Application detection method and device, equipment and cluster

Abstract

The invention discloses an application detection method and device, equipment and a cluster, and relates to the technical field of computers. In the method, at least one target type of data packet in a plurality of data packets related to an application can be determined according to the lengths of the plurality of data packets related to the application, and the at least one target type is the type of the data packet related to the abnormal application. Equivalently, the data packets related to the abnormal application in the plurality of data packets related to the application are determined, so that whether the application is the abnormal application or not is determined according to the distribution characteristics of the data packets of at least one target type in the plurality of data packets. When the abnormal application is detected, contents in a plurality of data packets related to the application do not need to be determined, so that whether the application is the abnormal application or not can be accurately judged no matter whether encryption communication is adopted between the computing equipment and the server side of the application or not, and therefore, the abnormal application installed on the computing equipment can be accurately detected by the method, and the user experience is improved. And the operation safety and performance of the computing equipment are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an application detection method, device, equipment and cluster. Background Art

[0002] Currently, some abnormal applications, such as mining applications and hacker applications, are installed on the computing devices of the cloud service system without the permission of the cloud service tenants. Once these applications are installed on the computing devices, they will occupy the computing resources and network resources of the computing devices and turn the cloud computing devices into puppet machines, which seriously affects the operating security and performance of the computing devices.

[0003] In the related art, when a computing device runs an application, the communication content between the computing device and the application's server is detected to determine whether the application is an abnormal application. However, since the communication content of encrypted communication cannot be detected at present, this method cannot accurately detect abnormal applications on computing devices. Summary of the invention

[0004] The present application provides an application detection method, apparatus, device and cluster, which can accurately detect abnormal applications on a computing device, thereby helping to improve the operational security and performance of the computing device.

[0005] In a first aspect, an application detection method is provided, the method being used to detect whether an application (such as a first application) on a computing device is an abnormal application (i.e., an abnormal application). A first application is installed on the computing device, the computing device establishes a first communication channel with a server of the first application, and the computing device sequentially transmits multiple data packets with the server of the first application based on the first communication channel. The method comprises: obtaining the lengths of multiple data packets; determining at least one target type of data packet among multiple data packets based on the lengths of multiple data packets and the length range of data packets corresponding to at least one target type; at least one target type is a type of data packet related to an abnormal application; and determining that the first application is an abnormal application based on the distribution characteristics of data packets of at least one target type among multiple data packets.

[0006] Optionally, when detecting whether an application on a computing device is an abnormal application, the application detection method provided in the present application can be executed by a computing device in a cloud service system, or can also be executed by a network detection and response (NDR) device in the cloud service system.

[0007] Optionally, the computing device may directly establish the first communication channel with the server of the first application, or the computing device may establish the communication channel with the server of the first application through a proxy server.

[0008] Optionally, the data packet related to the abnormal application refers to a data packet transmitted between a client of the abnormal application and a server of the abnormal application.

[0009] Optionally, the abnormal application may be a mining application, and the data packets related to the mining application are data packets transmitted between the client of the mining application and the server of the mining application, and the types of data packets related to the mining application include one or more of the following: task allocation, task submission, and task feedback. In this way, the mining application of the computing device can be detected through the solution of the present application.

[0010] Since the types of data packets related to abnormal applications and the distribution characteristics of different types of data packets are regular, based on this, the application detection method provided by the present application determines at least one target type of data packet existing in multiple data packets related to the first application, that is, the existing data packet related to the abnormal application, according to the length range of data packets corresponding to at least one target type of the lengths of multiple data packets related to the first application, thereby determining whether the first application is an abnormal application based on whether the distribution characteristics of at least one target type of data packet in the multiple data packets meet the distribution characteristics of different types of data packets in the data packets related to the abnormal application.

[0011] Since in the process of detecting abnormal applications, the type of data packet is determined according to the length of the data packet related to the first application, and whether the first application is an abnormal application is determined according to the distribution characteristics of the data packet of at least one target type, it is not necessary to determine the contents of multiple data packets. Therefore, regardless of whether the computing device and the server of the first application communicate in an encrypted manner, it is possible to accurately determine whether the first application is an abnormal application. In this way, the application detection method provided in the present application can accurately detect abnormal applications installed on the computing device, which helps to improve the operating security and performance of the computing device.

[0012] In addition, in the process of detecting abnormal applications, the IP address of the server of the abnormal application is not relied on, and the number of IP addresses of the server of the abnormal application is huge and constantly changing, and the collection difficulty is relatively high. Therefore, compared with the method of detecting the IP address of the server of the abnormal application, the difficulty of detecting abnormal applications is also reduced. In addition, since it does not rely on the IP address of the server of the abnormal application, even if there is an intermediate agent (i.e., a proxy server) between the computing device and the server of the first application, it does not affect the accuracy of the detection result. Therefore, compared with the method of detecting the IP address of the server of the abnormal application, the accuracy of the detection is improved.

[0013] In a possible implementation, at least one target type of data packet among multiple data packets is determined based on the lengths of multiple data packets and the length range of data packets corresponding to at least one target type, including: determining the initial type of each data packet among multiple data packets based on the lengths of multiple data packets and the length range of data packets corresponding to at least one target type; the initial type is the target type or the non-target type; determining the length of data packets corresponding to at least one target type based on the lengths of some data packets among multiple data packets; the initial type of some data packets is the target type; determining at least one target type of data packet among multiple data packets based on the lengths of multiple data packets and the lengths of data packets corresponding to at least one target type. In this way, it is helpful to improve the accuracy of the length of the data packet corresponding to at least one target type, and further helps to improve the accuracy of the determined data packet of at least one target type.

[0014] In another possible implementation, at least one target type includes M different types; determining the length of a data packet corresponding to at least one target type according to the length of some data packets among the multiple data packets includes: determining the length of a data packet corresponding to at least one target type according to the length of M data packets among the multiple data packets; the initial types of the M data packets are M different types, and the order of the M data packets meets a preset rule. In this way, it is helpful to improve the accuracy of the length of the data packet corresponding to the at least one target type determined.

[0015] In another possible implementation, the method further includes: determining a target substring from a string sequence corresponding to the initial types of the multiple data packets; wherein a character in the string sequence is used to indicate the initial type of a data packet, the target substring includes M different characters, the M different characters indicate the initial types of the M data packets, and the order of the M different characters meets a preset rule. This helps to improve the significance of comparing the initial types of different data packets, thereby improving the convenience of determining the M data packets.

[0016] In another possible implementation, the character string sequence includes a target character, the target character is used to indicate a non-target type, and the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the character string sequence. This helps to ensure the accuracy of the length of the data packet corresponding to the at least one target type determined.

[0017] In another possible implementation, determining the first application as an abnormal application based on the distribution characteristics of at least one target type of data packets among the multiple data packets includes: if the distribution characteristics of at least one target type of data packets meet a preset characteristic, determining the first application as an abnormal application; the preset characteristic includes the distribution characteristics of different types of data packets in the data packets related to the abnormal application. In this way, it helps to ensure the accuracy of determining the first application as an abnormal application.

[0018] In another possible implementation, at least one target type includes M different types; the preset features include: at least one target type of data packet includes M consecutive data packets, the order of the M consecutive data packets meets the preset rule, and the target types of the M consecutive data packets are M different types. This helps to improve the screening accuracy of abnormal applications, thereby reducing the probability of the first application being falsely reported as an abnormal application.

[0019] In another possible implementation, the preset features include: at least one target type of data packet includes M data packets, and the number of non-target type data packets between two adjacent data packets in the M data packets is less than or equal to the number threshold; the order of the M data packets meets the preset rules, and the target types of the M data packets are M different types. This helps to expand the coverage of abnormal applications, thereby helping to avoid missing abnormal applications of computing devices.

[0020] Optionally, 1≤quantity threshold≤40.

[0021] In another possible implementation, the preset feature includes: the proportion of data packets of at least one target type in the multiple data packets is greater than or equal to the proportion threshold. This helps to avoid the normal application being mistaken for an abnormal application when there are a small number of data packets in the data packets related to the normal application, and the length of the small number of data packets is the same as the length of the data packets corresponding to the at least one target type, thereby helping to reduce the false alarm rate of abnormal applications.

[0022] Optionally, 60%≤proportion threshold≤100%.

[0023] In another possible implementation, the computing device establishes multiple second communication channels with multiple devices, and the multiple devices include the server of the first application; the method also includes: determining the first communication channel from the multiple second communication channels; the first communication channel is a long connection, and / or the rate of the first communication channel is less than or equal to the rate threshold, and the rate of the first communication channel refers to the rate at which the computing device and the server of the first application transmit data packets based on the first communication channel. In this way, it is helpful to filter out the communication channels related to normal applications in the multiple second communication channels, and retain the communication channels related to the multiple second communication channels suspected of abnormal applications, which in turn helps to reduce the performance pressure of subsequent detection and avoid excessive occupation of computing device resources.

[0024] Optionally, the first communication channel is a communication channel established based on a connection request sent by the computing device. This helps to reduce the performance pressure of subsequent detection and avoids excessive occupation of computing device resources.

[0025] In another possible implementation, the method further includes: outputting prompt information, the prompt information being used to indicate that the first application is an abnormal application. This helps the cloud service tenant to promptly handle abnormal applications on the computing device, and prevents the abnormal applications from affecting the operation of applications installed on the computing device by the cloud service tenant.

[0026] Optionally, the prompt information includes at least one of an identifier of the first application, an identifier of the first communication channel, an IP address of the server of the first application, and an identifier of the first computing device. This helps the cloud service tenant to accurately locate the location of the abnormal application, and then quickly handle the abnormal application on the computing device.

[0027] In another possible implementation, a second application is also installed on the computing device; the method further includes: if the Internet Protocol IP address of the server of the second application is the same as the IP address of the server device of the first application, determining that the second application is an abnormal application. This helps to more accurately screen out abnormal applications on the computing device, thereby helping to improve the operating security and performance of the computing device.

[0028] In a second aspect, an application detection device is provided, the device comprising: a functional unit for executing any one of the methods provided in the first aspect, the actions performed by each functional unit are implemented by hardware or by hardware executing corresponding software. For example, the application detection device may include an acquisition module, a classification module and a judgment module; the acquisition module is used to obtain the length of multiple data packets; the classification module is used to determine at least one target type of data packet among multiple data packets based on the length of multiple data packets and the length range of data packets corresponding to at least one target type; at least one target type includes a type of data packet related to abnormal applications; the judgment module is used to determine that the first application is an abnormal application based on the distribution characteristics of data packets of at least one target type among multiple data packets.

[0029] According to a third aspect, a processor is provided, which is used to execute any one of the methods provided in the first aspect to detect whether an application running on a computing device is an abnormal application.

[0030] In a fourth aspect, a chip is provided, comprising: a processor and a power supply circuit; the power supply circuit is used to supply power to the chip; the processor is used to execute any one of the methods provided in the first aspect to detect whether an application running on a computing device is an abnormal application.

[0031] In a fifth aspect, a computing device is provided, comprising a memory and a processor, wherein the processor and the memory are connected; instructions are stored in the memory, and the processor executes the instructions stored in the memory, so that the computing device executes any one of the methods provided in the first aspect to detect whether an application running on the computing device is an abnormal application.

[0032] In a sixth aspect, a computing device cluster is provided, the computing device cluster comprising at least one computing device, each computing device in the at least one computing device comprising a processor and a memory; the processor of each computing device executes instructions stored in the memory of each computing device, so that each computing device executes any one of the methods provided in the first aspect to detect whether the application running on each computing device is an abnormal application.

[0033] In the seventh aspect, an NDR device is provided, the NDR device includes a memory and a processor, the processor and the memory are connected; instructions are stored in the memory, and the processor executes the instructions stored in the memory, so that the NDR device executes any one of the methods provided in the first aspect to detect whether the application running on each computing device in the computing device cluster is an abnormal application.

[0034] In an eighth aspect, a computing device cluster is provided, the computing device cluster comprising an NDR device, a physical switch and at least one computing device, the NDR device is connected to the physical switch, and the physical switch is connected to each computing device in the at least one computing device; the NDR device comprises a memory and a processor, and the processor is connected to the memory; instructions are stored in the memory, and the processor executes the instructions stored in the memory so that the NDR device executes any one of the methods provided in the first aspect to detect whether the application running on each computing device in the at least one computing device is an abnormal application.

[0035] In the ninth aspect, a computer-readable storage medium and a computer program instruction are provided. When the computer program instruction is executed by a computing device or an NDR device, the computing device or the NDR device executes any one of the methods provided in the first aspect to detect whether the application program running on the computing device is an abnormal application.

[0036] In the tenth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device or an NDR device, the computing device or the NDR device executes any one of the methods provided in the first aspect to detect whether the application running on the computing device is an abnormal application.

[0037] Among them, the technical effects brought about by any design method in the second aspect to the tenth aspect can refer to the technical effects brought about by different design methods in the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of the structure of a cloud service system provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of the structure of another cloud service system provided in an embodiment of the present application;

[0040] Figure 3 A schematic diagram of interaction between a computing device and an application server provided in an embodiment of the present application;

[0041] Figure 4 A flowchart of an application detection method provided in an embodiment of the present application;

[0042] Figure 5 A schematic diagram of the interaction between a client and a server of a mining application provided in an embodiment of the present application;

[0043] Figure 6 A schematic diagram of initial types of multiple data packets provided in an embodiment of the present application;

[0044] Figure 7 A schematic diagram of a sliding window provided in an embodiment of the present application;

[0045] Figure 8 A schematic diagram of an application detection device provided in an embodiment of the present application;

[0046] Fig. 9 A detection flow chart of an application detection device provided in an embodiment of the present application;

[0047] Fig.10 A schematic diagram of a computing device provided in an embodiment of the present application;

[0048] Fig.11 A schematic diagram of a computing device cluster provided in an embodiment of the present application;

[0049] Fig.12 A schematic diagram of an NDR device provided in an embodiment of the present application;

[0050] Fig.13 A schematic diagram of another computing device cluster provided in an embodiment of the present application;

[0051] Fig.14 A connection diagram of a computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0053] In the description of the embodiments of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the present application is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural.

[0054] Furthermore, in the description of the embodiments of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0055] In addition, in order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, the words "first", "second", etc. are used to distinguish the same items or similar items with substantially the same functions and effects. Those skilled in the art can understand that the words "first", "second", etc. do not limit the quantity and execution order, and the words "first", "second", etc. do not necessarily limit the difference.

[0056] Meanwhile, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for ease of understanding.

[0057] The following is an introduction to the relevant terms involved in the embodiments of the present application.

[0058] Application Program: Abbreviated as APP, it refers to a computer program developed and run on an operating system in order to complete one or several specific tasks.

[0059] Application software: referred to as software, refers to a collection of applications and related documents or other dependencies of the application.

[0060] Mining software: also known as mining applications, is an application for computing devices that provides computing power for the operation of the blockchain network and generates new digital currency by solving complex mathematical problems. Among them, the computing device running the mining application can be called a miner or a mining machine. For example, within a preset time, multiple miners calculate an arithmetic problem together. The miner who calculates the answer first is equivalent to mining a block, and the miner who calculates the answer first can get the newly generated digital currency as a reward.

[0061] Mining Pool: refers to a device that combines the computing power of multiple miners (i.e. computing devices) and jointly operates the combined computing power. The mining pool can assign mining tasks to each miner, and each miner submits the mining results to the mining pool after completing the mining task. After the computing power of multiple miners jointly mines a block, the mining pool can distribute the newly generated digital currency to each miner based on the proportion of each miner's computing power.

[0062] Client: refers to a computing device that initiates a request to a server through client software or an application such as a browser. The request is used to request data or services, etc. The client can also be called the client of an application / software.

[0063] Server: refers to a computing device that provides services to client software or applications such as browsers. The server receives requests from clients, processes the requests and returns corresponding data or services. The server can also be called the server of the application / software.

[0064] In the embodiment of the present application, the client refers to a computing device (such as a cloud server, etc.) that runs abnormal applications such as mining applications and hacker applications, and the server refers to a device (such as a mining pool, etc.) that provides services (such as allocating mining tasks, virtual currency, hacker tasks, etc.) for abnormal applications.

[0065] It should be noted that when the application client communicates with the application server, the application client sends a connection request to the application server to request to establish a communication channel. After the communication channel is successfully established, data can be transmitted between the application client and the application server.

[0066] It can be understood that the server and the client are relative terms. A computing device can act as both a server and a client.

[0067] Communication channel: refers to the channel established before data transmission between the client and the server. After a data transmission is completed, the client or server can release the channel (i.e. close the communication channel). For example, the client sends a connection request to the server, the server receives the connection request, and then the two parties establish a communication channel. After the communication channel is established, the client sends a message (i.e. data) to the server, and the server returns a response message (i.e. data) to the client, which is considered to be the completion of a data transmission.

[0068] Short communication connection: abbreviated as short connection, refers to the communication channel that is closed after the client and the server complete a data transmission. The operation steps of the short connection are: establish communication channel - data transmission - close communication channel.

[0069] Long communication connection: abbreviated as long connection, refers to a communication channel that will not be closed immediately after the client and the server complete a data transmission, and will continue to use the communication channel for subsequent data transmission. The operation steps of a long connection are: establish a communication channel - data transmission - ... maintain connection (also known as connection keep-alive) ... - data transmission - close the communication channel.

[0070] The following is an exemplary introduction to the application scenarios of the embodiments of the present application.

[0071] With the development of cloud technology, more and more tenants are using cloud service systems to handle their business. When tenants use cloud service systems, some abnormal applications, such as mining applications and hacker applications, are installed on the computing devices of the cloud service system without the permission of the cloud service tenants. Once these abnormal applications are installed on the computing devices, they will occupy the computing resources and network resources of the computing devices and turn the computing devices into puppet machines, which seriously affects the operating security and performance of the computing devices.

[0072] Since multiple data packets are transmitted between the computing device and the server of the first application during the running of the application (such as the first application), the related art proposes a detection method based on this, that is, by detecting whether the content of multiple data packets contains specified content, determining whether the first application is an abnormal application. However, when the server of the first application and the computing device communicate in an encrypted manner, since the current detection technology cannot detect the content of the data packet, the detection method of the related art will determine that the specified content does not exist in the multiple data packets, and thus determine that the application is a normal application. Therefore, the detection method in the related art cannot accurately detect abnormal applications on the computing device.

[0073] In view of this, an embodiment of the present application provides an application detection method, which can determine whether a first application is an abnormal application based on the length of multiple data packets. Since in the process of detecting abnormal applications, only the length of the data packet is used, and the content of the data packet is not needed, therefore, regardless of whether the computing device and the server of the first application communicate in an encrypted manner, it is possible to accurately determine whether the first application is an abnormal application. Based on this, the application detection method provided in the embodiment of the present application can accurately detect abnormal applications installed on the computing device, which helps to improve the operating security and performance of the computing device.

[0074] It should be noted that normal applications refer to applications installed on computing devices with the permission of cloud service tenants, while abnormal applications refer to applications installed on computing devices without the permission of cloud service tenants.

[0075] The following is an exemplary introduction to the system architecture of the embodiments of the present application.

[0076] In one example, the application detection method provided by the embodiment of the present application can be applied to a single computing device to detect whether the application running on the single computing device is an abnormal application.

[0077] In another embodiment, the application detection method provided in the embodiment of the present application may be applied to a computing device cluster to detect whether an application running on a computing device in the computing device cluster is an abnormal application.

[0078] Among them, the computing device cluster can be a cluster that a cloud service provider provides cloud services to cloud service tenants, such as: cloud computing, cloud containers, cloud storage, etc., or it can also be other clusters that do not provide cloud services. The embodiments of the present application do not limit this.

[0079] When a computing device cluster provides cloud services for cloud service tenants, the computing device cluster may be referred to as a cloud service system.

[0080] It should be noted that the cloud service system may also be referred to as a cloud system, a cloud computing system, a cloud computing service system, etc., and the embodiments of the present application do not limit this.

[0081] Hereinafter, the application detection method is applied to a cloud service system as an example to illustrate the embodiments of the present application. When the application detection method is applied to a single computing device or other types of computing device clusters, the execution process of the application detection method can refer to the following embodiments, which will not be repeated later.

[0082] like Figure 1 The figure is a schematic diagram of the structure of a cloud service system according to an embodiment of the present application.

[0083] See also Figure 1 The cloud service system may include a physical switch and at least one computing device, the physical switch is connected to each computing device in the at least one computing device, and each computing device may communicate with an external network through the physical switch.

[0084] It should be noted that the embodiments of the present application do not limit the number of physical switches and computing devices in the cloud service system.

[0085] In the embodiment of the present application, the cloud service tenant can use the first electronic device to communicate with the cloud service system, so as to use the cloud service rented from the cloud service system through the first electronic device, such as cloud computing, cloud container, cloud storage and other cloud services.

[0086] Optionally, the first electronic device can be a mobile phone, a tablet computer, a handheld computer, a PC, a cellular phone, a personal digital assistant (PDA), a wearable device (such as a smart watch, a smart bracelet, etc.), a smart home device (such as a television, etc.), a car machine (such as a car computer, etc.), a smart screen, a game console, headphones, AI speakers, augmented reality (AR) / virtual reality (VR) equipment, an ultra-mobile personal computer (UMPC), a laptop computer, a netbook, a desktop computer or an all-in-one computer, etc.

[0087] It should be noted that the above is only an exemplary description, and the embodiments of the present application do not limit the specific form of the first electronic device.

[0088] In the embodiment of the present application, the cloud service provider can use the second electronic device to communicate with the cloud service system, so as to manage the applications on each computing device through the second electronic device. For example, the second electronic device can receive a prompt message sent by a computing device, and manage the first application on a computing device by indicating that the first application is an abnormal application through the prompt message, such as uninstalling the first application, crushing the first application, etc.

[0089] It should be noted that, for the relevant description of the second electronic device, reference can be made to the first electronic device, which will not be repeated here.

[0090] like Figure 2 , which is a schematic diagram of the structure of another cloud service system provided in an embodiment of the present application.

[0091] See also Figure 2 The cloud service system may include a physical switch, an NDR device, and at least one computing device. The NDR device is connected to the physical switch, the physical switch is connected to each computing device in the at least one computing device, and each computing device may communicate with an external network (e.g., multiple devices) through the physical switch.

[0092] It should be noted that the embodiments of the present application do not limit the specific forms of the multiple devices. For example, the multiple devices may be terminal devices, computing devices, etc.

[0093] In the embodiment of the present application, the NDR device can obtain the communication information between each computing device and multiple devices through the physical switch. Exemplarily, the communication information may include a communication channel identifier, IP addresses of multiple devices, an IP address of a computing device, an identifier of a computing device, a rate of a communication channel, a length of a data packet, etc. Among them, a data packet refers to a data packet transmitted between each computing device and multiple devices.

[0094] In this way, the NDR device can use communication information to determine whether the physical switch has transmitted data packets related to abnormal applications, and then determine whether there are abnormal applications on the cloud service system and the computing device where the abnormal applications are located.

[0095] Exemplarily, the NDR device may obtain communication information between each computing device and multiple devices by mirroring information transmitted by the physical switch to a storage device of the NDR device.

[0096] Need to explain, Figure 2 For additional descriptions of the cloud service system shown, see Figure 1 The description of the cloud service system shown will not be repeated here.

[0097] like Figure 3 , which is a schematic diagram of the interaction between the computing device and the application server provided in an embodiment of the present application.

[0098] See also Figure 3 In the embodiment of the present application, at least one application may be installed on the computing device. For example, the at least one application may include application 1, ..., application Z. The computing device communicates with the server of application 1, ..., and the server of application Z through a physical switch.

[0099] It can be understood that the computing device can also be called a client of Application 1, ..., Application Z.

[0100] As the client of application 1, the computing device can send a connection request to the server of application 1 while running application 1. After receiving the connection request, the two parties establish communication channel 1. After that, the computing device can send data packet 1' to the server of application 1, and the server of application 1 can send data packet 1 to the computing device. Similarly, when the computing device runs application Z, it can send data packet z' to the server of application Z, and the server of application Z can send data packet z to the computing device.

[0101] Taking application 1 as an example, the application detection method provided in the embodiment of the present application can determine whether application 1 is an abnormal application based on the length of data packet 1' and data packet 1. When determining whether application 1 is an abnormal application, the application detection method can be executed by a computing device, or can also be executed by an NDR device.

[0102] It should be noted that the system architecture and application scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of the system architecture and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0103] For ease of understanding, the application detection method provided in the embodiment of the present application is introduced below in conjunction with the accompanying drawings.

[0104] Figure 4 4 is a flow chart showing an application detection method according to an exemplary embodiment. Exemplarily, the application detection method includes the following S401-S404.

[0105] In the embodiment of the present application, Figure 4 The application detection method shown can be executed by a detection device to detect Figure 1 , Figure 2 Check whether there are any abnormal applications installed in the cloud service system shown.

[0106] In one example, the detection device may be a computing device. Figure 1 or Figure 2 Any computing device in the cloud service system shown. During the process of executing the application detection method, the computing device can detect whether the application installed on the computing device is an abnormal application.

[0107] In another example, the detection device may be an NDR device. During the process of the NDR device executing the application detection method, it may detect whether an abnormal application is installed on each computing device in the cloud service system.

[0108] Hereinafter, the embodiment of the present application is described by way of example by taking the detection of whether an application on a computing device is an abnormal application as an example. The computing device may be Figure 1 or Figure 2 Any one of the at least one computing device shown.

[0109] In the embodiment of the present application, a computing device and multiple devices (such as Figure 4 A plurality of second communication channels are established between the devices 1, ..., and G as shown. A first application is installed on the computing device, for example, Figure 3 In the application 1 shown, multiple devices include a server of a first application (also referred to as the first server of the first application), multiple second communication channels include a first communication channel established between a computing device and the server of the first application, and the computing device transmits multiple data packets in sequence with the server of the first application based on the first communication channel.

[0110] Optionally, the computing device may directly establish the first communication channel with the server of the first application, or the computing device may establish the communication channel with the server of the first application through a proxy server. In the case where the computing device establishes the communication channel with the server of the first application through a proxy server, the proxy server may also be referred to as the server of the first application.

[0111] It should be noted that “multiple data sequentially transmitted between the computing device and the server of the first application based on the first communication channel” can be referred to as multiple data packets sequentially transmitted by the first communication channel, multiple data packets related to the first communication channel, etc. The first communication channel can be referred to as a communication channel related to the first application, and the first application can be referred to as an application related to the first communication channel, which will not be further explained later.

[0112] Exemplarily, the multiple data packets include data packets sent by the computing device to the server of the first application and data packets received by the computing device from the server of the first application, wherein the multiple data packets are sorted in a transmission order.

[0113] The data packet sent by the computing device to the server of the first application can be referred to as a sending packet among the multiple data packets, or simply a sending packet. The data packet received by the computing device from the server of the first application can be referred to as a receiving packet among the multiple data packets, or simply a receiving packet.

[0114] Optionally, step S401: the detection device determines a first communication channel from a plurality of second communication channels.

[0115] When the detection device is a computing device, the computing device can directly obtain the information required to execute the application detection method (such as the connection information and the length of the data packet described below) from the local device (i.e., the storage device of the computing device). When the detection device is an NDR device, the NDR device can obtain the information required to execute the application detection method through a physical switch, which will not be described later.

[0116] In the embodiment of the present application, the detection device may determine the first communication channel from the plurality of second communication channels according to the attribute of the first communication channel.

[0117] The first communication channel may include multiple attributes, and attributes 1 to 3 are used for exemplary description below.

[0118] Attribute 1: The first communication channel is a communication channel requested to be established by the computing device.

[0119] The communication channel requested to be established by the computing device refers to a communication channel established based on a connection request sent by the computing device.

[0120] After the computing device establishes multiple second communication channels with multiple devices, the connection information of the second communication channels will be stored. The connection information includes a source IP address and a destination IP address. The source IP address is used to indicate the IP address of the device that sends the connection request, and the destination IP address is used to indicate the IP address of the device that receives the connection. Based on this, in the connection information of the first communication channel, the source IP address is the IP address of the computing device.

[0121] Exemplarily, the connection information of the communication channel may be stored in a storage device of the computing device, such as a memory. It should be noted that the present application does not limit the storage location of the connection information of the communication channel, and the above is only an exemplary description.

[0122] On this basis, the detection device can filter out the communication channel actively established by the computing device from the multiple second communication channels according to whether the destination IP address in the connection information of each second communication channel is the IP address of the computing device.

[0123] In this embodiment, since the abnormal application is installed on the computing device, the computing device acts as the client of the abnormal application. Therefore, the communication channel related to the abnormal application must be established by the computing device request, that is, it is established by the computing device sending a connection request to the server of the abnormal application. Based on this, by screening out the communication channel established by the computing device request from multiple second communication channels, it helps to filter out the communication channels related to normal applications and retain the communication channels suspected to be related to abnormal applications in the multiple second communication channels, which in turn helps to reduce the performance pressure of subsequent detection and avoid excessive occupation of computing device resources.

[0124] The communication channel related to the normal application refers to the communication channel that the computing device requests to establish with the server of the normal application during the process of running the normal application, or the communication channel that the client of the normal application requests to establish with the computing device.

[0125] Need to explain, Figure 4 The active connection shown refers to a communication channel established by a computing device actively sending a connection request, and the passive connection refers to a communication channel established by a computing device receiving a connection request.

[0126] Property 2: The first communication channel is a long connection.

[0127] In this embodiment, since the client and server of the abnormal application usually communicate based on a long connection, by setting the first communication channel as a long connection, the communication channels related to normal applications in multiple second communication channels can be filtered out, and the communication channels suspected to be related to abnormal applications in the multiple second communication channels can be retained. This helps to reduce the performance pressure of subsequent detection and avoid excessive occupation of computing device resources.

[0128] In the embodiment of the present application, a long connection may be a communication channel whose survival time is greater than or equal to a time threshold.

[0129] In this embodiment, by setting the long connection to be a communication channel whose survival time is greater than or equal to the time threshold, the detection device can filter the first communication channel from multiple second communication channels according to the survival time of the communication channel, which helps to improve the convenience of filtering the first communication channel.

[0130] Optional, 5 seconds ≤ duration threshold ≤ 600 seconds.

[0131] In one example, the duration threshold may be 5 seconds, so that communication channels with a survival time greater than or equal to 5 seconds (s) can be screened out from the plurality of second communication channels, or in other words, communication channels with a survival time less than 5 seconds from the plurality of second communication channels are filtered out. In another example, the duration threshold may be 60s. In another example, the duration threshold may be 600s.

[0132] In this embodiment, by setting the duration threshold to be greater than or equal to 5 seconds and less than or equal to 600 seconds, it not only helps to filter out communication channels related to normal applications, such as communication channels for cloud service tenants to browse web pages, but also helps to retain communication channels for suspected abnormal applications, thereby helping to ensure the accuracy of filtering / screening.

[0133] The following is an exemplary introduction to the process of selecting a long connection from multiple second communication channels through Examples 1 and 2.

[0134] In example 1, the connection information may include a connection identifier, wherein different communication channels have different connection identifiers.

[0135] It should be noted that the connection information stored in the storage device is the connection information of the communication channel that is currently in a live state, wherein the communication channel that is in a live state refers to a communication channel that has not been closed.

[0136] Based on this, the detection device can determine the long connection from multiple second communication channels by following steps 1 to 2.

[0137] Step 1: The detection device obtains the first connection information and the second connection information.

[0138] The difference between the time of acquiring the first connection information and the time of acquiring the second connection information is the duration threshold. Exemplarily, the detection device acquires the first connection information at a first moment and acquires the second connection information at a second moment. The difference between the first moment and the second moment is the duration threshold.

[0139] The first connection information includes a first connection identifier, and different first connection identifiers are used to indicate different communication channels. The second connection includes a second connection identifier, and different second connection identifiers are used to indicate different communication channels.

[0140] Step 2: The detection device determines the long connection based on the first connection information and the second connection information.

[0141] Since the storage device stores information about communication channels that are in a live state, if the connection information of a communication channel exists in both the first connection information and the second connection information, it means that the communication channel is in a live state at the first moment and is also in a live state at the second moment.

[0142] On this basis, since both the first connection information and the second connection information include a connection identifier, and different connection identifiers indicate different communication channels, the survival time of the communication channel indicated by the same connection identifier in the first connection information and the second connection information is greater than or equal to the time threshold. Based on this, the detection device can determine the communication channel indicated by the same connection identifier in the first connection information and the second connection information as a long connection.

[0143] Exemplarily, the first connection identifier includes a1, a2, an, and the second connection identifier includes a1, a2, am. Based on this, it can be determined that the communication channel indicated by a1 and the communication channel indicated by a2 are long connections.

[0144] It should be noted that the first connection information, the first connection identifier, the second connection information, and the second connection identifier are named in order to distinguish the connection information obtained at different times and the connection identifiers in the connection information obtained at different times.

[0145] In this embodiment, by obtaining the first connection information and the second connection information at two different times, and determining the communication channel indicated by the same connection identifier in the first connection information and the second connection information as a long connection, it helps to ensure that the determined long connection is currently alive, and further helps to ensure the validity of the determined first communication channel.

[0146] Example 2: The connection information of the communication channel includes the establishment time of the communication channel.

[0147] Based on this, the detection device can obtain the connection information of each second communication channel in the multiple second communication channels, obtain the establishment time of each second communication channel, and determine the difference between the establishment time of each second communication channel and the current time as the survival time of each second communication channel. The detection device can determine the second communication channel with a survival time greater than or equal to the duration as a long connection.

[0148] In this embodiment, the survival time of the second communication channel is determined by the establishment time of the second communication channel, which can avoid obtaining the connection information of the second communication channel multiple times, thereby helping to improve efficiency and reduce performance pressure.

[0149] Attribute 3, the rate of the first communication channel is less than or equal to the rate threshold.

[0150] The rate of the first communication channel refers to the rate at which the computing device transmits data packets to the server of the first application based on the first communication channel.

[0151] It should be noted that a communication channel with a rate less than or equal to a rate threshold can be called a low-rate connection or a low-traffic connection, and correspondingly, a communication channel with a rate greater than a rate threshold can be called a high-rate connection or a high-traffic connection, which will not be explained further below.

[0152] In this embodiment, since the communication channels related to normal applications are usually high-speed connections, such as communication channels for transmitting videos and files, by setting the rate of the first communication channel to be less than or equal to the rate threshold, and setting a suitable rate threshold, such as a rate threshold between 3 data packets / second ≤ rate threshold ≤ 20 data packets / second, high-speed connections in multiple second communication channels can be filtered out, thereby filtering out communication channels related to normal applications in multiple second communication channels, and retaining communication channels suspected of being related to abnormal applications in multiple second communication channels. This helps to reduce the performance pressure of subsequent detection and avoid excessive occupation of computing device resources.

[0153] Optionally, 3 packets / second ≤ rate threshold ≤ 20 packets / second.

[0154] In one example, the rate threshold may be 3 packets / second (hereinafter referred to as quantity value / s), so that a communication channel with a rate less than or equal to 3 / second can be screened out from the plurality of second communication channels. In another example, the rate threshold may be 5 / second. In yet another example, the rate threshold may be 20 / second.

[0155] The following is an exemplary introduction to the process of screening out low-rate connections from multiple second communication channels.

[0156] In the embodiment of the present application, the detection device can determine the rate of each second communication channel based on an algorithm (such as a token bucket algorithm), and on this basis, determine the second communication channel whose rate is less than or equal to the rate threshold as the first communication channel.

[0157] Exemplarily, the detection device puts multiple destination IP addresses related to the second communication channels into an IPSet set, and performs a limit rate check on the second communication channels related to each destination IP address in the IPSet set, such as determining whether the rate of each second communication channel is less than or equal to the rate threshold, so as to filter out the second communication channels with a rate greater than the rate threshold, such as deleting them from the IPSet set. In this way, the remaining second communication channels in the IPSet set are low-rate connections.

[0158] It should be noted that the destination IP address associated with the second communication channel refers to the IP address of the device that receives the connection request when the second communication channel is established.

[0159] It should be noted that the embodiment of the present application does not limit the method of screening low-speed connections, and the above is only an exemplary description.

[0160] It should be noted that the embodiment of the present application does not limit the number of attributes of the first communication channel, and the first communication channel may have one or more attributes from attribute 1 to attribute 3.

[0161] It should be noted that the embodiment of the present application does not limit the number of first communication channels determined from multiple second communication channels. Exemplarily, it can be one, or it can also be multiple.

[0162] In the following, taking a first communication channel as an example, a process of determining whether an application related to the first communication channel (ie, the first application) is an abnormal application is exemplarily introduced.

[0163] Step S402: The detection device obtains the lengths of multiple data packets related to the first application.

[0164] The multiple data packets related to the first application refer to multiple data packets transmitted in sequence between the computing device and the server of the first application. The unit of the length of the data packet is byte.

[0165] It should be noted that the multiple data packets related to the first application may also be referred to as multiple data packets related to the first communication channel, and no distinction is made between the two in the embodiments of the present application.

[0166] Wherein, obtaining the lengths of the multiple data packets refers to obtaining the length of each data packet in the multiple data packets.

[0167] Exemplarily, the multiple data packets include data packet 1, ..., data packet f, and obtaining the lengths of the multiple data packets refers to obtaining the lengths of data packet 1, ..., and data packet f.

[0168] In an embodiment of the present application, the detection device can obtain the length of multiple data packets by calling a target application programming interface (API). A hook associated with the target API is set in the operating system of the computing device, and the hook is used to record the length of the data packet received and the length of the data packet sent by the computing device.

[0169] In an example, the detection device calls the target API to obtain multiple data packets, and the detection device decompresses the multiple data packets to obtain the lengths of the multiple data packets.

[0170] In another example, the target API is associated with log information of multiple data packets, and the log information records the lengths of multiple data packets. The detection device calls the target API to obtain the lengths of multiple data packets recorded in the log information.

[0171] Exemplarily, the target API is configured with a call table, and the call table is used to fill in the connection identifier. The detection device writes the connection identifier of the first communication channel into the call table to indicate the length of the data packet related to the first communication channel. After that, the detection device will receive the length of the data packet related to the first communication channel recorded by the hook associated with the target API. When it is not necessary to obtain the length of the data packet, the detection device can delete the identifier of the first communication channel in the call table.

[0172] In the embodiment of the present application, the multiple data packets may be data packets transmitted sequentially by the computing device and the server of the first application based on the first communication channel within a preset time period.

[0173] Exemplarily, the detection device writes the connection identifier of the first communication channel into the call table at a first moment, and deletes the connection identifier of the first communication channel in the call table at a second moment, and the difference between the first moment and the second moment is a preset duration, thereby obtaining the length of the data packets transmitted sequentially within the preset duration.

[0174] In this embodiment, by setting multiple data packets as data packets transmitted sequentially between the computing device and the server of the first application within a preset time period, it helps to control the number of data packets that need to be classified subsequently, thereby reducing the performance pressure of subsequent detection.

[0175] Optionally, 5 minutes ≤ preset duration ≤ 60 minutes.

[0176] In one example, the preset time length is 5 minutes, and the detection device can obtain the length of each data packet transmitted sequentially by the first communication channel within 5 minutes. In another example, the preset time length is 15 minutes, and the detection device can obtain the length of each data packet transmitted sequentially by the first communication channel within 15 minutes. In another example, the preset time length is 60 minutes, and the detection device can obtain the length of each data packet transmitted sequentially by the first communication channel within 60 minutes.

[0177] In this embodiment, by setting the preset duration to be greater than or equal to 5 minutes and less than or equal to 60 minutes, it not only helps to control the number of data packets that need to be classified subsequently, thereby reducing the performance pressure of subsequent detection, but also helps to ensure that there are a sufficient number of data packets for determining whether the first application is an abnormal application, thereby ensuring the accuracy of the judgment.

[0178] Step S403: The detection device determines at least one target type of data packet among the multiple data packets according to the lengths of the multiple data packets; wherein the at least one target type is a type of data packet related to the abnormal application.

[0179] In the embodiment of the present application, the data packets related to the abnormal application refer to the data packets transmitted between the abnormal application client and the abnormal application server during the abnormal application running process. For example, during the abnormal application client running the abnormal application, data packets a1-data packet an are transmitted between the abnormal application server and the abnormal application server, then data packets a1-data packet an are data packets related to the abnormal application.

[0180] Based on this, the type of the data packet related to the abnormal application refers to the type of the data packet a1 - the type of the data packet an.

[0181] Exemplarily, when the type of data packet a1 - the type of data packet an are the same, the type of data packet related to the abnormal application may include one type; or, when the type of data packet a1 - the type of data packet an are partially different, the type of data packet related to the abnormal application may include multiple types, or, in other words, include multiple different types.

[0182] For the convenience of description, the type of data packet related to abnormal application is referred to as preset type below and will not be explained later.

[0183] In the embodiment of the present application, at least one target type includes a preset type, which may include each type in the preset type, or may include some types in the preset type. For example, the preset type includes 5 different types, at least one target type may include 3 different types, or at least one target type may also include 5 different types.

[0184] Based on this, at least one target type includes a preset type, which can also be understood as at least one target type belonging to a set of preset types.

[0185] It should be noted that the embodiment of the present application does not limit the number of types included in the at least one target type. Exemplarily, the at least one target type may include one type, or may include multiple types.

[0186] In the following, taking the abnormal application as a mining application as an example, at least one target type in the embodiment of the present application is exemplarily introduced.

[0187] like Figure 5 , which is a schematic diagram of the interaction between the client of a mining application (also called a miner) and the server of a mining application (also called a mining pool).

[0188] For example, see Figure 5 After the miner starts the mining application, it sends a connection request to the mining pool to request the establishment of a mining communication channel. After the mining pool receives the connection request, the two parties establish a mining communication channel. After that, the miner and the mining pool can communicate based on the mining communication channel. Specifically, the miner can send a login request to the mining pool. After receiving the login request, the mining pool can return the login result to the miner (such as: successful login). After that, the mining pool can send a first computing task to the miner. After receiving the first computing task, the miner performs the first computing task (also called mining). After completing the first computing task, the miner submits the calculation result of the first computing task to the mining pool. After receiving the calculation result submitted by the miner, the mining pool returns the result of the first mining to the miner, such as: returning digital currency when a block is mined, or returning mining failure when no block is mined.

[0189] After the first mining is completed, the mining pool can continue to send the second computing task, the third computing task, etc. to the miners. Among them, the process of the second mining, the process of the third mining, etc., can refer to the process of the first mining, and will not be repeated here.

[0190] Based on this, in one example, the preset types may include task assignment (New Job), task submission (Solution Submission) and task feedback (Submission Result). Among them, task assignment is used to indicate the computing task sent by the mining pool to the miner, task submission is used to indicate the computing result of the computing task submitted by the miner to the mining pool, and task feedback is used to indicate the mining result sent by the mining pool to the miner.

[0191] On this basis, since the mining communication channel is a long connection, the miner will also send detection information to the mining pool based on the keep-alive mechanism to determine whether the mining communication channel is available. After receiving the detection information, the mining pool will return the detection results to the miner.

[0192] Based on this, in another example, the preset types may include task allocation, task submission and task feedback, connection keepalive and connection keepalive feedback. Among them, connection keepalive is used to indicate the detection information sent by the miner to the mining pool, and connection keepalive feedback is used to indicate the detection result sent by the mining pool to the miner.

[0193] In the embodiment of the present application, the preset type can be indicated by characters, wherein different types are indicated by different characters. In this way, when the distribution characteristics of at least one target type of data packets in multiple data packets are subsequently checked, it helps to improve convenience.

[0194] On this basis, in order to distinguish the type of data packets sent by the miner to the mining pool from the type of data packets sent by the mining pool to the miner, in the embodiment of the present application, the type of data packets sent by the miner to the mining pool and the type of data packets sent by the mining pool to the miner can be indicated by using lowercase characters. For example, the type of data packets sent by the miner to the mining pool is indicated by lowercase characters, and the type of data packets sent by the mining pool to the miner is indicated by uppercase characters.

[0195] Exemplarily, J is used to indicate task allocation, s is used to indicate task submission, R is used to indicate submission feedback, k is used to indicate connection keep-alive, and K is used to indicate connection keep-alive feedback.

[0196] It should be noted that the type of data packet sent by the miner to the mining pool may be indicated using uppercase characters, and the type of data packet sent by the mining pool to the miner may be indicated using lowercase characters. This embodiment of the present application does not limit this.

[0197] On this basis, in one example, at least one target type may include task allocation (J), task submission (s), and submission feedback (R). In another example, at least one target type may include task allocation (J), task submission (s), submission feedback (R), connection keep alive (k), and connection keep alive feedback (K).

[0198] In the following, an embodiment of the present application is exemplarily described by taking at least one target type including task allocation (J), task submission (s), submission feedback (R), connection keep-alive (k) and connection keep-alive feedback (K) as an example.

[0199] It should be noted that task assignment (J), submission feedback (R), and connection keepalive feedback (K) are the types of data packets sent by the mining pool to the miners, which can be used as the types of data packets received by the computing device from the server of the first application, and can be called the receiving type in at least one target type, or can also be simply referred to as the receiving type.

[0200] Task submission (s) and connection keepalive (k) are the types of data packets sent by miners to the mining pool, which can be used as the types of data packets sent by the computing device to the server of the first application. They can be called the sending type in at least one target type, or simply referred to as the sending type.

[0201] In the embodiment of the present application, other types except at least one target type may be referred to as unknown types (Unknown) or non-target types. Exemplarily, u and U may be used to indicate non-target types. Among them, u is used to indicate unknown type packets sent by miners to mining pools, and U is used to indicate unknown type packets sent by mining pools to miners.

[0202] In an embodiment of the present application, a detection device classifies multiple data packets according to their lengths to obtain a type of each data packet in the multiple data packets, thereby determining at least one target type of data packet in the multiple data packets.

[0203] There are multiple implementation methods for determining at least one target type of data packet among multiple data packets based on multiple data packet lengths. The following is an exemplary description using Methods 1 to 3.

[0204] Mode 1: The detection device determines a data packet of at least one target type among the multiple data packets according to the lengths of the multiple data packets and a length range of data packets corresponding to at least one target type.

[0205] It should be noted that the length range of the data packet corresponding to the target type may also be referred to as the length range corresponding to the target type. Based on this, in the following embodiments, descriptions such as the length range corresponding to the task assignment (J) may be considered as the length range of the data packet corresponding to the task assignment (J).

[0206] In the embodiment of the present application, the length range corresponding to at least one target type refers to the length range corresponding to each type included in the at least one target type.

[0207] Exemplarily, when at least one target type includes task assignment (J), task submission (s), submission feedback (R), connection keepalive (k) and connection keepalive feedback (K), the length range corresponding to at least one target type includes the length range corresponding to task assignment (J), the length range corresponding to task submission (s), the length range corresponding to submission feedback (R), the length range corresponding to connection keepalive (k) and the length range corresponding to connection keepalive feedback (K).

[0208] Exemplarily, the length range corresponding to at least one target type is shown in Table 1.

[0209] Table 1

[0210] Data packets sent by the mining pool to miners Data packets sent by miners to the mining pool The length of the data packet is 0 bytes: "A" The length of the data packet is 0 bytes: "a" The length of the data packet is 0-60 bytes: "U" The length of the data packet is 0-60 bytes: "u" The length of the data packet is 60-301 bytes: "R" The length of the data packet is 60-301 bytes: "K" The length of the data packet is 60-121 bytes: "k" The length of the data packet is 301-501 bytes: "J" The length of the data packet is 121-501 bytes: "s" The length of the data packet is greater than 501 bytes: "U" The length of the data packet is greater than 501 bytes: "u"

[0211] Referring to Table 1, A, a is used to indicate an acknowledgement character (ACK), a is used to indicate an acknowledgement character sent by a miner to a mining pool, and A is used to indicate an acknowledgement character sent by a mining pool to a miner.

[0212] It should be noted that the embodiment of the present application does not limit the method for determining the length range corresponding to at least one target type. Exemplarily, it can be determined based on the length of multiple data packets related to the current mining applications. The detection device can store the length range corresponding to at least one target type.

[0213] Exemplarily, the multiple data packets include data 1, ..., data packet 21, and the lengths of data packets 1, ..., data packet 21 are 50, 320, 50, 300, 250, 345, 300, 250, 100, 200, 50, 50, 350, 300, 200, 50, 50, 350, 50, 125, and 90 respectively.

[0214] The detection device compares the length of the received packet with the length range corresponding to the received type, that is, with the length range corresponding to U, the length range corresponding to R, the length range corresponding to K, and the length range corresponding to J, respectively, so as to determine at least one target type of data packet among multiple data packets.

[0215] For example, the length of data packet 2 is 320, which belongs to the length range corresponding to task assignment (J), that is, [301,501]. Therefore, the type of data packet 2 is determined to be task assignment (J). The length of data packet 10 is 200, which belongs to the length range corresponding to task feedback (R) and the length range corresponding to connection keep-alive feedback (K). Since the type of the previous data packet 9 is connection keep-alive (k), the type of data packet 10 is determined to be connection keep-alive feedback (K). It should be noted that if the type of data packet 9 is task submission (s), the type of data packet 10 is determined to be submission feedback (R).

[0216] The detection device compares the length of the sent packet with the length range corresponding to the sending type, that is, with the length range corresponding to u, the length range corresponding to k, and the length range corresponding to s, respectively, so as to determine at least one target type of data packet among multiple data packets.

[0217] For example, the length of data packet 4 is 122, which belongs to the length range corresponding to task submission (s), that is, [121, 501]. Therefore, the type of data packet 4 is determined to be task submission (s).

[0218] Based on this, the types of data packets 1, ..., data packet 21 are u, J, u, s, R, J, s, R, k, K, u, U, J, s, R, u, U, J, u, s, R respectively. Therefore, data packets of at least one target type among the multiple data packets include: data packet 2, data packet 4, data packet 5, 6, 7, 8, 9, 10, 13, 14, 15, 18, 20, 21.

[0219] In this implementation, determining at least one target type of data packet among multiple data packets through a length range corresponding to at least one target type helps improve the efficiency of determining at least one target type of data packet, and further helps improve the efficiency of detecting abnormal applications.

[0220] Mode 2: The detection device may determine a data packet of at least one target type among the multiple data packets according to the lengths of the multiple datagram packets and the length of the data packet corresponding to the at least one target type.

[0221] It should be noted that the length of the data packet corresponding to the target type may also be referred to as the length corresponding to the target, which will not be described in detail later. Based on this, in the following embodiments, descriptions such as the length corresponding to the task assignment (J) may be considered as the length corresponding to the task assignment (J).

[0222] In this embodiment, since multiple data packets are classified according to the precise length value corresponding to at least one target type, and data packets of at least one target type among the multiple data packets are determined, compared with classifying multiple data packets according to the length range corresponding to at least one target type, it helps to improve the accuracy of the classification results.

[0223] In the embodiment of the present application, the type included in at least one target type can be used to indicate the content of the data packet. For example, task allocation (J) is used to indicate that the content of the data packet sent by the server of the abnormal application to the client is a work task (such as a mining task).

[0224] Based on this, by determining at least one target type of data packet among multiple data packets, the communication content between the computing device and the server of the first application is determined, so that it is possible to determine whether the first application is an abnormal application by judging whether the communication content between the computing device and the server of the first application is consistent with the communication content between the client and server of the abnormal application.

[0225] In the embodiment of the present application, the length corresponding to at least one target type refers to the length corresponding to each type included in the at least one target type.

[0226] Exemplarily, when at least one target type includes task assignment (J), task submission (s), submission feedback (R), connection keepalive (k), and connection keepalive feedback (K), the length corresponding to at least one target type includes the length corresponding to task assignment (J), the length corresponding to task submission (s), the length corresponding to submission feedback (R), the length corresponding to connection keepalive (k), and the length corresponding to connection keepalive feedback (K).

[0227] It should be noted that since the accuracy of classifying multiple data packets according to the length corresponding to at least one target type is higher than the accuracy of classifying multiple data packets according to the length range corresponding to at least one target type, classifying multiple data packets according to the length corresponding to at least one target type can also be called detailed classification, and the length corresponding to at least one target type can also be called the detailed classification standard of multiple data packets.

[0228] In an embodiment of the present application, the detection device compares the length of each data packet in multiple data packets with the length corresponding to at least one target type. If the difference between the length of a data packet and the length corresponding to at least one target type is less than or equal to a length threshold, the type of a data packet is determined to be the target type.

[0229] When the detection device performs comparison, the length of the received packet in multiple data packets is compared with the length corresponding to the received type in at least one target type, and the length of the sent packet in multiple data packets is compared with the length corresponding to the sent type in at least one target type.

[0230] It should be noted that if the difference between the length of a data packet and the length corresponding to at least one target type is greater than a length threshold, it can be determined that the type of the data packet is a non-target type or an unknown type.

[0231] Exemplarily, the length corresponding to at least one target type includes the length corresponding to task assignment (J), the length corresponding to task submission (s), the length corresponding to submission feedback (R), the length corresponding to connection keepalive (k), and the length corresponding to connection keepalive feedback (K). The detection device compares the length of a data packet with the length corresponding to J, the length corresponding to s, the length corresponding to R, the length corresponding to k, and the length corresponding to K, respectively.

[0232] If data packet a among multiple data packets is a received packet, and the difference between the length of data packet a and the length corresponding to J is less than or equal to the length threshold, then the type of data packet a is determined to be J. If data packet b among multiple data packets is a sent packet, and the difference between the length of data packet b and the length corresponding to s is less than or equal to the length threshold, then the type of data packet b is determined to be s. If data packet c among multiple data packets is a received packet, and the difference between the length of data packet c and the length corresponding to J, the length corresponding to R, and the length corresponding to K are all greater than the length threshold, then the type of data packet c is determined to be a non-target type.

[0233] In this embodiment, the type of a data packet is determined to be a target type by setting the difference between the length of a data packet and the length corresponding to at least one target type to be less than or equal to a length threshold. Compared with determining the type of a data packet to be a target type only when the length of a data packet is equal to the length corresponding to at least one target type, this helps to improve the coverage of data packets of at least one target type, and further helps to improve the coverage of abnormal applications, thus helping to avoid missing abnormal applications on computing devices.

[0234] Optionally, 0≤length threshold≤20.

[0235] In an example, the length threshold may be 0. If the difference between the lengths of data packets a and J is equal to 0, the type of data packet a is J.

[0236] In another example, the length threshold may be 5. If the difference between the lengths of data packets a and J is 0-5 (ie, less than or equal to 5), the type of data packet a is J.

[0237] In another example, the length threshold may be 10. If the difference between the lengths of data packets a and J is 0-10 (ie, less than or equal to 10), the type of data packet a is J.

[0238] In another example, the length threshold may be 20. If the difference between the lengths of data packets a and J is 0-20 (ie, less than or equal to 10), the type of data packet a is J.

[0239] It should be noted that, below, the embodiment of the present application is exemplified by taking the length threshold of 5 as an example.

[0240] Exemplarily, at least one target type includes task assignment (J), task submission (s), submission feedback (R), connection keepalive (k) and connection keepalive feedback (K), where the length corresponding to J is 350 bytes, the length corresponding to s is 300 bytes, the length corresponding to R is 250 bytes, the length corresponding to k is 100 bytes, and the length corresponding to K is 200 bytes.

[0241] The multiple data packets include data 1, ..., data packet 21, and the lengths of data packets 1, ..., data packet 21 are 50, 320, 50, 300, 250, 345, 300, 250, 100, 200, 50, 50, 350, 300, 200, 50, 50, 350, 50, 125, and 90 respectively.

[0242] The received packets include: data packet 2, data packet 5, data packet 6, data packet 8, data packet 10, data packet 12, data packet 13, data packet 15, data packet 17, data packet 18, and data packet 21. The detection device compares the length of the received packet with the length corresponding to the received type, that is, with the length corresponding to J, the length corresponding to R, and the length corresponding to K, respectively.

[0243] For example, the length of data packet 6 is 345, and the difference between it and the length corresponding to J (ie, 350) is 5, which is equal to the length threshold. Therefore, the type of data packet 6 is J, and data packet 6 is a data packet of the target type.

[0244] The sent packets include: data packet 1, data packet 3, data packet 4, data packet 7, data packet 9, data packet 11, data packet 14, data packet 16, data packet 19, and data packet 20. The detection device compares the length of the sent packet with the length corresponding to the sending type, that is, compares it with the length corresponding to s and the length corresponding to k.

[0245] For example, the length of data packet 7 is 300, and the difference between the length corresponding to s (ie, 300) is 0. Therefore, the type of data packet 7 is s, and data packet 7 is a data packet of the target type.

[0246] Based on this, the initial types of data packets 1,..., data packet 21 are u, u, u, s, R, J, s, R, k, K, u, U, J, s, R, u, U, J, u, s, R respectively.

[0247] There are multiple implementation methods for determining the length corresponding to at least one target type. The following is an exemplary description using methods a to c.

[0248] Mode a: Based on the lengths of multiple data packets related to the first communication channel, determine the length corresponding to at least one target type.

[0249] Exemplarily, before executing S403, after determining the length corresponding to at least one target type by means of method c, a data packet of at least one target type among the multiple data packets is determined according to the lengths of the multiple data packets and the length corresponding to the at least one target type.

[0250] In this embodiment, since miners and mining pools usually communicate based on the stratum protocol, and the stratum protocol uses the JSON data format to transmit data packets. In the JSON format data packets, spaces, carriage returns, etc. do not affect the message content, but affect the message length. Therefore, determining the sub-classification criteria based on multiple data packets related to the first communication channel helps to improve the accuracy of the sub-classification criteria, and further helps to improve the accuracy of the sub-classification results obtained by classifying multiple data packets based on the sub-classification criteria.

[0251] The following is an illustrative description of the implementation process of method a through S1 to S2.

[0252] Step S1: The detection device determines the initial type of each data packet in the multiple data packets according to the lengths of the multiple data packets and the length range corresponding to at least one target type; the initial type is a target type or a non-target type.

[0253] In an embodiment of the present application, by comparing whether the length of each data packet in the multiple data packets belongs to the length range corresponding to at least one target type, the multiple data packets are roughly classified to determine the initial type of each data packet in the multiple data packets.

[0254] It should be noted that for the relevant description of S1, please refer to the relevant description in the above method 1, which will not be repeated here.

[0255] Step S2: the detection device determines the length corresponding to at least one target type according to the length of some data packets among the multiple data packets; the initial type of some data packets is the target type.

[0256] Exemplarily, the initial types of data packets 2, data packets 4-data packets 10, data packets 13-data packets 15, data packets 18, data packets 20, and data packets 21 are target types. Therefore, the detection device can determine the length corresponding to at least one target type based on the lengths of data packets 2, data packets 4-data packets 10, data packets 13-data packets 15, data packets 18, data packets 20, and data packets 21.

[0257] It should be noted that classifying multiple data packets according to the length range of data packets corresponding to at least one target type can be considered as a rough classification of multiple data packets, and then classifying multiple data packets according to the length of data packets corresponding to at least one target type can be considered as a detailed classification of multiple data packets. The rough classification of multiple data packets can also be called the first classification, and the detailed classification of multiple data packets is also called the second classification.

[0258] In the above embodiment, a plurality of data packets are roughly classified according to a length range corresponding to at least one target type to obtain initial types of the plurality of data packets, and a length corresponding to at least one target type is determined according to the length of some data packets whose initial type is the target type. This is equivalent to determining a detailed classification standard in the rough classification result, and then using the detailed classification standard to perform detailed classification on the plurality of data packets. Compared with directly using the length range corresponding to at least one target type to classify the plurality of data packets, this helps to improve the accuracy of the classification results, thereby helping to improve the accuracy of the judgment results and reducing the false alarm rate of abnormal applications.

[0259] In the embodiment of the present application, there is no limit on the number of types included in the at least one target type. Hereinafter, the embodiment of the present application is exemplarily described by assuming that the at least one target type includes M different types.

[0260] Optionally, the detection device may determine the length corresponding to at least one target type based on the lengths of M data packets among the multiple data packets; the initial types of the M data packets are M different types, and the ordering of the M data packets satisfies a preset rule.

[0261] The preset rules include the type sorting of data packets related to abnormal applications.

[0262] Exemplarily, the order of transmitting data packets between the miner and the mining pool is: the mining pool sends a data packet of type task allocation to the miner, the miner sends a data packet of type task submission to the mining pool, the mining pool sends a data packet of type submission feedback to the miner, the miner sends a data packet of type connection keepalive to the mining pool, and the mining pool sends a data packet of type connection keepalive feedback to the miner.

[0263] Based on this, when the abnormal application is a mining application, the type order of the data packets related to the abnormal application is JsR or JsRkK. In other words, the preset rule includes the type order of M data packets being JsR or JsRkK.

[0264] like Figure 6 As shown, it is a schematic diagram of the initial types of multiple data packets provided in an embodiment of the present application.

[0265] See also Figure 6 , one column indicates one data packet, different columns indicate different data packets, wherein the height of the column indicates the length of the data packet. From left to right are data packet 1, ..., data packet 21.

[0266] In one example, at least one target type includes task allocation (J), task submission (s), task feedback (R), connection keep-alive (k), and connection keep-alive feedback (K), that is, at least one target type includes 5 different types. Based on this, 5 data packets can be selected from multiple data packets, and the initial types of the 5 data packets are task allocation (J), task submission (s), task feedback (R), connection keep-alive (k), and connection keep-alive feedback (K), and the types of the 5 data packets are sorted as JsRkK. Therefore, the 5 data packets in combination 5 meet all conditions. Therefore, the detection device can determine the length corresponding to at least one target type based on the length of the 5 data packets in combination 5.

[0267] In another example, at least one target type includes task allocation (J), task submission (s), and task feedback (R), that is, at least one target type includes 3 different types. Based on this, 3 data packets can be selected from multiple data packets, and the initial types of the 3 data packets are task allocation (J), task submission (s), and task feedback (R), and the types of the 3 data packets are sorted as JsR. Therefore, combination 1, combination 2, combination 3, and combination 4 all meet the conditions. Therefore, the detection device can determine the length corresponding to at least one target type based on the length of the data packets in combination 1, combination 2, combination 3, or combination 4.

[0268] After determining M data packets from the multiple data packets, the detection device can determine the length corresponding to the first type among the M types based on the length of the third data packet among the M data packets, wherein the initial type of the third data packet is the same as the first type.

[0269] Exemplarily, the detection device determines the length corresponding to J based on the length of the data packet whose initial type is J, determines the length corresponding to s based on the length of the data packet whose initial type is s, determines the length corresponding to R based on the length of the data packet whose initial type is R, determines the length corresponding to k based on the length of the data packet whose initial type is k, and determines the length corresponding to K based on the length of the data packet whose initial type is K.

[0270] Optionally, the detection device may determine the target substring from a string sequence corresponding to the initial types of the plurality of data packets, and the data packets corresponding to the target string include M data packets.

[0271] Among them, one character in the character string sequence is used to indicate the initial type of a data packet; the target substring includes M different characters, and the M different characters indicate the initial types of the M data packets.

[0272] Among them, the M different characters indicate M different types, and the order of the M different characters meets the preset rules.

[0273] As shown above, the string sequence corresponding to the initial types of multiple data packets is uJusRJsRkKuUJsRuUJusR, and the string sequence includes multiple substrings, such as: "uJu", "uJus", "JusR", "JsR", "JsRkKuU", "uUJsR", "uUJsRuU", "JsRuU", etc.

[0274] In an example, the M different types include JsRkK, and “JsRkKuU” meets the condition of the target substring and can be used as the target substring.

[0275] In another example, the M different types include JsR, then substrings such as "JusR", "JsR", "JsRkKuU", "uUJsR", "uUJsRuU" or "JsRuU" meet the conditions of the target substring and can be used as the target substring.

[0276] In the embodiment of the present application, the string sequence includes target characters, the target characters are used to indicate non-target types, and the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the string sequence.

[0277] In one example, the M different types include JsRkK, and "JsRkKuU" may be the target substring. In another example, the M different types include JsR, and "uUJsRuU" may be the target substring.

[0278] The target substring includes the most non-target type characters, and the target data packet combination indicated by the target substring includes the most non-target type data packets, which can be considered as noise in the recognition process.

[0279] Since the target data packet combination contains the most noise, at least one target type of data packet in the target data packet combination has greater discrimination and accuracy than at least one target type of data packet in the non-target data packet combination (i.e., data packet indicated by a non-target substring). Therefore, using the length of data packets whose initial type is the target type in the target data packet combination to determine the length corresponding to at least one target type helps to improve the accuracy of the length corresponding to at least one target type, thereby reducing the probability of misreporting the first application as an abnormal application.

[0280] In the embodiment of the present application, the detection device may determine the target substring from the string sequence based on a sliding window or a regular expression.

[0281] The following uses a sliding window as an example to introduce the process of determining a target substring from a string sequence.

[0282] In the following, taking M different types including JsR as an example, the process of determining the target substring based on the sliding window is exemplarily introduced.

[0283] Since the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the string sequence, the sliding window corresponding to the target substring can also be called a maximum sliding window.

[0284] like Figure 7 , which is a schematic diagram of a sliding window provided in an embodiment of the present application.

[0285] After determining the character string sequences corresponding to the initial types of the multiple data packets, a sliding window is created, the sliding window including a front cursor and a back cursor, and the sliding window is used to screen a substring including M different characters, that is, a target character string.

[0286] Initially, the front cursor and the back cursor are both at the leftmost end. When sliding begins, the front cursor moves to the right first. During the movement, the characters in the sliding window gradually increase. If JsR appears in the sliding window and there are no repeated characters, the current sliding window size is recorded, such as: Figure 7 The sliding window 1 shown in (a) in the figure has a size of 5 characters, which is first named as the maximum sliding window size (max_window_siz). After that, the front cursor continues to slide to the right. When repeated characters appear in the sliding window, the front cursor stops sliding to the right and the back cursor starts to move to the right. During the movement of the back cursor, the characters in the sliding window gradually decrease. When the repeated characters disappear, the back cursor stops sliding. This is repeated. If JsR appears in the sliding window again and there are no repeated characters, the current sliding window size is recorded, such as: Figure 7 The sliding window 2 shown in (b) in the figure has a size of 7 characters and is named the new sliding window size (new_windows_size). Comparing new_windows_size and max_windows_size, the largest sliding window is taken as the new maximum sliding window size, that is, sliding window 2 is taken as the new maximum sliding window size. After that, the front cursor starts sliding again, and this is repeated until the target substring is determined.

[0287] It should be noted that the embodiment of the present application does not limit how to determine M data packets from multiple data packets, and the above is only an exemplary description.

[0288] It should be noted that in the embodiment of the present application, the length corresponding to at least one target type can also be determined according to the length range corresponding to at least one target type. For example, the length range corresponding to the task assignment is 301-501, and the length corresponding to the task assignment can be any value between 301-501, or it can also be the average value of 301-501.

[0289] Mode b: Based on the lengths of multiple first data packets, determine the length corresponding to at least one target type.

[0290] Exemplarily, the computing device establishes a third communication channel with the second server of the first application, and the computing device sequentially transmits a plurality of first data packets with the second server of the first application based on the third communication channel.

[0291] Based on this, the detection device can determine the length corresponding to at least one target type according to the lengths of the plurality of first data packets. After determining the length corresponding to at least one target type, the detection device can store the length corresponding to at least one target type in a storage device of the computing device.

[0292] Exemplarily, when storing the length corresponding to at least one target type, the detection device may store the identifier of the first application, the identifier of the second communication channel, the IP address of the second server of the first application, and other related information in association with the length corresponding to at least one target type. In this way, when storing multiple sub-classification criteria (i.e., the length corresponding to at least one target type) in the computing device, it helps to improve the convenience of selecting the sub-classification criteria to be used.

[0293] Exemplarily, the type of the third communication channel is the same as the type of the first communication channel. For example, the first communication channel is a low-rate long connection, and the third communication channel is also a low-rate long connection.

[0294] In this method, multiple data packets transmitted through different communication channels of the same application share a common sub-classification standard. This avoids the need to repeatedly determine the sub-classification standard when the application server changes its IP address. This not only helps to ensure the accuracy of the sub-classification, but also helps to reduce the workload of the detection equipment, thereby reducing the performance pressure of the detection equipment in executing the application detection method.

[0295] It should be noted that for other related instructions of method b, please refer to method a and will not be repeated here.

[0296] Mode c: Based on the lengths of the plurality of second data packets, determine the length of the data packet corresponding to at least one target type.

[0297] Exemplarily, a third application is also installed on the computing device, for example, Figure 3In the application 3 shown, the computing device establishes a fourth communication channel with the server of the third application, and the computing device transmits a plurality of second data packets with the server of the third application based on the fourth communication channel.

[0298] Based on this, the detection device can determine the length corresponding to at least one target type according to the lengths of the plurality of second data packets. After determining the length corresponding to at least one target type, the detection device can store the length corresponding to at least one target type in a storage device of the computing device.

[0299] Exemplarily, when storing the length corresponding to at least one target type, the detection device may store related information such as the identifier of the third application, the identifier of the fourth communication channel, the IP address of the server of the third application in association with the length corresponding to at least one target type.

[0300] Exemplarily, the type of the fourth communication channel may be the same as the type of the first communication channel. For example, the first communication channel is a low-rate long connection, and the fourth communication channel is also a low-rate long connection.

[0301] Exemplarily, the third application may be an abnormal application, which helps to ensure the accuracy of the sub-classification standard.

[0302] In this method, by setting different applications to share a common sub-classification standard, it helps to reduce the workload of the detection equipment, thereby reducing the performance pressure of the detection equipment in executing the application detection method.

[0303] It should be noted that for other related instructions of method c, please refer to method a and will not be repeated here.

[0304] Method 3: Determine at least one target type of data packet among the multiple data packets according to the lengths of the multiple data packets and the classification model.

[0305] The classification model is used to determine the type of the data packet according to the length of the data packet.

[0306] In the embodiment of the present application, the classification model can be trained according to the data packets related to the abnormal application and the preset type, so that the classification model can determine the type of the data packet according to the length of the data packet. On this basis, after obtaining the lengths of multiple data packets, the lengths of the multiple data packets are input into the classification model to obtain the types of the multiple data packets output by the classification model, thereby achieving the determination of at least one target type of data packet among the multiple data packets.

[0307] It should be noted that the embodiments of the present application do not limit the specific type of the classification model, for example, it may be a convolutional neural network (CNN), a recurrent neural network (RNN), etc.

[0308] Step S404: The detection device determines that the first application is an abnormal application according to the distribution characteristics of at least one target type of data packets among the multiple data packets.

[0309] In the embodiment of the present application, at least one target type of data packet has multiple distributions in multiple data packets, such as Figure 4 In the distribution 1, distribution 2 and distribution 3 shown, the detection device determines whether the first application is an abnormal application according to whether the distribution characteristics of the multiple distributions meet the preset characteristics. The preset characteristics include the distribution characteristics of different types of data packets in the data packets related to the abnormal application. If the distribution characteristics of at least one target type of data packet in the multiple data packets meet the preset characteristics, the detection device determines that the first application is an abnormal application. Otherwise, the first application is determined to be a normal application.

[0310] By comparing the distribution characteristics of at least one target type of data packet in multiple data packets with preset characteristics, it is determined whether the first application is an abnormal application. If the distribution characteristics of at least one target type of data packet meet the distribution characteristics of different types of data packets in the data packets related to the abnormal application, it means that the communication content between the computing device and the server of the first application is consistent with the communication content between the client and the server of the abnormal application. At this time, the first application is determined to be an abnormal application, which helps to ensure the accuracy of the determination result.

[0311] In an embodiment of the present application, the distribution characteristics of data packets of at least one target type meet preset characteristics, including multiple situations. The following is an exemplary description through situations 1 to 3.

[0312] Case 1: The distribution characteristics of the data packets of at least one target type include: the data packets of at least one target type include M consecutive data packets, the order of the M consecutive data packets meets the preset rules, and the target types of the M consecutive data packets are M different types.

[0313] In one example, at least one target type includes task allocation (J), task submission (s), task feedback (R), connection keep alive (k), and connection keep alive feedback (K). Based on this, the M different types include J, s, R, k, and K, and the types of the M consecutive data packets are sorted as J, s, R, k, and K (satisfying the preset rules).

[0314] Since the types of data packets 1, ..., 21 are u, u, u, s, R, J, s, R, k, K, u, U, J, s, R, u, U, J, u, s, R, data packets 6 (J), data packets 7 (s), data packets 8 (R), data packets 9 (k), and data packets 10 (K) can be M consecutive data packets. Therefore, the distribution characteristics of data packets of at least one target type in the multiple data packets meet the distribution characteristics of data packets of different types in the data packets related to the abnormal application, and the first application is an abnormal application.

[0315] In another example, at least one target type includes task assignment (J), task submission (s), and task feedback (R). Based on this, the M different types include J, s, and R, and the types of the M consecutive data packets are sorted as J, s, and R (satisfying the preset rules).

[0316] In this case, data packet 6 (J), data packet 7 (s) and data packet 8 (R) can be M consecutive data packets, or data packet 13 (J), data packet 14 (s) and data packet 15 (R) can also be M consecutive data packets. Therefore, the distribution characteristics of at least one target type of data packet in the multiple data packets meet the distribution characteristics of different types of data packets in the data packets related to the abnormal application, and the first application is an abnormal application.

[0317] In this embodiment, by setting at least one target type of data packet to include M consecutive data packets, the order of the M consecutive data packets meets the preset rules, and the target types of the M consecutive data packets are M different types, the first application is determined to be an abnormal application. This helps to improve the screening accuracy of abnormal applications and thereby reduce the probability of the first application being falsely reported as an abnormal application.

[0318] Case 2: The distribution characteristics of at least one target type of data packets include: at least one target type of data packets includes M data packets, the number of non-target type data packets between two adjacent data packets in the M data packets is less than or equal to the quantity threshold, the sorting of the M data packets meets the preset rules, and the target types of the M data packets are M different types.

[0319] Optionally, 1≤quantity threshold≤40.

[0320] In one example, the quantity threshold may be 0. In another example, the quantity threshold may be 10. In yet another example, the quantity threshold may be 40. Hereinafter, the embodiment of the present application is exemplarily described by taking the quantity threshold of 10 as an example.

[0321] Exemplarily, at least one target type includes task assignment (J), task submission (s), and task feedback (R). Based on this, the M different types include J, s, and R, and the types of the M consecutive data packets are sorted as J, s, and R (satisfying the preset rules), the number of non-target type data packets between the data packets of type J and the data packets of type s is less than 10, and the number of non-target type data packets between the data packets of type s and the data packets of type R is less than 10.

[0322] In this case, data packet 18(J), data packet 20(s), and data packet 21(R)) can be regarded as M data packets. Among them, the number of non-target type data packets between data packet 18(J) and data packet 20(s) is 1, which is less than the number threshold (i.e., 10), and the first application is an abnormal application.

[0323] In this embodiment, by considering the number of non-target type data packets between two adjacent target type data packets, it helps to expand the coverage of abnormal applications, thereby helping to avoid missing abnormal applications of computing devices.

[0324] It should be noted that case 1 can be considered as a special case of case 2. When the quantity threshold of case 2 is 0, case 2 is the same as case 2.

[0325] Case 3: The distribution characteristics of the data packets of at least one target type include: the proportion of the data packets of the at least one target type in the multiple data packets is greater than or equal to the proportion threshold.

[0326] In the embodiment of the present application, the detection device can determine whether the first application is an abnormal application based on the relationship between the proportion of data packets of at least one target type in multiple data and the proportion threshold.

[0327] In this embodiment, by setting the proportion of data packets of at least one target type in multiple data packets to be greater than or equal to a proportion threshold, this helps to avoid the situation where a small number of data packets are included in data packets related to normal applications, and when the length of the small number of data packets is the same as the length corresponding to at least one target type, the normal application is mistakenly identified as an abnormal application, thereby helping to reduce the false alarm rate of abnormal applications.

[0328] Optionally, 60%≤proportion threshold≤100%.

[0329] In one example, the percentage threshold may be 100%, so that when each of the multiple data packets is a data packet of the target type, the first application is an abnormal application. In another example, the percentage threshold may be 80%. In yet another example, the percentage threshold may be 60%.

[0330] As shown above, the types of data packets 1, ..., and data packets 21 are u, u, u, s, R, J, s, R, k, K, u, U, J, s, R, u, U, J, u, s, R, respectively, among which there are 13 data packets of at least one target type, accounting for 61.9% of the 21 data packets. Based on this, if the proportion threshold is 60%, the proportion of data packets of at least one target type in multiple data packets is greater than the proportion threshold, and the first application is an abnormal application. If the proportion threshold is 80%, the proportion of data packets of at least one target type in multiple data packets is less than the proportion threshold, and the first application is a normal application (i.e., a non-abnormal application).

[0331] In this embodiment, by setting the percentage threshold to be greater than or equal to 60% and less than or equal to 100%, it not only helps to ensure that non-normal applications are determined as abnormal applications, but also helps to avoid normal applications from being mistaken for abnormal applications, thereby helping to improve the accuracy of the judgment results.

[0332] Optionally, the application detection method may further include: the detection device outputs prompt information; the prompt information is used to indicate that the first application is an abnormal application.

[0333] Exemplarily, the prompt information may be in the form of text messages, emails, web pages, pop-up windows, etc. It should be noted that the present application does not limit the specific form of the prompt information, and the above is only an exemplary description.

[0334] In the embodiment of the present application, when the first application is determined to be an abnormal application, the detection device can output a prompt message to the first electronic device used by the cloud service tenant who rents the computing device, and / or the second electronic device used by the cloud service provider. In this way, it is helpful for the cloud service tenant and / or the cloud service provider to handle the abnormal application on the computing device in a timely manner, so as to improve the performance and operation safety of the computing device and avoid the abnormal application from interfering with the operation of the normal application of the cloud service tenant.

[0335] In the embodiment of the present application, the prompt information includes at least one of the identifier of the first application, the identifier of the first communication channel, the IP address of the server of the first application, and the identifier of the first computing device. By setting the prompt information to include the identifier of the first application, the identifier of the first communication channel, the IP address of the server of the first application, the identifier of the first computing device, etc., it is helpful for cloud service tenants and / or cloud service providers to more clearly understand the specific situation of abnormal applications, and further help to accurately locate abnormal applications, abnormal application servers, and communication channels related to abnormal applications.

[0336] Optionally, the application detection method may further include: if the IP address of the server of the second application is the same as the IP address of the server of the first application, determining that the second application is an abnormal application.

[0337] Exemplarily, the computing device also has a second application installed, for example, Figure 3 In the application 2 shown, during the process of the computing device running the second application, a fifth communication channel is established with the server of the second application. In the case where the first application is an abnormal application, if the IP address of the server of the second application is the same as the IP address of the device related to the first application, it means that the server of the second application is the same as the server of the first application.

[0338] Based on this, when the IP address of the server of the second application is the same as the IP address of the server of the first application, the second application is determined as an abnormal application, which helps to more accurately screen out abnormal applications on the computing device, thereby helping to improve the operating security and performance of the computing device.

[0339] It should be noted that when it is determined that the second application is an abnormal application, the computing device can send prompt information of the second application to the first electronic device and / or the second electronic device. For relevant instructions on the prompt information, please refer to the above-mentioned instructions on the prompt information sent based on the first application being an abnormal application, which will not be repeated here.

[0340] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the application detection device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0341] The embodiment of the present application can divide the functional modules of the application detection device according to the above method. For example, the application detection device can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0342] For example, Figure 8A possible structural diagram of the application detection device (referred to as application detection device 800) involved in the above embodiment is shown. The application detection device 800 is used to detect whether the first application is an abnormal application based on the lengths of multiple data packets related to the first application. The actions performed by the application detection device 800 are implemented by a computing device / NDR device or by executing corresponding software through a computing device / NDR device. The application detection device 800 may include: a length acquisition module 801, a classification module 802 and a judgment module 803. The length acquisition module 801 is used to obtain the lengths of multiple data packets. For example, Figure 4 S402 shown. Classification module 802 is used to determine at least one target type of data packet among the multiple data packets according to the length of the multiple data packets and the length of the data packet corresponding to the at least one target type; the at least one target type is the type of data packet related to the abnormal application. For example, Figure 4 S403 shown. The judgment module 803 is used to determine that the first application is an abnormal application according to the distribution characteristics of at least one target type of data packets in the multiple data packets. For example, Figure 4 S404 shown.

[0343] Optionally, the classification module 802 is also used to: determine the initial type of each data packet in the multiple data packets according to the length of the multiple data packets and the length range of the data packets corresponding to at least one target type; the initial type is the target type or the non-target type; determine the length of the data packets corresponding to at least one target type according to the length of some data packets in the multiple data packets; the initial type of some data packets is the target type; determine at least one target type of data packet according to the length of the multiple data packets and the length of the data packets corresponding to at least one target type.

[0344] Optionally, at least one target type includes M different types; the classification module 802 is specifically used to: determine the length of the data packet corresponding to at least one target type based on the length of M data packets among multiple data packets; the initial types of the M data packets are M different types, and the ordering of the M data packets meets preset rules.

[0345] Optionally, the classification module 802 is also used to: determine a target substring from a string sequence corresponding to the initial types of multiple data packets; wherein a character in the string sequence is used to indicate the initial type of a data packet, the target substring includes M different characters, the M different characters indicate the initial types of M data packets, and the order of the M different characters satisfies a preset rule.

[0346] Optionally, the character string sequence includes target characters, the target characters are used to indicate non-target types, and the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the character string sequence.

[0347] Optionally, at least one target type includes M different types; the judgment module 803 is specifically used to: if the distribution characteristics of data packets of at least one target type meet preset characteristics, determine that the first application is an abnormal application; the preset characteristics include distribution characteristics of different types of data packets in data packets related to the abnormal application.

[0348] Optionally, the preset features include: at least one target type of data packet includes M consecutive data packets, the order of the M consecutive data packets satisfies the preset rules, and the target types of the M consecutive data packets are M different types; or, the preset features include: at least one target type of data packet includes M data packets, and the number of non-target type data packets between two adjacent data packets in the M data packets is less than or equal to a quantity threshold; the order of the M data packets satisfies the preset rules, and the target types of the M data packets are M different types.

[0349] Optionally, the preset feature includes: a proportion of data packets of at least one target type in the multiple data packets is greater than or equal to a proportion threshold.

[0350] Optionally, the computing device establishes multiple second communication channels with multiple devices, and the multiple devices include a server of a first application; the application detection device 800 also includes a filtering module 804, and the filtering module 804 is used to determine a first communication channel from multiple second communication channels; the first communication channel is a long connection, and / or the rate of the first communication channel is less than or equal to a rate threshold, and the rate of the first communication channel refers to the rate at which the computing device and the server of the first application transmit data packets based on the first communication channel.

[0351] Optionally, the judgment module 803 is further used to: output prompt information, where the prompt information is used to indicate that the first application is an abnormal application.

[0352] Optionally, the prompt information includes at least one of an identifier of the first application, an identifier of the first communication channel, an IP address of a server of the first application, and an identifier of the first computing device.

[0353] Optionally, the judgment module 803 is further used to: if the Internet Protocol IP address of the server of the second application is the same as the IP address of the server of the first application, determine that the second application is an abnormal application.

[0354] For the detailed description of the above optional methods, please refer to the above method embodiments, which will not be repeated here. In addition, the explanation of any application detection device 800 provided above and the description of the beneficial effects can refer to the above corresponding method embodiments, which will not be repeated here.

[0355] For example, Fig. 9 A detection flow chart of the application detection device 800 involved in the above embodiment is shown.

[0356] See also Fig. 9 , the filtering module 804 filters the multiple second communication channels to filter out the communication channels related to the normal application and obtain the first communication channel related to the suspected abnormal application. Afterwards, the length acquisition module 801 obtains the length of multiple data packets related to the first communication channel, and the classification module 802 roughly classifies the multiple data packets according to the lengths of the multiple data packets and the length range of the data packets corresponding to at least one target type to obtain the initial types of the multiple data packets. On this basis, the classification module 802 determines the length of the data packet corresponding to at least one target type according to the length of the part of the data packets whose initial type is the target type, as the classification standard for detailed classification. Afterwards, the classification module 802 re-classifies the multiple data packets based on the length of the data packet corresponding to at least one target type and the length of the multiple data packets to obtain the result of detailed classification, that is, obtains at least one target type of data packet in the multiple data packets. Afterwards, the judgment module 803 determines whether the first application related to the first communication channel is an abnormal application based on the detailed classification result.

[0357] It should be noted that the above detection process is only one detection process of the application detection device 800, wherein the operation performed by the filtering module 804 and the rough classification operation performed by the classification module 802 are both optional actions.

[0358] In the embodiment of the present application, the filtering module 804, the length acquisition module 801, the classification module 802 and the judgment module 803 can all be implemented by software, or can be implemented by hardware. Exemplarily, the implementation of the length acquisition module 801 is introduced below by taking the length acquisition module 801 as an example. Similarly, the implementation of the filtering module 804, the classification module 802 and the judgment module 803 can refer to the implementation of the length acquisition module 801.

[0359] As an example of a software functional unit, the length acquisition module 801 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the length acquisition module 801 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0360] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0361] As an example of a hardware functional unit, the length acquisition module 801 may include at least one computing device, such as a server, etc. Alternatively, the length acquisition module 801 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0362] The multiple computing devices included in the length acquisition module 801 can be distributed in the same region or in different regions. The multiple computing devices included in the length acquisition module 801 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the length acquisition module 801 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0363] It should be noted that, in other embodiments, the length acquisition module 801 can be used to execute any step in the application detection method, the filtering module 804 can be used to execute any step in the application detection method, the classification module 802 can be used to execute any step in the application detection method, and the judgment module 803 can be used to execute any step in the application detection method, or, the steps that the filtering module 804, the length acquisition module 801, the classification module 802 and the judgment module 803 are responsible for implementing can be specified as needed, and the filtering module 804, the length acquisition module 801, the classification module 802 and the judgment module 803 respectively implement different steps in the application detection method to realize all the functions of the application detection device.

[0364] The present application also provides a computing device. Fig.10 As shown, the computing device 100 includes: a bus 102, a processor 104, a memory 106, and a communication interface 108. The processor 104, the memory 106, and the communication interface 108 communicate with each other through the bus 102. The computing device 100 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 100.

[0365] The bus 102 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 The bus 102 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 102 may include a path for transmitting information between various components of the computing device 100 (eg, the memory 106, the processor 104, and the communication interface 108).

[0366] The processor 104 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0367] The memory 106 may include a volatile memory, such as a random access memory (RAM). The processor 104 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0368] The memory 106 stores executable program codes, and the processor 104 executes the executable program codes to respectively implement the functions of the aforementioned filtering module, length acquisition module, classification module and judgment module, thereby implementing the application detection method. That is, the memory 106 stores instructions for executing the application detection method.

[0369] The communication interface 108 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 100 and other devices or a communication network.

[0370] It should be noted that the computing device 100 may be a cloud service system (such as Figure 1 or Figure 2 A computing device as shown).

[0371] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, for example, a cloud server, a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0372] like Fig.11 As shown, the computing device cluster 110 includes at least one computing device 100. The memory 106 in one or more computing devices 100 in the computing device cluster 110 may store the same instructions for executing the application detection method.

[0373] Need to explain, Fig.11 For instructions on at least one computing device in the computing device cluster shown, refer to Fig.10 The relevant description of the computing device shown is not repeated here.

[0374] It should be noted that the computing device cluster 110 can be used as a cloud service system (such as Figure 1 ), used to provide cloud services to cloud service tenants.

[0375] The present application also provides an NDR device. Fig.12 As shown, the NDR device 120 includes: a bus 122, a processor 124, a memory 126, and a communication interface 128. The processor 124, the memory 126, and the communication interface 128 communicate with each other through the bus 122. It should be understood that the present application does not limit the number of processors and memories in the NDR device 120, nor does it limit the connection method of the processor 124 and the memory 126.

[0376] The memory 126 stores executable program codes, and the processor 104 executes the executable program codes to respectively implement the functions of the aforementioned filtering module, length acquisition module, classification module and judgment module, thereby implementing the application detection method. That is, the memory 106 stores instructions for executing the application detection method.

[0377] Need to explain, Fig.12 For other related descriptions of the processor 124 and the memory 126 in the NDR device, please refer to Fig.10 The relevant description of the computing device shown is not repeated here.

[0378] It should be noted that the NDR device 120 may be a cloud service system (such as Figure 1 or Figure 2 NDR device in the figure).

[0379] The present application embodiment also provides another computing device cluster. Fig.13 As shown, the computing device cluster 130 includes an NDR device 120, a physical switch 132, and at least one computing device 134. The NDR device 120 is connected to the physical switch 132, and the physical switch 132 is connected to each computing device 134 of the at least one computing device 134.

[0380] It should be noted that the hardware structure of the computing device 134 can be referred to Fig.10 The hardware structure of the computing device 100 is not described in detail here.

[0381] Need to explain, Fig.13 For other related descriptions of the computing device cluster shown, please refer to Fig.11 The description of the computing device cluster shown is not repeated here.

[0382] It should be noted that the computing device cluster 130 can be used as a cloud service system (such as Figure 2 ), used to provide cloud services to cloud service tenants.

[0383] In one possible implementation, a computing device cluster (e.g., Fig.11 or Fig.13One or more computing devices in the computing device cluster shown in the figure may be connected via a network, which may be a wide area network or a local area network. Fig.14 A possible implementation is shown. Fig.14 As shown, two computing devices (such as computing device 100A and computing device 100B) are connected via a network. Specifically, the network is connected via the communication interface of each computing device. In this type of possible implementation, the memory 106 in the computing device 100A stores instructions for executing the functions of the filtering module 804. At the same time, the memory 106 in the computing device 100B stores instructions for executing the functions of the length acquisition module 801, the classification module 802, and the judgment module 803.

[0384] Fig.14 The connection method between the computing device clusters shown may be that considering that the application detection method provided in this application requires relatively high computing resources, it is considered that the functions implemented by the length acquisition module 801, the classification module 802 and the judgment module 803 are handed over to the computing device 100B for execution.

[0385] It should be understood that Fig.14 The functions of the computing device 100A shown in FIG. 1 may also be completed by multiple computing devices 100. Similarly, the functions of the computing device 100B may also be completed by multiple computing devices 100.

[0386] The present application embodiment also provides another computing device cluster. The connection relationship between the computing devices in the computing device cluster can be similar to that of Fig.11 , Fig.13 , Fig.14 The connection mode of the computing device cluster is shown in FIG. The difference is that the memory 106 in one or more computing devices 100 in the computing device cluster may store the same instructions for executing the application detection method.

[0387] In some possible implementations, the memory 106 of one or more computing devices 100 in the computing device cluster may also store partial instructions for executing the application detection method. In other words, the combination of one or more computing devices 100 may jointly execute instructions for executing the application detection method.

[0388] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on an NDR device / computing device or stored in any available medium. When the computer program product is run on an NDR device / at least one computing device, the NDR device / at least one computing device executes the application detection method.

[0389] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by the NDR device / computing device or a data storage device such as a data center containing one or more available media. Among them, the available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid-state hard disk), etc. The computer-readable storage medium includes instructions that instruct the computing device to execute the application detection method.

[0390] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. An application detection method, characterized in that: A first application is installed on a computing device, the computing device establishes a first communication channel with a server of the first application, and the computing device sequentially transmits a plurality of data packets with the server of the first application based on the first communication channel; the method comprises: The computing device obtains the lengths of the plurality of data packets; The computing device determines, according to the lengths of the plurality of data packets and the length range of data packets corresponding to the at least one target type, a data packet of the at least one target type among the plurality of data packets; the at least one target type is a type of data packet related to the abnormal application; The computing device determines that the first application is the abnormal application according to distribution characteristics of data packets of the at least one target type in the multiple data packets.

2. The method according to claim 1, characterized in that The computing device determines, according to the lengths of the plurality of data packets and the length range of data packets corresponding to the at least one target type, a data packet of the at least one target type among the plurality of data packets, including: The computing device determines an initial type of each of the plurality of data packets according to the lengths of the plurality of data packets and the length range of the data packets corresponding to the at least one target type; the initial type is a target type or a non-target type; The computing device determines the length of the data packet corresponding to the at least one target type according to the length of some data packets among the plurality of data packets, the initial type of the some data packets being the target type; The computing device determines a data packet of the at least one target type according to lengths of the plurality of data packets and a length of a data packet corresponding to the at least one target type.

3. The method according to claim 2, characterized in that The at least one target type includes M different types; the computing device determines the length of the data packet corresponding to the at least one target type according to the length of some data packets among the multiple data packets, including: The computing device determines the length of the data packet corresponding to the at least one target type based on the length of M data packets among the multiple data packets; the initial types of the M data packets are the M different types, and the order of the M data packets meets the preset rules.

4. The method according to claim 3, characterized in that The method further comprises: The computing device determines a target substring from a sequence of strings corresponding to the initial types of the plurality of data packets; Among them, one character in the string sequence is used to indicate the initial type of a data packet, the target substring includes M different characters, the M different characters indicate the initial types of the M data packets, and the order of the M different characters meets the preset rule.

5. The method according to claim 4, characterized in that The character string sequence includes target characters, the target characters are used to indicate non-target types, and the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the character string sequence.

6. The method according to any one of claims 1 to 5, characterized in that The computing device determines, according to distribution characteristics of data packets of the at least one target type in the plurality of data packets, that the first application is the abnormal application, including: If the distribution characteristics of the data packets of the at least one target type meet the preset characteristics, the computing device determines that the first application is the abnormal application; the preset characteristics are the distribution characteristics of the data packets related to the abnormal application.

7. The method according to claim 6, characterized in that The at least one target type includes M different types; The preset feature is that the data packets of the at least one target type include M consecutive data packets, the order of the M consecutive data packets meets the preset rule, and the types of the M consecutive data packets are the M different types; or The preset feature is that the at least one target type of data packet includes M data packets, and the number of non-target type data packets between two adjacent data packets in the M data packets is less than or equal to the quantity threshold; the sorting of the M data packets meets the preset rules, and the types of the M data packets are the M different types.

8. The method according to claim 6 or 7, characterized in that: The preset feature includes: a proportion of the data packets of the at least one target type in the multiple data packets is greater than or equal to a proportion threshold.

9. The method according to any one of claims 1 to 8, characterized in that The computing device establishes a plurality of second communication channels with a plurality of devices, wherein the plurality of devices include a server of the first application; and the method further includes: The computing device determines the first communication channel from the multiple second communication channels; the first communication channel is a long connection, and / or the rate of the first communication channel is less than or equal to a rate threshold, and the rate of the first communication channel refers to the rate at which the computing device and the server of the first application transmit data packets based on the first communication channel.

10. The method according to any one of claims 1 to 9, characterized in that A second application is also installed on the computing device; and the method further includes: If the Internet Protocol IP address of the server of the second application is the same as the IP address of the server of the first application, the computing device determines that the second application is the abnormal application.

11. The method according to any one of claims 1 to 10, characterized in that: The abnormal application is a mining application, and the data packets related to the mining application are data packets transmitted between the client of the mining application and the server of the mining application. The types of the data packets related to the mining application include one or more of the following: task allocation, task submission and task feedback.

12. An application detection device, characterized in that: The device comprises: A length acquisition module is used to obtain the lengths of multiple data packets; a classification module, configured to determine a data packet of at least one target type among the plurality of data packets according to the lengths of the plurality of data packets and a length range of data packets corresponding to at least one target type; the at least one target type is a type of data packet related to an abnormal application; A judgment module is used to determine that the first application is the abnormal application according to the distribution characteristics of the data packets of the at least one target type in the multiple data packets.

13. The device according to claim 12, characterized in that The classification module is further used to determine the initial type of each data packet in the plurality of data packets according to the length of the plurality of data packets and the length range of the data packets corresponding to the at least one target type; the initial type is a target type or a non-target type; The classification module is further used to determine the length of the data packet corresponding to the at least one target type according to the length of some data packets among the multiple data packets, the initial type of the some data packets being the target type; The classification module is further configured to determine a data packet of the at least one target type according to the lengths of the plurality of data packets and the length of a data packet corresponding to the at least one target type.

14. The device according to claim 13, characterized in that The at least one target type includes M different types; the classification module is also used to determine the length of the data packet corresponding to the at least one target type based on the length of M data packets among the multiple data packets; the initial types of the M data packets are the M different types, and the ordering of the M data packets meets the preset rules.

15. The device according to claim 14, characterized in that The classification module is also used to determine a target substring from a string sequence corresponding to the initial types of the multiple data packets; wherein a character in the string sequence is used to indicate the initial type of a data packet, the target substring includes M different characters, the M different characters indicate the initial types of the M data packets, and the order of the M different characters meets the preset rule.

16. The device according to claim 15, characterized in that The character string sequence includes target characters, the target characters are used to indicate non-target types, and the number of target characters in the target substring is greater than the number of target characters in the non-target substring of the character string sequence.

17. The device according to any one of claims 12 to 16, characterized in that The judgment module is also used to determine that the first application is the abnormal application if the distribution characteristics of the data packets of the at least one target type meet the preset characteristics; the preset characteristics are the distribution characteristics of different types of data packets in the data packets related to the abnormal application.

18. The device according to claim 17, characterized in that The at least one target type is M different types; The preset feature is that the data packets of the at least one target type include M consecutive data packets, the order of the M consecutive data packets meets the preset rule, and the types of the M consecutive data packets are the M different types; or The preset feature is that the at least one target type of data packet includes M data packets, and the number of non-target type data packets between two adjacent data packets in the M data packets is less than or equal to the quantity threshold; the sorting of the M data packets meets the preset rules, and the types of the M data packets are the M different types.

19. The device according to claim 17 or 18, characterized in that The preset feature includes: a proportion of the data packets of the at least one target type in the multiple data packets is greater than or equal to a proportion threshold.

20. The device according to any one of claims 12 to 19, characterized in that The device also includes a filtering module; The filtering module is used to determine a first communication channel from the multiple second communication channels; the first communication channel is a long connection, and / or the rate of the first communication channel is less than or equal to a rate threshold, and the rate of the first communication channel refers to the rate at which a computing device on which the first application is installed and a server of the first application transmit the multiple data packets based on the first communication channel.

21. The device according to any one of claims 12 to 20, characterized in that The judgment module is further configured to determine that the second application is the abnormal application if the Internet Protocol IP address of the server of the second application is the same as the IP address of the server of the first application.

22. The device according to any one of claims 12 to 21, characterized in that The abnormal application is a mining application, and the data packets related to the mining application are data packets transmitted between the client of the mining application and the server of the mining application. The types of the data packets related to the mining application include one or more of the following: task allocation, task submission and task feedback.

23. A computing device, characterized in that The computing device includes a memory and a processor, wherein the processor is connected to the memory; instructions are stored in the memory, and the processor executes the instructions stored in the memory, so that the computing device executes the method according to any one of claims 1 to 11.

24. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, each computing device in the at least one computing device includes a processor and a memory; The processor of each computing device executes the instructions stored in the memory of each computing device, so that each computing device performs the method according to any one of claims 1 to 11.

25. A computer-readable storage medium, characterized in that: include: Computer program instructions, when the computer program instructions are executed by a computing device, the computing device performs the method according to any one of claims 1-11.

26. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 11.

Images