A node detection method and device, and a storage medium

Abstract

The application provides a node detection method and device and a storage medium, relates to the technical field of communication, and can detect and confirm a target node participating in a data flow process. The method comprises the following steps: acquiring traffic data of a target node in a current time period. The traffic data of the target node in the current time period is input into a first traffic prediction model to obtain predicted traffic data of the target node in a first time period, and the first time period is located outside the current time period. The predicted traffic data is detected based on a first anomaly detection algorithm to determine whether the predicted traffic data is abnormal. In the case that the predicted traffic data is determined to be abnormal, a second anomaly detection algorithm is used to determine whether the target node is abnormal. The local density deviation of the target node in a traffic space is determined. In the case that the deviation is greater than a preset threshold, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, and particularly relates to a node detection method and device and storage medium. BACKGROUND

[0002] In the data flow process, the abnormality detection of the intermediate node is an important technical means for guaranteeing the data integrity and security and ensuring the reliability and efficiency of data transmission. Timely discovery and processing of abnormal problems in the data transmission process can reduce the business risks caused by data loss, leakage or transmission failure. This is of great significance to guarantee the normal operation and sustainable development of enterprises.

[0003] At present, the abnormality monitoring method and the traditional machine learning algorithm are not applicable to the data flow with randomness and uncertainty. The fixed threshold monitoring cannot be used in the data flow process, and the detection accuracy of the traditional machine learning algorithm for the abnormal node in the data flow process is not high. SUMMARY

[0004] The present application provides a node detection method, device and storage medium, which can detect and confirm the abnormality of the target node participating in the data flow process.

[0005] To achieve the above purpose, the present application adopts the following technical scheme:

[0006] In a first aspect, the present application provides a node detection method, which comprises:

[0007] obtaining the traffic data of the target node in a first time period;

[0008] inputting the traffic data of the target node in the first time period into a first traffic prediction model to obtain the traffic data of the target node in a second time period, the second time period being located after the first time period;

[0009] detecting the traffic data in the second time period based on a first abnormality detection algorithm to determine whether the traffic data in the second time period is abnormal;

[0010] in the case that the traffic data in the second time period is determined to be abnormal, determining whether the target node is abnormal based on a second abnormality detection algorithm; wherein in the case that the index of the traffic data of the target node in the second time period exceeds a preset range, the target node is an abnormal node, and the first abnormality detection algorithm and the second abnormality detection algorithm are different.

[0011] According to the above technical means, the present application can detect the abnormality of the target node participating in the data flow activity according to the predicted traffic data and the actual traffic data of the target node. The secondary judgment of the abnormal node reduces the false positive rate of the node abnormality detection.

[0012] In a possible implementation, the root node obtains the traffic data of the target node in a first time period; the root node associates a plurality of random groups, each of which includes a plurality of nodes; the target node and the nodes in the plurality of random groups belong to a same security domain; and the nodes in the security domain have passed identity authentication.

[0013] According to the technical means, the identity authentication is performed, the security domain is formed, and the data flow activity is performed, so that the abnormality of the node is prevented before the data flow activity is performed, and the possibility of abnormality of the participating node of the data flow activity is reduced.

[0014] In a possible implementation, the identity authentication includes at least one of the following: enterprise identity authentication of the node; the enterprise identity refers to whether the enterprise to which the node belongs has the permission to participate in the data flow activity; physical address authentication of the node; the physical node refers to whether the physical address of the node is consistent with the registered physical address of the node; and signature authentication of the node.

[0015] According to the technical means, the enterprise identity, the physical address, and the signature of the node are comprehensively authenticated, so that the identity authentication process of the node is more specific.

[0016] In a possible implementation, the port mirroring technology is used to copy the traffic data of the center node in each random group to the root node; the center node of the random group is the node with the highest reputation value in the plurality of nodes of the random group, and the reputation value is inversely proportional to the frequency of the abnormal data processing behavior of the node.

[0017] According to the technical means, the real-time traffic data of the plurality of target nodes can be obtained through the port mirroring technology, so that the real-time performance of the node detection method is improved. The target node is connected to the root node through the center node, so that the communication network is simpler.

[0018] In a possible implementation, in a case where the target node is determined to be a fault node, a corresponding fault processing strategy is determined according to the fault type and the fault degree of the target node; and the target node is managed according to the fault processing strategy.

[0019] According to the technical means, the fault node can be processed in a timely manner according to the fault type and the fault degree of the target node, so that the continuity and stability of the data flow are ensured, and the data security and privacy protection are promoted.

[0020] In a possible implementation, for each random group, in response to the plurality of nodes in the random group completing processing of the target data, the center node in the random group acquires the data processing logs of all the nodes in the random group, and determines a corresponding traffic matrix according to the data processing log of each node in the random group, the traffic matrix being used to represent the data traffic change of the node at different times; and the traffic matrices of the plurality of random groups are trained to obtain the first traffic prediction model based on a preset algorithm.

[0021] According to the technical means described above, the data processing logs of the plurality of target nodes participating in the data flow activity are acquired, which is of great importance to fault troubleshooting, performance monitoring, security auditing, and fault prevention.

[0022] In a possible implementation, the fault feedback information of the target node is acquired, the fault feedback information being used to indicate whether the abnormality detection result of the target node is correct; and the parameters of the first abnormality detection algorithm and / or the second abnormality detection algorithm are adjusted according to the fault feedback information.

[0023] According to the technical means described above, the abnormality detection algorithm can be optimized according to the fault feedback information of the target node, whether the abnormality detection result of the target node is correct, which improves the accuracy of the subsequent abnormality detection algorithm, enhances the data security, and promotes the update, optimization, and improvement of the node detection method.

[0024] In a possible implementation, the difference between the predicted traffic data amount of the second time period and the actual traffic data amount of the second time period exceeds a preset threshold, and / or the traffic data in the second time period corresponds to a data processing abnormality; wherein the data processing includes input and output of the traffic data, sending of the traffic data, and resources used for processing the data.

[0025] According to the technical means described above, the current traffic data, the predicted traffic data, and / or the abnormality of the behavior model of the traffic data can be used as the abnormality judgment condition of the target node, which enriches the abnormality judgment condition and makes the node detection method more comprehensive.

[0026] In a possible implementation, the first abnormality detection algorithm is an abnormality detection algorithm designed based on LSTM, and the second abnormality detection algorithm is a LOF density-based algorithm.

[0027] According to the technical means described above, the target node can be detected by the abnormality detection algorithm designed based on LSTM and the LOF density-based algorithm, which improves the accuracy and security of the abnormality detection.

[0028] In a second aspect, the application provides a node detection device, which comprises an acquisition unit and a processing unit.

[0029] an acquisition unit configured to acquire traffic data of a target node in a first time period;

[0030] a processing unit configured to input the traffic data of the target node in the first time period into a first traffic prediction model to obtain traffic data of the target node in a second time period, the second time period being subsequent to the first time period;

[0031] the processing unit is further configured to detect the traffic data of the target node in the second time period based on a first anomaly detection algorithm to determine whether the traffic data of the target node in the second time period is abnormal;

[0032] the processing unit is further configured to, in a case where it is determined that the traffic data of the target node in the second time period is abnormal, determine whether the target node is abnormal based on a second anomaly detection algorithm; wherein the target node is an abnormal node in a case where an index of the traffic data of the target node in the second time period exceeds a preset range, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

[0033] In a possible implementation, the acquisition unit is further configured to acquire the traffic data of the target node in the first time period through a root node; the root node is associated with a plurality of random groups, each random group including a plurality of nodes; the target node and the nodes in the plurality of random groups belong to a same security domain; and the nodes in the security domain have passed identity authentication.

[0034] In a possible implementation, the identity authentication includes at least one of the following: enterprise identity authentication of the node; the enterprise identity refers to whether an enterprise to which the node belongs has a permission to participate in data circulation activities; physical address authentication of the node; the physical node refers to whether a physical address of the node is consistent with a physical address registered by the node; and signature authentication of the node.

[0035] In a possible implementation, the processing unit is further configured to, based on a port mirroring technology, copy traffic data of a center node in each random group to the root node; wherein the center node of the random group is a node with a highest reputation value among the plurality of nodes in the random group, and the reputation value is inversely proportional to a frequency of abnormal data processing behaviors of the node.

[0036] In a possible implementation, the processing unit is further configured to, in a case where it is determined that the target node is a faulty node, determine a corresponding fault handling strategy according to a fault type and a fault degree of the target node; and manage the target node according to the fault handling strategy.

[0037] In a possible implementation, the processing unit is further configured to, for each random group, in response to the plurality of nodes in the random group completing processing of the target data, acquire, by a center node in the random group, data processing logs of all nodes in the random group, and determine, according to the data processing log of each node in the random group, a corresponding traffic matrix, the traffic matrix being used to represent data traffic changes of the node at different times; and train, based on a preset algorithm, the traffic matrices of the plurality of random groups to obtain the first traffic prediction model.

[0038] In a possible implementation, the acquisition unit is further configured to acquire fault feedback information of the target node, the fault feedback information being used to indicate whether an anomaly detection result of the target node is correct; and the processing unit is further configured to adjust parameters of the first anomaly detection algorithm and / or the second anomaly detection algorithm according to the fault feedback information.

[0039] In a possible implementation, the processing unit is further configured to: when a difference between the predicted traffic data amount of the second time period and the actual traffic data amount of the second time period exceeds a preset threshold, and / or when the traffic data in the second time period corresponds to data processing anomalies; and the data processing includes input and output of the traffic data, sending of the traffic data, and resources used for processing the data.

[0040] In a possible implementation, the first anomaly detection algorithm is an anomaly detection algorithm designed based on LSTM, and the second anomaly detection algorithm is a LOF density-based algorithm.

[0041] In a third aspect, a node detection device is provided, which includes a processor and a communication interface; the communication interface is coupled to the processor, and the processor is configured to run a computer program or instructions to implement the node detection method described in the first aspect and any possible implementation manner of the first aspect.

[0042] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores instructions, when the instructions run on a terminal, causing the terminal to perform the node detection method described in the first aspect and any possible implementation manner of the first aspect.

[0043] In a fifth aspect, a computer program product including instructions is provided, when the computer program product runs on a node detection device, causing the node detection device to perform the node detection method described in any possible implementation manner of the first aspect.

[0044] In a sixth aspect, a chip is provided, which includes a processor and a communication interface; the communication interface is coupled to the processor, and the processor is configured to run a computer program or instructions to implement the node detection method described in the first aspect and any possible implementation manner of the first aspect.

[0045] Specifically, the chip provided in the present application further comprises a memory for storing a computer program or instructions. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 The flow of a node detection method provided for the embodiment of the present application Figure 1

[0047] Figure 2 The flow of a node detection method provided for the embodiment of the present application Figure 2

[0048] Figure 3 The flow of a node detection method provided for the embodiment of the present application Figure 3

[0049] Figure 4 The structural schematic diagram of a node detection device provided for the embodiment of the present application. DETAILED DESCRIPTION

[0050] The node detection method, device and storage medium provided by the embodiment of the present application are described in detail below with reference to the drawings.

[0051] The term “and / or” in the present document merely describes an association relationship of associated objects, and indicates that there can be three relationships, for example, A and / or B can represent the three cases of A alone, A and B together, and B alone.

[0052] The terms “first” and “second” and the like in the specification and drawings of the present application are used to distinguish different objects or different treatments of the same object, and are not used to describe a specific order of the objects.

[0053] In addition, the terms “include” and “have” and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device.

[0054] It should be noted that in the embodiments of the present application, the words “exemplary” or “for example” are used to represent an example, illustration or description. Any embodiment or design scheme described as “exemplary” or “for example” in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words “exemplary” or “for example” are intended to present the relevant concept in a specific manner.

[0055] ​​​In the description of the present application, the meaning of "a plurality of" is two or more, unless otherwise specified.

[0056] In the following, the terms related to the embodiments of the present application are explained to facilitate the understanding of the readers.

[0057] (1) Long Short-Term Memory (LSTM): A special recurrent neural network structure designed to solve the problem of gradient vanishing and gradient explosion faced by traditional recurrent neural network structure when dealing with long-term dependencies. Through its memory cells and gating mechanism, it can effectively capture and retain long-term dependencies.

[0058] (2) Local Outlier Factor (LOF): A density-based anomaly detection algorithm that calculates the outlier factor for each data point. The outlier factor reflects the density difference between the point and other points in its neighborhood. If the outlier factor of the point is much greater than 1, it indicates that the density of the point is significantly lower than that of other points in its neighborhood, so it can be determined as an abnormal point. If the outlier factor of the point is close to 1, it indicates that the density of the point is similar to that of other points in its neighborhood, so it can be determined as a normal point.

[0059] (3) Node: Refers to each key point and / or intersection point in the data flow process. It can be the source, storage, transmission, processing, exchange and use of data. Multiple nodes form a data flow network through data transmission and exchange, and constitute the basic framework of data flow.

[0060] (4) Port mirroring technology: A network management technology that copies data from a specific port on a switch or router to another port. In this process, the network device will copy the message flowing through the source port and transmit it to the designated mirror port for analysis and monitoring. The messages received and transmitted by the mirror port will be copied to the port connected to the monitoring device for analysis by the monitoring device.

[0061] The above is a brief introduction to some of the concepts involved in the embodiments of the present application.

[0062] Currently, the abnormal monitoring method and the traditional machine learning algorithm are not suitable for data flow with randomness and uncertainty. Fixed threshold monitoring cannot be used in the data flow process, and the traditional machine learning algorithm has low accuracy for security detection of data flow. For the case of unknown abnormal type, manual intervention is needed to modify and improve the machine learning algorithm.

[0063] In view of this, the embodiment of the present application provides a node detection method, which can detect target nodes participating in a data flow process, and also has the functions of confirming abnormal nodes and feeding back abnormal detection results.

[0064] The node detection method provided by the embodiment of the present application will be described below with reference to the drawings. The actions and terms involved in the embodiments of the present application can be mutually referred to and are not limited. The message names or parameter names in the messages exchanged between devices in the embodiments of the present application are only examples, and other names can also be used in specific implementations. The actions involved in the embodiments of the present application are only examples, and other names can also be used in specific implementations, for example, “include” in the embodiments of the present application can also be replaced by “carry” or “carry” and the like.

[0065] It should be noted that the execution subject of the present application can be a data monitoring system or an application program of the data monitoring system. The execution subject will be described below as an example of the data monitoring system.

[0066] As shown in Figure 1 The embodiment of the present application provides a node detection method, which includes:

[0067] S101, the data monitoring system obtains traffic data of a target node in a first time period.

[0068] The target node can be a plurality of working nodes in a random group, which are used as carriers for data transmission and data processing. The traffic data in the first time period can include input traffic, output traffic, input time and output time of the target node.

[0069] It should be noted that the target node can be a connection point and / or a data processing unit participating in the data flow process, including but not limited to hardware devices such as servers, routers, communication base stations, etc., software entities such as application programs, databases, algorithm modules, etc. The node is responsible for data transmission, processing, storage, exchange or sharing in the data flow process, has diversity and dynamics, and can adapt to changes of different data flow scenarios and network topologies.

[0070] In an example, the data monitoring system obtains traffic data of the target node in a current time period through a root node. The root node is associated with a plurality of random groups, each random group includes a plurality of nodes; the target node and the nodes in the plurality of random groups belong to a security domain. The nodes in the security domain are nodes that have passed identity authentication.

[0071] The root node is a node that can be directly or indirectly connected with all participating nodes in the data flow process, and is used to obtain traffic data of the target nodes. The random group is a plurality of groups formed by a plurality of nodes participating in the data flow process in the security domain, facilitating the acquisition of traffic data of the target nodes and anomaly detection. The security domain is formed by a plurality of nodes that pass the identity authentication. The identity authentication can include enterprise identity authentication of the node, physical address authentication of the node, and signature authentication of the node. The nodes that pass the identity authentication do not need to be authenticated again before participating in the data flow process, but still need to be authenticated again. By constructing the security domain, the possibility of node anomaly can be initially reduced.

[0072] Further, the enterprise identity authentication of the node can be whether the node enterprise has data access permission. The physical address authentication of the node can be to compare the MAC address of the node with the registered MAC address of the node to confirm the identity of the node. The signature authentication of the node can be that the node uses its own private key to sign the data information, and sends the data information and the signature to the receiver. The receiver can use the public key to verify the signature, and if the verification is passed, it means that the data information has not been modified in the sending process.

[0073] In another example, the data monitoring system can obtain the traffic data of the target node based on the port mirroring technology. The target node can copy its real-time traffic data to the center node of the random group through the port mirroring technology. The center node in each random group can copy the traffic data of the target node to the root node when obtaining the traffic data of the target node in the random group. The data monitoring system can collect the traffic data of the target node in the root node through the traffic collection device.

[0074] The center node of the random group is the node with the highest reputation value among the plurality of nodes in the random group, and the reputation value is inversely proportional to the frequency of abnormal data processing behavior of the node.

[0075] S102, the data monitoring system inputs the traffic data of the target node in the first time period into the first traffic prediction model to obtain the traffic data of the target node in the second time period.

[0076] The second time period is after the first time period. The first traffic prediction model can be constructed based on an LSTM model, and is used to obtain predicted traffic data according to the current traffic data.

[0077] In an example, the feature selection of the first traffic prediction model can include time features, input traffic features, output traffic features, behavior features, and the like. The first traffic prediction model can process the traffic data through normalization, standardization, and the like, so that multiple features of different dimensions can be compared and analyzed on the same scale.

[0078] In S103, the data monitoring system detects the traffic data of the second time period based on the first anomaly detection algorithm, and determines whether the traffic data of the second time period is abnormal.

[0079] The first anomaly detection algorithm is an LSTM-based anomaly detection algorithm. The first anomaly detection algorithm performs well in processing time series data with long-term correlation, and can accurately capture long-term trends and patterns in the data, thereby more effectively identifying error data that deviates from the normal model. The first anomaly detection algorithm is designed according to a preset anomaly detection rule, and can analyze the node traffic behavior according to the traffic data of the current time period and the predicted traffic data, and identify nodes that significantly deviate from the normal model and mark them as potential abnormal nodes.

[0080] In an example, the input of the first anomaly detection algorithm is traffic data. The structure of the first anomaly detection algorithm includes an input layer, multiple LSTM layers, and a fully connected layer. The input layer is used to process the input traffic data, the multiple LSTM layers are used to output the context information of the traffic data in the time series and the connection and trend of the data between different time points, and the fully connected layer is used to make an abnormality judgment according to the output of the LSTM layer. The training process of the first anomaly detection algorithm is to optimize the model parameters through a backpropagation algorithm to minimize the prediction error.

[0081] The traffic data includes input traffic features, output traffic features, and time features. The multiple LSTM layers contain Dropout to reduce overfitting. Dropout is a regularization technique used in neural network training to prevent overfitting and improve the generalization ability of the model. The prediction error can be mean square error (MSE) or mean absolute error (MAE).

[0082] In another example, whether the traffic data is abnormal can include that the difference between the predicted traffic data amount of the second time period and the actual traffic data amount of the second time period exceeds a preset threshold, and / or that the traffic data in the second time period corresponds to a data processing abnormality. The data processing includes input and output of the traffic data, sending of the traffic data, and resources used for processing the data. The data processing abnormality can be referred to as behavior abnormality of the target node.

[0083] Specifically, the abnormal behavior of the target node can include case 1 to case 3.

[0084] Case 1, input / output abnormality.

[0085] The condition of the input and output abnormality of the traffic data can be that the difference between the traffic data output by the target node and the predicted output traffic data is greater than the preset threshold, and the target node is determined to be an abnormal node.

[0086] In an example, the target node is configured to double the input traffic data, and the preset threshold is 1M. In the case where the input traffic data is 4M, the predicted output traffic data should be 8M. The actual output traffic data of the target node is 11M, and the difference between the actual output traffic data and the expected output traffic data is greater than the preset threshold 1M. Therefore, the target node is determined to be an abnormal node.

[0087] Case 2, sending abnormality.

[0088] The condition of the sending abnormality of the traffic data can be that the rate of the traffic data output by the target node is greater than or less than the preset fluctuation range, and the target node is determined to be an abnormal node.

[0089] In an example, the preset fluctuation range of the target node is 10M / min to 20M / min, and the rate of the traffic data output by the target node without indication is 50M / min or the target node stops outputting data. The rate of the actual output traffic data of the target node is greater than or less than the fluctuation range, and the target node is determined to be an abnormal node.

[0090] Case 3, resource occupation abnormality.

[0091] The condition of the resource abnormality of the processing data can be that the bandwidth and / or computing resources occupied by the node increase without corresponding business growth and / or demand growth.

[0092] In an example, the bandwidth occupation of the target node increases from 1Gbps to 5Gbps, but the input traffic data of the target node does not change, and the target node is determined to be an abnormal node.

[0093] S104, the data monitoring system determines whether the target node is abnormal based on a second abnormality detection algorithm in the case where the traffic data of the second time period is abnormal.

[0094] The second abnormality detection algorithm is a LOF density-based algorithm, and the first abnormality detection algorithm and the second abnormality detection algorithm are different.

[0095] In an example, the data monitoring system can determine, by the second anomaly detection algorithm, that the target node is an abnormal node when the local density deviation of the target node in the traffic space is greater than a preset threshold. When it is determined that the target node is a failure node, the data monitoring system can determine a corresponding failure processing strategy according to the failure type and the failure degree of the target node, and manage the target node according to the failure processing strategy.

[0096] According to the above technical means, the target node participating in the data flow activity can be abnormally detected according to the predicted traffic data of the target node and the traffic data of the current time period. The secondary judgment of the abnormal node reduces the false positive rate of node anomaly detection.

[0097] In another embodiment, the node detection method provided by the application further includes the process of obtaining the data processing log of the plurality of target nodes. As shown in Figure 2 , the flow of the node detection method provided by the application Figure 2 , the process of obtaining the data processing log of the plurality of target nodes can include the following steps S201-S202.

[0098] S201, the data monitoring system obtains the data processing log of all nodes in the random group through the center node in the random group in response to the completion of the processing of the target data by the plurality of nodes in the random group.

[0099] Among them, the completion of the processing of the target data by the plurality of nodes in the random group is the completion of a data flow activity.

[0100] In an example, after the completion of a data flow activity, the plurality of nodes can send the data processing log to the center node in the random group. After the center node obtains the data processing log of the plurality of nodes, the center node analyzes and processes the data processing log of the plurality of nodes to obtain the index of the data processing log of the plurality of nodes, and sends the index of the plurality of data processing logs to the root node.

[0101] Among them, the root node can form a training set and a test set with the index of the data processing log of the plurality of nodes to train and update the first traffic prediction model and / or the first anomaly detection algorithm when the root node obtains the index of the data processing log of the plurality of nodes. For details, please refer to the description of the embodiment shown in Figure 3 , which will not be repeated here.

[0102] In another example, the random group 1 includes the target node 1, the target node 2, the target node 3 and the center node 1, and the random group 2 includes the target node 4, the target node 5, the target node 6 and the center node 2. After the data flow activity ends, the target node 1, the target node 2 and the target node 3 send the data processing logs to the center node 1. The target node 4, the target node 5 and the target node 6 send the data processing logs to the center node 2. The center node 1 and the center node 2 respectively send the data processing logs of the target nodes in the random group to the root node.

[0103] S202, the data monitoring system determines the corresponding flow matrix according to the data processing logs of each node in the random group.

[0104] The flow matrix can include the input flow, the output flow and the time of multiple data flow activities.

[0105] In an example, as shown in Formula One, a node A participates in n times of data activities, and the generated flow data can use a 3*n matrix A composed of a plurality of P n n O n T n vector. n

[0106]

[0107] I1, …, In represent the input flow generated in the first to the nth data flow activities. O1, …, On represent the output flow generated in the first to the nth data flow activities. T1, …, Tn represent the time of the first to the nth data flow activities. n n n

[0108] According to the above technical means, the present application can play an important role in fault troubleshooting, performance monitoring, security audit, fault prevention and the like by acquiring the data processing logs of the plurality of target nodes participating in the data flow activities.

[0109] In another embodiment, the node detection method provided by the present application further includes updating the first flow prediction model and the first anomaly detection algorithm according to the fault feedback information of the target node. As shown in Formula Two, the node detection method provided by the present application includes the following steps S201 to S202. Figure 3 Figure 4 The method for adjusting the first anomaly detection algorithm and / or the second anomaly detection algorithm according to the feedback information can include the following steps S301 to S302.

[0110] S301, the data monitoring system acquires the fault feedback information of the target node.​​​​​​

[0111] The feedback information is used to indicate whether the abnormality determination result of the target node is correct.

[0112] S302, adjusting the parameters of the first abnormality detection algorithm and / or the second abnormality detection algorithm according to the fault feedback information.

[0113] In an example, the data monitoring system can obtain the data processing logs of the plurality of target nodes from the root node, and analyze and compare the obtained data processing logs of the plurality of target nodes to obtain the fault feedback information of the target node. In the case where the feedback information of the target node indicates that the abnormality determination result has a problem, the first traffic prediction model and / or the first abnormality detection algorithm can be trained and updated according to the training set and the test set.

[0114] In a possible implementation manner, the data monitoring system can periodically evaluate and audit the security of the system, check whether there are security vulnerabilities and hidden dangers, adjust the security policy according to the evaluation result, and strengthen the security protection measures to ensure the long-term stable operation of the trusted security domain.

[0115] According to the above technical means, the target node can be detected by the abnormality detection algorithm based on LSTM and the LOF density-based algorithm, and the accuracy and security of the abnormality detection are improved.

[0116] It can be understood that the above node detection method can be implemented by a node detection apparatus. The node detection apparatus includes hardware structures and / or software modules corresponding to the execution of each function in order to implement the above functions. Those skilled in the art should easily realize that, in combination with the modules and algorithm steps of each example described in the embodiments disclosed herein, the embodiments disclosed herein can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments disclosed herein.

[0117] The node detection apparatus generated according to the above method examples can be used to divide the functional modules, for example, each functional module can be divided according to each function, or two or more functions can be integrated in one processing module. The integrated module can be implemented in the form of hardware or software functional module. It should be noted that the division of modules in the embodiments disclosed herein is illustrative, and is only a logical functional division. There can be another division manner when actually implemented.

[0118] Figure 4 This is a schematic diagram of a node detection device provided in an embodiment of this application. Figures 1-3 As shown, the node detection device 40 can be used to perform... ​ The node detection method shown is described. The node detection device 40 includes an acquisition unit 401 and a processing unit 402.

[0119] The acquisition unit 401 is used to acquire the traffic data of the target node in the current time period;

[0120] The processing unit 402 is used to input the traffic data of the target node in the current time period into the first traffic prediction model to obtain the predicted traffic data of the target node in the first time period, which is outside the current time period.

[0121] The processing unit 402 is also used to detect the predicted traffic data based on the first anomaly detection algorithm to determine whether the predicted traffic data is abnormal;

[0122] The processing unit 402 is further configured to determine whether a target node is abnormal based on a second anomaly detection algorithm when the predicted traffic data is determined to be abnormal; wherein, the target node has a local density deviation in the traffic space; wherein, if the deviation is greater than a preset threshold, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

[0123] In one possible implementation, the acquisition unit 401 is further configured to acquire the traffic data of the target node for the current time period through the root node; the root node is associated with multiple random groups, each random group including multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have been authenticated.

[0124] In one possible implementation, authentication includes at least one of the following: enterprise identity authentication of the node; physical address authentication of the node; and signature authentication of the node.

[0125] In one possible implementation, the processing unit 402 is further configured to copy the traffic data of the central node in each random group to the root node based on port mirroring technology; wherein the central node of the random group is the node with the highest reputation value among the multiple nodes in the random group, and the reputation value is inversely proportional to the frequency of abnormal data processing behavior of the node.

[0126] In one possible implementation, the processing unit 402 is further configured to, when the target node is determined to be a faulty node, determine a corresponding fault handling strategy based on the fault type and fault severity of the target node; and manage the target node according to the fault handling strategy.

[0127] In a possible implementation, the processing unit 402 is further configured to, for each random group, in response to the plurality of nodes in the random group completing processing of the target data, acquire, by a center node in the random group, data processing logs of all nodes in the random group, and determine a corresponding traffic matrix according to the data processing logs of each node in the random group, the traffic matrix being used to represent data traffic changes of the node at different times; and train a first traffic prediction model based on the traffic matrices of the plurality of random groups according to a preset algorithm.

[0128] In a possible implementation, the acquiring unit 401 is further configured to acquire fault feedback information of the target node, the fault feedback information being used to indicate whether an anomaly detection result of the target node is correct; and the processing unit 402 is further configured to adjust parameters of the first anomaly detection algorithm and / or the second anomaly detection algorithm according to the fault feedback information.

[0129] In a possible implementation, the predicted traffic data exceeds a preset threshold, and / or a behavior mode corresponding to the traffic data of the current time period is abnormal.

[0130] In a possible implementation, the first anomaly detection algorithm is an anomaly detection algorithm designed based on LSTM, and the second anomaly detection algorithm is a LOF density-based algorithm.

[0131] Those skilled in the art can clearly understand the above-mentioned technical solutions from the description of the above-mentioned embodiments. For the convenience and brevity of description, only the division of the above-mentioned functional modules is taken as an example for illustration. In actual applications, the above-mentioned functions can be completed by different functional modules according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, device and unit described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here.

[0132] The present disclosure also provides a computer-readable storage medium, which stores instructions. When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can perform the node detection method provided in the embodiments of the present disclosure.

[0133] The embodiments of the present disclosure also provide a computer program product containing instructions, which, when running on an electronic device, causes the electronic device to perform the node detection method provided in the embodiments of the present disclosure.

[0134] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: electrical connections having one or more wires; portable computer disks; hard disks; random access memory (RAM); read-only memory (ROM); erasable programmable read-only memory (EPROM); registers; hard disks; optical fibers; portable compact disc read-only memory (CD-ROM); optical storage devices; magnetic storage devices; or any suitable combination thereof; or any other form of computer-readable storage medium known in the art. An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium may also be a component of the processor. The processor and the storage medium may reside in an application-specific integrated circuit (ASIC). In the embodiments of this application, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A node detection method, characterized in that, The method includes: Obtain traffic data of the target node for the first time period; specifically including: obtaining the traffic data of the target node for the first time period through the root node; the root node is associated with multiple random groups, each random group including multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have been authenticated; The traffic data of the target node in the first time period is input into the first traffic prediction model to obtain the traffic data of the target node in the second time period, which is after the first time period. The traffic data in the second time period is detected based on the first anomaly detection algorithm to determine whether the traffic data in the second time period is abnormal. If the traffic data in the second time period is determined to be abnormal, the target node is determined to be abnormal based on the second anomaly detection algorithm; wherein, if the traffic data index of the target node in the second time period exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

2. The method according to claim 1, characterized in that, The identity authentication includes at least one of the following: Enterprise identity authentication for nodes; the enterprise identity refers to whether the enterprise to which the node belongs has the authority to participate in data circulation activities. Node physical address authentication; the physical address authentication refers to whether the physical address of the node is consistent with the physical address registered by the node; Node signature authentication.

3. The method according to claim 1, characterized in that, The step of obtaining the traffic data of the target node for the first time period through the root node includes: Based on port mirroring technology, the traffic data of the central node in each random group is copied to the root node; wherein, the central node of the random group is the node with the highest reputation value among the multiple nodes in the random group, and the reputation value is inversely proportional to the frequency of abnormal data processing behavior of the node.

4. The method according to claim 1 or 2, characterized in that, The method further includes: If the target node is determined to be a faulty node, a corresponding fault handling strategy is determined based on the fault type and severity of the target node. The target node is managed according to the fault handling strategy.

5. The method according to claim 1 or 2, characterized in that, The method further includes: For each random group, in response to the multiple nodes in the random group completing the processing of the target data, the data processing logs of all nodes in the random group are obtained through the central node in the random group, and the corresponding traffic matrix is ​​determined based on the data processing logs of each node in the random group. The traffic matrix is ​​used to represent the changes in data traffic of the nodes at different times. The first traffic prediction model is obtained by training the traffic matrix of multiple random groups based on a preset algorithm.

6. The method according to claim 1 or 2, characterized in that, The method further includes: Obtain fault feedback information of the target node, wherein the fault feedback information is used to indicate whether the anomaly detection result of the target node is correct; The parameters of the first anomaly detection algorithm and / or the second anomaly detection algorithm are adjusted based on the fault feedback information.

7. The method according to claim 1 or 2, characterized in that, The traffic data anomalies in the second time period include: The difference between the predicted traffic data volume and the actual traffic data volume in the second time period exceeds a preset threshold, and / or the data processing corresponding to the traffic data in the second time period is abnormal; wherein, the data processing includes the input and output of traffic data, the transmission of traffic data, and the resources used for processing data.

8. The method according to claim 1 or 2, characterized in that, The method further includes: The first anomaly detection algorithm is an anomaly detection algorithm based on LSTM, and the second anomaly detection algorithm is a density-based LOF algorithm.

9. A node detection device, characterized in that, The device includes: an acquisition unit and a processing unit; The acquisition unit is used to acquire traffic data of the target node for a first time period; specifically, the acquisition unit is used to: acquire the traffic data of the target node for the first time period through the root node; the root node is associated with multiple random groups, each random group includes multiple nodes; the target node and the nodes in the multiple random groups belong to a security domain; the nodes in the security domain have been authenticated. The processing unit is used to input the traffic data of the target node in a first time period into a first traffic prediction model to obtain the traffic data of the target node in a second time period, wherein the second time period is after the first time period. The processing unit is further configured to detect the traffic data of the second time period based on the first anomaly detection algorithm, and determine whether the traffic data of the second time period is abnormal. The processing unit is further configured to determine whether the target node is abnormal based on a second anomaly detection algorithm when it is determined that the traffic data in the second time period is abnormal; wherein, if the traffic data index of the target node in the second time period exceeds a preset range, the target node is an abnormal node, and the first anomaly detection algorithm and the second anomaly detection algorithm are different.

10. A node detection device, characterized in that, include: Memory and processor; The memory and the processor are coupled; The memory is used to store instructions that can be executed by the processor; When the processor executes the instruction, it performs the node detection method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed on a computer, cause the computer to perform the node detection method as described in any one of claims 1-8.

12. A computer program product, characterized in that, The computer program product includes computer program instructions that, when executed by a processor, implement the node detection method as described in any one of claims 1-8.

Images