A method, device and system for real-time monitoring of server traffic

Abstract

The present invention relates to the field of traffic transmission technology, and proposes a method, device and system for real-time monitoring of server traffic, including: obtaining normal traffic data segments and abnormal traffic data segments of several main features; obtaining an analysis interval and a comparison analysis interval according to the state value of the normal traffic data segment; obtaining an overall correlation index according to the analysis interval and its comparison analysis interval; obtaining an abnormal degree according to the state value of the abnormal traffic data segment and the normal traffic data segment; obtaining an abnormal performance index according to the abnormal degree; obtaining an abnormal performance degree according to the abnormal performance index; obtaining a retention degree of the main features according to the abnormal performance degree; obtaining a retained feature according to the retention degree; performing model training according to the retained feature to obtain a traffic classification model; and using the traffic classification model to monitor server traffic in real time. The present invention obtains the retained features by screening the retention degree, and trains the traffic classification model, thereby improving the accuracy of traffic monitoring.

Description

Technical Field

[0001] The present invention relates to the technical field of traffic transmission, and in particular to a method, device and system for real-time monitoring of server traffic. Background Art

[0002] Servers usually store a lot of sensitive information because they carry a large number of key business and user services, such as e-commerce, financial transactions, medical records, etc. When processing these businesses, servers need to save users' personal information, payment data, communication records, etc. to ensure the normal operation of the business, provide personalized services, and meet regulatory requirements. In addition, servers also need to store important data related to company operations, such as internal documents, employee information, and business processes. Therefore, servers have become a centralized storage point for sensitive information and an important target for attackers. In order to ensure the accessibility of servers, servers are usually open to the public, which makes it easy for attackers to identify and exploit their vulnerabilities.

[0003] Server traffic monitoring can identify and respond to potential various types of network attacks in real time, thereby ensuring high availability and stability of the server. By analyzing traffic patterns, the monitoring system can promptly detect abnormal behavior, protect sensitive data security, optimize resource utilization, and improve user experience, thereby supporting the continued operation and development of the business.

[0004] In the prior art, when performing real-time monitoring of server traffic, the random forest algorithm is often used to monitor server traffic and identify various types of network attack behaviors. However, the random forest selects features randomly, and the representativeness of different features will be different. Improper feature selection will affect the model performance and cause inaccurate server traffic monitoring results. Summary of the invention

[0005] The present invention provides a method, device and system for real-time monitoring of server traffic, so as to solve the problem that unreasonable feature selection affects model performance and thus leads to inaccurate server traffic monitoring results. The technical solutions adopted are as follows:

[0006] The present invention proposes a method for real-time monitoring of server traffic, which comprises the following steps:

[0007] Acquire normal traffic data segments and abnormal traffic data segments with several main characteristics; the normal traffic data segments and the abnormal traffic data segments contain several state values;

[0008] Record any main feature as the target main feature; obtain the analysis interval of the target main feature and its control analysis interval according to the state values ​​of the target main feature and other main features in the normal traffic data segment; obtain the overall correlation index between any two main features according to the similarity relationship between the change ratio of the analysis interval of each main feature and its control analysis interval;

[0009] According to the difference between the state values ​​of the target main feature in the abnormal traffic data segment and the state values ​​of the normal traffic data segment, the abnormal degree of the state value of the target main feature in the abnormal traffic data segment is obtained; according to the overall correlation index between any two main features and the abnormal degree of the state value of the main feature in the abnormal traffic data segment, the abnormal performance index of the state value of the main feature in the abnormal traffic data segment is obtained;

[0010] According to the abnormal performance index of the state value of the main feature in the abnormal traffic data segment, the abnormal performance degree of the main feature in each abnormal traffic data segment is obtained;

[0011] According to the discreteness of the abnormal performance degree of the main feature in all abnormal traffic data segments, the retention degree of the main feature is obtained;

[0012] The main features are screened according to the retention degree to obtain the retained features; the model is trained according to the retained features to obtain the traffic classification model; and the traffic classification model is used to monitor the server traffic in real time.

[0013] Furthermore, the specific method of obtaining the analysis interval of the target main feature and its comparison analysis interval according to the state values ​​of the target main feature and other main features in the normal traffic data segment includes:

[0014] Obtain all minimum values ​​of the target main feature in any normal traffic data segment, and record the interval between any pair of adjacent minimum values ​​as an analysis interval of the target main feature;

[0015] Any analysis interval of the target main feature is recorded as the target analysis interval;

[0016] Record any main feature other than the target main feature as a reference main feature of the target main feature;

[0017] Get the maximum value of each analysis interval;

[0018] Among several analysis intervals in the normal flow data segment of the reference main feature of the target main feature, the analysis interval whose maximum value is closest to the time of the maximum value of the target analysis interval is recorded as a reference analysis interval of the target analysis interval.

[0019] Furthermore, the overall correlation index between any two main features is obtained based on the similarity relationship between the analysis interval of each main feature and its control analysis interval, including the specific method of:

[0020] Calculate the absolute value of the difference between the time at which the maximum value of the target analysis interval is located and the time at which the maximum value of any control analysis interval of the target analysis interval is located, and record the inverse proportional normalization result of the absolute value of the difference as the association confidence of the target analysis interval and the control analysis interval;

[0021] The range of all state values ​​in the target analysis interval is recorded as the amplitude increment of the target analysis interval;

[0022] The main characteristics of the target The calculation method of the correlation of the reference main features is:

[0023]

[0024] In the formula, The main characteristics of the target The relevance of the main features of the reference; The total number of analysis intervals for the target main feature in all normal traffic data segments; The main feature of the target is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The main feature of the target is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The main feature of the target is the first The amplitude increment of each analysis interval; The main feature of the target is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; The main feature of the target is the first The amplitude increment of each analysis interval; The main feature of the target is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; is the absolute value function; is an exponential function with a natural constant as base;

[0025] Any two main features are recorded as the first main feature and the second main feature respectively; the average of the correlation between the first main feature and the second main feature and the correlation between the second main feature and the first main feature is recorded as the overall correlation index between the first main feature and the second main feature.

[0026] Furthermore, the method of obtaining the abnormal degree of the state value of the target main feature in the abnormal traffic data segment according to the difference between the state values ​​of the target main feature in the abnormal traffic data segment and the state values ​​of the target main feature in the normal traffic data segment includes the following specific methods:

[0027] Any state value of the target main feature in any abnormal traffic data segment is recorded as the target state value; the mean of the state values ​​of the target main feature in each normal traffic data segment is obtained, and the sum of the absolute values ​​of the differences between the means of all the state values ​​and the target state value is calculated, and the linear normalization result of the sum is recorded as the abnormality degree of the target state value.

[0028] Furthermore, the abnormal performance index of the state value of the main feature in the abnormal traffic data segment is obtained according to the overall correlation index between any two main features and the abnormal degree of the state value of the main feature in the abnormal traffic data segment, including the specific method of:

[0029]

[0030] In the formula, is the abnormal performance index of the target state value; is the abnormality degree of the target state value; is the total number of main features; The main features of the target and the second features other than the main features of the target The overall correlation index of the main characteristics; In addition to the main features of the target The degree of abnormality of the main features at the time when the target state value is located; is the weight normalization function.

[0031] Furthermore, the abnormal performance index of the state value of the main feature in the abnormal traffic data segment is used to obtain the abnormal performance degree of the main feature in each abnormal traffic data segment, including the specific method of:

[0032] K-means clustering is performed on the state value of the target main feature in any abnormal traffic data segment, and the clustering distance measurement adopts the absolute value of the difference of the abnormal performance index between the state values ​​to obtain two clusters; the means of the abnormal performance index of all state values ​​of the two clusters are obtained respectively, and the largest mean is recorded as the abnormal index standard of the abnormal traffic data segment, and the smallest mean is recorded as the normal index standard of the abnormal traffic data segment;

[0033] For any state value of the target main feature in any abnormal traffic data segment, the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the abnormal index standard is recorded as the abnormal skewness of the state value; the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the normal index standard is recorded as the normal skewness of the state value;

[0034] The main features of the target are The first abnormal traffic data segment The performance weight of each state value is calculated as:

[0035]

[0036] In the formula, The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The first abnormal traffic data segment Normal skewness of state values;

[0037] The main features of the target are The calculation method of the abnormal performance degree of an abnormal traffic data segment is:

[0038]

[0039] In the formula, The main feature of the target is The degree of abnormal performance of each abnormal traffic data segment; For the The total number of status values ​​of abnormal traffic data segments; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The abnormal index standard of each abnormal traffic data segment; The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; is the weight normalization function.

[0040] Furthermore, the retention degree of the main features is obtained according to the discreteness of the abnormal performance degree of the main features in all abnormal traffic data segments, including the specific method of:

[0041] The linear normalization result of the variance of the abnormal performance degree of the target main feature in all abnormal traffic data segments is recorded as the retention degree of the target feature.

[0042] Furthermore, the model training is performed according to the retained features to obtain the traffic classification model, including the following specific methods:

[0043] Manually label each abnormal traffic data segment with the specific attack type the server is subjected to; specific labels include: denial of service attack, intrusion attack, network scanning and detection, malicious code attack and cross-site scripting attack;

[0044] Mark all normal traffic data segments as normal;

[0045] The retained features and labels of all abnormal traffic data segments and normal traffic data segments are input into the random forest for training to obtain a trained traffic classification model.

[0046] The present invention also provides a server traffic real-time monitoring device, the device comprising:

[0047] A data acquisition module, a data analysis module and a traffic monitoring module, wherein the data acquisition module is used to obtain traffic data segments, the data analysis module obtains a traffic classification model by calling a computer program to implement the steps of the above method, and the traffic monitoring module monitors server traffic in real time according to the traffic classification model.

[0048] The present invention also proposes a real-time monitoring system for server traffic, which includes a memory, a processor, and a computer program stored in the memory and running on the processor, and the processor implements the steps of the above method when executing the computer program.

[0049] The beneficial effects of the present invention are as follows: since the types of attacks on the server are various, the abnormal feature groups caused by different attacks are different, and the feature groups are composed of main features with strong correlation. The present invention obtains the overall correlation index between the main features through the similar relationship of the change ratio of the main features in the normal traffic data segment, and judges the correlation between any two main features; since the types of attacks on the server are various, the abnormal feature groups that cause the abnormalities are also different, and different feature groups have different abnormal performance levels when the server abnormality occurs. The present invention obtains the abnormal performance index of the state value through the abnormal degree of the state value of the main feature with a higher overall correlation index, and judges the correlation between each state value. Abnormal performance; since the server system may automatically adjust resources or load balancing strategies when an abnormality is detected, this dynamic adjustment will cause traffic to fluctuate between normal and abnormal states. The present invention obtains the abnormal performance degree of the main feature in each abnormal traffic data segment through the change of the abnormal performance index of the state value in the abnormal traffic data segment; when screening the main features, the main features with higher overall correlation index are screened according to their contribution to the distinction of attack types under different types of attacks. The present invention determines the ability of each main feature to distinguish attack types through the discreteness of the abnormal performance degree of the main features in all abnormal traffic data segments, and obtains the retention degree of each main feature. The present invention screens the main features by the retention degree, obtains the retained features, and trains the traffic classification model, so that the server traffic monitoring results of the traffic classification model are more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0051] Figure 1 A flow chart of a method for real-time monitoring of server traffic provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0053] See also Figure 1, which shows a flow chart of a method for real-time monitoring of server traffic provided by an embodiment of the present invention, the method comprising the following steps:

[0054] Step S001: Obtain normal traffic data segments and abnormal traffic data segments with several main characteristics.

[0055] It should be noted that the purpose of this embodiment is to analyze the changes in the main features of the normal traffic data segment and the abnormal traffic data segment, screen the main features, retain the main features with strong ability to distinguish the attack type, obtain the retained features, and use the retained features to train the random forest, so that the classification results of the random forest for abnormal traffic are more accurate. Therefore, the main features of the normal traffic data segment and the abnormal traffic data segment are first obtained.

[0056] Specifically, during the operation of the server, the status values ​​of all main features are collected at each moment every 1 second, and the main features include inbound traffic, outbound traffic, total number of data packets, data packet size, number of active connections, number of new connections, bandwidth utilization, packet loss rate, delay and jitter, CPU usage, memory usage, disk read and write speed, number of concurrent connections, number of threads and number of processes; for any main feature, the time series sequence formed by the results of linear normalization of the state value of the main feature at all times is recorded as the feature time series sequence of the main feature; wherein the object of linear normalization is the state value of the main feature at all times.

[0057] Furthermore, according to the characteristic time series of all main features, Normal traffic data segment and abnormal traffic data segment, the time sequence length of the normal traffic data segment and the abnormal traffic data segment is Minutes, of which, is the number of preset flow time periods, is the preset flow period length. , Let's take this as an example.

[0058] Step S002, record any one main feature as the target main feature; obtain the analysis interval of the target main feature and its comparison analysis interval according to the state values ​​of the target main feature and other main features in the normal traffic data segment; obtain the overall correlation index between any two main features according to the similarity relationship between the change ratio of the analysis interval of each main feature and its comparison analysis interval.

[0059] It should be noted that since the types of attacks on the server are diverse, the abnormal phenomena caused by each attack will cause the status values ​​of several related main features to become abnormal. For example, an increase in the number of connections will directly lead to an increase in bandwidth usage. When a large number of requests pour in at the same time, the bandwidth will quickly reach the upper limit, resulting in a longer response time. Therefore, when the monitoring traffic of the server is abnormal, if one of the features is abnormal, these related features will also have corresponding abnormalities. Therefore, it is necessary to determine the correlation between each two main features.

[0060] It should be further explained that, due to the abnormality of the abnormal traffic data segment, the state value of the main feature changes in a trend, so the correlation between every two main features is judged according to the transformation relationship of the normal traffic data segment.

[0061] Specifically, any one main feature is recorded as the target main feature, all minimum values ​​of the target main feature in any normal traffic data segment are obtained, and the interval between any pair of adjacent minimum values ​​is recorded as an analysis interval of the target main feature;

[0062] Any analysis interval of the target main feature is recorded as the target analysis interval;

[0063] Record any main feature other than the target main feature as a reference main feature of the target main feature;

[0064] Get the maximum value of each analysis interval;

[0065] Among several analysis intervals in the normal flow data segment of the reference main feature of the target main feature, the analysis interval whose maximum value is closest to the time of the maximum value of the target analysis interval is recorded as a reference analysis interval of the target analysis interval.

[0066] It should be noted that, since the state values ​​with strong correlation always change synchronously during the operation of the server, the closer the time when the maximum value of the analysis interval is to that of the control analysis interval, the more likely it is that the two are fluctuations that affect each other, that is, the higher the confidence level of the fluctuation correlation.

[0067] The target analysis interval and its The confidence level of association for each control analysis interval is calculated as:

[0068]

[0069] In the formula, The target analysis interval and its Confidence of association for each control analysis interval; The moment when the maximum value of the target analysis interval is located; The target analysis interval is The moment when the maximum value of the control analysis interval is located; is an exponential function with a natural constant as its base.

[0070] Furthermore, the range of all state values ​​in the target analysis interval is recorded as the amplitude increment of the target analysis interval;

[0071] It should be noted that since the influence changes of various main features of the server basically conform to a linear relationship, when a certain main feature changes, the associated main features will also change accordingly, and the degree of change is proportional. Therefore, when a certain main feature changes, according to the relationship between the amount of change in the main feature and the amount of change in the corresponding associated main feature, the target analysis interval and its control analysis interval are analyzed to obtain the ratio of fluctuations in the analysis interval to fluctuations in the control analysis interval. Since the influence changes of various main features of the server basically conform to a linear relationship, the similarity between all proportions is relatively high, and when the correlation confidence corresponding to the analysis interval and its control analysis interval is relatively high, it indicates that the correlation between the two main features is stronger.

[0072] Specifically, the main characteristics of the target The calculation method of the correlation of the reference main features is:

[0073]

[0074] In the formula, The main characteristics of the target The relevance of the main features of the reference; The total number of analysis intervals for the target main feature in all normal traffic data segments; The main feature of the target is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The main feature of the target is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The main feature of the target is the first The amplitude increment of each analysis interval; The main feature of the target is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; The main feature of the target is the first The amplitude increment of each analysis interval; The main feature of the target is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; is the absolute value function; is an exponential function with a natural constant as its base.

[0075] It should be noted that the correlation between the main features is mutual. When the correlation between two main features is relatively high, the overall correlation index of the two main features is relatively high.

[0076] Specifically, any two main features are recorded as the first main feature and the second main feature respectively; the average of the correlation between the first main feature and the second main feature and the correlation between the second main feature and the first main feature is recorded as the overall correlation index between the first main feature and the second main feature.

[0077] Step S003: According to the difference between the state values ​​of the target main feature in the abnormal traffic data segment and in the normal traffic data segment, the abnormal degree of the state value of the target main feature in the abnormal traffic data segment is obtained; according to the overall correlation index between any two main features and the abnormal degree of the state value of the main feature in the abnormal traffic data segment, the abnormal performance index of the state value of the main feature in the abnormal traffic data segment is obtained.

[0078] It should be noted that the main features with a higher overall correlation index will form a feature group. When the server is attacked and an abnormality occurs, the feature group can reflect the abnormality type of the server. The two main features with higher overall correlation index are more likely to belong to the same feature group. When an abnormality occurs in the server, the types of attacks on the server are diverse, resulting in different feature groups causing abnormalities. Different feature groups also have different abnormal performance levels when server abnormalities occur. For a main feature, if an abnormality occurs at the same time as a main feature with a higher overall correlation, it indicates that the abnormal performance level of the feature group to which the main feature belongs is higher, and the reference degree for the classification of abnormality types is greater.

[0079] It should be further explained that for any main feature, when an abnormality occurs in the server, if the main feature shows abnormality, the state value of the main feature will generally increase significantly, so the abnormal performance is mainly reflected in the state value of the main feature. Therefore, the state value of the abnormal traffic data segment is compared with the state value of the normal traffic data segment to determine the abnormal degree of the abnormal traffic data segment at each moment.

[0080] Specifically, any state value of the target main feature in any abnormal traffic data segment is recorded as the target state value; the mean of the state values ​​of the target main feature in each normal traffic data segment is obtained, and the sum of the absolute values ​​of the differences between the means of all the state values ​​and the target state value is calculated, and the linear normalization result of the sum is recorded as the abnormality degree of the target state value; wherein the normalization object is the sum corresponding to all state values ​​of the target main feature in all abnormal traffic data segments.

[0081] It should be noted that when an abnormality occurs in the server, the abnormality of the main features belonging to the same feature group will also increase for the main features with a high degree of abnormality, that is, the abnormality of the main features with a higher overall correlation index will also increase, so the abnormal performance index of each state value is calculated accordingly.

[0082] The calculation method of the abnormal performance index of the target state value is:

[0083]

[0084] In the formula, is the abnormal performance index of the target state value; is the abnormality degree of the target state value; is the total number of main features; The main features of the target and the second features other than the main features of the target The overall correlation index of the main characteristics; In addition to the main features of the target The degree of abnormality of the main features at the time when the target state value is located; is the weight normalization function.

[0085] Step S004: Obtain the abnormal performance degree of the main feature in each abnormal traffic data segment according to the abnormal performance index of the state value of the main feature in the abnormal traffic data segment.

[0086] It should be noted that when an abnormality occurs in the server, most server systems currently may automatically adjust resources or load balancing strategies when an abnormality is detected. This dynamic adjustment will cause the traffic to fluctuate between normal and abnormal states, so that in a single abnormal traffic data segment, the abnormal performance index will fluctuate, and the fluctuation speed will be faster. The overall amplitude of the abnormal performance index will show a polarized trend between normal and abnormal, and will gather at the two poles.

[0087] Specifically, K-means clustering with K=2 is performed on the state value of the target main feature in any abnormal traffic data segment, and the absolute value of the difference in the abnormal performance index between the state values ​​is used as the clustering distance measurement to obtain two clusters; wherein, K-means clustering is a well-known technology, and the specific method is not introduced here; the means of the abnormal performance index of all state values ​​of the two clusters are obtained respectively, and the largest mean is recorded as the abnormal index standard of the abnormal traffic data segment, and the smallest mean is recorded as the normal index standard of the abnormal traffic data segment.

[0088] It should be noted that, among the two clusters, the cluster with the highest mean value of the abnormal performance index represents the cluster in the abnormal state, and the cluster with the lowest mean value of the abnormal performance index represents the cluster in the normal state. When an abnormality occurs in the server, due to the self-regulation of the server, the main characteristics of the abnormality will switch repeatedly between the normal and abnormal states. Therefore, when the abnormal performance index of the state value of the target main characteristic in the abnormal traffic data segment is highly clustered between the abnormal index standard and the normal index standard, especially when most of them are clustered near the abnormal index standard, it indicates that the abnormal performance degree of the target main characteristic in the abnormal traffic data segment is higher.

[0089] Specifically, for any state value of the target main feature in any abnormal traffic data segment, the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the abnormal index standard is recorded as the abnormal skewness of the state value; the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the normal index standard is recorded as the normal skewness of the state value.

[0090] It should be noted that, if the abnormal skewness of the state value is closer to the normal index standard, it means that the state value has fluctuated to the normal state, and the weight of the state value is smaller when calculating the abnormal performance degree. When the abnormal skewness is closer to the abnormal index standard, it means that it has fluctuated to the abnormal state, and the weight of the state value is larger when calculating the abnormal performance degree.

[0091] Specifically, the main features of the target are The first abnormal traffic data segment The performance weight of each state value is calculated as:

[0092]

[0093] In the formula, The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The first abnormal traffic data segment The normal skewness of the state values.

[0094] It should be noted that the state value with a performance weight of 0 is a state value that fluctuates to a normal state and does not have the ability to express the degree of abnormality, while the state value with a performance weight of 1 is a state value that fluctuates to an abnormal state. The degree of abnormal expression of the target main feature in each abnormal traffic data segment is judged based on the state value with a performance weight of 1.

[0095] Specifically, the main features of the target are The calculation method of the abnormal performance degree of an abnormal traffic data segment is:

[0096]

[0097] In the formula, The main feature of the target is The degree of abnormal performance of each abnormal traffic data segment; For the The total number of status values ​​of abnormal traffic data segments; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The abnormal index standard of each abnormal traffic data segment; The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; is the weight normalization function, and the normalization object is the target main feature in the first The performance weights of all status values ​​of an abnormal traffic data segment.

[0098] Step S005: According to the discreteness of the abnormal performance degree of the main feature in all abnormal traffic data segments, the retention degree of the main feature is obtained.

[0099] It should be noted that, since the types of attacks on the server are diverse, different attacks cause different abnormal feature groups. Therefore, the greater the change in the abnormal performance of a feature group under different attacks, the greater the contribution of the feature group to the distinction of attack types. Since the abnormal performance degree is calculated by combining multiple main features with a higher overall correlation index, the greater the fluctuation of the overall correlation index in all abnormal traffic data segments, the stronger the ability to distinguish attack types.

[0100] The linear normalization result of the variance of the abnormal performance degree of the target main feature in all abnormal traffic data segments is recorded as the retention degree of the target feature; the normalized object is the variance of the abnormal performance degree of each main feature in all abnormal traffic data segments.

[0101] Step S006: Filter the main features according to the retention degree to obtain the retained features; perform model training according to the retained features to obtain a traffic classification model; and use the traffic classification model to monitor the server traffic in real time.

[0102] It should be noted that after obtaining the retention degree of each main feature, it is necessary to screen the main features according to the retention degree, and screen out the main features that contribute more to the distinction of attack types, so as to improve the accuracy of identifying abnormal server traffic.

[0103] Specifically, the retention level is greater than the retention threshold. The main features of are retained to obtain the retained features; wherein, in this embodiment, to give a narrative;

[0104] Manually label each abnormal traffic data segment with the specific attack type the server is subjected to; specific labels include: denial of service attack, intrusion attack, network scanning and detection, malicious code attack and cross-site scripting attack;

[0105] Mark all normal traffic data segments as normal;

[0106] The retained features and labels of all abnormal traffic data segments and normal traffic data segments are input into the random forest for training to obtain a trained traffic classification model; the training process of the random forest is a well-known technology, and the specific method is not introduced here;

[0107] The retained features of a new traffic period to be identified are obtained, and the retained features of the traffic period to be identified are input into the trained traffic classification model to obtain the identification result of the traffic period; when the attacked server traffic is identified, corresponding defense and repair measures are taken according to the identified label type.

[0108] This embodiment adopts Model to present inverse proportional relationship and normalization, As the input of the model, the implementer can set the inverse proportional function and normalization function according to the actual situation.

[0109] The present invention also provides a server traffic real-time monitoring device, which includes: a data acquisition module, a data analysis module and a traffic monitoring module, wherein the data acquisition module is used to acquire traffic data segments, the data analysis module obtains a traffic classification model by calling a computer program to implement the steps of the above method, and the traffic monitoring module monitors the server traffic in real time according to the traffic classification model.

[0110] Another embodiment of the present invention provides a real-time monitoring system for server traffic, which includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, steps S001 to S006 of the above method are implemented.

[0111] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for real-time monitoring of server traffic, characterized in that: The method comprises the following steps: Obtaining normal traffic data segments and abnormal traffic data segments with several main features; the normal traffic data segments and the abnormal traffic data segments contain several state values, and the several main features include inbound traffic, outbound traffic, total number of data packets, data packet size, number of active connections, number of new connections, bandwidth utilization, data packet loss rate, delay and jitter, CPU utilization, memory utilization, disk read and write speed, number of concurrent connections, number of threads, and number of processes; Record any main feature as the target main feature; obtain the analysis interval of the target main feature and its control analysis interval according to the state values ​​of the target main feature and other main features in the normal traffic data segment; obtain the overall correlation index between any two main features according to the similarity relationship between the change ratio of the analysis interval of each main feature and its control analysis interval; According to the difference between the state values ​​of the target main feature in the abnormal traffic data segment and the state values ​​of the normal traffic data segment, the abnormal degree of the state value of the target main feature in the abnormal traffic data segment is obtained; according to the overall correlation index between any two main features and the abnormal degree of the state value of the main feature in the abnormal traffic data segment, the abnormal performance index of the state value of the main feature in the abnormal traffic data segment is obtained; According to the abnormal performance index of the state value of the main feature in the abnormal traffic data segment, the abnormal performance degree of the main feature in each abnormal traffic data segment is obtained; According to the discreteness of the abnormal performance degree of the main feature in all abnormal traffic data segments, the retention degree of the main feature is obtained; The main features are screened according to the retention degree to obtain the retained features; the model is trained according to the retained features to obtain the traffic classification model; the server traffic is monitored in real time using the traffic classification model; The specific method of obtaining the analysis interval of the target main feature and its comparison analysis interval according to the state values ​​of the target main feature and other main features in the normal traffic data segment includes: Obtain all minimum values ​​of the target main feature in any normal traffic data segment, and record the interval between any pair of adjacent minimum values ​​as an analysis interval of the target main feature; Any analysis interval of the target main feature is recorded as the target analysis interval; Record any main feature other than the target main feature as a reference main feature of the target main feature; Get the maximum value of each analysis interval; Among the analysis intervals in the normal flow data segment of the reference main feature of the target main feature, the analysis interval whose maximum value is closest to the time of the maximum value of the target analysis interval is recorded as a reference analysis interval of the target analysis interval; The specific method of obtaining the overall correlation index between any two main features based on the similarity relationship between the analysis interval of each main feature and its control analysis interval is as follows: Calculate the absolute value of the difference between the time at which the maximum value of the target analysis interval is located and the time at which the maximum value of any control analysis interval of the target analysis interval is located, and record the inverse proportional normalization result of the absolute value of the difference as the association confidence of the target analysis interval and the control analysis interval; The range of all state values ​​in the target analysis interval is recorded as the amplitude increment of the target analysis interval; The main characteristics of the target The calculation method of the correlation of the reference main features is: In the formula, The main characteristics of the target The relevance of the main features of the reference; The total number of analysis intervals for the target main feature in all normal traffic data segments; The main feature of the target is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The target main feature is the first The analysis interval is related to the Confidence in association between the control analysis intervals in the reference key features; The target main feature is the first The amplitude increment of each analysis interval; The target main feature is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; The target main feature is the first The amplitude increment of each analysis interval; The main feature of the target is the first The analysis interval is The amplitude increment of the control analysis interval in the reference main feature; is the absolute value function; is an exponential function with a natural constant as base; Any two main features are recorded as the first main feature and the second main feature respectively; the average of the correlation between the first main feature and the second main feature and the correlation between the second main feature and the first main feature is recorded as the overall correlation index between the first main feature and the second main feature; The abnormal performance index of the state value of the main feature in the abnormal traffic data segment is used to obtain the abnormal performance degree of the main feature in each abnormal traffic data segment, including the specific method of: K-means clustering is performed on the state value of the target main feature in any abnormal traffic data segment, and the clustering distance measurement adopts the absolute value of the difference of the abnormal performance index between the state values ​​to obtain two clusters; the means of the abnormal performance index of all state values ​​of the two clusters are obtained respectively, and the largest mean is recorded as the abnormal index standard of the abnormal traffic data segment, and the smallest mean is recorded as the normal index standard of the abnormal traffic data segment; For any state value of the target main feature in any abnormal traffic data segment, the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the abnormal index standard is recorded as the abnormal skewness of the state value; the inverse proportional normalization result of the absolute value of the difference between the abnormal performance index of the state value and the normal index standard is recorded as the normal skewness of the state value; The main features of the target are The first abnormal traffic data segment The performance weight of each state value is calculated as: In the formula, The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The first abnormal traffic data segment Normal skewness of the state values; The main features of the target are The calculation method of the abnormal performance degree of an abnormal traffic data segment is: In the formula, The main feature of the target is The degree of abnormal performance of each abnormal traffic data segment; For the The total number of status values ​​of abnormal traffic data segments; The main feature of the target is The first abnormal traffic data segment The abnormal skewness of the state values; The main feature of the target is The abnormal index standard of each abnormal traffic data segment; The main feature of the target is The first abnormal traffic data segment The performance weight of each state value; is the weight normalization function.

2. A method for real-time monitoring of server traffic according to claim 1, characterized in that: The specific method of obtaining the abnormal degree of the state value of the target main feature in the abnormal traffic data segment according to the difference between the state value of the target main feature in the abnormal traffic data segment and the state value of the target main feature in the normal traffic data segment is as follows: Any state value of the target main feature in any abnormal traffic data segment is recorded as the target state value; the mean of the state values ​​of the target main feature in each normal traffic data segment is obtained, and the sum of the absolute values ​​of the differences between the means of all the state values ​​and the target state value is calculated, and the linear normalization result of the sum is recorded as the abnormality degree of the target state value.

3. A method for real-time monitoring of server traffic according to claim 1, characterized in that: The method of obtaining the abnormal performance index of the state value of the main feature in the abnormal traffic data segment according to the overall correlation index between any two main features and the abnormal degree of the state value of the main feature in the abnormal traffic data segment includes the following specific methods: In the formula, is the abnormal performance index of the target state value; is the abnormality degree of the target state value; is the total number of main features; The main features of the target and the second features other than the main features of the target The overall correlation index of the main characteristics; In addition to the main features of the target The degree of abnormality of the main features at the time when the target state value is located; is the weight normalization function.

4. A method for real-time monitoring of server traffic according to claim 1, characterized in that: The method of obtaining the retention degree of the main features according to the discreteness of the abnormal performance degree of the main features in all abnormal traffic data segments includes the following specific methods: The linear normalization result of the variance of the abnormal performance degree of the target main feature in all abnormal traffic data segments is recorded as the retention degree of the target feature.

5. A method for real-time monitoring of server traffic according to claim 1, characterized in that: The specific method of performing model training according to the retained features to obtain the traffic classification model includes: Manually label each abnormal traffic data segment with the specific attack type the server is subjected to; specific labels include: denial of service attack, intrusion attack, network scanning and detection, malicious code attack and cross-site scripting attack; Mark all normal traffic data segments as normal; The retained features and labels of all abnormal traffic data segments and the retained features and labels of normal traffic data segments are input into the random forest for training to obtain a trained traffic classification model.

6. A server traffic real-time monitoring device, characterized in that: The equipment includes: A data acquisition module, a data analysis module and a traffic monitoring module, wherein the data acquisition module is used to acquire traffic data segments, the data analysis module obtains a traffic classification model by calling a computer program to implement the steps of a server traffic real-time monitoring method as described in any one of claims 1-5, and the traffic monitoring module monitors the server traffic in real time according to the traffic classification model.

7. A server traffic real-time monitoring system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of a method for real-time monitoring of server traffic as described in any one of claims 1 to 5 are implemented.

Images