Network traffic prediction method, apparatus, network node, storage medium, and computer program product

Abstract

The application discloses a network flow prediction method and device, a network node, a storage medium and a computer program product. The method comprises the following steps: a network node acquires first data, wherein the first data contains historical attack data of one or more servers; features of the first data are extracted, and the first data is clustered by using the extracted features to obtain a clustering result, wherein the clustering result represents a server set similar to the historical attack data, and each server set contains at least one server; and a first prediction result of a first server in the one or more servers is obtained by using the clustering result, wherein the first prediction result represents an abnormal network flow condition of the first server.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network traffic prediction method and device, a network node, a storage medium and a computer program product. BACKGROUND

[0002] A distributed denial of service (DDoS, Distributed Denial Of Service) attack is an attack in which an attacker uses a large number of false Internet Protocol (IP) addresses to send a large number of invalid or high-traffic network requests to an attacked object (such as a target server), so as to exhaust the resources of the attacked object, thereby causing legitimate users to be unable to normally access.

[0003] For DDoS attacks, network anomaly traffic detection technology is an effective protection means, which can monitor network traffic in real time, identify current DDoS attack traffic of the network, and reduce the impact of DDoS attacks on network traffic by separating the identified DDoS attack traffic from legitimate traffic and cleaning the attack traffic. However, the above technology detects the current network traffic and cannot predict the network traffic, so it is difficult to achieve early warning of attacks.

[0004] For network traffic prediction, related network traffic prediction schemes have the problem of low prediction accuracy. SUMMARY

[0005] To solve the problems in the related art, the embodiments of the present application provide a network traffic prediction method, device, network node, storage medium and computer program product.

[0006] The technical scheme of the embodiments of the present application is implemented as follows:

[0007] The embodiments of the present application provide a network traffic prediction method applied to a network node, comprising:

[0008] Obtaining first data, wherein the first data contains historical attack data of one or more servers;

[0009] Extracting features of the first data, and clustering the first data using the extracted features to obtain a clustering result, wherein the clustering result represents a set of one or more servers with similar historical attack data, and each server set contains at least one server;

[0010] Using the clustering result to obtain a first prediction result of a first server in the one or more servers, wherein the first prediction result represents a network traffic anomaly of the first server.

[0011] In the scheme, the first prediction result of the first server in the one or more servers is obtained by using the clustering result, including:

[0012] The second data containing historical network traffic data of the one or more servers is obtained.

[0013] The second prediction result of the first server is obtained by using the second data, and the second prediction result represents a network traffic anomaly situation of the first server.

[0014] The first prediction result is obtained by using the second prediction result and the clustering result.

[0015] In the scheme, the first prediction result is obtained by using the second prediction result and the clustering result, including:

[0016] A first server set associated with the first server represented by the clustering result is determined.

[0017] The third prediction result of one or more second servers in the first server set except the first server is obtained by using the second data, and the third prediction result represents a network traffic anomaly situation of the second server.

[0018] The first prediction result is obtained by using the second prediction result and the third prediction result of the one or more second servers.

[0019] In the scheme, the first prediction result is obtained by using the second prediction result and the third prediction result of the one or more second servers, including:

[0020] The third prediction result matched with the second prediction result is determined from the third prediction result of the one or more second servers.

[0021] The first ratio representing the similarity between the network traffic anomaly situation represented by the second prediction result and the network traffic anomaly situation represented by the third prediction result is determined by using the determined third prediction result and the third prediction result of the one or more second servers.

[0022] In the case where the first ratio is greater than or equal to a first threshold value, the second prediction result is taken as the first prediction result.

[0023] In the scheme, the method further includes:

[0024] In the case where the first ratio is less than the first threshold value, the second prediction result is updated by using the determined third prediction result to obtain the first prediction result.

[0025] In the above scheme, the step of clustering the first data using the extracted features to obtain the clustering result includes:

[0026] Using the extracted features, the similarity between the historical attack data of each server in the first data and the historical attack data of other servers is determined;

[0027] The first data is clustered using a determined similarity to obtain the clustering result.

[0028] In the above scheme, determining the similarity between historical attack data of each server and historical attack data of other servers in the first data using extracted features includes:

[0029] By utilizing the extracted features, the distance between the historical attack data of each server in the space and the historical attack data of other servers is determined, thus obtaining the first distance;

[0030] Using the first distance, the similarity between the historical attack data of each server and the historical attack data of other servers is obtained.

[0031] In the above scheme, the step of using extracted features to determine the distance between the historical attack data of each server in the space and the historical attack data of other servers to obtain the first distance includes:

[0032] The extracted features are divided into a first feature and a second feature. The first feature contains static features of the historical attack data of the one or more servers, and the second feature contains time-related features of the historical attack data of the one or more servers.

[0033] Determine the distance between the first feature corresponding to the historical attack data of each server in the space and the first feature corresponding to the historical attack data of other servers to obtain the second distance;

[0034] The third distance is obtained by determining the distance between the second feature corresponding to the historical attack data of each server in the space and the second feature corresponding to the historical attack data of other servers.

[0035] The first distance is obtained by using the second distance and the third distance.

[0036] The method in the above scheme further includes:

[0037] The first data is preprocessed to obtain the preprocessed first data;

[0038] Extract features from the preprocessed first data.

[0039] The embodiment of the present application further provides a network flow prediction device, comprising:

[0040] An acquisition unit is configured to acquire first data, wherein the first data comprises historical attack data of one or more servers;

[0041] A clustering unit is configured to extract features of the first data, and cluster the first data by using the extracted features to obtain clustering results, wherein the clustering results represent one or more server sets with similar historical attack data, and each server set comprises at least one server;

[0042] A prediction unit is configured to obtain a first prediction result of a first server in the one or more servers by using the clustering results, wherein the first prediction result represents a network flow anomaly of the first server.

[0043] The embodiment of the present application further provides a network node, comprising a processor and a communication interface; wherein,

[0044] The communication interface is configured to acquire first data, wherein the first data comprises historical attack data of one or more servers;

[0045] The processor is configured to extract features of the first data, and cluster the first data by using the extracted features to obtain clustering results, wherein the clustering results represent one or more server sets with similar historical attack data, and each server set comprises at least one server; and obtain a first prediction result of a first server in the one or more servers by using the clustering results, wherein the first prediction result represents a network flow anomaly of the first server.

[0046] The embodiment of the present application further provides a network node, comprising a processor and a memory for storing a computer program capable of running on the processor,

[0047] When the processor is used to run the computer program, the processor is configured to perform the steps of any of the network flow prediction methods.

[0048] The embodiment of the present application further provides a storage medium, wherein the storage medium stores a computer program, and the computer program is used to perform the steps of any of the network flow prediction methods when the computer program is executed by a processor.

[0049] The embodiment of the present application further provides a computer program product, comprising a computer program, and the computer program is used to perform the steps of any of the network flow prediction methods when the computer program is executed by a processor.

[0050] The network flow prediction method, device, network node, storage medium and computer program product provided by the embodiment of the application, the network node obtains first data, the first data contains historical attack data of one or more servers; the features of the first data are extracted, and the first data is clustered by using the extracted features to obtain a clustering result, the clustering result represents a server set similar in historical attack data, and each server set contains at least one server; by using the clustering result, a first prediction result of a first server in the one or more servers is obtained, and the first prediction result represents the network flow anomaly of the first server. The technical scheme provided by the embodiment of the application can cluster the attack similarity of the historical attack data by analyzing the features of the historical attack data (such as DDos attack data) of the server, so as to obtain the server set attacked by similar attacks, so that the network node can predict the network abnormal flow of the target server (i.e. the first server) based on the server set similar in attack, and the prediction accuracy is improved. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 A network flow prediction method flowchart of an embodiment of the application;

[0052] Figure 2 A network abnormal flow prediction system structure diagram of an embodiment of the application;

[0053] Figure 3 A network abnormal flow prediction method flowchart of an embodiment of the application;

[0054] Figure 4 A network flow prediction device structure diagram of an embodiment of the application;

[0055] Figure 5 A network node structure diagram of an embodiment of the application. DETAILED DESCRIPTION

[0056] The application will be described in further detail below with reference to the drawings and embodiments.

[0057] The related network flow prediction scheme mainly uses artificial intelligence technology to collect and extract the features of network flow, and predicts and classifies the network flow; wherein, the network flow is affected by many factors, and has linear, nonlinear, multi-scale and other characteristics.

[0058] In a network traffic prediction scheme, a linear prediction method (such as an Auto-Regressive Moving Average Model (ARMA) model) is used to realize short-term prediction of network traffic and overload early warning. However, the above scheme ignores the nonlinear variation characteristics such as randomness and suddenness of network traffic, and the prediction accuracy of network traffic is not high in complex scenarios.

[0059] In another network traffic prediction scheme, in order to improve the prediction accuracy, a prediction method combining a BackPropagation (BP) neural network, a Convolutional Neural Networks (CNN), a Recurrent Neural Network (RNN), and other nonlinear models and multiple models is used to realize higher-precision prediction of network traffic. Then, combined with a machine learning model, the abnormal situation of network traffic can be identified.

[0060] As can be seen from the above description, the related network traffic prediction scheme uses deep learning and machine learning methods to analyze historical network traffic and predict network abnormal situations. In this process, since only historical network traffic is used as input, the influence of attack features (such as DDoS attack features) on prediction is not fully considered, and there is a high false negative rate, which makes it difficult to ensure high-precision attack prediction. In addition, only the traffic rules of the target server itself over time are used for prediction, without considering the situation of similar servers in space, and there is also a high false positive rate.

[0061] Therefore, in various embodiments of the present application, a network node can cluster attack similarity and obtain attack-similar servers (which can also be referred to as cluster servers) by performing feature extraction and similarity analysis of historical attack data. By using attack-similar servers to predict network abnormal traffic of a target server, the prediction accuracy can be improved, and the attack can be warned in advance, thereby ensuring network security.

[0062] The embodiments of the present application provide a network traffic prediction method, as shown in Figure 1 The method is applied to a network node and includes the following steps.

[0063] Step 101: Obtain first data containing historical attack data of one or more servers.

[0064] Step 102: extracting features of the first data, and clustering the first data by using the extracted features to obtain a clustering result, the clustering result representing one or more server sets similar to the historical attack data, each server set containing at least one server;

[0065] Step 103: obtaining a first prediction result of a first server in the one or more servers by using the clustering result, the first prediction result representing a network traffic anomaly of the first server.

[0066] In actual application, the network node can be referred to as a network traffic prediction node, a service node, etc., and the application embodiments do not limit the name of the network node as long as the function is realized. In addition, the first server can be referred to as a target server or a target server to be predicted, and the application embodiments do not limit the name of the first server.

[0067] In actual application, in step 101, the network node can obtain the historical attack data of the one or more servers from a related attack cleaning system (such as a DDos cleaning system), so as to obtain the first data; wherein the historical attack data of each server can contain one or more (also can be understood as at least one or at least one) of attack identification (such as ID), destination IP address, port, network protocol, total attack traffic, attack traffic rate, attack type, attack start time, update time and attack state.

[0068] Exemplarily, in the process of cleaning network abnormal traffic, the attack cleaning system can generate a network traffic cleaning log at a fixed time interval until the attack ends; wherein the fields of the network traffic cleaning log can contain one or more of attack ID, destination IP address, port, network protocol, total attack traffic, attack traffic rate, attack type, attack start time, update time and attack state. In this case, the network node can collect the network traffic cleaning logs generated by the attack cleaning system within a certain time length (which can be set according to needs), so as to obtain the first data.

[0069] In actual application, before step 102, the network node can pre-process the first data to better represent the attack target or attack change associated with the first data.

[0070] Based on this, in an embodiment, the method can further include:

[0071] Pre-processing the first data to obtain pre-processed first data;

[0072] Extracting features of the pre-processed first data.

[0073] The type of preprocessing can include filtering, merging, or data enhancement, and the specific type of preprocessing is not limited in the embodiments of the present application.

[0074] In actual application, since attacks are usually persistent, the network node can perform merging processing on the historical attack data of the one or more servers based on the attack identifiers included in the historical attack data, so as to better represent the change of attack traffic.

[0075] For example, the network node can merge the historical attack data with the same attack ID (which can be understood as the same server) to realize standardization of the historical attack data. By aggregating the attack traffic rate and / or attack start time included in the historical attack data, an attack traffic trend (which can also be referred to as attack traffic trend data) can be formed. The merged historical attack data can include one or more of the destination IP address, the port, the network protocol, the attack type, and the attack traffic trend. The attack traffic trend can be understood as a finite set and can be expressed as:

[0076] L = {(t1, p1), (t2, p2),..., (tm, pm)} (1) m m

[0077] Wherein, L represents the attack traffic trend, m represents the number of elements (which can also be referred to as a binary tuple) in the attack traffic trend, (t m m represents the attack traffic rate at time t m is p m , and the time interval t m -t m-1 is fixed.

[0078] In actual application, since attacks are usually targeted, the network node can combine customer asset data to perform data enhancement on the historical attack data of the one or more servers, so as to better represent the attack target. The customer asset data can be obtained from the related servers and can include one or more (or at least one) of the server purpose and the customer code corresponding to the server, and the embodiments of the present application are not limited in this regard.

[0079] For example, the network node can add one or more of the purpose of the server and the customer code to which the server belongs to the historical attack data of the one or more servers, to obtain the historical attack data of the one or more servers after data enhancement.

[0080] ​​​Here, after preprocessing the first data, the network node can perform feature extraction on the preprocessed first data, and generate a feature set corresponding to the first data using the extracted features, so as to subsequently cluster the first data using the feature set to obtain the clustering result. The feature set can include features corresponding to the historical attack data of each server in the one or more servers; wherein the feature set can be represented as:

[0081] A={a1,a2,...,a n} (2)

[0082] Wherein A represents the feature set, n represents the size of the feature set, i.e. the number of data points contained, and a n represents the nth data point (also referred to as sample point) in the feature set, which contains all features of the historical attack data of the nth server, each data point is identified by destination IP address and port, and a n can be represented as:

[0083] a n ={d1,d2,d3,d4,d5,L} (3)

[0084] Wherein d1 represents the network protocol, d2 represents the attack type, d3 represents the total attack traffic, d4 represents the purpose of the server, and d5 represents the customer code to which the server belongs.

[0085] In actual application, considering that different features may have different scales and distributions, the network node can perform normalization processing on the features contained in each data point in the feature set, so as to subsequently cluster the first data using the normalized feature set to improve the clustering effect, i.e. to improve the clustering effect.

[0086] In actual application, attackers often use a large number of zombie hosts to attack specific servers, and such attacks have certain relationships in the dimensions of attack target, attack means, attack frequency, traffic size, etc. Therefore, the network node can determine similar historical attack data using the feature set, thereby realizing clustering of the first data.

[0087] Specifically, in an embodiment, the specific implementation of step 102 can include:

[0088] Using the extracted features, determine the similarity between the historical attack data of each server in the first data and the historical attack data of other servers;

[0089] Using the determined similarity to cluster the first data to obtain the clustering result.

[0090] In actual application, based on the feature set, the network node can analyze the similarity of attacks suffered by the one or more servers to obtain a clustering result of corresponding historical attack data in attack similarity; wherein, the similarity between corresponding historical attack data can be obtained by using the distance of historical attack data of different servers in space (such as two-dimensional space or three-dimensional space).

[0091] Specifically, in an embodiment, the determination of the similarity between the historical attack data of each server in the first data and the historical attack data of other servers by using the extracted features comprises:

[0092] The determination of the distance between the historical attack data of each server and the historical attack data of other servers in space by using the extracted features obtains a first distance.

[0093] The determination of the similarity between the historical attack data of each server and the historical attack data of other servers by using the first distance.

[0094] In actual application, for the distance of historical attack data of two servers in space, the network node can calculate the distance between corresponding features of historical attack data of the two servers by using the feature set, and take the calculated distance as the similarity between the historical attack data of the two servers; wherein, the greater the calculated distance is, the lower the similarity between the historical attack data of the two servers is; correspondingly, the smaller the calculated distance is, the higher the similarity between the historical attack data of the two servers is.

[0095] Specifically, in an embodiment, the determination of the distance between the historical attack data of each server and the historical attack data of other servers in space by using the extracted features obtains a first distance, which comprises:

[0096] The division of the extracted features obtains a first feature and a second feature, wherein the first feature contains static features of the historical attack data of the one or more servers, and the second feature contains time-related features of the historical attack data of the one or more servers.

[0097] The determination of the distance between the first feature corresponding to the historical attack data of each server and the first feature corresponding to the historical attack data of other servers in space obtains a second distance.

[0098] The determination of the distance between the second feature corresponding to the historical attack data of each server and the second feature corresponding to the historical attack data of other servers in space obtains a third distance.

[0099] The determination of the first distance by using the second distance and the third distance.

[0100] The first feature can be referred to as a static feature, and the second feature can be referred to as a dynamic feature or a time sequence feature. The names of the first feature and the second feature are not limited in the embodiments of the present application.

[0101] In actual applications, the network node can divide the features contained in each data point based on the attributes of the features associated with the feature set to obtain the first feature and the second feature. In the case where each data point in the feature set contains one or more of a network protocol, an attack type, total attack traffic, a use of a server, and a customer code to which a server belongs, the first feature can contain one or more of the network protocol, the attack type, the total attack traffic, the use of the server, and the customer code to which the server belongs of the historical attack data of the one or more servers. In the case where each data point in the feature set contains an attack traffic trend, the second feature can contain the attack traffic trend of the historical attack data of the one or more servers.

[0102] Here, for the first feature, the network node can use the Euclidean distance to calculate the distance between the first feature corresponding to the historical attack data of one server (which can be understood as the first feature contained in one data point in the feature set) and the first feature corresponding to the historical attack data of another server (which can be understood as the first feature contained in another data point in the feature set), thereby obtaining the second distance. The distance between the first features corresponding to two data points can be expressed as:

[0103]

[0104] ED(H,Q) represents the distance between data point H and data point Q, r represents the number of features, such as 5, representing five features d1 to d5, h i represents the i-th feature contained in data point H, q i represents the i-th feature contained in data point Q.

[0105] In actual application, since the attack duration corresponding to the historical attack data of each server can be different and / or the attack start time is different, and the time granularity of the historical attack data is fine, the network node can use a dynamic time adjustment (DTW, Dynamic Time Warping) algorithm (specifically, a FastDTW algorithm) to calculate the distance between the second features corresponding to the historical attack data of one server (which can be understood as the second features contained in one data point in the feature set) and the second features corresponding to the historical attack data of another server (which can be understood as the second features contained in another data point in the feature set), thereby obtaining the third distance; wherein the distance between the second features corresponding to two data points can be expressed as:

[0106]

[0107] wherein H L represents the second features contained in the data point H, Q L represents the second features contained in the data point Q, DTW(H L , Q L ) represents the distance between the second features corresponding to the data point H and the data point Q.

[0108] It should be noted that the principle of the DTW algorithm is to align the second features contained in two data points according to the optimal path to determine a path, so that the sum of the distances between all features on the path is minimized, thereby obtaining the corresponding distance.

[0109] In actual application, after obtaining the second distance and the third distance, the network node can perform summation processing on the second distance and the third distance to obtain the first distance; wherein the first distance can be expressed as:

[0110]

[0111] That is, the network node can take the total distance of the first features and the second features corresponding to two data points as the distance between the historical attack data of the corresponding two servers, and further obtain the first distance.

[0112] In actual application, after obtaining the first distance, the network node can use a clustering algorithm (such as a K-means clustering algorithm) to cluster the historical attack data of the one or more servers to obtain one or more server sets with similar historical attack data, so as to realize clustering of the historical attack data in attack similarity; wherein each server set can include one or more servers (which can also be understood as at least one server) subjected to similar attacks.

[0113] Here, in the case of generating the clustering result, the network node can combine the related prediction result to perform secondary prediction on the related prediction result through the clustering result, so as to improve the prediction accuracy of the first server.

[0114] Specifically, in an embodiment, the specific implementation of step 103 can include:

[0115] obtaining second data containing historical network traffic data of the one or more servers;

[0116] obtaining a second prediction result of the first server by using the second data, the second prediction result representing network traffic anomaly of the first server;

[0117] obtaining the first prediction result by using the second prediction result and the clustering result.

[0118] Wherein, the second prediction result can be referred to as a first prediction result, which can represent network traffic anomaly of the first server in a future time period, such as existence of abnormal network traffic or non-existence of abnormal network traffic, and the first prediction result can be referred to as a final prediction result or a secondary prediction result, which can represent network traffic anomaly of the first server in a future time period. The name of the first prediction result and the second prediction result is not limited in the embodiments of the present application, as long as the function is realized.

[0119] In actual application, the network node can obtain the historical network traffic data of the one or more servers from a related network traffic detection system to obtain the second data, use a related network traffic prediction method (such as a linear prediction method or a nonlinear model) to obtain the second prediction result by using the second data, and then perform secondary prediction on the second prediction result through the clustering result to improve the prediction accuracy.

[0120] Here, in the process of performing secondary prediction on the second prediction result, the network node can determine other servers similar to the historical attack data of the first server based on the clustering result, so as to perform secondary prediction based on the determined other servers to obtain the first prediction result.

[0121] Specifically, in an embodiment, the obtaining of the first prediction result by using the second prediction result and the clustering result includes:

[0122] determining a first server set associated with the first server represented by the clustering result;

[0123] The second data is used to obtain third prediction results of one or more second servers in the first server set except the first server, the third prediction results representing network traffic anomaly conditions of the second servers;

[0124] The second prediction result and the third prediction results of the one or more second servers are used to obtain the first prediction result.

[0125] The first server set can be referred to as a same-cluster server list, a same-cluster server set, etc., and the first server set at least contains the first server. When the first server set contains the one or more second servers, the one or more second servers can be referred to as same-cluster servers of the first server, that is, the one or more second servers are similar to the first server in attack.

[0126] Here, the network node can find the first server set corresponding to the first server from the one or more server sets represented by the clustering result, and each server in the first server set can be identified by an IP address and a port. When the first server set contains the one or more second servers, the network node can determine a first number corresponding to the one or more second servers. If the first number is less than a second threshold (which can also be referred to as a same-cluster server number threshold, which can be set as needed, and embodiments of the present application do not limit this), it represents that the number of second servers is small, and the one or more second servers cannot be used for secondary prediction. In this case, the network node can use the second prediction result as the first prediction result.

[0127] In actual application, if the first number is greater than or equal to the second threshold, it represents that the number of second servers is large, and in this case, the network node can use the second data to obtain third prediction results of each second server by using a related network traffic prediction method, and perform secondary prediction by referring to the third prediction results of the one or more second servers. The third prediction result can represent network traffic anomaly conditions of the second server within a certain time in the future, such as existence of abnormal network traffic or non-existence of abnormal network traffic.

[0128] Specifically, in an embodiment, the second prediction result and the third prediction results of the one or more second servers are used to obtain the first prediction result, including:

[0129] determining a third prediction result matched with the second prediction result from the third prediction results of the one or more second servers;

[0130] determine a first ratio based on the determined third prediction result and the third prediction results of the one or more second servers, the first ratio representing a similarity between the network traffic anomaly represented by the second prediction result and the network traffic anomaly represented by the third prediction results;

[0131] in a case where the first ratio is greater than or equal to a first threshold, use the second prediction result as the first prediction result.

[0132] The first threshold can be referred to as a proportion threshold, and a value of the first threshold can be set as needed, which is not limited in the embodiments of the present application.

[0133] In actual application, the network node can determine the same third prediction result as the second prediction result from the third prediction results of the one or more second servers, and then determine the first ratio, which can also be understood as a proportion of the number of the third prediction result same as the second prediction result. If the first ratio is greater than or equal to the first threshold, the network node can determine that the second prediction result is consistent with the third prediction results of most of the second servers, and maintain the second prediction result unchanged, that is, use the second prediction result as the first prediction result.

[0134] Here, if the first ratio is less than the first threshold, the network node can determine that the second prediction result is inconsistent with the third prediction results of most of the second servers; in this case, the network node can update the second prediction result.

[0135] Based on this, in an embodiment, the method can further include:

[0136] in a case where the first ratio is less than the first threshold, update the second prediction result based on the determined third prediction result to obtain the first prediction result.

[0137] In actual application, in a case where the first ratio is less than the first threshold, the network node can update the second prediction result based on the determined third prediction result, that is, update the second prediction result to the third prediction result of most of the second servers.

[0138] In addition, in a case where the first server set does not include the one or more second servers, the network node cannot perform secondary prediction by referring to the one or more second servers, and in this case, the network node can use the second prediction result as the first prediction result.

[0139] The network flow prediction method provided in the embodiments of the present application comprises the following steps: a network node acquires first data, wherein the first data comprises historical attack data of one or more servers; features of the first data are extracted, and the first data is clustered by using the extracted features to obtain a clustering result, wherein the clustering result represents one or more server sets similar in historical attack data, and each server set comprises at least one server; and a first prediction result of a first server in the one or more servers is obtained by using the clustering result, wherein the first prediction result represents a network flow anomaly of the first server. The technical solution provided in the embodiments of the present application can cluster the attack similarity of historical attack data (such as DDos attack data) by analyzing the features of the historical attack data, thereby obtaining a server set attacked by similar attacks, so that the network node can predict the network abnormal flow of a target server (i.e. the first server) based on the server set similar in attack, thereby improving the prediction accuracy.

[0140] The present application will be further described in detail below with reference to the embodiments.

[0141] In the embodiments of the present application, a network abnormal flow prediction system based on attack similarity is proposed, which is suitable for the scenario of DDoS attack prediction of large-scale assets; the clustering in attack similarity is performed by extracting the historical attack features of DDoS cleaning logs and analyzing the historical attack features; the first prediction result of the same cluster server with high attack similarity is compared horizontally in space, and the network flow of a target server is predicted for the second time based on a threshold; wherein, as shown in the figure, Figure 2 The network abnormal flow prediction system comprises an attack similarity analysis module, an abnormal flow prediction module, a secondary prediction module and a data preprocessing module; wherein,

[0142] The data preprocessing module is configured to collect, filter, merge and enhance the historical network flow data (i.e. the second data) and the historical DDoS attack data (i.e. the first data);

[0143] The attack similarity analysis module is configured to acquire the preprocessed historical DDoS attack data, extract attack features and analyze attack similarity, and cluster the historical DDoS attack data based on the attack similarity to obtain an attack similarity analysis result (i.e. the clustering result);

[0144] The abnormal flow prediction module is configured to use a related technology to predict the network abnormal flow of the historical network flow data to obtain the first prediction result (i.e. the second prediction result) of the target server (i.e. the first server);

[0145] The secondary prediction module is configured to perform secondary prediction on the first prediction result output by the abnormal traffic prediction module based on the clustering result, so as to obtain a final prediction result (i.e., the first prediction result mentioned above).

[0146] Specifically, the process of the network abnormal traffic prediction system for network abnormal traffic prediction includes the following steps, as shown in the figure. Figure 3

[0147] Step 301: The attack similarity analysis module performs attack similarity analysis.

[0148] Here, after the attack similarity analysis module obtains the preprocessed historical DDoS attack data from the data preprocessing module, it extracts attack features of the historical DDoS attack data and analyzes the attack similarity of the attack features, and then performs step 302.

[0149] Step 302: The attack similarity analysis module generates an attack similarity analysis result.

[0150] In actual application, the attack similarity analysis module clusters the historical DDoS attack data based on the attack similarity model, and obtains the attack similarity analysis result of the attack target (i.e., the server mentioned above) in the attack similarity, and the attack target is uniquely identified by IP address and port.

[0151] Step 303: The abnormal traffic prediction module performs first prediction of network abnormal traffic of the target server, and obtains a first prediction result of the target server.

[0152] Here, the abnormal traffic prediction module predicts the network abnormal situation of the target server in a future period of time based on the related network abnormal traffic prediction method, and obtains the first prediction result of the target server, which includes the existence of abnormal traffic or the non-existence of abnormal traffic.

[0153] Step 304: The secondary prediction module obtains a same-cluster server (i.e., the second server mentioned above) of the target server in the attack similarity.

[0154] Here, the secondary prediction module obtains the same-cluster server of the target server in the attack similarity based on the attack similarity analysis result, and then performs step 305.

[0155] Step 305: The secondary prediction module judges whether the same-cluster server is obtained successfully.

[0156] In the case where the secondary prediction module successfully obtains the same-cluster server, the secondary prediction module forms a same-cluster server list, each server in the same-cluster server list is represented by IP address and port, and step 306 is performed; otherwise, step 310 is performed.

[0157] ​Step 306: The secondary prediction module determines whether there are servers in the same cluster and the number is greater than a threshold value.

[0158] Here, in the case where the number of servers in the same cluster included in the same cluster server list is greater than or equal to the number threshold of servers in the same cluster (i.e., the second threshold described above), the secondary prediction module can perform secondary prediction by referring to the prediction result of the servers in the same cluster, and in this case, step 307 is performed; in the case where the number of servers included in the same cluster server list is less than the number threshold of servers in the same cluster, step 310 is performed.

[0159] Step 307: The abnormal traffic prediction module iterates through the same cluster server list to perform first prediction of the servers in the same cluster.

[0160] Here, the abnormal traffic prediction module performs first prediction of the network abnormal traffic for each server in the same cluster based on the relevant network abnormal traffic prediction method, and obtains the first prediction result of the servers in the same cluster (i.e., the third prediction result described above).

[0161] Step 308: The abnormal traffic prediction module determines whether the iteration is completed.

[0162] If the iteration is completed, step 309 is performed; otherwise, step 308 is performed.

[0163] Step 309: The secondary prediction module performs secondary prediction based on the first prediction result.

[0164] Here, the secondary prediction module determines the proportion of results (i.e., the first ratio described above) that are the same as the first prediction result of the target server according to the first prediction result of the target server and the first prediction result of the servers in the same cluster; in the case where the proportion of results is greater than or equal to the proportion threshold (i.e., the first threshold described above), it means that the first prediction result of the target server is consistent with the first prediction result of most of the servers in the same cluster, and the secondary prediction module maintains the first prediction result unchanged; in the case where the proportion of results is less than the proportion threshold, it means that the first prediction result of the target server is inconsistent with the first prediction result of most of the servers in the same cluster, and the secondary prediction module updates the first prediction result of the target server to the first prediction result of most of the servers in the same cluster.

[0165] Step 310: End the current process.

[0166] In the embodiment of the present application, for the collected historical DDoS attack data, the corresponding historical attack features can be extracted, and the problem of insufficient features in the attack dimension caused by collecting only historical traffic data is solved. In addition, by analyzing the historical attack features, clustering results in attack similarity can be obtained, and then the same cluster servers of the target server in attack similarity can be obtained. By comparing the first prediction results of the same cluster servers with high attack similarity, the secondary prediction of the first prediction result of the target server is realized. That is, the attack similarity is introduced in the embodiment of the present application on the basis of related technologies, so as to more accurately predict the network abnormal traffic of the target server, thereby improving the DDoS attack prediction accuracy, so as to be able to early warn the DDoS attack and protect the network security.

[0167] In order to realize the method of the embodiment of the present application, the embodiment of the present application further provides a network traffic prediction device arranged on a network node, as shown in the figure, the device comprises: Figure 4

[0168] The acquisition unit 401 is configured to acquire first data, wherein the first data comprises historical attack data of one or more servers.

[0169] The clustering unit 402 is configured to extract features of the first data, and perform clustering on the first data by using the extracted features to obtain a clustering result, wherein the clustering result represents a set of one or more servers with similar historical attack data, and each server set comprises at least one server.

[0170] The prediction unit 403 is configured to obtain a first prediction result of a first server in the one or more servers by using the clustering result, wherein the first prediction result represents a network traffic anomaly of the first server.

[0171] In an embodiment, the acquisition unit 401 is configured to acquire second data, wherein the second data comprises historical network traffic data of the one or more servers.

[0172] The prediction unit 403 is configured to obtain a second prediction result of the first server by using the second data, wherein the second prediction result represents a network traffic anomaly of the first server; and obtain the first prediction result by using the second prediction result and the clustering result.

[0173] In an embodiment, the prediction unit 403 is configured to:

[0174] Determine a first server set associated with the first server represented by the clustering result.

[0175] ​The second data is used to obtain third prediction results of one or more second servers in the first server set except the first server, the third prediction results representing network traffic anomaly conditions of the second servers;

[0176] The second prediction result and the third prediction results of the one or more second servers are used to obtain the first prediction result.

[0177] In an embodiment, the prediction unit 403 is configured to:

[0178] determine a third prediction result matching the second prediction result from the third prediction results of the one or more second servers;

[0179] determine a first ratio representing a similarity between the network traffic anomaly condition represented by the second prediction result and the network traffic anomaly condition represented by the third prediction result, using the determined third prediction result and the third prediction results of the one or more second servers;

[0180] In a case where the first ratio is greater than or equal to a first threshold, the second prediction result is taken as the first prediction result.

[0181] In an embodiment, the prediction unit 403 is further configured to, in a case where the first ratio is less than the first threshold, update the second prediction result using the determined third prediction result to obtain the first prediction result.

[0182] In an embodiment, the clustering unit 402 is configured to:

[0183] determine a similarity between the historical attack data of each server and the historical attack data of other servers in the first data using the extracted features;

[0184] cluster the first data using the determined similarity to obtain the clustering result.

[0185] In an embodiment, the clustering unit 402 is configured to:

[0186] determine a distance between the historical attack data of each server and the historical attack data of other servers in the space using the extracted features to obtain a first distance;

[0187] obtain a similarity between the historical attack data of each server and the historical attack data of other servers using the first distance.

[0188] In an embodiment, the clustering unit 402 is configured to:

[0189] The extracted features are classified to obtain first features and second features, the first features including static features of the historical attack data of the one or more servers, and the second features including time-related features of the historical attack data of the one or more servers;

[0190] The second distance is determined as a distance between the first feature corresponding to the historical attack data of each server in the space and the first feature corresponding to the historical attack data of other servers.

[0191] The third distance is determined as a distance between the second feature corresponding to the historical attack data of each server in the space and the second feature corresponding to the historical attack data of other servers.

[0192] The first distance is obtained by using the second distance and the third distance.

[0193] In an embodiment, the clustering unit 402 is further configured to:

[0194] The first data is preprocessed to obtain preprocessed first data.

[0195] Features of the preprocessed first data are extracted.

[0196] In actual application, the obtaining unit 401 can be implemented by a communication interface in a network traffic prediction device; the clustering unit 402 and the prediction unit 403 can be implemented by a processor in the network traffic prediction device.

[0197] It should be noted that the network traffic prediction device provided in the above embodiments is only used as an example for the division of the above program modules, and in actual application, the above processing can be completed by different program modules according to needs, that is, the internal structure of the device is divided into different program modules to complete all or part of the above processing. In addition, the network traffic prediction device and the network traffic prediction method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be repeated here.

[0198] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of the present application, the embodiments of the present application further provide a network node, as shown in the following Figure 5 The network node 500 includes:

[0199] A communication interface 501 capable of information interaction with other devices;

[0200] A processor 502 connected with the communication interface 501 to realize information interaction with other devices, for running a computer program, and executing the method provided in one or more of the above technical solutions;

[0201] a memory 503, wherein the computer program is stored in the memory 503.

[0202] In particular, the communication interface 501 is configured to acquire first data, wherein the first data comprises historical attack data of one or more servers.

[0203] The processor 502 is configured to extract features of the first data, and perform clustering on the first data by using the extracted features to obtain a clustering result, wherein the clustering result represents a set of one or more servers with similar historical attack data, and each set of servers comprises at least one server; and obtain a first prediction result of a first server in the one or more servers by using the clustering result, wherein the first prediction result represents a network traffic anomaly of the first server.

[0204] In an embodiment, the communication interface 501 is configured to acquire second data, wherein the second data comprises historical network traffic data of the one or more servers.

[0205] The processor 502 is configured to obtain a second prediction result of the first server by using the second data, wherein the second prediction result represents a network traffic anomaly of the first server; and obtain the first prediction result by using the second prediction result and the clustering result.

[0206] In an embodiment, the processor 502 is configured to:

[0207] determine a first set of servers associated with the first server represented by the clustering result;

[0208] obtain third prediction results of one or more second servers in the first set of servers except the first server by using the second data, wherein the third prediction results represent network traffic anomalies of the second servers;

[0209] obtain the first prediction result by using the second prediction result and the third prediction results of the one or more second servers.

[0210] In an embodiment, the processor 502 is configured to:

[0211] determine a third prediction result matching the second prediction result from the third prediction results of the one or more second servers;

[0212] determine a first ratio by using the determined third prediction result and the third prediction results of the one or more second servers, wherein the first ratio represents a similarity between a network traffic anomaly represented by the second prediction result and a network traffic anomaly represented by the third prediction result.

[0213] in a case where the first ratio is greater than or equal to a first threshold, taking the second prediction result as the first prediction result.

[0214] In an embodiment, the processor 502 is further configured to, in a case where the first ratio is less than the first threshold, update the second prediction result by using a determined third prediction result to obtain the first prediction result.

[0215] In an embodiment, the processor 502 is configured to:

[0216] determine, by using the extracted features, a similarity between the historical attack data of each server in the first data and the historical attack data of other servers;

[0217] cluster the first data by using the determined similarity to obtain the clustering result.

[0218] In an embodiment, the processor 502 is configured to:

[0219] determine, by using the extracted features, a distance between the historical attack data of each server in the space and the historical attack data of other servers to obtain a first distance;

[0220] obtain, by using the first distance, a similarity between the historical attack data of each server and the historical attack data of other servers.

[0221] In an embodiment, the processor 502 is configured to:

[0222] divide the extracted features to obtain first features and second features, the first features including static features of the historical attack data of the one or more servers, and the second features including features of the historical attack data of the one or more servers with respect to time;

[0223] determine a distance between the first features corresponding to the historical attack data of each server in the space and the first features corresponding to the historical attack data of other servers to obtain a second distance;

[0224] determine a distance between the second features corresponding to the historical attack data of each server in the space and the second features corresponding to the historical attack data of other servers to obtain a third distance;

[0225] obtain the first distance by using the second distance and the third distance.

[0226] In an embodiment, the processor 502 is further configured to:

[0227] Preprocess the first data to obtain preprocessed first data.

[0228] Extract features of the preprocessed first data.

[0229] It should be noted that the specific processing process of the processor 502 and the communication interface 501 can be understood with reference to the above method.

[0230] Of course, in actual application, each component in the network node 500 is coupled together through the bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between the components. The bus system 504 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, in order to clearly illustrate the application, all kinds of buses are marked as the bus system 504 in the figure. Figure 5

[0231] The memory 503 in the embodiment of the application is used to store various types of data to support the operation of the network node 500. Examples of these data include: any computer programs used for operation on the network node 500.

[0232] The method disclosed in the above embodiment of the application can be applied to the processor 502 or implemented by the processor 502. The processor 502 can be an integrated circuit chip with signal processing capability. In the implementation process, each step of the above method can be completed by integrated logic circuits or instructions in the form of software in the processor 502. The processor 502 mentioned above can be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 502 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the application. The general-purpose processor can be a microprocessor or any conventional processor. In combination with the steps of the method disclosed in the embodiments of the application, the hardware decoding processor can be directly embodied to execute the above method, or the hardware and software modules in the decoding processor can be combined to execute the above method. The software module can be located in a storage medium, and the storage medium is located in the memory 503, and the processor 502 reads the information in the memory 503 and combines the hardware to complete the steps of the above method.

[0233] ​In an exemplary embodiment, the network node 500 can be implemented with one or more of Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field-Programmable Gate Arrays (FPGAs), general purpose processors, controllers, micro-controllers (MCUs), microprocessors (Microprocessors), or other electronic elements for executing the aforementioned methods.

[0234] It can be understood that the memory (the memory 503) of the embodiments of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), sync link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0235] In the example embodiments, the embodiments of the present application also provide a storage medium, specifically a computer readable storage medium, such as the memory 503 storing a computer program executable by the processor 502 of the network node 500 to complete the steps of the aforementioned network node side method. The computer readable storage medium can be FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM, etc.

[0236] In the example embodiments, the embodiments of the present application also provide a computer program product comprising a computer program executable by the processor 502 of the network node 500 to complete the steps of the aforementioned network node side method.

[0237] It should be noted that "first", "second", etc. are used to distinguish similar objects, and do not necessarily mean a specific order or sequence.

[0238] In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0239] The above is only a preferred embodiment of the present application, and is not intended to limit the protection scope of the present application.

Claims

1. A network traffic prediction method characterized by, The application is applied to a network node, comprising: obtaining first data, wherein the first data comprises historical attack data of one or more servers; extracting features of the first data, and clustering the first data by using the extracted features to obtain a clustering result, wherein the clustering result represents a server set comprising one or more servers with similar historical attack data, and each server set comprises at least one server; obtaining a second data, wherein the second data comprises historical network traffic data of the one or more servers; obtaining a second prediction result of the first server by using the second data, wherein the second prediction result represents a network traffic anomaly of the first server; obtaining the first prediction result by using the second prediction result and the clustering result, wherein the obtaining the first prediction result by using the second prediction result and the clustering result comprises: determining a first server set associated with the first server represented by the clustering result; obtaining third prediction results of one or more second servers in the first server set except the first server by using the second data, wherein the third prediction results represent network traffic anomalies of the second servers; obtaining the first prediction result by using the second prediction result and the third prediction results of the one or more second servers, wherein the obtaining the first prediction result by using the second prediction result and the third prediction results of the one or more second servers comprises: determining a third prediction result matched with the second prediction result from the third prediction results of the one or more second servers; determining a first ratio by using the determined third prediction result and the third prediction results of the one or more second servers, wherein the first ratio represents a similarity between a network traffic anomaly represented by the second prediction result and a network traffic anomaly represented by the third prediction result; in a case that the first ratio is greater than or equal to a first threshold, taking the second prediction result as the first prediction result; in a case that the first ratio is less than the first threshold, updating the second prediction result by using the determined third prediction result to obtain the first prediction result. The clustering of the first data by using the extracted features to obtain the clustering result comprises:

2. The method of claim 1, wherein, determining a similarity between historical attack data of each server in the first data and historical attack data of other servers by using the extracted features; clustering the first data by using the determined similarity to obtain the clustering result. The determining of the similarity between historical attack data of each server in the first data and historical attack data of other servers by using the extracted features comprises:

3. The method of claim 2, wherein, ​ The extracted features are used to determine distances between the historical attack data of each server in the space and the historical attack data of other servers, to obtain first distances; The first distances are used to obtain similarities between the historical attack data of each server and the historical attack data of other servers.

4. The method of claim 3, wherein, The extracted features are used to determine distances between the historical attack data of each server in the space and the historical attack data of other servers, to obtain first distances, including: The extracted features are divided to obtain first features and second features, the first features including static features of the historical attack data of the one or more servers, and the second features including time-related features of the historical attack data of the one or more servers; Distances between the first features corresponding to the historical attack data of each server in the space and the first features corresponding to the historical attack data of other servers are determined to obtain second distances; Distances between the second features corresponding to the historical attack data of each server in the space and the second features corresponding to the historical attack data of other servers are determined to obtain third distances; The second distances and the third distances are used to obtain the first distances.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: The first data is preprocessed to obtain preprocessed first data; Features of the preprocessed first data are extracted.

6. A network traffic prediction apparatus characterized by comprising: It includes: An acquisition unit is configured to acquire first data, the first data including historical attack data of one or more servers; A clustering unit is configured to extract features of the first data, and use the extracted features to cluster the first data to obtain clustering results, the clustering results representing one or more server sets with similar historical attack data, each server set including at least one server; A prediction unit is configured to use the clustering results to obtain a first prediction result of a first server in the one or more servers, the first prediction result representing a network traffic anomaly of the first server; wherein The acquisition unit is configured to acquire second data, the second data including historical network traffic data of the one or more servers; The prediction unit is configured to use the second data to obtain a second prediction result of the first server, the second prediction result representing a network traffic anomaly of the first server; use the second prediction result and the clustering results to obtain the first prediction result; wherein The prediction unit is configured to determine a first server set associated with the first server represented by the clustering results; use the second data to obtain third prediction results of one or more second servers in the first server set except the first server, the third prediction results representing network traffic anomalies of the second servers; use the second prediction result and the third prediction results of the one or more second servers to obtain the first prediction result; wherein The prediction unit is configured to determine a first server set associated with the first server represented by the clustering results; use the second data to obtain third prediction results of one or more second servers in the first server set except the first server, the third prediction results representing network traffic anomalies of the second servers; use the second prediction result and the third prediction results of the one or more second servers to obtain the first prediction result; wherein The prediction unit is configured to determine a third prediction result matching the second prediction result from third prediction results of the one or more second servers, determine a first ratio using the determined third prediction result and the third prediction results of the one or more second servers, the first ratio representing a similarity between a network traffic anomaly represented by the second prediction result and a network traffic anomaly represented by the third prediction result, and determine the first prediction result as the second prediction result when the first ratio is greater than or equal to a first threshold, or update the second prediction result using the determined third prediction result to obtain the first prediction result when the first ratio is less than the first threshold.

7. A network node, characterized by: Comprise: a processor and a communication interface; wherein the communication interface is configured to obtain first data, the first data comprising historical attack data of one or more servers; the processor is configured to extract features of the first data, cluster the first data using the extracted features to obtain a clustering result, the clustering result representing one or more server sets with similar historical attack data, each server set comprising at least one server, and obtain a first prediction result of a first server in the one or more servers using the clustering result, the first prediction result representing a network traffic anomaly of the first server; and the communication interface is configured to obtain second data, the second data comprising historical network traffic data of the one or more servers; the processor is configured to obtain a second prediction result of the first server using the second data, the second prediction result representing a network traffic anomaly of the first server, and obtain the first prediction result using the second prediction result and the clustering result; and the processor is configured to determine a first server set associated with the first server represented by the clustering result, obtain third prediction results of one or more second servers in the first server set except the first server using the second data, the third prediction results representing network traffic anomalies of the second servers, and obtain the first prediction result using the second prediction result and the third prediction results of the one or more second servers; and the processor is configured to determine a third prediction result matching the second prediction result from third prediction results of the one or more second servers, determine a first ratio using the determined third prediction result and the third prediction results of the one or more second servers, the first ratio representing a similarity between a network traffic anomaly represented by the second prediction result and a network traffic anomaly represented by the third prediction result, and determine the first prediction result as the second prediction result when the first ratio is greater than or equal to a first threshold, or update the second prediction result using the determined third prediction result to obtain the first prediction result when the first ratio is less than the first threshold.

8. A network node, characterized by: Comprise: a processor and a communication interface; wherein the communication interface is configured to obtain first data, the first data comprising historical attack data of one or more servers; the processor is configured to extract features of the first data, cluster the first data using the extracted features to obtain a clustering result, the clustering result representing one or more server sets with similar historical attack data, each server set comprising at least one server, and obtain a first prediction result of a first server in the one or more servers using the clustering result, the first prediction result representing a network traffic anomaly of the first server; and the communication interface is configured to obtain second data, the second data comprising historical network traffic data of the one or more servers; the processor is configured to obtain a second prediction result of the first server using the second data, the second prediction result representing a network traffic anomaly of the first server, and obtain the first prediction result using the second prediction result and the clustering result; and the processor is configured to determine a first server set associated with the first server represented by the clustering result, obtain third prediction results of one or more second servers in the first server set except the first server using the second data, the third prediction results representing network traffic anomalies of the second servers, and obtain the first prediction result using the second prediction result and the third prediction results of the one or more second servers; and the processor is configured to determine a third prediction result matching the second prediction result from third prediction results of the one or more second servers, determine a first ratio using the determined third prediction result and the third prediction results of the one or more second servers, the first ratio representing a similarity between a network traffic anomaly represented by the second prediction result and a network traffic anomaly represented by the third prediction result, and determine the first prediction result as the second prediction result when the first ratio is greater than or equal to a first threshold, or update the second prediction result using the determined third prediction result to obtain the first prediction result when the first ratio is less than the first threshold. a processor and memory for storing a computer program capable of running on the processor, wherein the processor, when running the computer program, is arranged to perform the steps of the method of any one of claims 1 to 5.

9. A storage medium having stored thereon a computer program, characterized in that The computer program, when executed by the processor, causes the performance of the steps of the method of any one of claims 1 to 5.

10. A computer program product comprising a computer program, characterized in that, The computer program, when executed by the processor, causes the performance of the steps of the method of any one of claims 1 to 5. The computer program, when executed by the processor, causes the performance of the steps of the method of any one of claims 1 to 5.

Images