Node detection method and device and storage medium

Abstract

The invention provides a node detection method and device and a storage medium, relates to the technical field of communication, and can perform anomaly detection and confirmation on a target node participating in a data circulation process. The method comprises the following steps: acquiring flow data of a target node in a current time period; and inputting the traffic data of the target node in the current time period into the first traffic prediction model to obtain predicted traffic data of the target node in a first time period, the first time period being outside the current time period. Detecting the predicted traffic data based on a first anomaly detection algorithm, and determining whether the predicted traffic data is abnormal; and when it is determined that the predicted traffic data is abnormal, determining whether the target node is abnormal based on a second anomaly detection algorithm. Wherein the local density deviation of the target node in the flow space; wherein under the condition that the deviation is greater than a preset threshold value, the target node is an abnormal node, and the first anomaly detection algorithm is different from the second anomaly detection algorithm.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a node detection method, device and storage medium. Background Art

[0002] In the process of data circulation, anomaly detection of intermediate nodes is an important technical means to ensure data integrity and security, and to ensure the reliability and efficiency of data transmission. Timely discovery and handling of abnormal problems in the data transmission process can reduce business risks caused by data loss, leakage or transmission failure. This is of great significance to ensuring the normal operation and sustainable development of enterprises.

[0003] At present, anomaly monitoring methods and traditional machine learning algorithms are not suitable for data circulation with random and uncertain characteristics. Fixed threshold monitoring cannot be used during data circulation, and traditional machine learning algorithms have low detection accuracy for abnormal nodes during data circulation. Summary of the invention

[0004] The present application provides a node detection method, device and storage medium, which can perform anomaly detection and anomaly confirmation on target nodes participating in a data flow process.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, the present application provides a node detection method, the method comprising:

[0007] Obtain the traffic data of the target node in the first time period;

[0008] Inputting the traffic data of the target node in the first time period into the first traffic prediction model to obtain the traffic data of the target node in the second time period, where the second time period is after the first time period;

[0009] Detecting the flow data in the second time period based on the first anomaly detection algorithm to determine whether the flow data in the second time period is abnormal;

[0010] When it is determined that the traffic data in the second time period is abnormal, whether the target node is abnormal is determined based on the second anomaly detection algorithm; wherein, when the indicator of the traffic data in the second time period of the target node exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

[0011] According to the above technical means, the present application can detect anomalies of target nodes participating in data circulation activities based on the predicted flow data and actual flow data of the target nodes. The secondary judgment of abnormal nodes reduces the false alarm rate of node anomaly detection.

[0012] In a possible implementation, traffic data of a target node in a first time period is obtained through a root node; the root node is associated with multiple random groups, each random group includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have passed identity authentication.

[0013] According to the above technical means, the present application can form a security domain for data circulation activities through identity authentication, realize preventive operations on node anomalies before data circulation activities, and reduce the possibility of anomalies in the participating nodes of data circulation activities.

[0014] In one possible implementation, identity authentication includes at least one of the following: enterprise identity authentication of the node; enterprise identity refers to whether the enterprise to which the node belongs has the authority to participate in data circulation activities; physical address authentication of the node; physical node refers to whether the physical address of the node is consistent with the physical address registered by the node; signature authentication of the node.

[0015] Based on the above technical means, this application can perform comprehensive authentication on the enterprise identity, physical address, and node signature of the node, making the node identity authentication process more specific.

[0016] In one possible implementation, based on port mirroring technology, the traffic data of the central node in each random group is copied to the root node; wherein the central node of the random group is the node with the highest reputation value among the multiple nodes of the random group, and the reputation value is inversely proportional to the frequency of the node's abnormal data processing behavior.

[0017] According to the above technical means, the present application can obtain real-time traffic data of multiple target nodes through port mirroring technology, thereby improving the real-time performance of the node detection method. The target node is connected to the root node through the central node, making the communication network simpler.

[0018] In a possible implementation, when it is determined that the target node is a faulty node, a corresponding fault handling strategy is determined according to the fault type and fault severity of the target node; and the target node is managed according to the fault handling strategy.

[0019] According to the above-mentioned technical means, the present application can promptly process the faulty nodes according to the fault type and degree of the target nodes, thereby ensuring the continuity and stability of data flow and promoting data security and privacy protection.

[0020] In one possible implementation, for each random group, in response to multiple nodes in the random group completing the processing of the target data, the data processing logs of all nodes in the random group are obtained through the central node in the random group, and the corresponding traffic matrix is ​​determined according to the data processing logs of each node in the random group. The traffic matrix is ​​used to represent the changes in data traffic of the nodes at different times; based on a preset algorithm, the traffic matrices of multiple random groups are trained to obtain a first traffic prediction model.

[0021] According to the above technical means, the present application can obtain data processing logs of multiple target nodes participating in data circulation activities, which plays an important role in troubleshooting, performance monitoring, security auditing, fault prevention, etc.

[0022] In a possible implementation, fault feedback information of the target node is obtained, where the fault feedback information is used to indicate whether an abnormality detection result of the target node is correct; and parameters of the first abnormality detection algorithm and / or the second abnormality detection algorithm are adjusted according to the fault feedback information.

[0023] According to the above technical means, the present application can determine whether the abnormal detection result of the target node is correct based on the fault feedback information of the target node, and optimize the abnormal detection algorithm. This improves the accuracy of the subsequent abnormal detection algorithm, enhances data security, and promotes the update, optimization and improvement of the node detection method.

[0024] In one possible implementation, the difference between the predicted traffic data volume in the second time period and the actual traffic data volume in the second time period exceeds a preset threshold, and / or the data processing corresponding to the traffic data in the second time period is abnormal; wherein, data processing includes the input and output of traffic data, the sending of traffic data, and the resources used to process data.

[0025] According to the above technical means, the present application can use the current time traffic data and the abnormality of the predicted traffic data and / or the behavior model of the traffic data as the abnormality judgment condition of the target node, enriching the abnormality judgment conditions and making the node detection method more comprehensive.

[0026] In a possible implementation, the first anomaly detection algorithm is an anomaly detection algorithm based on LSTM design, and the second anomaly detection algorithm is a LOF density-based algorithm.

[0027] According to the above technical means, the present application can detect the target node through the anomaly detection algorithm based on LSTM design and the LOF density-based algorithm, thereby improving the accuracy and security of anomaly detection.

[0028] In a second aspect, the present application provides a node detection device, which includes: an acquisition unit and a processing unit.

[0029] An acquisition unit, used to acquire traffic data of a target node in a first time period;

[0030] A processing unit, configured to input the flow data of the target node in the first time period into the first flow prediction model to obtain the flow data of the target node in the second time period, where the second time period is after the first time period;

[0031] The processing unit is further used to detect the flow data in the second time period based on the first anomaly detection algorithm to determine whether the flow data in the second time period is abnormal;

[0032] The processing unit is also used to determine whether the target node is abnormal based on the second anomaly detection algorithm when it is determined that the traffic data in the second time period is abnormal; wherein, when the indicator of the traffic data in the second time period of the target node exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

[0033] In a possible implementation, the acquisition unit is also used to obtain the traffic data of the target node in the first time period through the root node; the root node is associated with multiple random groups, each random group includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have passed identity authentication.

[0034] In one possible implementation, identity authentication includes at least one of the following: enterprise identity authentication of the node; enterprise identity refers to whether the enterprise to which the node belongs has the authority to participate in data circulation activities; physical address authentication of the node; physical node refers to whether the physical address of the node is consistent with the physical address registered by the node; signature authentication of the node.

[0035] In one possible implementation, the processing unit is also used to copy the traffic data of the central node in each random group to the root node based on port mirroring technology; wherein the central node of the random group is the node with the highest reputation value among the multiple nodes of the random group, and the reputation value is inversely proportional to the frequency of the node's abnormal data processing behavior.

[0036] In a possible implementation, the processing unit is further configured to, when determining that the target node is a faulty node, determine a corresponding fault handling strategy according to the fault type and fault severity of the target node; and manage the target node according to the fault handling strategy.

[0037] In one possible implementation, the processing unit is also used to complete the processing of target data for each random group in response to multiple nodes in the random group, obtain the data processing logs of all nodes in the random group through the central node in the random group, and determine the corresponding traffic matrix based on the data processing logs of each node in the random group, where the traffic matrix is ​​used to represent the changes in data traffic of the nodes at different times; based on a preset algorithm, the traffic matrices of multiple random groups are trained to obtain a first traffic prediction model.

[0038] In one possible implementation, the acquisition unit is also used to obtain fault feedback information of the target node, and the fault feedback information is used to indicate whether the abnormality detection result of the target node is correct; the processing unit is also used to adjust the parameters of the first abnormality detection algorithm and / or the second abnormality detection algorithm according to the fault feedback information.

[0039] In one possible implementation, the processing unit is also used to detect when the difference between the predicted traffic data volume in the second time period and the actual traffic data volume in the second time period exceeds a preset threshold, and / or the data processing corresponding to the traffic data in the second time period is abnormal; wherein the data processing includes the input and output of traffic data, the sending of traffic data, and the resources used to process the data.

[0040] In a possible implementation, the first anomaly detection algorithm is an anomaly detection algorithm based on LSTM design, and the second anomaly detection algorithm is a LOF density-based algorithm.

[0041] In a third aspect, the present application provides a node detection device, comprising: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the node detection method described in the first aspect and any possible implementation method of the first aspect.

[0042] In a fourth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a terminal, the terminal executes the node detection method described in the first aspect and any possible implementation of the first aspect.

[0043] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a node detection device, enables the node detection device to execute a node detection method as described in any possible implementation of the first aspect.

[0044] In a sixth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the node detection method described in the first aspect and any possible implementation method of the first aspect.

[0045] Specifically, the chip provided in the present application also includes a memory for storing computer programs or instructions. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A process of a node detection method provided in an embodiment of the present application Figure 1 ;

[0047] Figure 2 A process of a node detection method provided in an embodiment of the present application Figure 2 ;

[0048] Figure 3 A process of a node detection method provided in an embodiment of the present application Figure 3 ;

[0049] Figure 4 A schematic diagram of the structure of a node detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The node detection method, device and storage medium provided in the embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0051] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0052] The terms "first" and "second" and the like in the specification and drawings of this application are used to distinguish different objects, or to distinguish different processing of the same object, rather than to describe a specific order of objects.

[0053] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include other steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0054] It should be noted that, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0055] In the description of the present application, unless otherwise specified, “plurality” means two or more.

[0056] The following explains the terms involved in the embodiments of the present application to facilitate the reader's understanding.

[0057] (1) Long short-term memory (LSTM): A special recurrent neural network structure that aims to solve the gradient vanishing and gradient exploding problems faced by traditional recurrent neural network structures when dealing with long-term dependencies. Through its memory units and gating mechanism, it can effectively capture and retain long-term dependencies.

[0058] (2) Local outlier factor (LOF): A density-based anomaly detection algorithm that calculates an outlier factor for each data point. The outlier factor reflects the density difference between the point and other points in its neighborhood. If the outlier factor of a point is much larger than 1, it indicates that the density of the point is significantly lower than that of other points in its neighborhood, so it can be determined as an outlier. If the outlier factor of a point is close to 1, it indicates that the density of the point is similar to that of other points in its neighborhood, so it can be determined as a normal point.

[0059] (3) Node: refers to each key point and / or intersection in the data circulation process. It can be the source, storage, transmission, processing, exchange and use of data. Multiple nodes form a data circulation network through data transmission and exchange, forming the basic framework of data circulation.

[0060] (4) Port mirroring technology: A network management technology that copies data from a specific port on a switch or router to another port. In this process, the network device will copy the message flowing through the source port and transmit the message to the designated mirror port for analysis and monitoring. The message sent and received by the mirror port will be copied to the port connected to the monitoring device for analysis by the monitoring device.

[0061] The above is a brief introduction to some concepts involved in the embodiments of this application.

[0062] At present, anomaly monitoring methods and traditional machine learning algorithms are not suitable for data circulation with random and uncertain characteristics. Fixed threshold monitoring cannot be used during data circulation, and the accuracy of traditional machine learning algorithms for data circulation security detection is not high. In the event of unknown anomalies, manual intervention is required to modify and improve the machine learning algorithm.

[0063] In view of this, an embodiment of the present application provides a node detection method, which can detect target nodes participating in the data flow process, and also has the functions of confirming abnormal nodes and providing feedback on abnormal detection results.

[0064] The node detection method provided by the embodiment of the present application is described below in conjunction with the accompanying drawings. Among them, the actions, terms, etc. involved in the various embodiments of the present application can refer to each other without limitation. The message name or parameter name in the message exchanged between the various devices in the embodiment of the present application is only an example, and other names can also be used in the specific implementation without limitation. The actions involved in the various embodiments of the present application are only an example, and other names can also be used in the specific implementation, such as: "included in" in the embodiment of the present application can also be replaced by "carried on" or "carried on", etc.

[0065] It should be noted that the execution subject of the present application may be a data monitoring system or an application program of the data monitoring system. The following description will be made taking the execution subject as a data monitoring system as an example.

[0066] like Figure 1 As shown, the embodiment of the present application proposes a node detection method, which includes:

[0067] S101. A data monitoring system obtains traffic data of a target node in a first time period.

[0068] The target node may be a plurality of working nodes in a random group, used as a carrier for data transmission and data processing. The flow data of the first time period may include the input flow, output flow, input time, and output time of the target node.

[0069] It should be noted that the target node can be a connection point and / or data processing unit involved in the data flow process, including but not limited to hardware devices such as servers, routers, communication base stations, etc., and software entities such as applications, databases, algorithm modules, etc. During the data flow process, the node is responsible for data transmission, processing, storage, exchange or sharing, etc. It is diverse and dynamic and can adapt to different data flow scenarios and changes in network topology.

[0070] In one example, the data monitoring system obtains the traffic data of the target node in the current time period through the root node. The root node is associated with multiple random groups, each of which includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain. The nodes in the security domain are nodes that have passed identity authentication.

[0071] Among them, the root node is a node that can be directly or indirectly connected to all participating nodes in the data flow process during the data flow process, and is used to obtain the traffic data of multiple target nodes. The random group is a multiple group composed of multiple nodes participating in the data flow process in the security domain, which is convenient for the acquisition of traffic data of the target node and anomaly detection. The security domain is composed of multiple nodes that have passed identity authentication. Identity authentication can include: enterprise identity authentication of the node, physical address authentication of the node, and signature authentication of the node. Nodes that have passed identity authentication do not need to undergo enterprise identity authentication and physical address authentication again before participating in the data flow process, but still need to undergo signature authentication again. By building a security domain, the possibility of node anomalies can be initially reduced.

[0072] Furthermore, the enterprise identity authentication of the node can be whether the node enterprise has data access rights. The physical address authentication of the node can be to confirm the identity of the node by comparing the MAC address of the node with the MAC address registered by the node. The signature authentication of the node can be that the node uses its own private key to sign the data information, and combines the data information with the signature and sends it to the recipient. The recipient can use the public key to verify the signature. If the verification is passed, it means that the data information has not been modified during the sending process.

[0073] In another example, the data monitoring system can obtain the traffic data of the target node based on port mirroring technology. The target node can copy its real-time traffic data to the central node of the random group through the port mirroring technology. When the central node in each random group obtains the traffic data of the target node in the random group, it can copy the traffic data of the target node to the root node. The data monitoring system can collect the traffic data of the target node in the root node through the traffic collection device.

[0074] Among them, the central node of the random group is the node with the highest reputation value among multiple nodes in the random group, and the reputation value is inversely proportional to the frequency of abnormal data processing behavior of the node.

[0075] S102: The data monitoring system inputs the flow data of the target node in the first time period into the first flow prediction model to obtain the flow data of the target node in the second time period.

[0076] The second time period is after the first time period. The first traffic prediction model may be constructed based on an LSTM model, and is used to obtain predicted traffic data based on current traffic data.

[0077] In one example, the feature selection of the first traffic prediction model may include: time features, input traffic features, output traffic features, behavior features, etc. The first traffic prediction model may process traffic data by normalization, standardization, etc., so that multiple features of different dimensions can be compared and analyzed at the same scale.

[0078] S103: The data monitoring system detects the flow data in the second time period based on the first anomaly detection algorithm to determine whether the flow data in the second time period is abnormal.

[0079] Among them, the first anomaly detection algorithm is an anomaly detection algorithm based on LSTM. This makes the first anomaly detection algorithm perform well when processing time series data with long-term correlation, and can accurately capture the long-term trends and patterns in the data, so as to more effectively identify erroneous data that does not conform to the normal pattern. The first anomaly detection algorithm is designed according to the preset anomaly detection rules, and can analyze the node traffic behavior according to the traffic data of the current time period and the predicted traffic data, identify the nodes that deviate significantly from the normal model and mark them as potential abnormal nodes.

[0080] In one example, the input of the first anomaly detection algorithm is traffic data. The structure of the first anomaly detection algorithm includes an input layer, multiple LSTM layers, and a fully connected layer. The input layer is used to process the input traffic data, the multiple LSTM layers are used to output the context information of the traffic data in the time series and the connection and change trend of the data at different time points, and the fully connected layer is used to make anomaly judgments based on the output of the LSTM layer. The training process of the first anomaly detection algorithm is to optimize the model parameters through the back propagation algorithm to minimize the prediction error.

[0081] The traffic data includes input traffic features, output traffic features, and time features. Multiple LSTM layers contain Dropout to reduce overfitting. Dropout is a regularization technique used to prevent overfitting in neural network training and to improve the generalization ability of the model. The prediction error can be mean square error (MSE) or mean absolute error (MAE).

[0082] In another example, whether the traffic data is abnormal may include: the difference between the predicted traffic data volume in the second time period and the actual traffic data volume in the second time period exceeds a preset threshold, and / or the data processing corresponding to the traffic data in the second time period is abnormal. The data processing includes the input and output of traffic data, the transmission of traffic data, and the resources used to process the data. The data processing abnormality can be called the behavior abnormality of the target node.

[0083] Specifically, the abnormal behavior of the target node may include situations 1 to 3.

[0084] Case 1: Input and output are abnormal.

[0085] Among them, the condition for abnormal input and output of flow data can be that the difference between the flow data output by the target node and the predicted output flow data is greater than a preset threshold, confirming that the target node is an abnormal node.

[0086] In one example, the target node is used to double the input traffic data output, and the preset threshold is 1M. When the input traffic data size is 4M, the predicted output traffic data size should be 8M. The actual output traffic data size of the target node is 11M. If the difference between the actual output traffic data and the expected output traffic data is greater than the preset threshold of 1M, the target node is confirmed to be an abnormal node.

[0087] Case 2: Sending exception.

[0088] The condition for abnormal transmission of traffic data may be that the rate of traffic data output by the target node is greater than a preset fluctuation range or less than a preset fluctuation range, confirming that the target node is an abnormal node.

[0089] In one example, the preset fluctuation range of the target node is 10M / min to 20M / min, and the target node outputs traffic data at a rate of 50M / min without instructions, or stops outputting data. The actual output traffic data rate of the target node is greater than the fluctuation range or less than the fluctuation range, confirming that the target node is an abnormal node.

[0090] Case 3: Abnormal resource usage.

[0091] Among them, the condition for processing data usage resource anomalies may be that the bandwidth and / or computing resources occupied by the node increase without corresponding business growth and / or demand growth.

[0092] In one example, the bandwidth usage of the target node increases from 1 Gbps to 5 Gbps, but the input traffic data of the target node does not change, confirming that the target node is an abnormal node.

[0093] S104: When the data monitoring system determines that the traffic data in the second time period is abnormal, the data monitoring system determines whether the target node is abnormal based on a second anomaly detection algorithm.

[0094] The second anomaly detection algorithm is a LOF density-based algorithm, and the first anomaly detection algorithm is different from the second anomaly detection algorithm.

[0095] In one example, the data monitoring system can use the second anomaly detection algorithm to determine that the target node is an abnormal node when the local density deviation of the target node in the traffic space is greater than a preset threshold. When the target node is determined to be a faulty node, the data monitoring system can determine a corresponding fault handling strategy based on the fault type and fault degree of the target node; and manage the target node according to the fault handling strategy.

[0096] According to the above technical means, the present application can detect anomalies of target nodes participating in data circulation activities based on the predicted traffic data of the target nodes and the traffic data of the current time period. The secondary judgment of abnormal nodes reduces the false alarm rate of node anomaly detection.

[0097] In another embodiment, the node detection method provided by the present application further includes a process for obtaining data processing logs of multiple target nodes. Figure 2 As shown, this is a process flow of a node detection method provided by this application Figure 2 , for obtaining data processing logs of multiple target nodes, may include the following steps S201 to S202.

[0098] S201. In response to multiple nodes in a random group completing processing of target data, the data monitoring system obtains data processing logs of all nodes in the random group through a central node in the random group.

[0099] Among them, the completion of a data flow activity is when multiple nodes in the random group complete the processing of the target data.

[0100] In one example, after a data circulation activity ends, multiple nodes can send data processing logs to the central node in the random group. After the central node obtains the data processing logs of multiple nodes, it analyzes and processes the data processing logs of multiple nodes, obtains the indexes of the data processing logs of multiple nodes, and sends the indexes of the multiple data processing logs to the root node.

[0101] When the root node obtains the indexes of the data processing logs of multiple nodes, the indexes of the data processing logs of the multiple nodes can be combined into a training set and a test set to train and update the first traffic prediction model and / or the first anomaly detection algorithm. For details, please refer to Figure 3 The description of the illustrated embodiment is not repeated here.

[0102] In another example, random group 1 includes target node 1, target node 2, target node 3 and central node 1, and random group 2 includes target node 4, target node 5, target node 6 and central node 2. After the data circulation activity is completed, target node 1, target node 2, and target node 3 send the data processing log to central node 1. Target node 4, target node 5, and target node 6 send the data processing log to central node 2. Central node 1 and central node 2 send the data processing log index of the target node in their respective random groups to the root node.

[0103] S202. The data monitoring system determines the corresponding traffic matrix according to the data processing log of each node in the random group.

[0104] The traffic matrix may include input traffic, output traffic, and time of multiple data flow activities.

[0105] In one example, as shown in Formula 1, a node A participates in n data activities, and the traffic data generated can be obtained by using multiple P n =[I n O n T n ]A 3*n matrix A composed of vectors n express.

[0106]

[0107] Among them, I1, ..., I n Indicates the input traffic generated from the 1st to the nth data circulation activities. O1, ..., O n Indicates the output traffic generated from the 1st to the nth data flow activities. T1, ..., T n Indicates the time from the 1st to the nth data circulation activity.

[0108] According to the above technical means, the present application can obtain data processing logs of multiple target nodes participating in data circulation activities, which plays an important role in troubleshooting, performance monitoring, security auditing, fault prevention, etc.

[0109] In another embodiment, the node detection method provided by the present application further includes updating the first traffic prediction model and the first anomaly detection algorithm according to the fault feedback information of the target node. Figure 3 As shown, this is a process flow of a node detection method provided by this application Figure 3 , used to adjust the first anomaly detection algorithm and / or the second anomaly detection algorithm according to the feedback information, and may include the following steps S301 to S302.

[0110] S301. The data monitoring system obtains fault feedback information of a target node.

[0111] The feedback information is used to indicate whether the abnormality judgment result of the target node is correct.

[0112] S302: Adjust parameters of the first anomaly detection algorithm and / or the second anomaly detection algorithm according to the fault feedback information.

[0113] In one example, the data monitoring system can obtain data processing logs of multiple target nodes from the root node, and analyze and compare the obtained data processing logs of the multiple target nodes to obtain fault feedback information of the target nodes. When the feedback information of the target node indicates that there is a problem with the abnormal judgment result, the first traffic prediction model and / or the first abnormality detection algorithm can be trained and updated based on the training set and the test set.

[0114] In one possible implementation, the data monitoring system can regularly evaluate and audit the security of the system to check for security vulnerabilities and hidden dangers. According to the evaluation results, the security strategy can be adjusted and security protection measures can be strengthened to ensure the long-term stable operation of the trusted security domain.

[0115] According to the above technical means, the present application can detect the target node through the anomaly detection algorithm based on LSTM design and the LOF density-based algorithm, thereby improving the accuracy and security of anomaly detection.

[0116] It is understandable that the above-mentioned node detection method can be implemented by a node detection device. In order to realize the above-mentioned functions, the node detection device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of each example described in the embodiments disclosed herein, the embodiments disclosed in the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the embodiments disclosed in this application.

[0117] The embodiment disclosed in the present application can divide the functional modules according to the node detection device generated by the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment disclosed in the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0118] Figure 4 This is a schematic diagram of the structure of a node detection device provided in an embodiment of the present application. Figure 4 As shown, the node detection device 40 can be used to perform Figure 1-Figure 3 The node detection method shown. The node detection device 40 includes: an acquisition unit 401 and a processing unit 402.

[0119] The acquisition unit 401 is used to acquire the flow data of the target node in the current time period;

[0120] The processing unit 402 is used to input the traffic data of the target node in the current time period into a first traffic prediction model to obtain the predicted traffic data of the target node in the first time period, where the first time period is outside the current time period;

[0121] The processing unit 402 is further configured to detect the predicted traffic data based on the first anomaly detection algorithm to determine whether the predicted traffic data is abnormal;

[0122] The processing unit 402 is also used to determine whether the target node is abnormal based on the second anomaly detection algorithm when it is determined that the predicted traffic data is abnormal; wherein, the local density deviation of the target node in the traffic space; wherein, when the deviation is greater than a preset threshold, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

[0123] In a possible implementation, the acquisition unit 401 is also used to obtain the traffic data of the target node in the current time period through the root node; the root node is associated with multiple random groups, each random group includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have passed identity authentication.

[0124] In a possible implementation, identity authentication includes at least one of the following: enterprise identity authentication of the node; physical address authentication of the node; signature authentication of the node.

[0125] In one possible implementation, the processing unit 402 is also used to copy the traffic data of the central node in each random group to the root node based on port mirroring technology; wherein the central node of the random group is the node with the highest reputation value among the multiple nodes of the random group, and the reputation value is inversely proportional to the frequency of the node's abnormal data processing behavior.

[0126] In a possible implementation, the processing unit 402 is further configured to, when determining that the target node is a faulty node, determine a corresponding fault handling strategy according to the fault type and fault severity of the target node; and manage the target node according to the fault handling strategy.

[0127] In one possible implementation, the processing unit 402 is also used to complete the processing of the target data for each random group in response to multiple nodes in the random group, obtain the data processing logs of all nodes in the random group through the central node in the random group, and determine the corresponding traffic matrix based on the data processing logs of each node in the random group, where the traffic matrix is ​​used to represent the changes in data traffic of the node at different times; and train the traffic matrices of multiple random groups based on a preset algorithm to obtain a first traffic prediction model.

[0128] In a possible implementation, the acquisition unit 401 is also used to obtain fault feedback information of the target node, and the fault feedback information is used to indicate whether the abnormality detection result of the target node is correct; the processing unit 402 is also used to adjust the parameters of the first abnormality detection algorithm and / or the second abnormality detection algorithm according to the fault feedback information.

[0129] In a possible implementation, the predicted traffic data exceeds a preset threshold, and / or the behavior pattern corresponding to the traffic data in the current time period is abnormal.

[0130] In a possible implementation, the first anomaly detection algorithm is an anomaly detection algorithm based on LSTM design, and the second anomaly detection algorithm is a LOF density-based algorithm.

[0131] Through the description of the above implementation methods, technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0132] The present disclosure also provides a computer-readable storage medium having instructions stored thereon. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the node detection method provided by the above-mentioned embodiment of the present disclosure.

[0133] The embodiments of the present disclosure also provide a computer program product including instructions, which, when executed on an electronic device, enables the electronic device to execute the node detection method provided by the embodiments of the present disclosure.

[0134] Among them, the computer readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a register, a hard disk, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above, or any other form of computer readable storage medium known in the art. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application-specific integrated circuit (ASIC). In the embodiments of the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program, which may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A node detection method, characterized in that: The method comprises: Obtain the traffic data of the target node in the first time period; Inputting the traffic data of the target node in a first time period into a first traffic prediction model to obtain the traffic data of the target node in a second time period, where the second time period is after the first time period; Detecting the flow data in the second time period based on the first anomaly detection algorithm to determine whether the flow data in the second time period is abnormal; When it is determined that the traffic data in the second time period is abnormal, whether the target node is abnormal is determined based on a second anomaly detection algorithm; wherein, when an indicator of the traffic data in the second time period of the target node exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

2. The method according to claim 1, characterized in that The obtaining of the traffic data of the target node in the first time period includes: The traffic data of the target node in the first time period is obtained through the root node; the root node is associated with multiple random groups, each random group includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have passed identity authentication.

3. The method according to claim 2, characterized in that The identity authentication includes at least one of the following: Node enterprise identity authentication; the enterprise identity refers to whether the enterprise to which the node belongs has the authority to participate in data circulation activities; Physical address authentication of the node; the physical node refers to whether the physical address of the node is consistent with the physical address registered by the node; Signature authentication of the node.

4. The method according to claim 2, characterized in that: The acquiring, through the root node, the traffic data of the target node in the first time period includes: Based on port mirroring technology, the traffic data of the central node in each random group is copied to the root node; wherein the central node of the random group is the node with the highest reputation value among the multiple nodes of the random group, and the reputation value is inversely proportional to the frequency of abnormal data processing behavior of the node.

5. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: In the case where it is determined that the target node is a faulty node, determining a corresponding fault handling strategy according to the fault type and fault severity of the target node; The target node is managed according to the fault handling strategy.

6. The method according to any one of claims 1 to 3, characterized in that The method further comprises: For each random group, in response to multiple nodes in the random group completing the processing of the target data, the data processing logs of all nodes in the random group are obtained through the central node in the random group, and the corresponding traffic matrix is ​​determined according to the data processing log of each node in the random group, and the traffic matrix is ​​used to represent the data traffic changes of the nodes at different times; The first traffic prediction model is obtained by training the traffic matrices of multiple random groups based on a preset algorithm.

7. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Acquire fault feedback information of the target node, where the fault feedback information is used to indicate whether an abnormality detection result of the target node is correct; Parameters of the first anomaly detection algorithm and / or the second anomaly detection algorithm are adjusted according to the fault feedback information.

8. The method according to any one of claims 1 to 3, characterized in that The traffic data in the second time period is abnormal, including: The difference between the predicted traffic data volume of the second time period and the actual traffic data volume of the second time period exceeds a preset threshold, and / or the data processing corresponding to the traffic data in the second time period is abnormal; wherein, the data processing includes the input and output of traffic data, the sending of traffic data, and the resources used to process data.

9. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The first anomaly detection algorithm is an anomaly detection algorithm based on LSTM design, and the second anomaly detection algorithm is a LOF density-based algorithm.

10. A node detection device, characterized in that: The device comprises: an acquisition unit and a processing unit; The acquisition unit is used to acquire the flow data of the target node in the first time period; The processing unit is used to input the traffic data of the target node in the first time period into the first traffic prediction model to obtain the traffic data of the target node in the second time period, where the second time period is after the first time period; The processing unit is further configured to detect the flow data in the second time period based on the first anomaly detection algorithm to determine whether the flow data in the second time period is abnormal; The processing unit is also used to determine whether the target node is abnormal based on a second anomaly detection algorithm when it is determined that the traffic data in the second time period is abnormal; wherein, when an indicator of the traffic data in the second time period of the target node exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

11. A node detection device, characterized in that: include: Memory and processor; The memory is coupled to the processor; The memory is used to store instructions executable by the processor; When the processor executes the instructions, the node detection method as described in any one of claims 1-8 is performed.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on a computer, the computer is enabled to execute the node detection method as claimed in any one of claims 1 to 8.

13. A computer program product, characterized in that The computer program product comprises computer program instructions, and when the computer program instructions are executed by a processor, the node detection method as claimed in any one of claims 1 to 8 is implemented.

Images