Node traffic monitoring method, system and device and storage medium

Abstract

The invention provides a node traffic monitoring method, system and device, and a storage medium, and the method comprises the steps: building a multi-node network model through simulating the node network topology of a target network system, simulating and mapping a real security protection environment in the target network system, and building a virtual protection platform; based on the node traffic data of each network node in the target network system, performing real-time traffic anomaly monitoring on each network node to obtain abnormal node information; and controlling the multi-node network model to carry out node traffic abnormity early warning and display the abnormal nodes, opening network vulnerabilities of the virtual protection platform so as to guide network attacks aiming at the target network system to the multi-node network model, thereby realizing rapid and accurate positioning of the abnormal nodes in the system, and improving the system reliability. Meanwhile, network vulnerabilities can be opened, network attacks are guided to the multi-node network model, the system abnormity positioning efficiency is improved, effective safety protection can be provided in time, and therefore the system safety is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a node traffic monitoring method, system, device and storage medium. Background Art

[0002] With the increasing integration of industrial automation systems and the Internet, industrial network systems have become an indispensable part of the industrial production process.

[0003] Industrial network systems usually have multiple node devices, and different types of devices are responsible for implementing different functions. Due to the complexity and information sensitivity of industrial network systems, they are prone to various failures or unauthorized access attacks, endangering the security of industrial networks. Therefore, the monitoring and analysis of industrial network traffic has become increasingly important. However, the existing industrial network monitoring methods are relatively simple. When network traffic anomalies occur, the anomalies cannot be discovered in time and effectively handled. The efficiency of system anomaly handling is low, resulting in low system security. Summary of the invention

[0004] The present invention provides a node traffic monitoring method, system, device and storage medium to solve the problem that in an industrial network monitoring mode, abnormal situations cannot be discovered in time and effective abnormal processing cannot be performed, the efficiency of system abnormal processing is low, and the system security is low.

[0005] In a first aspect, an embodiment of the present application provides a node traffic monitoring method, including:

[0006] Acquire a system simulation model for simulating the real operating environment of the target network system, the system simulation model includes a multi-node network model simulating the node network topology of the target network system and a virtual protection platform of the multi-node network model, the virtual protection platform is used to simulate and map the real security protection environment in the target network system;

[0007] Based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, which includes abnormal nodes with abnormal traffic.

[0008] Based on the abnormal node information, the multi-node network model is controlled to issue traffic anomaly warnings and display abnormal nodes. The multi-node network model is controlled to simulate real traffic scenarios, and the network vulnerabilities of the virtual protection platform are opened to guide network attacks against the target network system to the multi-node network model.

[0009] Optionally, the abnormal node information also includes an abnormal level of the abnormal node; based on the abnormal node information, the multi-node network model is controlled to perform traffic abnormality warning and display abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios, and network vulnerabilities of the virtual protection platform are opened, including:

[0010] Locate abnormal nodes in a multi-node network model, display abnormal nodes in the multi-node network model according to the abnormality level, and issue traffic abnormality warnings based on the abnormality level;

[0011] Based on the node traffic data of abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios and open the network vulnerabilities of the virtual protection platform.

[0012] Optionally, the abnormal node information also includes an abnormal level of the abnormal node, and the node monitoring model includes an abnormal prediction model and an abnormal classification model; real-time traffic abnormality monitoring is performed on each network node to obtain abnormal node information, including:

[0013] Based on the node traffic data of each network node, an abnormal prediction model is used to predict the real-time traffic anomaly of each network node and determine the abnormal nodes with abnormal traffic. The abnormal prediction model is a support vector machine model trained based on the historical node traffic data of the target network system.

[0014] Based on the node traffic data of abnormal nodes, an abnormal classification model is used to classify the degree of traffic abnormality of abnormal nodes to obtain the abnormal level of abnormal nodes. The abnormal classification model is an isolation forest model trained based on the abnormal historical node traffic data in the target network system.

[0015] Optionally, after obtaining a system simulation model for simulating a real operating environment of the target network system, the method further includes:

[0016] After acquiring the node flow data of each network node in the target network system, generating a playback time anchor point of the node flow data of each network node according to the data packet timestamp in the node flow data of each network node, and storing the node flow data and the playback time anchor point of each network node;

[0017] When a node traffic playback instruction is received, the real traffic scenario of the target network system is simulated through a multi-node network model based on the node traffic data and playback time anchor point of each network node.

[0018] Optionally, after performing real-time traffic anomaly monitoring on each network node and obtaining abnormal node information, the method further includes:

[0019] The abnormal node in the abnormal node information is used as the node anchor point of the traffic anomaly, and the time when the abnormal node is detected is used as the time anchor point of the traffic anomaly;

[0020] The node anchor points and corresponding time anchor points of traffic anomalies, as well as the corresponding node traffic data are stored for subsequent retrieval.

[0021] In a second aspect, an embodiment of the present application provides a node traffic monitoring system, including a target network system and a node traffic monitoring device, wherein the node traffic monitoring device is used to:

[0022] An acquisition module is used to acquire a system simulation model for simulating the real operating environment of the target network system, wherein the system simulation model includes a multi-node network model simulating the node network topology of the target network system and a virtual protection platform of the multi-node network model, wherein the virtual protection platform is used to simulate and map the real security protection environment in the target network system;

[0023] A monitoring module is used to perform real-time traffic anomaly monitoring on each network node based on the node traffic data of each network node in the target network system, and obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic;

[0024] The control module is used to control the multi-node network model to issue traffic anomaly warnings and display abnormal nodes based on abnormal node information, control the multi-node network model to simulate real traffic scenarios, and open network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned parameter aggregation method based on federated learning when executing the computer program.

[0026] In a fourth aspect, an embodiment of the present application provides a readable storage medium, which stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned parameter aggregation method based on federated learning are implemented.

[0027] In a solution provided by the above-mentioned node traffic monitoring method, system, device and storage medium, a system simulation model is constructed by simulating the actual operating environment of the target network system. The system simulation model includes a multi-node network model and a virtual protection platform that simulate the node network topology of the target network system. The virtual protection platform is used to simulate and map the actual security protection environment in the target network system; then, based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, and the abnormal node information includes abnormal nodes with abnormal traffic; finally, based on the abnormal node information, the multi-node network model is controlled to issue traffic anomaly warnings and display abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios, and the network vulnerabilities of the virtual protection platform are opened to guide network attacks against the target network system to the multi-node network model. In this embodiment, the real node network topology of the target network system is simulated by a multi-node network model, and the real security protection environment of the target network system is simulated by a virtual protection platform. Then, real-time traffic anomaly monitoring is performed on each network node in the target network system. When a network node with traffic abnormality is detected, an abnormal warning is issued through the multi-node network model and the abnormal node is displayed intuitively, thereby achieving rapid and accurate positioning of abnormal nodes in the system. At the same time, the network vulnerabilities of the virtual protection platform are opened to guide network attacks to the multi-node network model, thereby improving the efficiency of system anomaly positioning and being able to provide effective security protection in a timely manner, thereby improving the security of the target network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0029] Figure 1 is a structural schematic diagram of a node flow monitoring system in one embodiment of the present invention;

[0030] Figure 2 It is a flow chart of a node traffic monitoring method in one embodiment of the present invention;

[0031] Figure 3 is another schematic flow chart of a node traffic monitoring method according to an embodiment of the present invention;

[0032] Figure 4 It is another flow chart of a node traffic monitoring method in one embodiment of the present invention;

[0033] Figure 5 yes Figure 2A schematic diagram of an implementation process of step S20;

[0034] Figure 6 yes Figure 2 A schematic diagram of an implementation process of step S30;

[0035] Figure 7 yes Figure 1 A structural schematic diagram of a mid-node flow monitoring device;

[0036] Figure 8 It is a schematic diagram of the structure of an electronic device in one embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or their collections. It should also be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0039] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0040] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0041] It should be understood that the order of execution of the steps in the following embodiments does not imply a precedence of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0042] In order to illustrate the technical solution of the present invention, specific embodiments are provided below for illustration.

[0043] It is important to understand that there are many node devices (network nodes) in the existing industrial network system, the information association between the node devices is complex, and the traffic data generated is huge, making it difficult to monitor the traffic conditions of each node device in the industrial network system in real time. Once an abnormal network traffic data event occurs in the industrial network system, it often indicates a network security threat, network configuration error, network configuration change, network congestion, and system equipment failure. In other words, abnormal traffic data in the industrial network system may mean unauthorized access attempts, and illegal organizations may try to steal sensitive data or confidential information. Abnormal traffic data may also mean that the network equipment such as servers, routers, switches in the industrial network system has failed or that the on-site workers have made mistakes. These traffic anomalies may cause security risks of data leakage, and may also cause the paralysis of industrial automation infrastructure, seriously threatening the security of the industrial network system. Therefore, real-time monitoring of network traffic in the industrial network system to quickly locate abnormal events and solve abnormal problems is crucial for the sustainable development of modern industry. However, the network traffic monitoring methods in existing industrial network systems can only monitor and display the traffic information of a single node, and the ability to locate and analyze anomalies is weak. It is difficult to perform traffic monitoring, analysis and security protection on multiple node devices at the same time without affecting the real equipment, so as to quickly and accurately locate and display the node devices with traffic anomalies, and implement effective emergency protection strategies when traffic anomalies occur to ensure the safe operation of the industrial network system.

[0044] In view of the above problems, the node traffic monitoring method provided by the embodiment of the present invention can be applied in Figure 1 In the node traffic monitoring system shown, the node traffic monitoring system includes a target network system and a node traffic monitoring device, wherein the node traffic monitoring device communicates with the target network system through a network.

[0045] Specifically, the acquisition module of the node traffic monitoring device obtains a system simulation model by simulating the real operating environment of the target network system, wherein the system simulation model includes a multi-node network model and a virtual protection platform of the multi-node network model, the multi-node network model is a network topology model constructed by simulating the node network topology of the target network system, that is, each node of the multi-node network model and the network topology relationship between the nodes correspond to the network nodes and the network topology relationship of the target network system one by one; the virtual protection platform is a virtual security platform constructed by simulating the real security protection environment in the target network system, that is, the operating environment and server configuration of the virtual protection platform are the same as the target network system, and the virtual protection platform has a mapping relationship with the real security protection environment in the target network system, so that the network attack of the target network system can be transferred later. Then, the monitoring module of the node traffic monitoring device collects the node traffic data of each network node in the target network system in real time. And based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic. Finally, the control module of the node traffic monitoring device controls the multi-node network model to issue traffic anomaly warnings and display abnormal nodes based on the abnormal node information, controls the multi-node network model to simulate real traffic scenarios, and opens the network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model.

[0046] In this embodiment, the real node network topology of the target network system is simulated through a multi-node network model, and the real security protection environment of the target network system is simulated through a virtual protection platform. Then, each network node in the target network system is monitored for traffic anomalies in real time. When a network node with traffic anomalies is detected, an abnormal warning is issued through a multi-node network model and the abnormal node is displayed intuitively, thereby realizing the rapid and accurate positioning of abnormal nodes in the system. At the same time, the multi-node network model is controlled to simulate real traffic scenarios, and the network vulnerabilities of the virtual protection platform are opened to guide network attacks to the multi-node network model, thereby improving the efficiency of system anomaly positioning and being able to provide effective security protection in a timely manner, thereby improving the security of the target network system.

[0047] In this embodiment, the node flow monitoring device can be various terminal devices, including but not limited to various personal computers, laptops, smart phones, and tablet computers. The node flow monitoring device can also be a server, which can be implemented as an independent server or a server cluster composed of multiple servers.

[0048] The target network system may be an industrial network system including multiple network nodes, such as a power system, an industrial manufacturing and automation system, a logistics system, an energy management and optimization system, a transportation system, a communication system, and an Internet of Things device system. For example:

[0049] In the power system, the present invention can be used to monitor the operation status of the power grid in real time, detect and resist network attacks, and prevent malicious interference with power production and distribution. The node flow playback function of the multi-node network model can adapt to the complex flow characteristics of the power system.

[0050] In industrial manufacturing and automation systems, network traffic data is a key indicator for evaluating production line performance, optimizing production processes, and ensuring the normal operation of equipment. Through multi-node network models, multi-node traffic display can monitor the network traffic of each production link in real time, so as to timely discover and locate fault points or production bottlenecks; it can also prevent malicious interference with industrial production and distribution of electricity users.

[0051] In the supply chain management of the logistics industry system, network traffic data reflects the flow of raw materials, parts and products between different nodes. Through the multi-node network model to display multi-node traffic, it is possible to track the network traffic of each link in the supply chain in real time, prevent malicious interference, and ensure the smooth operation of the supply chain.

[0052] In energy management and optimization systems, network traffic data can be used to monitor the flow of energy such as electricity and gas during transmission. By displaying multi-node traffic through a multi-node network model, it is possible to view the distribution and consumption of energy at each node in real time and prevent malicious interference, thereby optimizing energy distribution and use.

[0053] In the traffic system, network traffic data reflects the operation of vehicles in the road network. Through the multi-node network model to display multi-node traffic, the distribution of traffic flow in each section can be viewed in real time, so as to predict traffic congestion, optimize traffic routes, reduce the negative impact of traffic congestion, prevent malicious interference, and ensure the normal operation of the system.

[0054] In relevant communication systems, multi-node traffic display through multi-node network models can clearly identify the distribution and consumption on each node device. Through multi-level traffic analysis, the system can detect and respond to potential network threats and protect related infrastructure and communication networks from hostile network attacks.

[0055] In the IoT device system, multi-node traffic display is performed through a multi-node network model, which can monitor the operation of various sensors and devices in the network in real time, thereby ensuring the stability and reliability of the IoT system.

[0056] These application areas are only some examples of the node traffic monitoring method in this embodiment. Due to the wide application of industrial network systems in various industries, this method is essential to ensure the stability and performance of various automation systems. This method provides important decision support and management means for various industries by real-time monitoring and analysis of network traffic data. It helps to reduce production downtime, improve production efficiency, reduce maintenance costs, and ensure that industrial automation systems remain highly reliable in a changing environment.

[0057] In one embodiment, if Figure 2 As shown, a node traffic monitoring method is provided, and the method is applied in Figure 1 The node flow monitoring device in is taken as an example to illustrate, including the following steps:

[0058] S10: Acquire a system simulation model for simulating a real operating environment of a target network system, wherein the system simulation model includes a multi-node network model and a virtual protection platform that simulates a node network topology of the target network system.

[0059] In this embodiment, the node traffic monitoring device needs to obtain a system simulation model that is pre-built according to the actual operating environment of the target network system to reproduce the operating environment of the target network system as realistically as possible. This system simulation model includes two parts: a multi-node network model and a virtual protection platform for the multi-node network model. The multi-node network model is used to simulate the actual traffic scenarios of each network node in the target network system and realize traffic scenario playback analysis. The virtual protection platform is a virtual protection platform used to simulate and map the actual security protection environment in the target network system.

[0060] The multi-node network model is a network topology model constructed by the node network topology of the target network system, which can simulate the node network topology in the target network system, that is, the nodes of the multi-node network model and the network topology relationship between the nodes correspond one-to-one with the network nodes and the network topology relationship of the target network system. Among them, it is necessary to generate a network topology based on the logical relationship of each device according to the data type and location area processed and transmitted by different devices in the target network system, and obtain a multi-node network model. According to the location area and data type of each device in the target network system, the corresponding virtual network nodes are generated. The virtual network nodes can reproduce the traffic conditions of the real network nodes, and restore the real traffic scenes in the target network system one-to-one, so as to achieve more comprehensive traffic monitoring and analysis of the target network system.

[0061] The virtual protection platform is a virtual security platform built based on the real security protection environment in the target network system, that is, the operating environment and server configuration of the virtual protection platform are the same as those of the target network system. In addition, the virtual protection platform has a mapping relationship with the real security protection environment in the target network system so that network attacks on the target network system can be diverted later. Through the device node and topology simulation of this simulated entity, as well as the protection environment simulation, a system simulation model that is highly consistent with the real environment can be obtained for subsequent traffic anomaly monitoring, positioning and security protection.

[0062] S20: Based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, where the abnormal node information includes abnormal nodes with abnormal traffic.

[0063] During the operation of the target network system, the node traffic monitoring device needs to perform real-time traffic anomaly monitoring on each network node based on the node traffic data of each network node in the target network system to obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic.

[0064] Among them, based on the node flow data of each network node in the target network system, real-time flow anomaly monitoring is performed on each network node to obtain abnormal node information, including the following steps: real-time collection of flow of each network node in the target network system to obtain the node flow data of each network node, and based on the node flow data of each network node, a pre-trained node monitoring model is used to perform real-time flow anomaly monitoring on the corresponding network node to obtain abnormal node information.

[0065] The node monitoring model is a machine learning model obtained by training the historical node traffic data of the target network system using the Support Vector Machine (SVM) algorithm. The accuracy of the node monitoring model can be guaranteed by using the historical node traffic data of the target network system for model training; and the node monitoring model trained with the SVM algorithm for anomaly monitoring can adapt to complex traffic patterns by mapping traffic data to a higher-dimensional space using a kernel function, which can improve the anomaly detection performance and adaptability of the node monitoring model, thereby providing accurate and stable anomaly detection capabilities.

[0066] By using the node traffic data obtained from the target network system, a node monitoring model is used to monitor the real-time traffic of each network node. By analyzing the node traffic data, abnormal traffic can be quickly and accurately identified, and the network nodes with abnormal traffic can be determined to obtain abnormal node information. By analyzing the abnormal node information, potential problems in the network can be discovered in a timely manner, thereby quickly performing system security protection.

[0067] Among them, data collection equipment (such as probes) can be set in advance in each network node of the target network system. When the target network system is running, the traffic of the corresponding network node is collected by the collection equipment on each network node to obtain the node traffic data of each network node. Among them, the node traffic data includes the data packets transmitted by the network node and the basic information of the data packets, such as the timestamp, protocol type, source IP address, source port number, destination IP address, destination port number, data area, etc. of the data packets.

[0068] In order to reduce the number of collection devices and the amount of data collected, collection devices can be set on key network nodes in the target network system to collect node flow data on key network nodes, and data splitting is performed according to the node flow data on key network nodes (such as data splitting by receiving port number), and the node flow data from each network node is determined as the node flow data of the corresponding network node. Among them, the key network node can be a relay node in the target network system, such as a repeater, a hub, a bridge, a switch, a router, a gateway and other devices. There are multiple data interfaces (such as RESTful API interfaces) in the key network nodes, through which flow data from different network nodes can be obtained from the key network nodes periodically or through GET requests.

[0069] Through key network nodes, traffic data from multiple network nodes can be aggregated and processed, which can reduce the amount of data transmission of each network node and improve network efficiency. Subsequently, the node traffic data of each network node is distributed to the corresponding virtual network nodes in the multi-node network model for traffic display, so as to observe the network traffic status from different angles and positions, and to conduct security monitoring of the real on-site network environment and user behavior from different angles.

[0070] S30: Based on the abnormal node information, control the multi-node network model to issue traffic anomaly warnings and display abnormal nodes, control the multi-node network model to simulate real traffic scenarios, and open network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model.

[0071] After obtaining the abnormal node information including the abnormal node, the node traffic monitoring device needs to control the multi-node network model to perform traffic anomaly warning based on the abnormal node information, and locate and display the abnormal node in the multi-node network model. For example, after obtaining the abnormal node information including the abnormal node, determine the position of the abnormal node in the multi-node network model (i.e., its corresponding virtual network node), display the abnormal node in the multi-node network model in a highlighted flashing display, and simultaneously perform a sound reminder of the traffic anomaly (such as a buzzer beeping) to achieve the traffic anomaly warning of the network node. In other embodiments, an alarm message can also be generated based on the time when the traffic anomaly is monitored, as well as the device information, geographical location, region and data type corresponding to the abnormal node, and the alarm message is sent to relevant personnel through the multi-node network model and / or other methods (such as email, broadcast, SMS, telephone call), so that they can quickly know the abnormal network node and respond to the security policy in time.

[0072] After obtaining the abnormal node information including abnormal nodes, the node traffic monitoring device controls the multi-node network model to perform abnormal traffic warning and display abnormal nodes. At the same time, it is also necessary to control the multi-node network model to simulate the real traffic scene and open the network loopholes of the virtual protection platform to guide the network attack on the target network system to the multi-node network model. Among them, the network loophole can be a network loophole of Web network service, data transmission (File Transfer Protocol, FTP) service, and database service. Since the virtual protection platform simulates the real security protection environment of the target network system, its service configuration is the same as the security protection configuration information of the target network system, and it is mapped to the real security protection environment of the target network system. When the multi-node network model simulates the real traffic scene of the target network system, the virtual protection platform opens the network loophole, which can mislead the network attacker and provide the target of the network attack. By guiding the network attack to the multi-node network model, the attack source can be accurately located in time, and the real assets can be concealed to protect the safe operation of the target network system.

[0073] In this embodiment, the real node network topology of the target network system is simulated through a multi-node network model, and the real security protection environment of the target network system is simulated through a virtual protection platform, and then the real-time traffic anomaly monitoring is performed on each network node in the target network system, so that the security protection and monitoring of the traffic of multiple network nodes can be realized, and the network nodes with abnormal traffic can be quickly located in the massive traffic nodes. When the network nodes with abnormal traffic are monitored, the multi-node network model is used to perform abnormal warning and intuitively display the abnormal nodes, so as to realize the rapid and accurate positioning of the abnormal nodes in the system. At the same time, the multi-node network model is also controlled to simulate the real traffic scene, and the network loopholes of the virtual protection platform are opened. When encountering abnormal intrusion, the network attack can be guided to the multi-node network model, which provides time for the timely implementation of the emergency plan. Therefore, this embodiment provides a node traffic monitoring method, which can improve the efficiency of system abnormality positioning, and can provide effective security protection in time, thereby improving the security of the target network system.

[0074] In addition, in this embodiment, the node flow data of any network node can be displayed through the multi-node network model, and the node flow data can be restored with any network node and time as anchor points, and the actual on-site flow environment scene can be reproduced, which is convenient for subsequent data analysis to enhance the understanding of relevant personnel on flow changes, especially abnormal events. It is also possible to reproduce and troubleshoot network node faults without affecting the on-site operation of the target network system, and formulate repair and optimization plans.

[0075] In one embodiment, in step S30, that is, after opening the network vulnerability of the virtual protection platform, the method also includes: when the multi-node network model is detected to be under a network attack through the virtual protection platform, the attack data of the network attack is recorded through the virtual protection platform, and the attack data of the network attack is analyzed.

[0076] When the network vulnerabilities of the open virtual protection platform are detected, the traffic conditions in the multi-node network model are security tested through the virtual protection platform. When the multi-node network model is detected to be under network attack, the attack data of the network attack is recorded through the virtual protection platform. The attack data is the network communication traffic data between the attacker and the virtual protection platform, which includes the attack target and attack behavior data. Then the attack data of the network attack is analyzed, which helps relevant personnel better understand the attacker's behavior and intentions, and provides strong support for preventing and responding to multi-level network attacks. By recording the network communication traffic data between the attacker and the virtual protection platform, the traffic data can be displayed and replayed for this traffic anomaly, and the corresponding abnormal data environment can be generated, which can help relevant personnel reproduce and learn the problems and attack purposes of this abnormal event, thereby accelerating the troubleshooting and diagnosis process.

[0077] In one embodiment, if Figure 3 As shown, after step S10, that is, after obtaining the system simulation model for simulating the real operating environment of the target network system, the method further includes the following steps:

[0078] S40: After acquiring the node flow data of each network node in the target network system, a playback time anchor point of the node flow data of each network node is generated according to the data packet timestamp in the node flow data of each network node, and the node flow data and the playback time anchor point of each network node are stored.

[0079] During the operation of the target network system, the node traffic monitoring device needs to collect the traffic of each network node in the target network system in real time to obtain the node traffic data of each network node in the target network system. For example, the traffic of each network node (or key network node) can be collected through a collection device (such as a probe), and the collected traffic data can be analyzed and reconstructed to obtain the node traffic data of each network node, and the collection time point of each node traffic data is recorded as the playback time anchor point for the subsequent playback of traffic data, and the node traffic data of each network node and its playback time anchor point are stored for subsequent traffic playback. Among them, the node traffic data includes the data packets transmitted by the network node and the basic information of the data packets, such as the timestamp (sending timestamp), protocol type, source IP address, source port number, destination IP address, destination port number, data area, etc. of the data packet.

[0080] After real-time collection of the traffic of each network node in the target network system, the collected traffic data is analyzed and reconstructed to restore the structure of the data packet, including information such as the IP header, TCP / UDP header, and payload, and obtain the reconstructed node traffic data of each network node. The purpose of reconstructing the data is to make the data packet as close as possible to the state of the original transmission, so that the network traffic can be accurately reproduced in a virtual environment. Among them, the node traffic data of the network node includes multiple data stream files and playback data of each data stream file. The playback data of the data stream file includes the size and duration of the data stream file, the number of data packets, the timestamp of each data packet, the sending time interval of the data packet, and the sending rate (sending speed) of the data packet. At the same time, according to the timestamp of the data packet in the node traffic data of the network node, the playback time anchor point of the node traffic data of each network node is generated, and the node traffic data and the playback time anchor point of each network node are stored.

[0081] Specifically, after obtaining the node flow data of each network node, it is necessary to segment the node flow data of each network node to obtain multiple data flow files of each network node. Among them, the timestamp, protocol type, source IP address, source port number, destination IP address, destination port number, data area, and specific content information of the data packet in the node flow data can be used as segmentation rules to segment and obtain multiple data flow files of different types, and the data type of each data flow file is the same. Then, traverse each data flow file, count the size of each data flow file, the number of data packets, the timestamp of each data packet, the duration of the data flow file (the timestamp of the first data packet in the data flow file and the timestamp of the last data packet are used to determine the duration of the data flow file), and the time interval of the data packets (the timestamp of each data packet is used to determine the time interval between each data packet and the first data packet), the sending rate of the data packet, and obtain the playback data of the data flow file, which is convenient for subsequent one-to-one mapping and playback of network nodes.

[0082] Among them, according to the timestamp of each data packet in the multiple data stream files of the network node, the sending time nodes of the multiple data stream files are aligned to generate the playback time anchor point of the node traffic data of the network node, wherein the timestamp of each data packet may be used as the playback time anchor point. Then, the multiple data stream files of each network node, the playback data of each data stream file and the playback time anchor point are stored in the database, so that the node traffic data of each network node can be replayed through the multi-node simulation model later, that is, the real traffic scene of the target network system is simulated. Among them, each network node that needs to replay the traffic can be stored as a playback node anchor point, so as to facilitate the subsequent playback of traffic data according to the playback node anchor point and the corresponding playback time anchor point. In other embodiments, the playback node anchor point and the playback time anchor point can also be determined according to the user setting information to meet the different playback needs of users.

[0083] S50: When a node traffic playback instruction is received, based on the node traffic data of each network node and the playback time anchor point, a real traffic scenario of the target network system is simulated through a multi-node network model.

[0084] The node traffic data of each network node includes multiple data stream files of each network node. The user (relevant personnel) sends a node traffic playback instruction to the node traffic monitoring device according to the demand. The node traffic playback instruction may include the network node and playback time (playback time anchor point) that need to play back the traffic data. Upon receiving the node traffic playback instruction, the node traffic monitoring device plays back the traffic data of each network node in a single node or multiple nodes through a multi-node simulation model based on the multiple data stream files of each network node, the playback data of each data stream file and the playback time anchor point, so as to simulate the real traffic scenario of the target network system.

[0085] Among them, when simulating the real traffic scenario of the target network system through a multi-node network model, it is necessary to put multiple data packets of multiple data flow files of the network node into the queue buffer in sequence according to the timestamp of each data packet and wait for sending. After aligning the sending time point of each data flow file according to the playback time anchor point, each data flow file is sent according to the sending time interval and sending rate of each data packet in the data flow file to realize the traffic data playback of the corresponding network node to simulate the real traffic scenario of the target network system.

[0086] In this embodiment, after obtaining the node flow data of each network node in the target network system, the playback time anchor point of the node flow data of each network node is generated according to the data packet timestamp in the node flow data of each network node, and the node flow data and the playback time anchor point of each network node are stored; when receiving the node flow playback instruction, based on the node flow data and the playback time anchor point of each network node, the real flow scenario of the target network system is simulated through a multi-node network model. By reconstructing the node flow data, determining the data transmission time and transmission rate of the node flow data of each network node, and generating the corresponding playback time anchor point, the accurate flow data simulation can be performed according to the actual needs, and the real flow scenario simulation of the target network system is realized, which is convenient for the subsequent monitoring and analysis of the flow status of each network node.

[0087] In one embodiment, step S50, i.e., based on the node traffic data of each network node and the playback time anchor point, simulating the real traffic scenario of the target network system through a multi-node network model specifically includes the following steps:

[0088] S51: When the node traffic playback instruction indicates to monitor the traffic of all network nodes, or the number of network nodes in the target network system is less than the preset value, based on the node traffic data and playback time anchor point of each network node, the real traffic scenario of each network node is simulated through a multi-node network model to realize single-node traffic scenario playback.

[0089] When receiving the node traffic playback instruction, if the node traffic playback instruction indicates to monitor the traffic of all network nodes, the node traffic monitoring device simulates the real traffic scene of each network node through the multi-node network model based on the node traffic data and playback time anchor point of each network node, and realizes the playback of the single node traffic scene. Among them, the playback process of the node traffic data of the network node is as described above and will not be repeated here.

[0090] In addition, when the number of network nodes in the target network system is less than the preset value, the real traffic scenarios of each network node can be simulated through a multi-node network model based on the node traffic data and playback time anchor points of each network node, so as to monitor and analyze the traffic conditions of each network node from different angles and discover problems in a timely manner.

[0091] S52: When the node traffic playback instruction indicates to monitor the traffic data of the preset type, or the number of network nodes in the target network system is greater than or equal to the preset value, all target network nodes that transmit the preset type of data are determined, and based on the node traffic data and playback time anchor point of each target network node, the real traffic scenario of the preset type of data is simulated through a multi-node network model to realize multi-node traffic scenario playback.

[0092] If the node traffic playback instruction indicates that the preset type of traffic data is to be monitored, the node traffic monitoring device needs to determine all target network nodes that transmit the preset type of data, and based on the node traffic data and playback time anchor point of each target network node, simulate the actual traffic scenario of the preset type of data through a multi-node network model to realize multi-node traffic scenario playback.

[0093] For example, when a user needs to view information about any type of monitoring item, the data type of the monitoring item is determined, a node traffic playback instruction of the data type is generated and sent to the node traffic monitoring device. After receiving the node traffic playback instruction, the node traffic monitoring device determines all target network nodes that transmit the preset type of data according to the node traffic playback instruction, and based on the node traffic data and playback time anchor point of each target network node, the traffic data of each target network node is played back through the system simulation model to achieve multi-node traffic scene playback to simulate the real traffic scene of the preset type of data. Among them, the playback process of the node traffic data of each target network node is as mentioned above and will not be repeated here.

[0094] In other embodiments, when the number of network nodes in the target network system is greater than or equal to a preset value, all network nodes can also be classified according to the data types transmitted by different network nodes to determine all target network nodes that transmit the same preset type of data. Then, all target network nodes that transmit the same preset type of data are grouped together, and when the control system simulation model plays back the traffic data, the traffic data of each target network node is played back according to the data type to which it belongs to simulate the actual traffic scenario of the corresponding type of data.

[0095] In this embodiment, when the node traffic playback instruction indicates that all network nodes are to be monitored for traffic, or the number of network nodes in the target network system is less than a preset value, based on the node traffic data and playback time anchor point of each network node, the real traffic scene of each network node is simulated through a multi-node network model to achieve single-node traffic scene playback. The simulation of traffic conditions of different network nodes can be achieved to achieve accurate traffic monitoring and analysis. When the node traffic playback instruction indicates that the traffic data of a preset type is to be monitored, or the number of network nodes in the target network system is greater than or equal to the preset value, all target network nodes that transmit the preset type of data are determined, and based on the node traffic data and playback time anchor point of each target network node, the real traffic scene of each target network node is simulated through a multi-node network model to achieve multi-node traffic scene playback. On the one hand, the traffic changes of different types of data can be simulated according to actual needs, and on the other hand, when there are many network nodes, there is no need to simulate the traffic scenes of all network nodes, which can reduce the simulation burden of traffic scenes.

[0096] In one embodiment, if Figure 4 As shown, after step S20, that is, after real-time traffic anomaly monitoring is performed on each network node and abnormal node information is obtained, the method further includes the following steps:

[0097] S60: taking the abnormal node in the abnormal node information as the node anchor point of the traffic anomaly, and taking the time when the abnormal node is detected as the time anchor point of the traffic anomaly;

[0098] S70: Store the node anchor point of the traffic anomaly, the corresponding time anchor point and the node traffic data for subsequent retrieval.

[0099] After performing real-time traffic anomaly monitoring on each network node and obtaining abnormal node information, the node traffic monitoring device uses the abnormal node in the abnormal node information as the node anchor point of the traffic anomaly, and uses the time when the abnormal node is monitored as the time anchor point of the traffic anomaly, and then stores the node anchor point of the traffic anomaly, the corresponding time anchor point and the corresponding node traffic data (i.e., the node traffic data of the abnormal node) for subsequent retrieval, so that subsequent relevant personnel can analyze the traffic situation of the abnormal node and determine the cause of the anomaly. Alternatively, based on the node anchor point of the traffic anomaly and its corresponding time anchor point, the node traffic data of the abnormal node can be replayed through a multi-node network model to simulate the node traffic situation of the abnormal node, so that relevant personnel can trace back and perform abnormal analysis on the node traffic situation of the abnormal node.

[0100] Among them, the corresponding node traffic data can be the node traffic data of the abnormal node near the time anchor point of its traffic anomaly; it can also be the node traffic data from the time the network node is started to the time anchor point of its traffic anomaly, or it can be all node traffic data of the abnormal node.

[0101] In this embodiment, the abnormal node in the abnormal node information is used as the node anchor point of the traffic anomaly, and the time when the abnormal node is monitored is used as the time anchor point of the traffic anomaly; the node anchor point of the traffic anomaly and the corresponding time anchor point, as well as the corresponding node traffic data are stored for subsequent retrieval. This provides a data basis for the subsequent simulation and playback of the node traffic situation of the abnormal node, facilitates the abnormal analysis and troubleshooting of the abnormal situation of the abnormal node, helps relevant personnel quickly locate the source of the abnormal problem, and promptly implements emergency plans. At the same time, by recording the network communication traffic data between the attacker and the virtual protection platform, these data include the interaction between the attacker and the virtual protection platform, and can display and replay the traffic data for this traffic anomaly, generate a corresponding abnormal data environment, and help relevant personnel reproduce and learn the problems and attack purposes of this abnormal event, thereby accelerating the troubleshooting and diagnosis process.

[0102] In one embodiment, the abnormal node information includes the abnormal level of the abnormal node, and the node monitoring model includes an abnormal prediction model and an abnormal classification model. Figure 5 As shown, in step S20, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, which specifically includes the following steps:

[0103] S21: Based on the node traffic data of each network node, an abnormal prediction model is used to perform real-time traffic anomaly prediction on each network node to determine the abnormal nodes with abnormal traffic.

[0104] After obtaining the node traffic data of each network node, it is necessary to obtain the pre-trained anomaly prediction model. Based on the node traffic data of each network node, the anomaly prediction model is used to predict the real-time traffic anomaly of each network node, so as to identify different types of abnormal traffic data and then determine the abnormal nodes with abnormal traffic. The abnormal situation of each network node is determined based on the abnormal traffic data, and reasoning is performed based on the tree-structured network topology of the target network model, where each branch of the tree-structured network topology represents a network node. The network nodes with abnormal traffic are predicted through cyclic analysis until each network node is checked, so as to accurately locate the network nodes with abnormal traffic.

[0105] For example, targeted threshold ranges can be generated based on the flow data size, flow change frequency, flow change amplitude, etc. of different target network systems. These threshold ranges are then used to analyze the node flow data of network nodes to identify whether key flow data indicators (such as the number of data packets, data packet size, number of node connections, etc.), flow change frequency, or flow change amplitude in the node flow data exceed the preset threshold range. When an indicator exceeds the preset threshold range, it is determined that the network node has flow anomalies and the network node is an abnormal node.

[0106] Among them, the abnormal prediction model is a support vector machine model trained based on the historical node traffic data of the target network system. The historical node traffic data includes normal historical node traffic data of each network node and abnormal historical node traffic data of each network node. That is, the SVM algorithm is used to perform machine learning on the historical node traffic data of the target network system to obtain a traffic prediction model, which can improve the performance and adaptability of the abnormal prediction model, thereby improving the effect of traffic data abnormality monitoring.

[0107] S22: Based on the node traffic data of the abnormal node, an abnormal classification model is used to classify the abnormal degree of the traffic of the abnormal node to obtain the abnormal level of the abnormal node.

[0108] After determining the abnormal node with abnormal traffic, it is necessary to obtain a pre-trained abnormality classification model, and then use the abnormality classification model to classify the degree of abnormal traffic of the abnormal node based on the node traffic data of the abnormal node to obtain the abnormal level of the abnormal node.

[0109] Among them, the anomaly classification model is an isolation forest model trained based on the abnormal historical node traffic data in the target network system. The isolation forest model is used to perform anomaly level analysis on the node traffic data of abnormal nodes, which can process large-scale data with linear time complexity, accuracy and without excessive computing resources.

[0110] Specifically, the anomaly classification model can be trained in the following way:

[0111] Step 1: Determine the number t of isolated trees (which can be 100), and select a preset number of abnormal historical node traffic data from the abnormal historical node traffic data of the target network system as training sample data, and use the data other than the training sample data in the abnormal historical node traffic data as test sample data, wherein each sample data of the training sample data and the test sample data is an abnormal historical node traffic data;

[0112] Step 2: Randomly select a training sample data from the training sample data and put it into a root node, and randomly specify a dimension, and randomly generate a cutting point P in the current training sample. The cutting point P is generated between the maximum value and the minimum value of the specified dimension in the current training sample data;

[0113] Step 3: Generate a hyperplane with the cutting point P, and divide the space of training samples into two subspaces to form two child nodes (leaf nodes), among which, the sample data less than the cutting point P in the specified dimension is placed in the left child node of the current node of the isolation tree, and the sample data greater than or equal to the cutting point P in the specified dimension is placed in the right child node of the current node;

[0114] Step 4: Recursively repeat steps 2 and 3 in the child node, and continuously construct new child nodes on the current node until there is only one data in the child node (no further cutting is possible) or the child node has reached the limited height, generating an isolated tree;

[0115] Step 5: Repeat steps 2 to 4 above to generate t isolated trees, and obtain an initial isolation forest model including t isolated trees;

[0116] Step 6: Predict the performance of the initial isolation forest model based on the test sample data in the test sample data. When the prediction performance of the initial isolation forest model meets the requirements, output the initial isolation forest model as an anomaly classification model.

[0117] In this embodiment, based on the abnormal historical node traffic data in the target network system, the performance evaluation adjustment parameters of the isolation forest model are adjusted by cross-validation, so as to optimize the classification accuracy and efficiency of the abnormal classification model. In addition, the number of isolated trees and the size of the training sample data can be adjusted according to the available computing resources to balance the performance of the model.

[0118] In this embodiment, based on the node flow data of each network node, an abnormal prediction model is used to predict the real-time flow anomaly of each network node, determine the abnormal node with abnormal flow, and based on the node flow data of the abnormal node, an abnormal classification model is used to classify the degree of flow anomaly of the abnormal node, obtain the abnormal level of the abnormal node, and refine the specific process of performing real-time flow anomaly monitoring on each network node to obtain abnormal node information. By using the support vector machine model to predict the real-time flow anomaly of each network node, the accuracy is high, and the stage flow anomaly can be quickly predicted. The isolation forest model is used to classify the node flow data of the abnormal node, which can effectively measure the degree of flow anomaly of the network node with high accuracy.

[0119] In one embodiment, in step S21, based on the node traffic data of each network node, an abnormal prediction model is used to perform real-time traffic anomaly prediction on each network node in the target network system to determine the abnormal node with abnormal traffic, which specifically includes the following steps:

[0120] S211: Based on the node traffic data of each network node, an abnormal prediction model is used to predict the traffic change of each network node to obtain the traffic prediction value of each network node.

[0121] First, after obtaining the node flow data of each network node, for each network node, the node flow data currently collected by the network node is feature encoded to obtain the flow feature vector of the network node; for example, the basic information of the data packet in the node flow data, such as the timestamp, protocol type, source IP address, source port number, destination IP address, destination port number, data area, etc. of the data packet is feature encoded to obtain the flow feature vector of the network node. Then, the flow feature vector of the network node is input into the abnormal prediction model to predict the flow change of the network node to obtain the flow prediction value of the network node, thereby obtaining the flow prediction value of each network node in the target network system. Among them, the flow prediction value includes at least one of the predicted flow data size, the predicted flow change frequency, and the predicted flow change amplitude.

[0122] For example, the abnormal prediction model may include at least one of the first prediction model, the second prediction model, and the third prediction model. The flow data size of each network node is predicted by the first prediction model to obtain the predicted flow data size of each network node; the flow change frequency of each network node is predicted by the second prediction model to obtain the predicted flow change frequency of each network node; the flow change amplitude of each network node is predicted by the third prediction model to obtain the predicted flow change amplitude of each network node.

[0123] S212: Perform traffic anomaly judgment based on the traffic prediction value of each network node. When it is determined that the network node has traffic anomaly based on the traffic prediction value of the network node and the corresponding threshold range, the network node is determined to be an abnormal node.

[0124] After obtaining the traffic prediction value of each network node, traffic anomaly judgment is performed based on the traffic prediction value of each network node. For each network node, it is necessary to judge whether each of its traffic prediction values ​​is within its corresponding threshold range, so as to determine whether the network node is abnormal based on the judgment result. When it is determined that the network node has traffic anomaly based on the traffic prediction value of the network node and the corresponding threshold range, the network node is determined to be an abnormal node. When it is determined that the network node does not have traffic anomaly based on the traffic prediction value of the network node and the corresponding threshold range, the network node is determined to be a normal network node, and the node traffic data of the network node continues to be collected to continue traffic anomaly monitoring.

[0125] Among them, if the traffic prediction value of the network node is any one of the predicted traffic data size, predicted traffic change frequency, and predicted traffic change amplitude, then it is determined whether the traffic prediction value of the network node is within its corresponding threshold range. If it is within its corresponding threshold range, it indicates that the traffic change of the network node is normal; if it is not within its corresponding threshold range, it indicates that the traffic prediction value of the network node is abnormal, and the traffic change of the network node may be abnormal, and the network node is determined to be an abnormal node.

[0126] Among them, when the traffic prediction value of the network node is at least two of the predicted traffic data size, the predicted traffic change frequency, and the predicted traffic change amplitude, it is determined whether each traffic prediction value of the network node is within its corresponding threshold range. When all traffic prediction values ​​of the network node are within its corresponding threshold range, it means that the traffic prediction values ​​of the network node are within the normal range, the traffic change of the network node is normal, and the network node is determined to be an abnormal node. When any traffic prediction value of the network node is not within its corresponding threshold range, it means that the traffic change of the network node may be abnormal, and the network node is determined to be an abnormal node. The traffic changes of the network node are monitored from multiple dimensions. Only when all traffic prediction values ​​are normal can the network node be determined to be normal, thereby improving the accuracy of traffic anomaly monitoring.

[0127] For example, the traffic prediction value of a network node includes the predicted traffic data size, the predicted traffic change frequency, and the predicted traffic change amplitude; the threshold range corresponding to the predicted traffic data size is (minimum threshold 100gb, maximum threshold 200gb), the threshold range corresponding to the predicted traffic change frequency is (minimum frequency threshold is less than 100 packets per second, maximum frequency threshold is more than 200 packets per second), and the threshold range corresponding to the predicted traffic change amplitude is within the range of ±preset percentage of the preset change amplitude, such as within the range of ±10% of the average traffic change amplitude of the network node on the previous day.

[0128] In this embodiment, the traffic prediction value of the network node includes the predicted traffic data size, the predicted traffic change frequency, and the predicted traffic change amplitude. The corresponding threshold range of each traffic prediction value is only for illustrative purposes. In other embodiments, the traffic prediction value of the network node may also include other traffic change values, and the corresponding threshold range of each traffic prediction value may also be other values, which are specifically calibrated according to the traffic conditions of each network node in the target network system over time.

[0129] In this embodiment, based on the node flow data of each network node, an abnormal prediction model is used to predict the flow change of each network node to obtain the flow prediction value of each network node, and then the flow abnormality judgment is performed based on the flow prediction value of each network node. When it is determined that the network node has a flow abnormality based on the flow prediction value of the network node and the corresponding threshold range, the network node is determined to be an abnormal node. Based on the latest node flow data, a support vector machine model is used to predict the flow change of each network node, which can more accurately predict the flow change of the network node, and then perform a threshold range judgment, which can accurately identify the network nodes with flow abnormalities, with high accuracy.

[0130] In one embodiment, step S22, i.e., based on the node traffic data of the abnormal node, an abnormal classification model is used to classify the abnormal degree of the traffic of the abnormal node to obtain the abnormal level of the abnormal node, which specifically includes the following steps:

[0131] S221: Determine an abnormality classification model corresponding to the abnormality type of the abnormal node as a target classification model.

[0132] In this embodiment, since different types of traffic anomalies may exist in network nodes, for example, the anomaly type may be an abnormal traffic data size, an abnormal traffic change frequency, an abnormal traffic change amplitude, etc., it is necessary to train different isolated deep forest models based on historical node traffic data of different anomaly types.

[0133] In the process of real-time traffic anomaly monitoring of each network node, the type of traffic anomaly (ie, anomaly type) may be determined based on the traffic anomaly of the node traffic data of the abnormal node, that is, the abnormal node information may also include the anomaly type.

[0134] After obtaining the abnormal node information, determine the abnormal classification model corresponding to the abnormal type of the abnormal node as the target classification model. The target classification model is an isolated deep forest model trained based on the historical node traffic data of the corresponding abnormal type. In other embodiments, the same abnormal classification model can also be used to classify abnormal nodes of all types, reducing the processing volume required for model training and the load required for model loading.

[0135] For example, the anomaly type can be any one of the following: abnormal flow data size, abnormal flow change frequency, and abnormal flow change amplitude. The corresponding anomaly classification models are flow size anomaly classification model, flow frequency anomaly classification model, and flow amplitude anomaly classification model. The flow size anomaly classification model is an isolated deep forest model trained based on the historical node flow data of abnormal flow data size; the flow frequency anomaly classification model is an isolated deep forest model trained based on the historical node flow data of abnormal flow change frequency; the flow amplitude anomaly classification model is an isolated deep forest model trained based on the historical node flow data of abnormal flow change amplitude.

[0136] When the abnormal type of the abnormal node is abnormal flow change frequency, the abnormal flow frequency classification model is used as the target classification model. When the abnormal type of the abnormal node is abnormal flow data size, the abnormal flow size classification model is used as the target classification model. When the abnormal type of the abnormal node is abnormal flow change amplitude, the abnormal flow amplitude classification model is used as the target classification model.

[0137] S222: Based on the node flow data of the abnormal node, the node flow data is processed respectively through multiple isolated trees in the target hierarchical model to obtain the average path length of the node flow data of the abnormal node in all isolated trees in the target hierarchical model.

[0138] After obtaining the target hierarchical model, based on the node flow data of the abnormal node, the node flow data is processed through multiple isolated trees in the target hierarchical model to obtain the average path length of the corresponding node flow data in all isolated trees in the target hierarchical model. The average path length is used to indicate the difficulty of the corresponding node flow data being attacked or the possibility of failure, so as to clearly point out the severity and complexity of the network attack (or failure).

[0139] The node flow data of the abnormal node is input into the root node of each isolated tree in the target hierarchical model, and the node flow data is processed by multiple isolated trees in the target hierarchical model to obtain the path length of the node flow data of the abnormal node in each isolated tree; wherein, the path length of the node flow data in each isolated tree is the number of edges passed by the child node (leaf node) from the root node of the isolated tree to the time when the node flow data is finally isolated, which represents the similarity between the node flow data of the abnormal node and the sample data. Then, the path lengths of the node flow data of the abnormal node in all isolated trees are added and divided by the total number of isolated trees in the target hierarchical model to obtain the average path length of the corresponding node flow data in all isolated trees in the target hierarchical model. wherein, the average path length is used to indicate the difficulty of the corresponding node flow data being attacked or the possibility of failure. The smaller the average path length, the higher the abnormality of the node flow data of the abnormal node; the larger the average path length, the lower the abnormality of the node flow data of the abnormal node, and it may even be normal data.

[0140] S223: Determine the abnormality level of the abnormal node according to the average path length.

[0141] After obtaining the average path length of the node flow data of the abnormal node in all isolated trees in the target hierarchical model, the abnormal score of the node flow data of the abnormal node is determined according to the average path length, and the abnormal level of the abnormal node is determined according to the abnormal score and a preset score threshold.

[0142] Specifically, it is necessary to determine the expected path length of the target hierarchical model, which is the average path length of all isolated trees in the target hierarchical model. The expected path length can be the average value of the complete path length of all isolated trees in the target hierarchical model (that is, the number of edges from the root node to all child nodes), or it can be calculated using the Euler constant. Then, based on the expected path length of the target hierarchical model, the average path length corresponding to the node flow data of the abnormal node is normalized to obtain the abnormal score of the abnormal node. Among them, the abnormal score of the abnormal node represents the overlap rate of its node flow data with the training sample data (that is, the abnormal node flow data). The node abnormality level is judged by the overlap rate with the abnormal flow data, which is more accurate.

[0143] The anomaly score of the abnormal node is calculated by the following formula:

[0144]

[0145] c(n)=2H(n-1)-(2(n-1) / n);

[0146] H(k)=ln(k)+ξ;

[0147] Wherein, s(x,n) represents the abnormal score of the abnormal node, x represents the node flow data of the abnormal node, and n represents the total number of isolated trees in the target hierarchical model; h(x) represents the path length of the node flow data of the abnormal node in each isolated tree; E(h(x)) represents the average path length of the node flow data of the abnormal node in all isolated trees in the target hierarchical model; c(n) represents the expected path length of the target hierarchical model, that is, the average path length of all isolated trees in the target hierarchical model; It means that the average path length corresponding to the node flow data of the abnormal node is normalized; H(k) represents the expected path length of the isolated tree k, that is, it can be the complete path length of all isolated trees in the target hierarchical model, k∈n; ξ represents the Euler constant, whose value is 0.5772156649.

[0148] After obtaining the abnormal score of the node traffic data of the abnormal node, it is necessary to determine the abnormal level of the abnormal node according to the abnormal score and the preset score threshold. Different score thresholds can be set for different abnormal levels, and the abnormal level of the abnormal node can be determined according to the abnormal score and different score thresholds, which is more accurate.

[0149] For example, when the abnormal score of the abnormal node is greater than or equal to the first score threshold (such as 60%) and less than or equal to the second score threshold (such as 80%), it indicates that the node traffic data of the abnormal node is (suspected) abnormal data, and its abnormal level is a first-level abnormality; when the abnormal score is greater than the second score threshold and less than the third score threshold (which can be a value of 95%-100%), it indicates that the node traffic data of the abnormal node is (dangerous) abnormal data, and its abnormal level is a second-level abnormality; when the abnormal score is greater than or equal to the third score threshold (such as 98%, 99%, 100%), it indicates that the node traffic data of the abnormal node is (serious) abnormal data, and its abnormal level is a second-level abnormality.

[0150] In this embodiment, each score threshold is only for illustrative purposes. In other embodiments, each score threshold may also be other values. The abnormality levels including level one abnormality, level two abnormality and level three abnormality are only for illustrative purposes. In other embodiments, the abnormality levels may also be divided in other ways, which will not be elaborated here.

[0151] In addition, when determining the abnormal level of an abnormal node based on the average path length, if the abnormal score of the node traffic data determined based on the average path length is less than a preset value (such as 60%, 50%), it means that the abnormal node may be a network node with normal traffic, and the abnormal score of the abnormal node needs to be recorded as abnormal node information for subsequent analysis and investigation. If the abnormal score is less than the preset value, the abnormal node can also be directly removed and marked as a normal network node without abnormal node display and warning.

[0152] In this embodiment, the abnormal classification model corresponding to the abnormal type of the abnormal node is determined as the target classification model, and then based on the node flow data of the abnormal node, the node flow data is processed respectively through multiple isolated trees in the target classification model to obtain the average path length of the node flow data of the abnormal node in all isolated trees in the target classification model; finally, the abnormal level of the abnormal node is determined according to the average path length. This process refines the abnormal level determination process of the abnormal node, determines the abnormal level based on the average path length of the abnormal node through the isolation forest algorithm, improves the accuracy of abnormal classification, and also provides in-depth analysis and classification of node flow abnormalities, making the abnormal monitoring results more hierarchical and operational.

[0153] In one embodiment, the abnormal node information includes abnormal nodes, abnormal levels of abnormal nodes, and node traffic data. Figure 6 As shown, in step S30, based on the abnormal node information, the multi-node network model is controlled to perform traffic abnormality warning and display abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios, and the network vulnerabilities of the virtual protection platform are opened, which specifically includes the following steps:

[0154] S31: locating abnormal nodes in the multi-node network model, displaying the abnormal nodes in the multi-node network model according to the abnormality level, and issuing traffic abnormality warnings based on the abnormality level.

[0155] In this embodiment, the abnormal node information includes abnormal nodes, abnormal levels of abnormal nodes, and node traffic data. After obtaining the abnormal node information, the node traffic monitoring device locates the abnormal node in the multi-node network model. Since the virtual network nodes in the multi-node network model correspond one-to-one to the network nodes in the target network, the abnormal node can be quickly located in the multi-node network model, and then the abnormal node is displayed in the multi-node network model according to the abnormal level, and the traffic abnormality warning is performed based on the abnormal level. Among them, different abnormal levels have different ways of displaying abnormal nodes in the multi-node network model, and different ways of performing traffic abnormality warning. The abnormal level is used to characterize the possibility of failure of a network node or the difficulty of being attacked by the network. The higher the abnormal level, the higher the possibility of failure or the lower the difficulty of being attacked by the network.

[0156] For example, abnormal nodes can be displayed in a multi-node network model in a highlighted flashing manner. As the abnormal level increases, the darker the color of the highlighted flashing of the abnormal nodes in the multi-node network model, the faster the frequency of the highlighted flashing; such as the abnormal level can be a first-level abnormality, a second-level abnormality, and a third-level abnormality that increase in order. At the first-level abnormality, the darker the color of the highlighted flashing of the abnormal nodes in the multi-node network model, the darker the color is, the yellow, orange, and red, respectively. The highlighted flashing of the abnormal nodes in the multi-node network model is low-frequency flashing, medium-frequency flashing, and high-frequency flashing. While displaying the abnormal nodes in a highlighted flashing manner in the multi-node network model, flow warnings can also be performed by means of sound reminders (such as buzzers). As the abnormal level increases, the frequency and volume of the sound reminders increase abnormally. In other embodiments, flow abnormality warnings can be performed by at least one method such as broadcasting, email, text messages, and telephone calls. As the abnormal level increases, the method and frequency of flow abnormality warnings increase.

[0157] S32: Based on the node traffic data of abnormal nodes, control the multi-node network model to simulate the real traffic scenario and open the network vulnerabilities of the virtual protection platform.

[0158] At the same time, the node traffic monitoring device uses the time when the traffic anomaly is detected as the time anchor point, and based on the node traffic data of the abnormal node (and the node traffic data of other network nodes), controls the multi-node network model to simulate a single-node (or multi-node) real traffic scenario, and opens the network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model, thereby ensuring the security of the target network system.

[0159] In this embodiment, by locating abnormal nodes in a multi-node network model, displaying abnormal nodes in the multi-node network model according to the abnormality level, and performing traffic anomaly warning based on the abnormality level, different abnormal node displays and warnings can be performed according to different abnormality levels to improve the warning effect; at the same time, based on the node traffic data of the abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios, and the network vulnerabilities of the virtual protection platform are opened, so as to ensure the security of the target network system.

[0160] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0161] In one embodiment, a server is provided, wherein the node traffic monitoring device corresponds to the node traffic monitoring method in the above embodiment. Figure 7 As shown, the node traffic monitoring device includes an acquisition module 701, a monitoring module 702 and a control module 703. Each functional module is described in detail as follows:

[0162] An acquisition module 701 is used to acquire a system simulation model for simulating the real operating environment of the target network system, wherein the system simulation model includes a multi-node network model simulating the node network topology of the target network system and a virtual protection platform of the multi-node network model, wherein the virtual protection platform is used to simulate and map the real security protection environment in the target network system;

[0163] The monitoring module 702 is used to perform real-time traffic anomaly monitoring on each network node based on the node traffic data of each network node in the target network system, and obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic;

[0164] The control module 703 is used to control the multi-node network model to issue traffic anomaly warnings and display abnormal nodes based on abnormal node information, control the multi-node network model to simulate real traffic scenarios, and open network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model.

[0165] Optionally, the abnormal node information further includes an abnormal level of the abnormal node. Based on the abnormal node information, the control module 703 is specifically configured to:

[0166] Locate abnormal nodes in a multi-node network model, display abnormal nodes in the multi-node network model according to the abnormality level, and issue traffic abnormality warnings based on the abnormality level;

[0167] Based on the node traffic data of abnormal nodes, the multi-node network model is controlled to simulate real traffic scenarios and open the network vulnerabilities of the virtual protection platform.

[0168] Optionally, the abnormal node information also includes the abnormal level of the abnormal node, the node monitoring model includes an abnormal prediction model and an abnormal classification model, and the monitoring module 702 is specifically used for:

[0169] Based on the node traffic data of each network node, an abnormal prediction model is used to predict the real-time traffic anomaly of each network node and determine the abnormal nodes with abnormal traffic. The abnormal prediction model is a support vector machine model trained based on the historical node traffic data of the target network system.

[0170] Based on the node traffic data of the abnormal node, an abnormal classification model is used to classify the abnormal degree of the traffic of the abnormal node to obtain the abnormal level of the abnormal node.

[0171] Optionally, after obtaining the system simulation model for simulating the real operating environment of the target network system, the control module 703 is further used to:

[0172] After acquiring the node flow data of each network node in the target network system, generating a playback time anchor point of the node flow data of each network node according to the data packet timestamp in the node flow data of each network node, and storing the node flow data and the playback time anchor point of each network node;

[0173] When a node traffic playback instruction is received, the real traffic scenario of the target network system is simulated through a multi-node network model based on the node traffic data and playback time anchor point of each network node.

[0174] Optionally, after performing real-time traffic anomaly monitoring on each network node and obtaining abnormal node information, the control module 703 is further used to:

[0175] The abnormal node in the abnormal node information is used as the node anchor point of the traffic anomaly, and the time when the abnormal node is detected is used as the time anchor point of the traffic anomaly;

[0176] The node anchor points and corresponding time anchor points of traffic anomalies, as well as the corresponding node traffic data are stored for subsequent retrieval.

[0177] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0178] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0179] The present application also provides an electronic device, such as Figure 8As shown, the electronic device 2 includes: at least one processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on at least one processor 20. When the processor 20 executes the computer program 22, the steps in any of the above-mentioned method embodiments are implemented, or when the processor 20 executes the computer program 22, the functions of each module / unit in the above-mentioned device embodiments are implemented.

[0180] Exemplarily, the computer program 22 may be divided into one or more modules / units, one or more modules / units are stored in the memory 21, and are executed by the processor 20 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program 22 in the electronic device 2.

[0181] Those skilled in the art will understand that Figure 8 These are merely examples of electronic devices and do not constitute a limitation of the electronic device. The electronic device may include more or fewer components than those shown in the figure, or a combination of certain components, or different components. For example, the electronic device may also include input and output devices, network access devices, buses, etc.

[0182] The processor may be a central processing unit, or other general-purpose processors, digital signal processors, application-specific integrated circuits, field programmable gate arrays or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0183] The memory may be an internal storage unit of an electronic device, such as a hard disk or memory of the electronic device. The memory may also be an external storage device of the electronic device, such as a plug-in hard disk, a smart memory card, a secure digital card, a flash memory card, etc. equipped on the electronic device. Furthermore, the memory may also include both an internal storage unit of the electronic device and an external storage device.

[0184] An embodiment of the present application further provides a readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0185] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0186] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, which can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory, random access memory, electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0187] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0188] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0189] In the embodiments provided in the present application, it should be understood that the disclosed devices / equipment and methods can be implemented in other ways. For example, the device / equipment embodiments described above are merely schematic, for example, the division of the modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0190] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0191] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A node traffic monitoring method, characterized in that: include: Acquire a system simulation model for simulating the real operating environment of the target network system, the system simulation model comprising a multi-node network model simulating the node network topology of the target network system and a virtual protection platform of the multi-node network model, the virtual protection platform being used to simulate and map the real security protection environment in the target network system; Based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic; Based on the abnormal node information, the multi-node network model is controlled to issue a traffic anomaly warning and display the abnormal node, the multi-node network model is controlled to simulate a real traffic scenario, and the network vulnerabilities of the virtual protection platform are opened to guide the network attack against the target network system to the multi-node network model.

2. The node traffic monitoring method according to claim 1, characterized in that: The abnormal node information also includes the abnormal level of the abnormal node. Based on the abnormal node information, controlling the multi-node network model to perform traffic abnormality warning and display the abnormal node, controlling the multi-node network model to simulate a real traffic scenario, and opening the network vulnerability of the virtual protection platform includes: Locating the abnormal node in the multi-node network model, displaying the abnormal node in the multi-node network model according to the abnormal level, and performing traffic abnormality warning based on the abnormal level; Based on the node traffic data of the abnormal node, the multi-node network model is controlled to simulate a real traffic scenario, and the network vulnerabilities of the virtual protection platform are opened.

3. The node traffic monitoring method according to claim 1, characterized in that: The abnormal node information also includes the abnormal level of the abnormal node. Based on the node traffic data of each network node in the target network system, real-time traffic anomaly monitoring is performed on each network node to obtain the abnormal node information, including: Based on the node traffic data of each of the network nodes, an abnormality prediction model is used to perform real-time traffic anomaly prediction on each of the network nodes to determine the abnormal nodes with abnormal traffic, wherein the abnormality prediction model is a support vector machine model trained based on the historical node traffic data of the target network system; Based on the node traffic data corresponding to the abnormal node, an abnormality classification model is used to classify the degree of traffic abnormality of the abnormal node to obtain the abnormal level of the abnormal node. The abnormality classification model is an isolation forest model trained based on the abnormal historical node traffic data in the target network system.

4. The node traffic monitoring method according to claim 3, characterized in that: The method of using an abnormality prediction model to perform real-time traffic anomaly prediction on each network node based on the node traffic data of each network node, and determining the abnormal node with abnormal traffic, comprises: Based on the node flow data of each of the network nodes, the abnormal prediction model is used to predict the flow change of each of the network nodes to obtain a flow prediction value of each of the network nodes, wherein the flow prediction value includes at least one of the predicted flow data size, the predicted flow change frequency, and the predicted flow change amplitude; Traffic anomaly judgment is performed based on the traffic prediction value of each network node. When it is determined that traffic anomaly exists in the network node based on the traffic prediction value of the network node and the corresponding threshold range, the network node is determined to be the abnormal node.

5. The node traffic monitoring method according to claim 3, characterized in that: The step of grading the abnormal degree of the traffic of the abnormal node by using an abnormal grading model based on the node traffic data corresponding to the abnormal node to obtain the abnormal level of the abnormal node includes: Determine the abnormal classification model corresponding to the abnormal type of the abnormal node as a target classification model, wherein the target classification model is an isolated deep forest model trained based on the historical node traffic data corresponding to the abnormal type; Based on the node flow data corresponding to the abnormal node, the node flow data is processed respectively through a plurality of isolated trees in the target hierarchical model to obtain an average path length of the corresponding node flow data in all the isolated trees, wherein the average path length is used to indicate the difficulty of the corresponding node flow data being attacked; The abnormality level of the abnormal node is determined according to the average path length.

6. The node traffic monitoring method according to any one of claims 1 to 5, characterized in that: After obtaining the system simulation model for simulating the real operating environment of the target network system, the method further includes: After acquiring the node flow data of each network node in the target network system, generating a playback time anchor point of the node flow data of each network node according to the data packet timestamp in the node flow data of each network node, and storing the node flow data of each network node and the playback time anchor point; When a node traffic playback instruction is received, the real traffic scenario of the target network system is simulated through the multi-node network model based on the node traffic data of each of the network nodes and the playback time anchor point.

7. The node traffic monitoring method according to any one of claims 1 to 5, characterized in that: After performing real-time traffic anomaly monitoring on each of the network nodes to obtain abnormal node information, the method further includes: The abnormal node in the abnormal node information is used as a node anchor point of the traffic anomaly, and the time when the abnormal node is monitored is used as a time anchor point of the traffic anomaly; The node anchor point of the traffic anomaly and the corresponding time anchor point, as well as the corresponding node traffic data are stored for subsequent retrieval.

8. A node traffic monitoring system, characterized in that: A node flow monitoring device is included, and the node flow monitoring device includes: An acquisition module, used to acquire a system simulation model for simulating the real operating environment of the target network system, wherein the system simulation model includes a multi-node network model simulating the node network topology of the target network system and a virtual protection platform of the multi-node network model, wherein the virtual protection platform is used to simulate and map the real security protection environment in the target network system; A monitoring module, configured to perform real-time traffic anomaly monitoring on each network node based on the node traffic data of each network node in the target network system, and obtain abnormal node information, wherein the abnormal node information includes abnormal nodes with abnormal traffic; A control module is used to control the multi-node network model to issue traffic anomaly warnings and display the abnormal nodes based on the abnormal node information, and to control the multi-node network model to simulate real traffic scenarios and open network vulnerabilities of the virtual protection platform to guide network attacks against the target network system to the multi-node network model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the node traffic monitoring method as described in any one of claims 1 to 7 are implemented.

10. A readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the node traffic monitoring method as described in any one of claims 1 to 7 are implemented.

Images