Intranet traffic anomaly detection method, device, electronic device and storage medium

Abstract

The present application provides a method, device, electronic device and storage medium for detecting abnormal intranet traffic, including: determining the application device network access relationship graph of the intranet to be detected based on the communication data between each application host in the intranet to be detected; analyzing the interaction behavior between each node in the application device network access relationship graph, and determining the external access behavior embedding vector of each node; wherein each node in the application device network access relationship graph represents the application host, and the edge between each node represents the access interaction behavior between the application hosts; performing a legitimacy check on the test traffic of the intranet to be detected based on the application device network access relationship graph, and determining whether the test traffic has abnormal access behavior. It can accurately model the traffic access relationship between enterprise applications, detect the abnormality of the intranet traffic according to the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

Description

Technical Field

[0001] The present application relates to the field of data monitoring technology, and in particular to a method, device, electronic device and storage medium for detecting abnormal intranet traffic. Background Art

[0002] Traffic is one of the golden indicators of the system, which directly reflects the operating status of the user's network. Healthy network traffic usually fluctuates smoothly. When the traffic suddenly rises or falls, it may indicate that there is a fault in the user's network. For example, when the external network link fails, the access traffic of external users cannot reach the user's intranet, and the traffic will drop suddenly. When the intranet server has a problem and cannot respond to the user's request, the traffic at this time will also drop suddenly. In addition to failures that cause sudden drops in traffic, when the intranet server is crawled or attacked by a crawler, the traffic will rise suddenly. Therefore, a sudden rise or fall in traffic often indicates that some kind of failure or abnormal behavior has occurred in the user's network. Therefore, traffic anomaly detection is very important for discovering network failures and maintaining the stability of the internal network. In the prior art, the normal behavior patterns of machine traffic are learned by machine learning, and machine learning algorithms are used to identify abnormal behaviors that deviate from these patterns, but it is usually difficult to adapt to changes in network traffic behavior, which leads to technical problems such as inaccurate traffic anomaly detection. Summary of the invention

[0003] In view of this, the purpose of the present application is to provide a method, device, electronic device and storage medium for detecting anomalies in intranet traffic, which can accurately model the traffic access relationship between enterprise applications, detect anomalies in intranet traffic based on the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

[0004] The present application provides a method for detecting abnormal intranet traffic, and the method comprises:

[0005] Determine a network access relationship diagram of application devices in the intranet to be detected based on communication data between application hosts in the intranet to be detected;

[0006] Analyze the interaction behaviors between the nodes in the application device network access relationship graph to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship graph represents the application host, and the edges between the nodes represent the access interaction behaviors between the application hosts;

[0007] Based on the application device network access relationship diagram, the legitimacy of the test traffic of the intranet to be detected is checked to determine whether there is abnormal access behavior in the test traffic.

[0008] In a possible implementation manner, determining the network access relationship of the application devices in the intranet to be detected based on the communication data between the application devices in the intranet to be detected includes:

[0009] Reading the original log in the message queue of the intranet to be detected based on multi-process and region;

[0010] Acquire the IP address corresponding to each of the application devices based on the API interface, extract the key fields in the original log based on the IP address corresponding to each of the application devices, and determine the access relationship between each of the application devices according to the extracted key fields;

[0011] A graph of the access relationship between each of the application devices is constructed to generate a network access relationship graph of the application devices.

[0012] In a possible implementation manner, analyzing the interaction behaviors between the nodes in the application device network access relationship graph to determine the external access behavior embedding vector of each node includes:

[0013] Based on the interaction behaviors between the nodes in the application device network access relationship diagram, determining an external access summary diagram of each node;

[0014] The external access behaviors in the external access summary graph are encoded based on an unsupervised algorithm to generate external access behavior embedding vectors of each node, and the external access behavior embedding vectors are updated in real time.

[0015] In a possible implementation manner, the legitimacy detection of the test traffic of the to-be-detected intranet based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior includes:

[0016] Performing a service activation legitimacy check on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal;

[0017] If the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior.

[0018] In a possible implementation manner, performing service activation legitimacy detection on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal includes:

[0019] Detecting whether there is an open service of the destination application host node corresponding to the test traffic in the application device network access relationship diagram;

[0020] If yes, the test traffic service is started normally;

[0021] If not, the test traffic service is activated abnormally.

[0022] In a possible implementation manner, if the test traffic service is enabled normally, then based on the application device network access relationship diagram, the access behavior legitimacy detection is performed on the test traffic of the intranet to be detected to determine whether the test traffic has abnormal access behavior, including:

[0023] Determine, based on the application device network access relationship graph, a candidate node having an external access behavior similar to that of the source host node of the test traffic;

[0024] Performing similarity calculation on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine a similarity value;

[0025] If the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior.

[0026] In a possible implementation manner, after determining that if the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior, the intranet traffic anomaly detection method further includes:

[0027] The alarm information of the test traffic is generated based on the key fields of the test traffic, the historical access behavior of the source host node, and the externally open services of the destination application host node.

[0028] The embodiment of the present application also provides an intranet traffic anomaly detection device, the intranet traffic anomaly detection device comprising:

[0029] An intranet access relationship diagram establishment module, used to determine the network access relationship diagram of the application devices in the intranet to be detected based on the communication data between the various application hosts in the intranet to be detected;

[0030] The intranet access relationship modeling module is used to analyze the interaction behavior between each node in the application device network access relationship diagram to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edges between each node represent the access interaction behavior between the application hosts;

[0031] The determination module is used to perform a legitimacy detection on the test traffic of the intranet to be detected based on the network access relationship diagram of the application device, and determine whether there is any abnormal access behavior in the test traffic.

[0032] An embodiment of the present application also provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the steps of the intranet traffic anomaly detection method as described above are performed.

[0033] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the intranet traffic anomaly detection method as described above are executed.

[0034] The embodiment of the present application provides a method, device, electronic device and storage medium for detecting abnormal intranet traffic. The method for detecting abnormal intranet traffic includes: determining the application device network access relationship diagram of the intranet to be detected based on the communication data between each application host in the intranet to be detected; analyzing the interaction behavior between each node in the application device network access relationship diagram to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edge between each node represents the access interaction behavior between the application hosts; performing a legitimacy check on the test traffic of the intranet to be detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior. It can accurately model the traffic access relationship between enterprise applications, detect the abnormality of the intranet traffic according to the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

[0035] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 A flowchart of a method for detecting abnormal intranet traffic provided by an embodiment of the present application;

[0038] Figure 2One of the structural schematic diagrams of an intranet traffic anomaly detection device provided in an embodiment of the present application;

[0039] Figure 3 A second structural diagram of an intranet traffic anomaly detection device provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0041] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application usually described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, each other embodiment obtained by those skilled in the art without making creative work belongs to the scope of protection of the present application.

[0042] First, the application scenarios to which the present application is applicable are introduced. The present application can be applied in the field of data monitoring technology.

[0043] Research has found that traffic is one of the golden indicators of the system, which directly reflects the operating status of the user's network. Healthy network traffic usually fluctuates smoothly. When the traffic suddenly rises or falls, it may indicate that there is a fault in the user's network. For example, when the external network link fails, the access traffic of external users cannot reach the user's intranet, and the traffic will drop suddenly. When the intranet server has a problem and cannot respond to the user's request, the traffic at this time will also drop suddenly. In addition to failures that cause sudden drops in traffic, when the intranet server is crawled or attacked by a crawler, the traffic will rise suddenly. Therefore, a sudden rise or fall in traffic often indicates that some kind of failure or abnormal behavior has occurred in the user's network. Therefore, traffic anomaly detection is very important for discovering network failures and maintaining the stability of the internal network. In the prior art, the normal behavior patterns of machine traffic are learned by machine learning, and machine learning algorithms are used to identify abnormal behaviors that deviate from these patterns, but it is usually difficult to adapt to changes in network traffic behavior, which leads to technical problems such as inaccurate traffic anomaly detection.

[0044] Based on this, an embodiment of the present application provides a method for detecting anomalies in intranet traffic, which can accurately model the traffic access relationship between enterprise applications, detect anomalies in intranet traffic based on the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

[0045] See also Figure 1 , Figure 1 This is a flow chart of a method for detecting abnormal intranet traffic provided by an embodiment of the present application. Figure 1 As shown in, the intranet traffic anomaly detection method provided by the embodiment of the present application includes:

[0046] S101: Based on the communication data between the application hosts in the intranet to be detected, a network access relationship diagram of the application devices in the intranet to be detected is determined.

[0047] In this step, the network access relationship diagram of the application devices is determined based on the communication data between the various application hosts in the intranet to be detected.

[0048] The intranet to be detected may be an internal network of an enterprise.

[0049] Here, we collect the communication data between various devices and services in the intranet, and use this data to build a detailed application-level network access relationship diagram, which vividly shows the interaction mode between various applications in the enterprise intranet.

[0050] In a possible implementation manner, determining the network access relationship of the application devices in the intranet to be detected based on the communication data between the application devices in the intranet to be detected includes:

[0051] A: Read the original logs in the message queue of the intranet to be detected based on multiple processes and regions.

[0052] Here, the original logs in the message queue of the intranet to be detected are read in different regions according to multiple processes.

[0053] Among them, python-kafka is used to connect to the kafka server, and the original logs in kafka are read in different regions through multiple processes.

[0054] B: Obtain the IP address corresponding to each of the application devices based on the API interface, extract the key fields in the original log based on the IP address corresponding to each of the application devices, and determine the access relationship between each of the application devices based on the extracted key fields.

[0055] Here, the IP address corresponding to each application device is obtained according to the API interface, the key fields in the original log are extracted according to the IP address corresponding to each application device, and the access relationship between each application device is determined according to the extracted key fields.

[0056] Among them, the correspondence between application and IP is obtained through the internal API interface, and then the key fields in the original log are extracted to generate the range relationship between applications. The application access relationship is stored in the hash table to ensure the rapid judgment of the existence of the access relationship. The access relationship associated with the application is stored in the adjacency table to ensure the efficiency of querying the subgraph.

[0057] C: constructing a graph of the access relationship between each of the application devices to generate a network access relationship graph of the application devices.

[0058] Here, a graph of the access relationship between each application device is constructed to generate a network access relationship graph of the application devices.

[0059] In this solution, considering that the traditional method of recording the access relationship between IPs is meaningless and cannot fully portray the access relationship between various businesses within the enterprise, the mutual access relationship between applications is recorded based on the application dimension. By consuming key data such as http, dns, ftp, smb, sql, tftp, icmpLog, msrdp, socks, sshLog, sslLog, and telnet, the access relationship between applications is recorded when the source IP and destination IP in the key data are both IPs defined as applications.

[0060] S102: Analyze the interaction behavior between each node in the application device network access relationship graph to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship graph represents the application host, and the edges between each node represent the access interaction behavior between application hosts.

[0061] In this step, the interaction behaviors between the nodes in the application device network access relationship diagram are analyzed to determine the external access behavior embedding vector of each node.

[0062] In a possible implementation manner, analyzing the interaction behaviors between the nodes in the application device network access relationship graph to determine the external access behavior embedding vector of each node includes:

[0063] a: Based on the interaction behaviors between the nodes in the application device network access relationship diagram, determine the external access summary diagram of each node.

[0064] Here, according to the interaction behaviors between the nodes in the application device network access relationship diagram, the external access summary diagram of each node is determined.

[0065] b: Encoding the external access behavior based on an unsupervised algorithm, generating an external access behavior embedding vector of each node, and updating the external access behavior embedding vector in real time.

[0066] Here, the external access behavior is encoded according to an unsupervised algorithm to generate an external access behavior embedding vector of each node, and the external access behavior embedding vector is updated in real time.

[0067] Here, when constructing the business relationship map within the enterprise, the interaction between different business units is deeply understood by modeling the access relationship. The device network access relationship graph is used to visualize the various nodes within the enterprise (for example, servers, applications, and services) and the access behaviors between them. In order to analyze the interaction behaviors of these nodes in more detail, an external access summary graph can be constructed for each node. This summary graph focuses on depicting how a single node interacts with other nodes and captures all external access requests initiated from the node. Using the Graph2Vec algorithm, the vector embedding of the historical external access behavior of the node is incrementally learned from these external access summary graphs. When the graph structure data is converted into points in the vector space, the relative positions of these points can reflect the similarity of the nodes in the original graph. In this way, the external access behavior of each node is encoded into a fixed-length vector that captures the essential characteristics of the node access pattern. The advantage of this method is that it can not only identify and understand the access behavior of the node based on historical data, but also dynamically update the vector representation of the node as new data arrives. This means that as time goes by and the access pattern changes, the system can flexibly adapt to new behavior patterns, thereby providing more accurate security monitoring, anomaly detection, and network optimization recommendations. The characteristics of incremental learning make this method very suitable for handling large-scale, dynamically changing enterprise network environments, providing an efficient and dynamic solution for maintaining network security and optimizing business processes.

[0068] S103: Performing a legitimacy check on the test traffic of the intranet to be detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior.

[0069] In this step, the legitimacy of the test traffic of the intranet to be tested is checked according to the network access relationship diagram of the application device to determine whether there is abnormal access behavior in the test traffic.

[0070] In a possible implementation manner, the legitimacy detection of the test traffic of the to-be-detected intranet based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior includes:

[0071] (1): Based on the network access relationship diagram of the application device, the service activation legitimacy of the test traffic is detected to determine whether the service activation of the test traffic is abnormal.

[0072] Here, the service activation legitimacy of the test traffic is detected according to the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal.

[0073] In a possible implementation manner, performing a service activation legitimacy detection on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal includes:

[0074] i: Detect whether there is an open service of the destination application host node corresponding to the test traffic in the application device network access relationship diagram.

[0075] Here, it is detected whether there is an open service of the destination application host node corresponding to the test traffic in the application device network access relationship diagram.

[0076] ii: If yes, the test traffic service is started normally; if no, the test traffic service is started abnormally.

[0077] Here, if the destination application host node in the application device network access relationship diagram has never opened such a service, the test traffic is likely to come from an attacker who is not within the enterprise, and the traffic is identified as abnormal.

[0078] Among them, when the test traffic service is abnormally opened, the alarm information of the test traffic is directly generated according to the key fields of the test traffic and the externally open services of the destination application host node.

[0079] (2): If the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is checked based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior.

[0080] Here, if the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is checked according to the network access relationship diagram of the application device to determine whether the test traffic has abnormal access behavior.

[0081] In a possible implementation manner, if the test traffic service is enabled normally, then based on the application device network access relationship diagram, the access behavior legitimacy detection is performed on the test traffic of the intranet to be detected to determine whether the test traffic has abnormal access behavior, including:

[0082] I: Determine a candidate node having an external access behavior similar to that of a source host node of the test traffic based on the application device network access relationship diagram.

[0083] Here, the nodes in the application device network access relationship graph that have similar external access behaviors to the source host node are determined as candidate nodes.

[0084] II: performing similarity calculation on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine a similarity value; if the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior.

[0085] Here, similarity calculation is performed based on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine the similarity value. If the similarity value is lower than the preset similarity threshold, the test traffic has abnormal access behavior.

[0086] In a possible implementation manner, after determining that if the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior, the intranet traffic anomaly detection method further includes:

[0087] The alarm information of the test traffic is generated based on the key fields of the test traffic, the historical access behavior of the source host node, and the externally open services of the destination application host node.

[0088] Here, alarm information for test traffic is generated based on the key fields of the test traffic, the historical access behavior of the source host node, and the externally exposed services of the destination application host node, thereby avoiding the "one-size-fits-all" processing method in traditional black alarm systems, helping security teams to more effectively identify and prioritize situations that may require further investigation, while reducing false alarms and interference with normal business processes.

[0089] In this application, intranet traffic anomaly detection is performed by building traffic access relationships between applications instead of access relationships between IPs, which can reveal traffic anomaly behavior in a more fine-grained manner. By creating a summary graph of external access for each node and using machine learning algorithms to incrementally learn the vector embedding of the node's historical access behavior, it provides an in-depth and dynamic way to understand and analyze the interaction between business units within the enterprise. In addition, its incremental learning characteristics enable the system to adapt to changes in access patterns, providing a flexible and efficient solution strategy for network security monitoring, anomaly detection, and network optimization; generating intranet threat gray alerts, thereby avoiding the "one-size-fits-all" approach in traditional black alert systems, helping security teams to more effectively identify and prioritize situations that may require further investigation, while reducing false alarms and interference with normal business processes.

[0090] The embodiment of the present application provides a method for detecting abnormal intranet traffic, and the method includes: determining the application device network access relationship diagram of the intranet to be detected based on the communication data between each application host in the intranet to be detected; analyzing the interaction behavior between each node in the application device network access relationship diagram, and determining the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edge between each node represents the access interaction behavior between the application hosts; performing a legitimacy check on the test traffic of the intranet to be detected based on the application device network access relationship diagram, and determining whether the test traffic has abnormal access behavior. It can accurately model the traffic access relationship between enterprise applications, detect the abnormality of the intranet traffic according to the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

[0091] See also Figure 2 , Figure 3 , Figure 2 One of the structural schematic diagrams of an intranet traffic anomaly detection device provided in an embodiment of the present application; Figure 3 This is a second structural diagram of an intranet traffic anomaly detection device provided in an embodiment of the present application. Figure 3 As shown in , the intranet traffic anomaly detection device 200 includes:

[0092] An intranet access relationship diagram establishing module 210 is used to determine a network access relationship diagram of application devices in the intranet to be detected based on communication data between various application hosts in the intranet to be detected;

[0093] The intranet access relationship modeling module 220 is used to analyze the interaction behavior between each node in the application device network access relationship diagram to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edge between each node represents the access interaction behavior between the application hosts;

[0094] The determination module 230 is used to perform a legitimacy detection on the test traffic of the intranet to be detected based on the application device network access relationship diagram, and determine whether the test traffic has abnormal access behavior.

[0095] Further, when the intranet access relationship diagram establishment module is used to determine the network access relationship of the application devices in the intranet to be detected based on the communication data between the various application devices in the intranet to be detected, the intranet access relationship diagram establishment module is specifically used to:

[0096] Reading the original log in the message queue of the intranet to be detected based on multi-process and region;

[0097] Acquire the IP address corresponding to each of the application devices based on the API interface, extract the key fields in the original log based on the IP address corresponding to each of the application devices, and determine the access relationship between each of the application devices according to the extracted key fields;

[0098] A graph of the access relationship between each of the application devices is constructed to generate a network access relationship graph of the application devices.

[0099] Furthermore, when the intranet access relationship modeling module is used to analyze the interaction behaviors between the nodes in the application device network access relationship graph and determine the external access behavior embedding vector of each node, the intranet access relationship modeling module is specifically used to:

[0100] Based on the interaction behaviors between the nodes in the application device network access relationship diagram, determining an external access summary diagram of each node;

[0101] The external access behaviors in the external access summary graph are encoded based on an unsupervised algorithm to generate external access behavior embedding vectors of each node, and the external access behavior embedding vectors are updated in real time.

[0102] Further, when the determination module is used to perform a legitimacy detection on the test traffic of the to-be-detected intranet based on the application device network access relationship diagram and determine whether the test traffic has abnormal access behavior, the determination module is specifically used to:

[0103] Performing a service activation legitimacy check on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal;

[0104] If the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior.

[0105] Further, when the determination module is used to perform service activation legitimacy detection on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal, the determination module is specifically used to:

[0106] Detecting whether there is an open service of the destination application host node corresponding to the test traffic in the application device network access relationship diagram;

[0107] If yes, the test traffic service is started normally;

[0108] If not, the test traffic service is activated abnormally.

[0109] Furthermore, if the test traffic service is enabled normally, the access behavior legitimacy detection is performed on the test traffic of the intranet to be detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior, including:

[0110] Determine, based on the application device network access relationship graph, a candidate node having an external access behavior similar to that of the source host node of the test traffic;

[0111] Performing similarity calculation on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine a similarity value;

[0112] If the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior.

[0113] Further, such as Figure 3 As shown, the intranet traffic anomaly detection device 200 further includes an alarm generation module 240, which is used to:

[0114] The alarm information of the test traffic is generated based on the key fields of the test traffic, the historical access behavior of the source host node, and the externally open services of the destination application host node.

[0115] An embodiment of the present application provides an intranet traffic anomaly detection device, which includes: an intranet access relationship diagram establishment module, which is used to determine the application device network access relationship diagram of the intranet to be detected based on the communication data between each application host in the intranet to be detected; an intranet access relationship modeling module, which is used to analyze the interaction behavior between each node in the application device network access relationship diagram, and determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edge between each node represents the access interaction behavior between the application hosts; a determination module, which is used to perform a legitimacy detection on the test traffic of the intranet to be detected based on the application device network access relationship diagram, and determine whether the test traffic has abnormal access behavior. It can accurately model the traffic access relationship between enterprise applications, detect the anomaly of the intranet traffic according to the access relationship, and improve the accuracy and efficiency of intranet traffic detection.

[0116] See also Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 4 As shown in , the electronic device 400 includes a processor 410 , a memory 420 and a bus 430 .

[0117] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, the above-mentioned Figure 1 The steps of the intranet traffic anomaly detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0118] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the computer program can execute the above-mentioned Figure 1 The steps of the intranet traffic anomaly detection method in the method embodiment shown, the specific implementation method can be found in the method embodiment, and will not be repeated here.

[0119] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0120] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0121] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0122] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0123] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0124] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting abnormal intranet traffic, characterized in that: The intranet traffic anomaly detection method comprises: Determine a network access relationship diagram of application devices in the intranet to be detected based on communication data between application hosts in the intranet to be detected; Analyze the interaction behaviors between the nodes in the application device network access relationship graph to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship graph represents the application host, and the edges between the nodes represent the access interaction behaviors between the application hosts; Performing a legitimacy check on the test traffic of the intranet to be tested based on the network access relationship diagram of the application device to determine whether the test traffic has abnormal access behavior; The performing of a legitimacy check on the test traffic of the to-be-detected intranet based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior includes: Performing a service activation legitimacy check on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal; If the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior; The step of analyzing the interaction behaviors between the nodes in the application device network access relationship graph to determine the external access behavior embedding vector of each node includes: Based on the interaction behaviors between the nodes in the application device network access relationship diagram, determining an external access summary diagram of each node; Encoding the external access behaviors in the external access summary graph based on an unsupervised algorithm to generate external access behavior embedding vectors of each node, and updating the external access behavior embedding vectors in real time; If the test traffic service is enabled normally, then based on the application device network access relationship diagram, the access behavior legitimacy detection is performed on the test traffic of the intranet to be detected to determine whether the test traffic has abnormal access behavior, including: Determine, based on the application device network access relationship graph, a candidate node having an external access behavior similar to that of the source host node of the test traffic; Performing similarity calculation on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine a similarity value; If the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior.

2. The method for detecting abnormal intranet traffic according to claim 1, characterized in that: The determining of the network access relationship of the application devices in the intranet to be detected based on the communication data between the application devices in the intranet to be detected includes: Reading the original log in the message queue of the intranet to be detected based on multi-process and region; Acquire the IP address corresponding to each of the application devices based on the API interface, extract the key fields in the original log based on the IP address corresponding to each of the application devices, and determine the access relationship between each of the application devices according to the extracted key fields; A graph of the access relationship between each of the application devices is constructed to generate a network access relationship graph of the application devices.

3. The method for detecting abnormal intranet traffic according to claim 1, characterized in that: The performing service activation legitimacy detection on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal includes: Detecting whether there is an open service of the destination application host node corresponding to the test traffic in the application device network access relationship diagram; If yes, the test traffic service is started normally; If not, the test traffic service is activated abnormally.

4. The method for detecting abnormal intranet traffic according to claim 1, characterized in that: After the test traffic has abnormal access behavior if the similarity value is lower than the preset similarity threshold, the intranet traffic anomaly detection method further includes: The alarm information of the test traffic is generated based on the key fields of the test traffic, the historical access behavior of the source host node, and the externally open services of the destination application host node.

5. An intranet traffic anomaly detection device, characterized in that: The intranet traffic anomaly detection device comprises: An intranet access relationship diagram establishment module, used to determine the network access relationship diagram of the application devices in the intranet to be detected based on the communication data between the various application hosts in the intranet to be detected; The intranet access relationship modeling module is used to analyze the interaction behavior between each node in the application device network access relationship diagram to determine the external access behavior embedding vector of each node; wherein each node in the application device network access relationship diagram represents the application host, and the edges between each node represent the access interaction behavior between the application hosts; A determination module, configured to perform a legitimacy detection on the test traffic of the intranet to be detected based on the network access relationship diagram of the application device, and determine whether the test traffic has abnormal access behavior; When the determination module is used to perform a legitimacy detection on the test traffic of the to-be-detected intranet based on the application device network access relationship diagram and determine whether the test traffic has abnormal access behavior, the determination module is specifically used to: Performing a service activation legitimacy check on the test traffic based on the application device network access relationship diagram to determine whether the service activation of the test traffic is abnormal; If the test traffic service is enabled normally, the access behavior legitimacy of the test traffic is detected based on the application device network access relationship diagram to determine whether the test traffic has abnormal access behavior; When the intranet access relationship modeling module is used to analyze the interaction behaviors between the nodes in the application device network access relationship graph and determine the external access behavior embedding vector of each node, the intranet access relationship modeling module is specifically used to: Based on the interaction behaviors between the nodes in the application device network access relationship diagram, determining an external access summary diagram of each node; Encoding the external access behaviors in the external access summary graph based on an unsupervised algorithm to generate external access behavior embedding vectors of each node, and updating the external access behavior embedding vectors in real time; When the determination module is used to detect the legitimacy of access behavior of the test traffic of the to-be-detected intranet based on the network access relationship diagram of the application device if the test traffic service is normally started, and to determine whether the test traffic has abnormal access behavior, the determination module is specifically used to: Determine, based on the application device network access relationship graph, a candidate node having an external access behavior similar to that of the source host node of the test traffic; Performing similarity calculation on the external access behavior embedding vector of the candidate node and the external access behavior embedding vector of the source host node to determine a similarity value; If the similarity value is lower than a preset similarity threshold, the test traffic has abnormal access behavior.

6. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate through the bus, and the machine-readable instructions are executed by the processor to execute the steps of the intranet traffic anomaly detection method as described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the intranet traffic anomaly detection method according to any one of claims 1 to 4 are executed.

Images