Abnormal traffic detection method and device, equipment, storage medium and program product

Abstract

The invention provides an abnormal traffic detection method and device, equipment, a storage medium and a program product. Comprising the following steps: acquiring a to-be-detected traffic data set in a preset unit time period, and performing aggregation processing to obtain multiple pieces of feature space data; wherein the traffic data set comprises a plurality of network traffic data; extracting features of each aggregated flow data to obtain corresponding feature vector data; density information of each piece of feature vector data and relative deviation information of the feature space data are calculated, and whether abnormal traffic exists in a unit time period or not is comprehensively determined based on the density information of the feature vector data and the relative deviation information of the feature space data. According to the method provided by the invention, the timeliness and accuracy of abnormal flow detection are improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, equipment, storage medium and program product for detecting abnormal traffic. Background Art

[0002] In today's increasingly complex network environment, port forwarding, as a common network configuration method, is widely used in enterprise internal networks, cloud computing services, and various Internet application scenarios to achieve internal and external network communications, cross network barriers, or optimize network resource access paths. However, this convenience also brings new challenges to network security, especially when port forwarding becomes a potential channel for abnormal traffic. Therefore, abnormal traffic detection around port forwarding becomes crucial.

[0003] Currently, the identification and protection of abnormal traffic requires the construction of a multi-layer defense system, including firewall policies at the network entrance, access control at the application layer, and the deployment of specialized traffic monitoring and analysis tools. The construction process of the multi-layer defense system and the detection process of abnormal traffic both require human participation.

[0004] However, the existing abnormal traffic detection method requires a lot of manpower and cannot identify abnormal traffic in a timely manner. Summary of the invention

[0005] The present application provides a method for detecting abnormal traffic, so as to solve the problem in the prior art that abnormal traffic relies on manual detection and cannot be identified in time.

[0006] In a first aspect, the present application provides a method for detecting abnormal traffic, comprising:

[0007] Acquire a traffic data set to be detected, wherein the traffic data set includes a plurality of network traffic data;

[0008] According to a preset unit time period, the network traffic data is aggregated to obtain multiple feature space data;

[0009] Extract the features of each aggregated traffic data to obtain corresponding feature vector data;

[0010] Calculate density information of each feature vector data, and determine whether there is a first flow anomaly in a unit time period corresponding to the feature vector data based on the density information;

[0011] Calculating relative deviation information of the feature space data, and judging whether there is a second flow anomaly in a unit time period corresponding to the feature space data based on the relative deviation information;

[0012] If there is a first flow anomaly and a second flow anomaly in the unit time period corresponding to the feature vector data, it is determined that there is abnormal flow in the unit time period.

[0013] In a possible implementation, calculating density information of each feature vector data includes:

[0014] For each feature vector data, a corresponding local domain is constructed according to a preset neighborhood radius, and feature vector data whose distance to the feature vector data is less than or equal to the preset neighborhood radius is determined as a neighbor point;

[0015] The ratio of the number of neighbor points of the feature vector data to the area of ​​the local domain of the feature vector data is determined as the density value of the feature vector data.

[0016] In a possible implementation, judging whether there is a first flow anomaly in a unit time period corresponding to the feature vector data based on the density information includes:

[0017] According to the density values ​​of all eigenvector data, calculate the average density value;

[0018] If the density value of the feature vector data is greater than the average density value, the density value of the feature vector data is compared with a preset deviation threshold;

[0019] If the density value of the feature vector data is greater than a preset deviation threshold, it is determined that a first flow anomaly exists in the unit time period corresponding to the feature vector data.

[0020] In a possible implementation manner, the preset deviation threshold includes a first type of preset deviation threshold, a second type of preset deviation threshold, and a third type of preset deviation threshold;

[0021] Correspondingly, if the density value of the feature vector data is greater than the preset deviation threshold, determining that there is a first flow anomaly in the unit time period corresponding to the feature vector data includes:

[0022] If the density value of the feature vector data is less than or equal to the first type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the first type of anomaly;

[0023] If the density value of the feature vector data is less than or equal to the second type preset deviation threshold and greater than the first type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type of anomaly;

[0024] If the density value of the feature vector data is greater than the third type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

[0025] In a possible implementation, calculating relative deviation information of feature space data includes:

[0026] A simple exponential smoothing formula is used to calculate the relative deviation value of the feature space data.

[0027] In a possible implementation, judging whether there is a second flow anomaly in a unit time period corresponding to the feature space data based on the relative deviation information includes:

[0028] If the relative deviation value is greater than a preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data.

[0029] In a possible implementation manner, the preset relative deviation threshold includes a first preset relative deviation threshold, a second preset relative deviation threshold, and a third preset relative deviation threshold;

[0030] Correspondingly, if the relative deviation value is greater than the preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, including:

[0031] If the relative deviation value is less than or equal to the first preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fourth type of anomaly;

[0032] If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly;

[0033] If the relative deviation value is greater than the third preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data, and the anomaly type is the sixth anomaly type.

[0034] In a possible implementation, if there is a first flow anomaly and a second flow anomaly in a unit time period corresponding to the feature vector data, after determining that there is abnormal flow in the unit time period, the method further includes:

[0035] Generate and send alarm information based on the feature space data and / or feature vector data in a unit time period.

[0036] In a second aspect, the present application provides a device for detecting abnormal flow, comprising:

[0037] An acquisition module is used to acquire a flow data set to be detected, wherein the flow data set includes a plurality of network flow data;

[0038] An aggregation module is used to aggregate the network traffic data according to a preset unit time period to obtain multiple feature space data;

[0039] An extraction module, used to extract the features of each aggregated traffic data to obtain corresponding feature vector data;

[0040] A first calculation module is used to calculate density information of each feature vector data, and based on the density information, determine whether there is a first flow anomaly in a unit time period corresponding to the feature vector data;

[0041] A second calculation module is used to calculate relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second flow anomaly in a unit time period corresponding to the feature space data;

[0042] The determination module is used to determine that abnormal flow exists in the unit time period if a first flow anomaly exists in the unit time period corresponding to the feature vector data and a second flow anomaly exists.

[0043] In a third aspect, the present application provides an abnormal flow detection device, including:

[0044] at least one processor;

[0045] and a memory in communication with at least one processor; wherein,

[0046] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the first aspect or various possible implementations of the first aspect as described above.

[0047] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect or various possible implementation methods of the first aspect as described above.

[0048] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect or various possible implementation methods of the first aspect.

[0049] The present application provides a method, device, equipment, storage medium and program product for detecting abnormal traffic, which aggregates a traffic data set within a preset unit time period to obtain multiple feature space data; wherein the traffic data set includes multiple network traffic data; and extracts the features of each aggregated traffic data to obtain corresponding feature vector data; calculates the density information of each feature vector data, and based on the density information, determines whether there is a first traffic anomaly in the unit time period corresponding to the feature vector data; calculates the relative deviation information of the feature space data, and based on the relative deviation information, determines whether there is a second traffic anomaly in the unit time period corresponding to the feature space data; if there is a first traffic anomaly in the unit time period corresponding to the feature vector data, and there is a second traffic anomaly, it is determined that there is abnormal traffic in the unit time period. Compared with the prior art that relies on manual detection of abnormal traffic, the present application is based on the aggregation processing and feature extraction of the traffic data set including multiple network traffic data, and the calculation of the density information of each feature vector and the calculation of the relative deviation information of the feature space data to determine the presence of abnormal traffic in the unit time period, which reduces manual operation and reduces the detection cost of abnormal traffic, and the method of the present application can detect abnormal traffic in a timely manner, thereby improving the detection efficiency of abnormal traffic. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0051] Figure 1 A schematic diagram of an abnormal traffic detection system architecture provided in an embodiment of the present application;

[0052] Figure 2 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application;

[0053] Figure 3 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application;

[0054] Figure 4 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application;

[0055] Figure 5 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application;

[0056] Figure 6 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application;

[0057] Figure 7 A schematic diagram of the structure of an abnormal flow detection device provided in an embodiment of the present application;

[0058] Figure 8 A schematic diagram of the structure of an abnormal flow detection device provided in an embodiment of the present application.

[0059] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0060] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0061] It should be noted that the data involved in this application (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0062] In the current network environment, port forwarding is an important channel for internal and external network communications, crossing network barriers or optimizing network resource access paths. It is also a potential channel for abnormal traffic. Therefore, in order to ensure network security, it is necessary to detect abnormal traffic in port forwarding.

[0063] In the prior art, the identification and protection of abnormal traffic requires the manual construction of a multi-level defense system to detect abnormal traffic. However, this abnormal traffic detection method requires a lot of manpower and cannot identify abnormal traffic in a timely manner, resulting in low efficiency in abnormal traffic detection.

[0064] Based on this, in the prior art, there is a problem that abnormal traffic detection is not timely, resulting in low efficiency in abnormal traffic detection.

[0065] In order to solve the above problems, the inventors found that when detecting traffic in port forwarding, there may be abnormal traffic when a large amount of the same type of traffic suddenly appears in a unit of time. However, relying solely on manual detection of these abnormal traffic will result in the inability to detect abnormal traffic in time, causing network security problems. Therefore, the inventors considered whether it is possible to perform aggregation processing and feature extraction on the traffic data set to obtain feature vectors, and calculate the density of the feature vectors and the relative deviation information of the feature space data, automatically detect abnormal traffic, thereby timely discovering abnormal traffic and improving the detection efficiency of abnormal traffic. Based on this, the present application proposes a method for detecting abnormal traffic to improve the timeliness and detection efficiency of abnormal traffic detection.

[0066] Optional, Figure 1 The present invention provides an abnormal traffic detection system architecture schematic diagram, wherein the abnormal traffic detection system is a computer device. Figure 1 In the above framework, the above framework includes at least one of a data acquisition device 101, a processing device 102, and a display device 103.

[0067] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the abnormal traffic detection system architecture. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0068] In a specific implementation process, the data acquisition device 101 may include an input / output interface and may also include a communication interface. The data acquisition device 101 may be connected to the processing device via the input / output interface or the communication interface.

[0069] The processing device 102 can perform aggregation processing and feature extraction on the traffic data set to obtain feature vectors, and calculate the density of each feature vector and the relative deviation information of the feature space data, and automatically detect abnormal traffic based on the density of each feature vector and the relative deviation information of the feature space data.

[0070] The display device 103 may also be a touch display screen or a screen of a terminal device, which is used to receive user instructions while displaying the above content to achieve interaction with the user.

[0071] It should be understood that the above-mentioned processing device can be implemented by a processor reading instructions in a memory and executing the instructions, or it can be implemented by a chip circuit.

[0072] In addition, the network architecture and business scenarios described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Ordinary technicians in this field can know that with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0073] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0074] Figure 2 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application is shown as follows: Figure 2 As shown, the method includes:

[0075] S201. Obtain a traffic data set to be detected, wherein the traffic data set includes a plurality of network traffic data.

[0076] In this embodiment, the traffic data set to be detected refers to a network traffic data set collected from a server.

[0077] S202: Aggregate the network traffic data according to a preset unit time period to obtain a plurality of feature space data.

[0078] In this embodiment, aggregating the network traffic data refers to normalizing, standardizing, integrating, aggregating, and storing the collected network traffic data.

[0079] For example, the preset unit time period may refer to 1 minute, and aggregating network traffic data may refer to aggregating the network traffic data according to keywords (such as mobile phone numbers and source IP (Internet Protocol) addresses) and time dimensions to obtain multiple feature space data.

[0080] S203: Extract features of each aggregated traffic data to obtain corresponding feature vector data.

[0081] In this embodiment, the feature vector includes the number of data records per unit time, the size of the data packet, the number of source IP addresses, the number of source ports, and the mobile phone number.

[0082] S204: Calculate density information of each feature vector data, and determine whether there is a first flow anomaly in a unit time period corresponding to the feature vector data based on the density information.

[0083] In this embodiment, by calculating the number of data records, data packet size, number of source IP addresses, number of source ports, and density information of mobile phone numbers in each unit time, different types of first flow anomalies can be determined and corresponding protective measures can be taken.

[0084] S205: Calculate relative deviation information of the feature space data, and determine whether there is a second flow anomaly in a unit time period corresponding to the feature space data based on the relative deviation information.

[0085] In this embodiment, the feature space data refers to the sum of the data packet sizes in the corresponding unit time period (the sum of the data packet sizes can also be called the traffic value). By judging the relative deviation information of the data packet sizes in the corresponding unit time period, the traffic anomaly in the time dimension can be determined.

[0086] S206: If there is a first flow anomaly and a second flow anomaly in the unit time period corresponding to the feature vector data, it is determined that there is abnormal flow in the unit time period.

[0087] In this embodiment, by comprehensively detecting the first flow anomaly and the second flow anomaly, it is possible to accurately determine whether abnormal flow exists in a unit time period, avoid abnormal flow detection errors, and improve the accuracy of abnormal flow detection.

[0088] In this embodiment, by automatically acquiring the traffic data set to be detected in each unit time period, the traffic data set to be detected is aggregated to obtain multiple feature space data, the relative deviation information of the feature space data is calculated, and features are extracted from the aggregated traffic data to obtain corresponding feature vector data, and the density information of each feature vector data is calculated. Based on the relative deviation information of the feature space data and the density information of the feature vector data, abnormal traffic is comprehensively detected, thereby avoiding the problems of untimely detection of abnormal traffic caused by manual detection of abnormal traffic and low detection efficiency of abnormal traffic, and improving the accuracy of abnormal traffic detection.

[0089] Optionally, if there is a first flow anomaly and a second flow anomaly in a unit time period corresponding to the feature vector data, after determining that there is abnormal flow in the unit time period, the method further includes:

[0090] Generate and send alarm information based on the feature space data and / or feature vector data in a unit time period.

[0091] In this embodiment, if it is determined that there is abnormal traffic in a unit time period, the characteristic space data and / or characteristic vector data of the unit time period are used to generate an alarm message and send it to the backend personnel, so that the backend personnel can determine whether it is a traffic attack based on the characteristic space data and / or characteristic vector data of the unit time period, so as to take timely protection.

[0092] Figure 3 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application is shown in the above Figure 2 Based on the illustrated embodiment, as Figure 3 As shown, the calculation of density information of each feature vector data in the above step S204, and judging whether there is a first flow anomaly in the unit time period corresponding to the feature vector data based on the density information, includes:

[0093] S301. For each feature vector data, a corresponding local domain is constructed according to a preset neighborhood radius, and feature vector data whose distance to the feature vector data is less than or equal to the preset neighborhood radius is determined as a neighbor point.

[0094] In this embodiment, a scatter plot corresponding to the feature vector is drawn based on the number of data records per unit time, the size of the data packet, the number of source IP addresses, the number of source ports, and the mobile phone number;

[0095] Calculate the distance between each scattered point in the scatter plot and other scattered points respectively, and build the corresponding local domain with the scattered point as the center according to the preset neighborhood radius r, select the scattered points in the corresponding local domain whose distance to the feature vector data is less than or equal to the preset neighborhood radius r as neighbor points, and count the number of neighbor points N i .

[0096] S302: Determine the ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data as the density value of the feature vector data.

[0097] In this embodiment, the density value P of the feature vector data i The calculation formula is as follows:

[0098]

[0099] Among them, i is the identifier of the feature vector data.

[0100] S303: Calculate the average density value according to the density values ​​of all feature vector data.

[0101] In this embodiment, the average density value P ′ The calculation formula is as follows:

[0102]

[0103] Where n is the number of all feature vector data.

[0104] S304: If the density value of the feature vector data is greater than the average density value, the density value of the feature vector data is compared with a preset deviation threshold.

[0105] In this embodiment, the density value P of each feature vector data i To sort, if the density value P of the eigenvector data i Greater than the average density value P ′ , the density value of the feature vector data is compared with the preset deviation threshold. In this way, the unit time period without abnormal traffic can be preliminarily removed, the number of abnormal traffic detection data can be reduced, and the detection efficiency of abnormal traffic can be improved.

[0106] S305: If the density value of the feature vector data is greater than a preset deviation threshold, it is determined that a first flow anomaly exists in the unit time period corresponding to the feature vector data.

[0107] In this embodiment, by calculating the density value of the feature vector data and determining whether there is a flow anomaly in the corresponding unit time period according to the average density value and the preset deviation threshold, the occurrence of errors is avoided and the accuracy of abnormal flow detection is improved.

[0108] Figure 4 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application is shown in the above Figure 3 Based on the illustrated embodiment, as Figure 4 As shown, the preset deviation threshold in the above step S305 includes a first type of preset deviation threshold, a second type of preset deviation threshold and a third type of preset deviation threshold; accordingly, if the density value of the feature vector data is greater than the preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, including:

[0109] S401a. If the density value of the feature vector data is less than or equal to the first type preset deviation threshold, it is determined that a first flow anomaly exists in the unit time period corresponding to the feature vector data, and the anomaly type is the first type of anomaly.

[0110] In this embodiment, the first type of preset deviation threshold may be 1500, and the first type of abnormality type may be a common abnormality.

[0111] S401b. If the density value of the feature vector data is less than or equal to the second type preset deviation threshold and greater than the first type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type anomaly type.

[0112] In this embodiment, the second type of preset deviation threshold may be 4500, and the second type of abnormality type may be a severe abnormality.

[0113] S401c: If the density value of the feature vector data is greater than the third type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

[0114] In this embodiment, the third type of preset deviation threshold may be 4500, and the third type of abnormality type may be a sudden change abnormality.

[0115] In this embodiment, the density values ​​of the feature vector data are divided by different preset deviation thresholds to determine different traffic anomaly levels so that the backend personnel can make targeted protection strategies in a timely manner.

[0116] Figure 5 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application is shown in the above Figures 1 to 4 Based on the illustrated embodiment, as Figure 5 As shown, the relative deviation information of the characteristic space data is calculated in the above step S205, and based on the relative deviation information, it is determined whether there is a second flow anomaly in the unit time period corresponding to the characteristic space data.

[0117] S501. Use a simple exponential smoothing formula to calculate the relative deviation value of the feature space data.

[0118] In this embodiment, the feature space data refers to the sum of the sizes of all data packets, and a simple exponential smoothing formula is used to calculate the relative deviation value of the feature space data, including:

[0119] Get the actual flow value Y for each unit time period t t and the initial prediction value S 0 , where the actual flow value Y t Refers to the sum of the packet sizes in the unit time period t, the initial prediction value S 0 It can refer to the actual flow value at the first unit time period t;

[0120] Based on the actual flow value Y for each unit time period t t and the initial prediction value S 0 , through the simple exponential smoothing formula, we can get the forecast S for each unit time period t t , the simple exponential smoothing formula is:

[0121] S t =wY t-1 +(1-w)S t-1

[0122] Among them, w is the smoothing constant 0.9, Y t-1 is the actual flow value in unit time period t-1, S t-1 is the predicted value of the unit time period t-1;

[0123] The actual flow value Y based on the unit time period t t and the predicted value S t , calculate the relative deviation RD at time point t, and obtain the relative deviation information of the feature space data. The calculation formula is as follows:

[0124]

[0125] S502: If the relative deviation value is greater than a preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data.

[0126] In this embodiment, by calculating the relative deviation value of the feature space data and determining whether there is a flow anomaly in the corresponding unit time period according to the preset relative deviation threshold, abnormal flow detection is performed when there is a sudden increase in flow at a certain time point and less flow at other time points, thereby avoiding the occurrence of errors and improving the accuracy of abnormal flow detection.

[0127] Figure 6 A flow chart of a method for detecting abnormal traffic provided by an embodiment of the present application is shown in the above Figure 5 Based on the illustrated embodiment, as Figure 4 As shown, the preset relative deviation threshold in the above step S502 includes a first preset relative deviation threshold, a second preset relative deviation threshold and a third preset relative deviation threshold; accordingly, if the relative deviation value is greater than the preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, including:

[0128] S601a: If the relative deviation value is less than or equal to the first preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data, and the anomaly type is the fourth anomaly type.

[0129] In this embodiment, the first preset relative deviation threshold may be 15%, and the fourth abnormality type may be a common abnormality.

[0130] S601b. If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly.

[0131] In this embodiment, the second preset relative deviation threshold may be 45%, and the fifth abnormality type may be a severe abnormality.

[0132] S601c: If the relative deviation value is greater than the third preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data, and the anomaly type is the sixth type of anomaly.

[0133] In this embodiment, the third preset relative deviation threshold may be 45%, and the sixth abnormality type may be a sudden change abnormality.

[0134] In this embodiment, the traffic anomalies in different time periods are graded by different preset relative deviation thresholds, reflecting the degree of traffic anomalies in each time period, so that the back-end personnel can preset protective measures based on historical data.

[0135] Figure 7 A schematic diagram of the structure of an abnormal flow detection device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the abnormal flow detection device includes:

[0136] The aggregation module 701 is used to aggregate the network traffic data according to a preset unit time period to obtain a plurality of feature space data.

[0137] The extraction module 702 is used to extract the features of each aggregated traffic data to obtain corresponding feature vector data.

[0138] The first calculation module 703 is used to calculate the density information of each feature vector data, and based on the density information, determine whether there is a first flow anomaly in the unit time period corresponding to the feature vector data.

[0139] The second calculation module 704 is used to calculate the relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second flow anomaly in the unit time period corresponding to the feature space data.

[0140] The determination module 705 is used to determine whether abnormal traffic exists in the unit time period if the first traffic anomaly exists and the second traffic anomaly exists in the unit time period corresponding to the feature vector data.

[0141] Figure 8 This is a schematic diagram of the structure of the abnormal flow detection device provided in the embodiment of the present application. Figure 8 As shown, the abnormal flow detection device provided in this embodiment includes:

[0142] At least one processor 801 and a memory 802 .

[0143] Optionally, the device further includes a communication component 803 . The processor 801 , the memory 802 and the communication component 803 are connected via a bus 804 .

[0144] In a specific implementation process, at least one processor 801 executes the computer-executable instructions stored in the memory 802, so that at least one processor 801 executes the above method.

[0145] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0146] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0147] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0148] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0149] The present application also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0150] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, the above method is implemented.

[0151] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special-purpose computer.

[0152] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be an integral part of the processor. The processor and the readable storage medium can be located in a dedicated integrated circuit. Of course, the processor and the readable storage medium can also exist in a device as discrete components.

[0153] The division of units is only a logical function division, and there may be other divisions in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or unit, which can be electrical, mechanical or other forms.

[0154] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0155] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0156] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a disk or an optical disk, and other media that can store program codes.

[0157] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0158] Finally, it should be noted that those skilled in the art will readily conceive of other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention, which follow the general principles of the present invention and include common knowledge or customary technical means in the art not disclosed by the present invention, are not limited to the precise structure described above and shown in the drawings, and may be modified and changed in various ways without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A method for detecting abnormal traffic, characterized in that: include: Acquire a traffic data set to be detected, wherein the traffic data set includes a plurality of network traffic data; Aggregating the network traffic data according to a preset unit time period to obtain a plurality of feature space data; Extracting features of each of the aggregated traffic data to obtain corresponding feature vector data; Calculating density information of each feature vector data, and judging whether there is a first flow anomaly in a unit time period corresponding to the feature vector data based on the density information; Calculating relative deviation information of the feature space data, and judging whether there is a second flow anomaly in a unit time period corresponding to the feature space data based on the relative deviation information; If there is a first flow anomaly and a second flow anomaly in the unit time period corresponding to the feature vector data, it is determined that there is abnormal flow in the unit time period.

2. The method according to claim 1, characterized in that The step of calculating density information of each feature vector data includes: For each feature vector data, a corresponding local domain is constructed according to a preset neighborhood radius, and feature vector data whose distance to the feature vector data is less than or equal to the preset neighborhood radius is determined as a neighbor point; The ratio of the number of neighboring points of the feature vector data to the area of ​​the local domain of the feature vector data is determined as the density value of the feature vector data.

3. The method according to claim 2, characterized in that The determining, based on the density information, whether there is a first flow anomaly in the unit time period corresponding to the feature vector data includes: Calculate an average density value according to the density values ​​of all the feature vector data; If the density value of the feature vector data is greater than the average density value, comparing the density value of the feature vector data with a preset deviation threshold; If the density value of the feature vector data is greater than the preset deviation threshold, it is determined that a first flow anomaly exists in the unit time period corresponding to the feature vector data.

4. The method according to claim 3, characterized in that The preset deviation thresholds include a first type of preset deviation threshold, a second type of preset deviation threshold and a third type of preset deviation threshold; Correspondingly, if the density value of the feature vector data is greater than the preset deviation threshold, determining that there is a first flow anomaly in the unit time period corresponding to the feature vector data includes: If the density value of the feature vector data is less than or equal to the first type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is a first type of anomaly; If the density value of the feature vector data is less than or equal to the second type preset deviation threshold and greater than the first type preset deviation threshold, it is determined that there is a first flow anomaly in the unit time period corresponding to the feature vector data, and the anomaly type is the second type of anomaly; If the density value of the feature vector data is greater than the third type preset deviation threshold, it is determined that a first flow anomaly exists in the unit time period corresponding to the feature vector data, and the anomaly type is the third type of anomaly.

5. The method according to any one of claims 1 to 4, characterized in that: The calculating relative deviation information of the feature space data includes: A simple exponential smoothing formula is used to calculate the relative deviation value of the feature space data.

6. The method according to claim 5, characterized in that The determining, based on the relative deviation information, whether there is a second flow anomaly in the unit time period corresponding to the feature space data includes: If the relative deviation value is greater than a preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data.

7. The method according to claim 6, characterized in that The preset relative deviation thresholds include a first preset relative deviation threshold, a second preset relative deviation threshold and a third preset relative deviation threshold; Correspondingly, if the relative deviation value is greater than a preset relative deviation threshold, determining that there is a second flow anomaly in the unit time period corresponding to the feature space data includes: If the relative deviation value is less than or equal to the first preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, and the anomaly type is a fourth type of anomaly; If the relative deviation value is greater than the first preset relative deviation threshold and less than or equal to the second preset relative deviation threshold, it is determined that there is a second flow anomaly in the unit time period corresponding to the feature space data, and the anomaly type is the fifth type of anomaly; If the relative deviation value is greater than the third preset relative deviation threshold, it is determined that a second flow anomaly exists in the unit time period corresponding to the feature space data, and the anomaly type is the sixth type of anomaly.

8. The method according to any one of claims 1 to 4, characterized in that: After determining that abnormal flow exists in the unit time period if the first flow anomaly exists and the second flow anomaly exists in the unit time period corresponding to the feature vector data, the method further includes: Generate and send warning information based on the feature space data and / or feature vector data of the unit time period.

9. An abnormal flow detection device, characterized in that: include: An acquisition module, used for acquiring a flow data set to be detected, wherein the flow data set includes a plurality of network flow data; An aggregation module, used for aggregating the network traffic data according to a preset unit time period to obtain a plurality of feature space data; An extraction module, used for extracting features of each of the aggregated traffic data to obtain corresponding feature vector data; A first calculation module, used to calculate density information of each feature vector data, and based on the density information, determine whether there is a first flow anomaly in a unit time period corresponding to the feature vector data; A second calculation module is used to calculate relative deviation information of the feature space data, and based on the relative deviation information, determine whether there is a second flow anomaly in the unit time period corresponding to the feature space data; The determination module is used to determine that abnormal flow exists in the unit time period if a first flow anomaly exists and a second flow anomaly exists in the unit time period corresponding to the feature vector data.

10. An abnormal flow detection device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the abnormal traffic detection method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the abnormal traffic detection method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal traffic detection method according to any one of claims 1 to 8 is implemented.

Images