a normalization layer, such as a Softmax layer, is used to classify the fused features after dimensionality reduction by the multilayer perceptron, resulting in the final classification results, including normal and abnormal.

[0101] During training, the cross-entropy loss between the classification result and the corresponding label can be used to optimize the graph neural network model. The formula for the cross-entropy loss is as follows:

[0102]

[0103] Where p = [p0,…,pC-1 ] is a probability distribution, where each element p i Let y represent the probability that a sample belongs to the i-th class; y = [y0, ..., y1] C-1 ] is the one-hot encoding of the sample label, where y represents the label when the sample belongs to the i-th class. i =1, otherwise y i =0; C is the number of categories.

[0104] The parameters of the graph neural network model are adjusted based on the cross-entropy loss until the loss converges, resulting in the final graph neural network model.

[0105] Parallel computation through graph neural networks enables the rapid capture of dynamic changes in network traffic, thereby accurately identifying abnormal traffic patterns and providing timely and effective protection for network security.

[0106] Furthermore, the parallel graph neural network model includes graph convolutional layers and graph attention layers. While fully learning the correlation between each node, it can retain as much prior information about the traffic data as possible. This structure enables the graph neural network model to exhibit better performance in abnormal traffic detection.

[0107] When constructing a graph neural network (GNN) model, the detection accuracy and performance can be improved by continuously adjusting model parameters and optimizing algorithms. Simultaneously, the GNN model is evaluated using a test set to ensure its effectiveness and reliability in practical applications. Optionally, LeakyReLU is used as the activation function in both the graph convolutional layers and graph attention layers of the parallel GNN model.

[0108] Step 108: Based on the classification results output by the graph neural network model, detect abnormal traffic on the target website.

[0109] For the traffic data corresponding to each access request of the target website obtained in step 102, the graph constructed by the corresponding encoding features is input into the trained graph neural network model. The graph neural network model can classify the state type of each traffic data. Based on whether the state type of each node is abnormal or normal, abnormal traffic of the target website can be detected, and the corresponding access request can be traced back. The model can also provide timely warnings or protection measures for the target website.

[0110] In one embodiment, the access time and IP address of the access request can be combined to pre-determine the target access request that is abnormal before using the graph neural network model for traffic anomaly detection.

[0111] Specifically, before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the method further includes: determining the access frequency index corresponding to the target IP address based on the access time and IP address, wherein the access frequency index is the sum of the number of times the target IP address accesses the target website within a first time interval and the number of times it accesses the target website within a second time interval in the preset time period, the first time interval being different from the second time interval; if the access frequency index is greater than a preset threshold, it is determined that each access request corresponding to the target IP address has abnormal traffic; or if the access frequency index is not greater than the preset threshold, the graphs constructed from the encoded features corresponding to the traffic data of each access request corresponding to the target IP address are input into the graph neural network model to determine whether the access requests corresponding to the target IP address have abnormal traffic.

[0112] The preset time period is, for example, one day; the first time interval is, for example, on the order of ten seconds; and the second time interval is, for example, on the order of hundreds of seconds. After obtaining the encoding characteristics of key network information in the traffic data of each access request, the access frequency index can be calculated using the encoding of IP address and access time.

[0113] The access frequency index is defined as follows:

[0114] L = L a +L b

[0115] Among them, L a L is a short-term access frequency index. For example, if there are 100 accesses from the same IP address within a 10-second time interval during a day, then L is considered a short-term access frequency index. a =1, otherwise, L a =0; L b This is a long-term access frequency index. For example, if there is a 300-second time interval within a day where the number of accesses from the same IP address exceeds 1000, then L is considered a high frequency index. b =1, otherwise, L b =0.

[0116] By calculating the sum of the short-term access frequency index and the long-term access frequency index, the access frequency index of each IP address can be determined, thus enabling a preliminary judgment on whether the target website is experiencing abnormal traffic.

[0117] Combination Figure 2If the access frequency index L is not equal to 0, the system outputs a detection result indicating abnormal traffic. If the access frequency index is equal to 0, a graph neural network model and a fusion encoding graph will be used to further detect whether there is abnormal traffic on the target website. That is, the detection model can include a graph neural network model, or it can further include a detection algorithm based on the access frequency index.

[0118] By combining the IP address and access time of the access request to calculate the access frequency index, it is possible to better capture the changing patterns and periodic characteristics of network traffic over time, and to predict abnormal traffic, thus saving computing resources.

[0119] In this embodiment, traffic data corresponding to each access request of the target website is obtained; key network information in the traffic data of each access request is encoded to obtain the encoding features corresponding to each access request. The key network information includes the IP address, access time, URL, request header information, and response status code of the access request; the graphs constructed from each encoding feature are input into a graph neural network model for classification. The graph neural network model is trained using the graphs constructed from the encoding features corresponding to the traffic data of historical access requests as samples and the status types corresponding to the traffic data as labels. The status types include abnormal and normal. The graphs use the encoding features corresponding to the traffic data of each access request as nodes and the correlations between nodes as edges; based on the classification results output by the graph neural network model, abnormal traffic of the target website is detected. This adopts a multi-dimensional data fusion encoding method, which makes full use of the complementarity of data to comprehensively and integratedly analyze the characteristics of network traffic, improves the sensitivity and specificity of traffic anomaly detection, and can more accurately identify different types of abnormal traffic. This achieves comprehensiveness and efficiency in traffic anomaly detection, providing strong technical support for network security maintenance.

[0120] Optionally, such as Figure 4 As shown in the figure, this application embodiment also provides a traffic anomaly detection device 2000, including a processor 2400 and a memory 2200. The memory 2200 stores a program or instructions that can run on the processor 2400. When the program or instructions are executed by the processor 2400, they implement the various steps of the above-described traffic anomaly detection method embodiment and can achieve the same technical effect. To avoid repetition, they will not be described again here.

[0121] This application also provides a readable storage medium storing a program or instructions. When executed by a processor, the program or instructions implement the various processes of any of the above-described traffic anomaly detection method embodiments and achieve the same technical effect. To avoid repetition, further details are omitted here. The readable storage medium includes computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0122] This application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program. The computer program is operable to cause a computer to execute various processes of any of the above-described traffic anomaly detection method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0123] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0124] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0125] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A method for detecting abnormal flow rates, characterized in that, include: Obtain traffic data corresponding to each access request to the target website; The key network information in the traffic data of each access request is encoded to obtain the encoding features corresponding to each access request. The key network information includes the IP address, access time, URL, request header information and response status code of the access request. The graphs constructed from each encoding feature are input into the graph neural network model for classification. The graph neural network model is trained using the graphs constructed from the encoding features corresponding to the traffic data of historical access requests as samples and the state types corresponding to the traffic data as labels. The state types include abnormal and normal. The graphs use the encoding features corresponding to the traffic data of each access request as nodes and the correlations between the nodes as edges. Based on the classification results output by the graph neural network model, abnormal traffic of the target website is detected; The process of encoding key network information in the traffic data of each access request to obtain the encoding features corresponding to each access request includes: Based on the traffic data of the target access request, determine the key network information in the target access request, including the IP address, access time, URL, request header information and response status code of the target access request; The IP address, access time, URL, request header information, and response status code of the target access request are encoded one by one; The encodings corresponding to the IP address, access time, URL, request header information, and response status code are merged to obtain the encoding features corresponding to the target access request.

2. The method according to claim 1, characterized in that, The step of encoding the IP address, access time, URL, request header information, and response status code of the target access request one-to-one includes: Encode the numeric sequence in the IP address as a first dimension value; Based on the time difference between the access time and the first preset time and the second preset time, the second dimension value corresponding to the access time is encoded, wherein the first preset time and the second preset time are different; The third dimension value corresponding to the URL is obtained by quantizing and encoding the URL. By quantizing the request header information, the fourth dimension value corresponding to the request header information is encoded; The fifth dimension value corresponding to the response status code is obtained by quantizing the response status code and encoding it.

3. The method according to claim 2, characterized in that, The process of encoding the second dimension value corresponding to the access time based on the time difference between the access time and the first preset time and the second preset time includes: Determine the first time difference between the access time and the first preset time, and the second time difference between the access time and the second preset time, respectively; The first time difference is encoded as a first value and the second time difference is encoded as a second value; By concatenating the first value and the second value, the second dimension value corresponding to the access time is obtained.

4. The method according to claim 1, characterized in that, Before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the process further includes: Based on the access time and IP address, the access frequency index corresponding to the target IP address is determined. The access frequency index is the sum of the number of times the target IP address accesses the target website in a first time interval within a preset time period and the number of times it accesses the target website in a second time interval within the preset time period. The first time interval and the second time interval are different. If the access frequency index is greater than a preset threshold, then it is determined that there is abnormal traffic in each access request corresponding to the target IP address; or If the access frequency index is not greater than the preset threshold, the graph constructed from the encoding features of the traffic data of each access request corresponding to the target IP address is input into the graph neural network model to determine whether there is traffic anomaly in the access requests corresponding to the target IP address.

5. The method according to claim 1, characterized in that, Before inputting the graphs constructed from each encoded feature into the graph neural network model for classification, the process further includes: The corresponding graph is constructed by taking the encoding features corresponding to the traffic data of each historical access request as nodes and the correlation between the corresponding nodes of each historical access request as edges. Using the aforementioned graph as a sample and the state type corresponding to the traffic data as a label, the graph neural network model is trained.

6. The method according to claim 5, characterized in that, The process of constructing a corresponding graph by using the encoding features corresponding to the traffic data of each historical access request as nodes and the correlations between the corresponding nodes of each historical access request as edges includes: An undirected graph is constructed using the encoding features corresponding to the traffic data of each historical access request as nodes and the correlations between the corresponding nodes of each historical access request as edges. Where V represents the set of nodes, and A represents the adjacency matrix of the nodes. , Let represent the element in the i-th row and j-th column of the adjacency matrix A. for The correlation coefficient between i, j t represents the number of historical access requests. These are the encoding features of the nodes; By setting each element in the adjacency matrix to remain unchanged during the training of the graph neural network model, a static undirected graph corresponding to each historical access request is obtained. By setting each element in the adjacency matrix to change dynamically during the training of the graph neural network model, a dynamic undirected graph corresponding to each historical access request is obtained. The static undirected graph and the dynamic undirected graph are parallelized to obtain the constructed graph.

7. The method according to claim 6, characterized in that, The graph neural network model includes graph convolutional layers, graph attention layers, and feature fusion layers. The process of training the graph neural network model using the graph as samples and the state type corresponding to the traffic data as labels includes: The static undirected graph is input into the graph convolutional layer to obtain the first feature; The dynamic undirected graph is input into the graph attention layer to obtain the second feature; The first feature and the second feature are input into the feature fusion layer to obtain the fused feature; Calculate the loss between the classification result of the traffic data corresponding to the fusion feature and the corresponding label; The parameters of the graph neural network model are adjusted based on the loss until the classification result and the loss of the corresponding label of the graph neural network model converge, so as to train the graph neural network model.

8. A flow anomaly detection device, characterized in that, It includes a processor and a memory, the memory storing a program or instructions that can run on the processor, the program or instructions being executed by the processor to implement the steps of the method as described in any one of claims 1-7.

9. A readable storage medium, characterized in that, The readable storage medium stores a program or instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a non-transitory computer-readable storage medium storing a computer program operable to cause a computer to perform the steps of the method as described in any one of claims 1 to 7 when executed.

Images