Intelligent traffic cleaning method, device, computer equipment and storage medium

Abstract

The present application discloses an intelligent traffic cleaning method, device, equipment and medium, the method comprising: obtaining current traffic data; inputting the current traffic data into a trained long short-term memory network for processing to obtain time series features, and comparing the time series features with the time series features of normal traffic data to determine whether the current traffic data is abnormal; when the current traffic data is abnormal, the time series features and the current traffic data are input into a trained gated loop unit for prediction to dynamically adjust the cleaning strategy. By combining a long short-term memory network with a gated loop unit, long-term dependencies in traffic data can be captured, thereby more accurately understanding the behavior patterns of normal traffic. By detecting abnormal traffic in real time and automatically adjusting protection strategies, millisecond-level responses can be achieved to effectively respond to various network attacks. Improve the accuracy of anomaly detection and reduce false alarm and missed alarm rates.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an intelligent traffic cleaning method, device, computer equipment and storage medium. Background Art

[0002] With the rapid development of network technology, network security issues have become increasingly prominent. Network threats such as DDoS attacks frequently occur, posing a serious threat to network security. Traditional cleaning strategies mainly rely on fixed rules and thresholds, which are difficult to cope with complex and changeable network attacks. At present, it is difficult to adjust manual protection strategies in real time, and fixed thresholds are difficult to adapt. In most anti-DDoS protection, the decision-making subjects of protection strategies and key points are still people, and the handling efficiency depends largely on manual experience. For new attack events that have no precedent for handling, it is easy to fall into a passive response situation; fixed threshold protection is difficult and cannot be adapted, which consumes a lot of energy and time of operators. Too large a threshold will lead to missed protection, and too small a threshold will lead to false protection, resulting in poor protection effect. Summary of the invention

[0003] Based on this, it is necessary to provide an intelligent traffic cleaning method, device, computer equipment and storage medium to address the above technical issues, so as to solve at least one problem existing in the above-mentioned prior art.

[0004] In a first aspect, the embodiment of the present application is implemented as follows: a smart traffic cleaning method is provided, comprising the following steps:

[0005] Get current traffic data;

[0006] Input the current traffic data into the trained long short-term memory network for processing to obtain time series features;

[0007] Comparing the time series characteristics with the time series characteristics of normal traffic data to determine whether the current traffic data is abnormal;

[0008] When the current traffic data is abnormal, the time series features and the current traffic data are input into the trained gated loop unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction result.

[0009] In one embodiment, the long short-term memory network is trained in the following manner:

[0010] Collecting historical traffic data, marking positive labels and negative labels on the historical traffic data, and obtaining training sample data;

[0011] Construct an initial long short-term memory network;

[0012] Iteratively training the initial long short-term memory network using the training sample data;

[0013] When the preset convergence condition is met, the trained long short-term memory network is obtained.

[0014] In one embodiment, determining whether the current traffic data is abnormal includes:

[0015] The current traffic data is processed time-step by time-step through a long short-term memory network to obtain a time series feature corresponding to the current traffic data;

[0016] Learning and memorizing the time series features corresponding to the normal traffic data through the long short-term memory network;

[0017] Comparing the time series characteristics corresponding to the current traffic data with the time series characteristics corresponding to the normal traffic data;

[0018] When the comparison is inconsistent, it is determined that the current flow data is abnormal;

[0019] The time series characteristics include at least one of periodic changes in flow, peak values, valley values, and flow growth trends.

[0020] In one embodiment, the LSTM network includes LSTM network cells, and the internal state of the LSTM network cells is updated in the following manner:

[0021] Update the input gate unit through the forget gate to obtain an updated input gate;

[0022] Based on the updated input gate, input weight and the recurrent weight of the forget gate, the internal state of the long short-term memory network cell is updated, wherein the output of the long short-term memory network cell is closed through the output gate.

[0023] In one embodiment, the inputting the time series features and the current traffic data into the trained gated recurrent unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction results, includes:

[0024] Input the time series features, the current traffic data and the strategy parameter set into the trained gated recurrent unit to predict the strategy parameters corresponding to the next time step;

[0025] Based on the policy parameters, the cleaning policy is dynamically adjusted.

[0026] In one embodiment, after inputting the time series features, the current traffic data and the set of policy parameters into the trained gated recurrent unit, the following steps are performed:

[0027] Outputting a flow-aware feature based on the gated recurrent unit, the flow-aware feature comprising a hidden state, a reset gate output, and an update gate output;

[0028] Based on the hidden state, adjusting the flow cleaning intensity, wherein the hidden state represents the state of the current flow data;

[0029] Based on the update gate output, adjusting the timeliness of traffic cleaning, wherein the update gate output represents the combined ratio of the current time step to the previous time step;

[0030] Based on the reset gate output, the flow cleaning persistence is adjusted, wherein the reset gate output represents the degree of reset of the hidden state corresponding to the previous time step to the current input.

[0031] In one embodiment, the method further includes:

[0032] Determining whether an abnormality occurs in the gated recurrent unit during the back propagation process;

[0033] If so, determine whether to perform truncation processing according to the preset gravity parameters and truncation threshold;

[0034] If so, the truncated gradient is updated.

[0035] In a second aspect, an intelligent traffic cleaning device is provided, comprising:

[0036] A current flow data acquisition unit, used to acquire current flow data and perform preprocessing;

[0037] A time series feature extraction unit is used to input the current traffic data into the trained long short-term memory network for processing to obtain time series features;

[0038] A flow anomaly determination unit, used for comparing the time series characteristics with the time series characteristics of normal flow data to determine whether the current flow data has an anomaly;

[0039] The cleaning strategy dynamic adjustment unit is used to input the time series characteristics and the current traffic data into the trained gated loop unit for prediction when the current traffic data is abnormal, so as to dynamically adjust the cleaning strategy based on the prediction result.

[0040] In a third aspect, a computer device is provided, comprising a memory, a processor, and computer-readable instructions stored in the memory and running on the processor, wherein the processor implements the intelligent traffic cleaning method as described above when executing the computer-readable instructions.

[0041] In a fourth aspect, a readable storage medium is provided, on which computer-readable instructions are stored. When the computer-readable instructions are executed by a processor, the intelligent traffic cleaning method as described above is implemented.

[0042] The above-mentioned intelligent traffic cleaning method, device, computer equipment and storage medium, the method of which is implemented, includes: obtaining current traffic data; inputting the current traffic data into a trained long short-term memory network for processing to obtain time series features; comparing the time series features with the time series features of normal traffic data to determine whether the current traffic data is abnormal; when the current traffic data is abnormal, the time series features and the current traffic data are input into the trained gated loop unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction results. In the embodiment of the present application, a deep learning model using a long short-term memory network and a gated loop unit can capture long-term dependencies in traffic data, thereby more accurately understanding the behavior pattern of normal traffic. By detecting abnormal traffic in real time and automatically adjusting the protection strategy, millisecond-level response can be achieved to effectively respond to various network attacks. Improve the accuracy of anomaly detection and reduce false alarm and missed alarm rates. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0044] Figure 1 This is a flow chart of an intelligent traffic cleaning method in one embodiment of the present application;

[0045] Figure 2 This is a schematic diagram of a network architecture of a deep learning model in one embodiment of the present application;

[0046] Figure 3 This is a structural diagram of an intelligent flow cleaning device in one embodiment of the present application;

[0047] Figure 4 It is a schematic diagram of a computer device in one embodiment of the present application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] In one embodiment, if Figure 1 As shown, a smart traffic cleaning method is provided, comprising the following steps:

[0050] In step S110, current flow data is obtained;

[0051] In an embodiment of the present application, multiple proxy servers may be configured, and network traffic may be collected in real time by region according to traffic type, traffic format, etc., or may be obtained through logs, access records, browsing records, etc. Among them, the traffic types may specifically include general traffic, precise traffic, public domain traffic, private domain traffic, and push traffic. General traffic includes traffic generated by information browsed on Weibo and news channels; precise traffic is specific traffic generated by users searching through indexes or keywords; public domain traffic is the same traffic generated by browsing e-commerce platforms, Zhihu, Douban and other fixed platforms; private domain traffic is traffic generated spontaneously in user software, such as traffic saved in groups, published comments, and published privacy files; push traffic is fixed platforms, web pages, APPs, etc. that automatically push user data information and generate push traffic.

[0052] In the embodiment of the present application, after the current traffic data is obtained, the traffic data can be preprocessed for use in model prediction. For example, outliers, duplicate values, or irrelevant data can be removed. Key features such as packet length, protocol type, source IP, and destination IP are extracted from the original network traffic data.

[0053] It should be noted that when used to train and evaluate the model, historical traffic data can be collected and different types of historical traffic data samples can be labeled, for example, normal traffic is marked as 0 and malicious traffic is marked as 1.

[0054] In step S120, the current traffic data is input into the trained long short-term memory network for processing to obtain time series features;

[0055] In an embodiment of the present application, a deep learning model combining a long short-term memory network and a gated recurrent unit can be constructed as a cleaning strategy prediction model. Among them, the long short-term memory network, due to its unique gating mechanism and cell state design, can effectively capture and process long-term dependencies in sequence data, and is particularly suitable for processing data with time series characteristics such as network traffic. Through the long short-term memory network model, the key features in the network traffic data can be accurately extracted to provide an accurate data basis for subsequent intelligent strategy adjustments. The gated recurrent unit can adjust the traffic cleaning strategy based on the time series features extracted by the long short-term memory network. The gated recurrent unit model can effectively alleviate the gradient vanishing problem and is suitable for real-time strategy adjustment. Through the gated recurrent unit, the cleaning strategy can be dynamically adjusted according to the real-time changes in network traffic to ensure efficient and safe processing of network traffic.

[0056] The time series characteristics include one or any combination of periodic changes, peak values ​​and valley values, and growth trends of current traffic data.

[0057] In step S130, the time series characteristics are compared with the time series characteristics of normal traffic data to determine whether the current traffic data is abnormal;

[0058] In an embodiment of the present application, historical traffic data may be collected and preprocessed. For example, outliers, duplicate values, or irrelevant data may be removed. Then, key features such as length, protocol type, source IP, and destination IP are extracted. Different types of traffic samples are labeled, for example, normal traffic is marked as 0 and malicious traffic is marked as 1, to construct a traffic sample data set for model training and evaluation. An initial long short-term memory network is constructed, and then the initial long short-term memory network is iteratively trained using a traffic sample data set. The long short-term memory network can capture the time series characteristics in the traffic data, thereby more accurately understanding the behavior patterns of normal traffic.

[0059] After obtaining the current traffic data, it can be preprocessed and input into the trained long short-term memory network for prediction to obtain the time series characteristics of the current traffic data, and then compared with the time series characteristics of the normal traffic data learned in the training phase. If the comparison is consistent, it means that the current traffic data is normal traffic, otherwise, it is abnormal traffic. It can be understood that the determination process of the abnormal traffic can be carried out in the long short-term memory network.

[0060] In step S140, when the current traffic data is abnormal, the time series features and the current traffic data are input into the trained gated loop unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction result.

[0061] In an embodiment of the present application, if an anomaly is detected in the current traffic data, the extracted time series features of the current traffic data and the current traffic data can be input into a trained gated loop unit, and the gated loop unit is used to predict the strategy parameter value of the next time step, thereby achieving dynamic adjustment of the traffic cleaning strategy.

[0062] The policy parameter value may specifically include cleaning policy rules such as flow threshold, bandwidth allocation rule, priority, security alarm response measures, etc. Based on the cleaning policy rules, the current cleaning policy may be adjusted, such as speed limit, global protection, etc.

[0063] Among them, the gated loop unit can be configured with a variety of protection measures according to the current traffic status, such as NS speed limit, DNS status protection, HTTP speed limit, HTTP URI protection, global protection configuration, etc.

[0064] In an embodiment of the present application, an intelligent traffic cleaning method is provided, comprising: obtaining current traffic data; inputting the current traffic data into a trained long short-term memory network for processing to obtain time series features; comparing the time series features with the time series features of normal traffic data to determine whether the current traffic data is abnormal; when the current traffic data is abnormal, the time series features and the current traffic data are input into a trained gated loop unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction results. In an embodiment of the present application, a deep learning model using a long short-term memory network and a gated loop unit can capture long-term dependencies in traffic data, thereby more accurately understanding the behavior patterns of normal traffic. By detecting abnormal traffic in real time and automatically adjusting the protection strategy, millisecond-level response can be achieved to effectively respond to various network attacks. Improve the accuracy of anomaly detection and reduce false alarm and missed alarm rates.

[0065] In one embodiment of the present application, the long short-term memory network can be trained in the following manner:

[0066] Collecting historical traffic data, marking positive labels and negative labels on the historical traffic data, and obtaining training sample data;

[0067] Construct an initial long short-term memory network;

[0068] Iteratively training the initial long short-term memory network using the training sample data;

[0069] When the preset convergence condition is met, the trained long short-term memory network is obtained.

[0070] Specifically, historical traffic data can be collected and preprocessed. For example, outliers, duplicate values ​​or irrelevant data are removed, and then key features such as length, protocol type, source IP and destination IP are extracted. Different types of traffic samples are labeled, for example, normal traffic is marked as 0 and malicious traffic is marked as 1, so as to construct a traffic sample data set for model training and evaluation. An initial long short-term memory network is constructed, and then the initial long short-term memory network is iteratively trained using a traffic sample data set. When the preset convergence conditions are met, such as the number of iterations reaches a preset number, such as 1,000 times, or the loss value of the prediction result is calculated using a preset loss function, such as cross entropy or regularization, when the loss value is less than a preset threshold, it indicates that the training is completed, and a trained long short-term memory network can be obtained.

[0071] See also Figure 2 , provides a network architecture of a deep learning model. During the training process, the long short-term memory network can process historical traffic data step by time, and learn and memorize the time series characteristics in normal traffic data through its internal memory mechanism and gating structure. The specific algorithm formula can be shown as follows:

[0072] ;

[0073] in, represents the forget gate; t represents the time; i represents the cell, and the weight is set to a value between 0 and 1 by the sigmoid (activation function) unit; Represents the current input vector; represents the current hidden layer vector, which contains the output of all long short-term memory cells, , , Represent the bias, input weight and recurrent weight of the forget gate respectively, represents sigmoid (activation function), and j represents a variable.

[0074] In one embodiment of the present application, the long short-term memory network includes long short-term memory network cells, and the internal state of the long short-term memory network cells is updated in the following manner:

[0075] Update the input gate unit through the forget gate to obtain an updated input gate;

[0076] Based on the updated input gate, input weight and the recurrent weight of the forget gate, the internal state of the long short-term memory network cell is updated, wherein the output of the long short-term memory network cell is closed through the output gate.

[0077] Specifically, the cell state is the core of the LSTM network, which can maintain and transmit long-term dependencies, so that the LSTM network can remember and use the time series data of the previously learned historical traffic data when processing time series data. And the update of the cell state can prevent the weight from weakening during the downward propagation process, which is conducive to the extraction of effective information. Updating the internal state of the LSTM network cell can be achieved through the following formula:

[0078] ;

[0079] in, represents the forget gate; t represents the time; i represents the cell, and the weight is set to a value between 0 and 1 by the sigmoid (activation function) unit; Represents the current input vector; represents the current hidden layer vector, which contains the output of all long short-term memory cells. b, U, and W represent the bias, input weight, and loop weight of the forget gate, respectively. represents sigmoid (activation function), represents the cell state at the current time step, Represents the cell state at the previous time step.

[0080] Among them, the external input gate unit It can be updated in the form of a forget gate, using sigmoid (activation function) to obtain a value between 0 and 1. The algorithm formula of the external input gate can be as follows:

[0081] ;

[0082] in, represents the forget gate; t represents the time; i represents the cell, and the weight is set to a value between 0 and 1 by the sigmoid (activation function) unit; Represents the current input vector; represents the current hidden layer vector, which contains the output of all long short-term memory cells, , , They represent the bias, input weight and recurrent weight of the forget gate respectively.

[0083] At this time, the output of the cell of the long short-term memory network Output gate Close, which can be calculated by the following formula:

[0084] ;

[0085] ;

[0086] in, , , Represents the bias, input weight, and recurrent weight of the forget gate, respectively. In these variants, you can choose to use the cell state as additional input. Represents the cell state at the current time step. Represents network traffic data at the current point in time, including characteristics such as packet size, transmission speed, and protocol type. Indicates the previous network traffic status, Represents long-term memory, which helps the model understand the time series characteristics of traffic. , , The forgetting, input, and output of information are controlled separately, thereby helping the model adapt to dynamic changes in network traffic. It can be used as the output of the model to represent the normal mode of the current network traffic and be used for subsequent anomaly detection. tanh represents the hyperbolic tangent function.

[0087] It can be understood that through the above parameters and formulas, the long short-term memory network can learn and understand the normal behavior patterns of network traffic, and provide a basis for subsequent anomaly detection and cleaning strategies. In actual use, if the current traffic data does not match the normal traffic pattern learned by the model, it can be judged as abnormal traffic and the corresponding cleaning strategy can be adopted.

[0088] It should be noted that the input gate determines how much new information will be added to the cell state in the current time step. The output gate controls the amount of information from the cell state to the output. The cell state as an additional input actually means that the cell state will be updated at each time step. The updated cell state not only affects the output of the current time step, but also serves as part of the input of the next time step, thereby achieving long-term preservation and flow of information.

[0089] In an embodiment of the present application, determining whether the current traffic data is abnormal includes:

[0090] The current traffic data is processed time-step by time-step through a long short-term memory network to obtain a time series feature corresponding to the current traffic data;

[0091] Learning and memorizing the time series features corresponding to the normal traffic data through the long short-term memory network;

[0092] Comparing the time series characteristics corresponding to the current traffic data with the time series characteristics corresponding to the normal traffic data;

[0093] When the comparison is inconsistent, it is determined that the current flow data is abnormal;

[0094] The time series characteristics include at least one of flow periodic changes, peak values, valley values, and flow growth trends.

[0095] Specifically, in the LSTM network training phase, historical traffic data can be used and labeled, for example, normal traffic is labeled as 0 and malicious traffic is labeled as 1. Then, the LSTM network is iteratively trained using the labeled historical traffic data to learn the time series characteristics of the normal network mode through the LSTM network. After obtaining the current traffic data, it can be preprocessed and input into the trained LSTM network for prediction to obtain the time series characteristics of the current traffic data, which are then compared with the time series characteristics of the normal traffic data learned in the training phase. If the comparison is consistent, it means that the current traffic data is normal traffic, otherwise, it is abnormal traffic.

[0096] In one embodiment of the present application, the time series features and the current traffic data are input into the trained gated recurrent unit for prediction, so as to dynamically adjust the cleaning strategy based on the prediction result, including:

[0097] Input the time series features, the current traffic data and the strategy parameter set into the trained gated recurrent unit to predict the strategy parameters corresponding to the next time step;

[0098] Based on the policy parameters, the cleaning policy is dynamically adjusted.

[0099] Among them, the policy parameter set may include multiple pre-configured policy parameters for dealing with abnormal traffic, and the policy parameters may specifically include traffic thresholds, bandwidth allocation rules, priorities, and security alarm response measures such as blocking, speed limiting or redirection.

[0100] Specifically, the key features of the current traffic data, namely the time series features, can be extracted through the long short-term memory network, which may include the periodic changes of traffic, the peak and valley values ​​of traffic, the growth trend of traffic, etc. Then, the extracted key features and the acquired current traffic data, as well as the pre-configured policy parameter set are input into the gated recurrent unit, and the policy parameters are dynamically adjusted by the gated unit to output the policy parameter value corresponding to the next time step, which can then be used for traffic cleaning.

[0101] Among them, the protection measures may include DNS speed limit, DNS status protection, HTTP speed limit, HTTP URI protection, global protection configuration, etc.

[0102] In one embodiment of the present application, after inputting the time series features, the current traffic data and the policy parameter set into the trained gated recurrent unit, the following steps are performed:

[0103] Outputting a flow-aware feature based on the gated recurrent unit, the flow-aware feature comprising a hidden state, a reset gate output, and an update gate output;

[0104] Based on the hidden state, adjusting the flow cleaning intensity, wherein the hidden state represents the state of the current flow data;

[0105] Based on the update gate output, adjusting the timeliness of traffic cleaning, wherein the update gate output represents the combined ratio of the current time step to the previous time step;

[0106] Based on the reset gate output, the flow cleaning persistence is adjusted, wherein the reset gate output represents the degree of reset of the hidden state corresponding to the previous time step to the current input.

[0107] Specifically, the forgetting factor and the update state unit can be controlled simultaneously by a single gating unit, which can be achieved by the following formula:

[0108] ;

[0109] Among them, u represents the update gate and r represents the reset gate. Then u and r can be calculated by the following formula:

[0110] ;

[0111] ;

[0112] Among them, b W represents the bias, input weight and recurrent weight of the forget gate respectively.

[0113] in, (Hidden state) indicates the state of the current traffic data. Its value and change trend can be used as a basis for adjusting the cleaning strategy. When the value continues to increase, it may mean that abnormal flow is increasing, and the cleaning intensity should be increased.

[0114] in, (Update gate output) can reflect the combined ratio of the information of the current time step and the information of the previous time step. In the cleaning strategy, it can be regarded as the perception of the speed of abnormal traffic change, so as to adjust the timeliness of cleaning.

[0115] in, (Reset gate output) controls the degree of reset of the state of the previous moment to the current input. In the cleaning strategy, it can be regarded as the perception of the persistence of abnormal traffic, so as to adjust the persistence of cleaning.

[0116] It should be noted that the update gate u can linearly gate any dimension, copying it or completely replacing it with the new target state value as needed. The reset gate r controls which parts of the current state are used to calculate the next target state, introducing additional nonlinear effects between the past state and the future state.

[0117] In an embodiment of the present application, the method further includes:

[0118] Determining whether an abnormality occurs in the gated recurrent unit during the back propagation process;

[0119] If so, determine whether to perform truncation processing according to the preset gravity parameters and truncation threshold;

[0120] If so, the truncated gradient is updated.

[0121] Specifically, in order to solve the problem of gradient disappearance or gradient explosion during deep neural network training, the truncated gradient algorithm can be used to prevent gradient anomalies during back propagation by truncating excessive gradients or increasing excessively small gradients. The truncated gradient method introduces a gravity parameter in the truncation process to adjust the sparsity of the model coefficients, making the truncation process smoother. When the gradient exceeds the set threshold, it is not truncated directly, but the gradient value is gradually adjusted according to the gravity parameter to make it close to the threshold.

[0122] In the update process of the truncated gradient method, the gravity parameter and the truncation threshold jointly determine whether the coefficients are truncated. A larger gravity parameter will cause more coefficients to be truncated, thereby increasing the sparsity of the model.

[0123] Among them, the truncated gradient update formula can be expressed as:

[0124] ;

[0125] in, represents the truncated gradient algorithm, Represents the gradient vector, which is used to guide the direction and magnitude of parameter updates. represents the gradient norm, are the components of the gradient vector. v represents the upper bound of the gradient norm, that is, the maximum allowed value of the gradient norm. Gradients exceeding this value will be truncated more severely. α represents the gravity parameter, which is used to represent the factor affecting the degree of gradient truncation. When the gradient norm exceeds the truncation threshold or the upper bound of the norm, the gravity parameter determines the degree of retention of the gradient after truncation. Smaller α values ​​result in more truncation, while larger values ​​retain more of the original gradient information. θ represents the truncation threshold. When the gradient norm exceeds this threshold, the gradient will be truncated to prevent training instability caused by excessive gradients.

[0126] It should be noted that during the training process, the gradients of the above parameters may be truncated to ensure the stability and convergence speed of the training. Truncated gradients help prevent the model parameters from updating too quickly due to excessive gradients, thereby avoiding oscillation or divergence during model training. A method for optimizing the gated recurrent unit model using a truncated gradient algorithm. This optimization method can significantly improve the training efficiency and stability of the model, thereby better processing complex network traffic data in practical applications.

[0127] In the embodiment of the present application, the long short-term memory network model is used to deeply process the network traffic data. The long short-term memory network model can effectively capture and process the long-term dependencies in the sequence data due to its unique gating mechanism and cell state design, and is particularly suitable for processing data with time series characteristics such as network traffic. Through the long short-term memory network model, the key features in the network traffic data can be accurately extracted, providing an accurate data basis for subsequent intelligent adjustment. After extracting the key features of the network traffic, the gated recurrent unit model is further used to intelligently adjust the traffic cleaning strategy. The gated recurrent unit model can effectively alleviate the gradient disappearance problem and is suitable for real-time strategy adjustment. Through the gated recurrent unit, the cleaning strategy can be dynamically adjusted according to the real-time changes of the network traffic to ensure efficient and safe processing of the network traffic. And by optimizing the gated recurrent unit model using the truncated gradient algorithm, the gradient explosion is effectively prevented: by truncating the excessive gradient, the gradient is effectively prevented from growing without limit during the back propagation process, thereby avoiding the problem of gradient explosion. Improve training stability: truncated gradients help maintain the stability of the training process and reduce the drastic fluctuations in model parameter updates. Accelerate convergence: By controlling the size of the gradient, the truncated gradient algorithm can help the optimizer find the appropriate parameter update direction more quickly, thereby accelerating the convergence of the model. Reduce the risk of overfitting: Too large a gradient may cause the model to overfit the noise in the training data. By truncating the gradient, this risk of overfitting can be reduced and the generalization ability of the model can be improved.

[0128] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0129] In one embodiment, an intelligent traffic cleaning device is provided, which corresponds one-to-one to the intelligent traffic cleaning method in the above embodiment. Figure 3 As shown, the intelligent traffic cleaning device includes a current traffic data acquisition unit 10, a time series feature extraction unit 20, a traffic anomaly determination unit 30 and a cleaning strategy dynamic adjustment unit 40. The functional modules are described in detail as follows:

[0130] The current flow data acquisition unit 10 is used to acquire the current flow data and perform preprocessing;

[0131] The time series feature extraction unit 20 is used to input the current traffic data into the trained long short-term memory network for processing to obtain time series features;

[0132] A flow anomaly determination unit 30, configured to compare the time series characteristics with the time series characteristics of normal flow data to determine whether the current flow data is abnormal;

[0133] The cleaning strategy dynamic adjustment unit 40 is used to input the time series features and the current traffic data into the trained gated loop unit for prediction when the current traffic data is abnormal, so as to dynamically adjust the cleaning strategy based on the prediction result.

[0134] In one embodiment of the present application, the long short-term memory network is trained in the following manner:

[0135] Collecting historical traffic data, marking positive labels and negative labels on the historical traffic data, and obtaining training sample data;

[0136] Construct an initial long short-term memory network;

[0137] Iteratively training the initial long short-term memory network using the training sample data;

[0138] When the preset convergence condition is met, the trained long short-term memory network is obtained.

[0139] In one embodiment of the present application, the flow anomaly determination unit 30 is further configured to:

[0140] The current traffic data is processed time-step by time-step through a long short-term memory network to obtain a time series feature corresponding to the current traffic data;

[0141] Learning and memorizing the time series features corresponding to the normal traffic data through the long short-term memory network;

[0142] Comparing the time series characteristics corresponding to the current traffic data with the time series characteristics corresponding to the normal traffic data;

[0143] When the comparison is inconsistent, it is determined that the current flow data is abnormal;

[0144] The time series characteristics include at least one of flow periodic changes, peak values, valley values, and flow growth trends.

[0145] In one embodiment of the present application, the long short-term memory network includes long short-term memory network cells, and the internal state of the long short-term memory network cells is updated in the following manner:

[0146] Update the input gate unit through the forget gate to obtain an updated input gate;

[0147] Based on the updated input gate, input weight and the recurrent weight of the forget gate, the internal state of the long short-term memory network cell is updated, wherein the output of the long short-term memory network cell is closed through the output gate.

[0148] In one embodiment of the present application, the cleaning strategy dynamic adjustment unit 40 is further used to:

[0149] Input the time series features, the current traffic data and the strategy parameter set into the trained gated recurrent unit to predict the strategy parameters corresponding to the next time step;

[0150] Based on the policy parameters, the cleaning policy is dynamically adjusted.

[0151] In one embodiment of the present application, the cleaning strategy dynamic adjustment unit 40 is further used to:

[0152] Outputting a flow-aware feature based on the gated recurrent unit, the flow-aware feature comprising a hidden state, a reset gate output, and an update gate output;

[0153] Based on the hidden state, adjusting the flow cleaning intensity, wherein the hidden state represents the state of the current flow data;

[0154] Based on the update gate output, adjusting the timeliness of traffic cleaning, wherein the update gate output represents the combined ratio of the current time step to the previous time step;

[0155] Based on the reset gate output, the flow cleaning persistence is adjusted, wherein the reset gate output represents the degree of reset of the hidden state corresponding to the previous time step to the current input.

[0156] In one embodiment of the present application, the device further includes a model optimization unit, which is used to:

[0157] Determining whether an abnormality occurs in the gated recurrent unit during the back propagation process;

[0158] If so, determine whether to perform truncation processing according to the preset gravity parameters and truncation threshold;

[0159] If so, the truncated gradient is updated.

[0160] In the embodiment of the present application, the long short-term memory network model is used to deeply process the network traffic data. The long short-term memory network model can effectively capture and process the long-term dependencies in the sequence data due to its unique gating mechanism and cell state design, and is particularly suitable for processing data with time series characteristics such as network traffic. Through the long short-term memory network model, the key features in the network traffic data can be accurately extracted, providing an accurate data basis for subsequent intelligent adjustment. After extracting the key features of the network traffic, the gated recurrent unit model is further used to intelligently adjust the traffic cleaning strategy. The gated recurrent unit model can effectively alleviate the gradient disappearance problem and is suitable for real-time strategy adjustment. Through the gated recurrent unit, the cleaning strategy can be dynamically adjusted according to the real-time changes of the network traffic to ensure efficient and safe processing of the network traffic. And by optimizing the gated recurrent unit model using the truncated gradient algorithm, the gradient explosion is effectively prevented: by truncating the excessive gradient, the gradient is effectively prevented from growing without limit during the back propagation process, thereby avoiding the problem of gradient explosion. Improve training stability: truncated gradients help maintain the stability of the training process and reduce the drastic fluctuations in model parameter updates. Accelerate convergence: By controlling the size of the gradient, the truncated gradient algorithm can help the optimizer find the appropriate parameter update direction more quickly, thereby accelerating the convergence of the model. Reduce the risk of overfitting: Too large a gradient may cause the model to overfit the noise in the training data. By truncating the gradient, this risk of overfitting can be reduced and the generalization ability of the model can be improved.

[0161] For the specific definition of the intelligent traffic cleaning device, please refer to the definition of the intelligent traffic cleaning method above, which will not be repeated here. Each module in the above-mentioned intelligent traffic cleaning device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0162] In one embodiment, a computer device is provided. The computer device may be a terminal device, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, a memory, and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a readable storage medium. The readable storage medium stores computer-readable instructions. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer-readable instructions are executed by the processor, an intelligent traffic cleaning method is implemented. The readable storage medium provided in this embodiment includes a non-volatile readable storage medium and a volatile readable storage medium.

[0163] In an embodiment of the present application, a computer device is provided, including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the steps of the intelligent traffic cleaning method described above are implemented.

[0164] In an embodiment of the application, a readable storage medium is provided, wherein the readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the steps of the intelligent traffic cleaning method as described above are implemented.

[0165] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through computer-readable instructions, and the computer-readable instructions can be stored in a non-volatile readable storage medium or a volatile readable storage medium. When the computer-readable instructions are executed, they may include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0166] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0167] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An intelligent traffic cleaning method, characterized in that: The method comprises: Get current traffic data; Input the current traffic data into the trained long short-term memory network for processing to obtain time series features; Comparing the time series characteristics with the time series characteristics of normal traffic data to determine whether the current traffic data is abnormal; When the current traffic data is abnormal, the time series feature, the current traffic data and the strategy parameter set are input into the trained gated recurrent unit to predict the strategy parameters corresponding to the next time step; Dynamically adjust the cleaning strategy based on the strategy parameters; Wherein, after inputting the time series features, the current traffic data and the strategy parameter set into the trained gated recurrent unit, the following steps are included: Outputting a flow-aware feature based on the gated recurrent unit, the flow-aware feature comprising a hidden state, a reset gate output, and an update gate output; Based on the hidden state, adjusting the flow cleaning intensity, wherein the hidden state represents the state of the current flow data; Based on the update gate output, adjusting the timeliness of traffic cleaning, wherein the update gate output represents the combined ratio of the current time step to the previous time step; Based on the reset gate output, the flow cleaning persistence is adjusted, wherein the reset gate output represents the degree of reset of the hidden state corresponding to the previous time step to the current input.

2. The intelligent traffic cleaning method according to claim 1, characterized in that: The long short-term memory network is trained in the following way: Collecting historical traffic data, marking positive labels and negative labels on the historical traffic data, and obtaining training sample data; Construct an initial long short-term memory network; Iteratively training the initial long short-term memory network using the training sample data; When the preset convergence condition is met, the trained long short-term memory network is obtained.

3. The intelligent traffic cleaning method according to claim 1, characterized in that: The determining whether the current traffic data is abnormal includes: The current traffic data is processed time-step by time-step through a long short-term memory network to obtain a time series feature corresponding to the current traffic data; Learning and memorizing the time series features corresponding to the normal traffic data through the long short-term memory network; Comparing the time series characteristics corresponding to the current traffic data with the time series characteristics corresponding to the normal traffic data; When the comparison is inconsistent, it is determined that the current flow data is abnormal; The time series characteristics include at least one of periodic changes in flow, peak values, valley values, and flow growth trends.

4. The intelligent traffic cleaning method according to claim 1, characterized in that: The LSTM network includes LSTM network cells, and the internal state of the LSTM network cells is updated in the following manner: Update the input gate unit through the forget gate to obtain an updated input gate; Based on the updated input gate, input weight and the recurrent weight of the forget gate, the internal state of the long short-term memory network cell is updated, wherein the output of the long short-term memory network cell is closed through the output gate.

5. The intelligent traffic cleaning method according to claim 1, characterized in that: The method further comprises: Determining whether an abnormality occurs in the gated recurrent unit during the back propagation process; If so, determine whether to perform truncation processing according to the preset gravity parameters and truncation threshold; If so, the truncated gradient is updated.

6. An intelligent flow cleaning device, characterized in that: The device comprises: A current flow data acquisition unit, used to acquire current flow data and perform preprocessing; A time series feature extraction unit is used to input the current traffic data into the trained long short-term memory network for processing to obtain time series features; A flow anomaly determination unit, used for comparing the time series characteristics with the time series characteristics of normal flow data to determine whether the current flow data has an anomaly; A cleaning strategy dynamic adjustment unit is used to input the time series features, the current traffic data and the strategy parameter set into the trained gated loop unit when the current traffic data is abnormal, and predict the strategy parameters corresponding to the next time step; Dynamically adjust the cleaning strategy based on the strategy parameters; Wherein, the cleaning strategy dynamic adjustment unit is also used for: Outputting a flow-aware feature based on the gated recurrent unit, the flow-aware feature comprising a hidden state, a reset gate output, and an update gate output; Based on the hidden state, adjusting the flow cleaning intensity, wherein the hidden state represents the state of the current flow data; Based on the update gate output, adjusting the timeliness of traffic cleaning, wherein the update gate output represents the combined ratio of the current time step to the previous time step; Based on the reset gate output, the flow cleaning persistence is adjusted, wherein the reset gate output represents the degree of reset of the hidden state corresponding to the previous time step to the current input.

7. A computer device comprising a memory, a processor, and computer-readable instructions stored in the memory and executed on the processor, characterized in that: When the processor executes the computer-readable instructions, the intelligent traffic cleaning method as described in any one of claims 1 to 5 is implemented.

8. A readable storage medium having computer-readable instructions stored thereon, characterized in that: When the computer-readable instructions are executed by a processor, the intelligent traffic cleaning method as described in any one of claims 1 to 5 is implemented.

Images